Code

I’ve pushed the code to perform the KNOB attack also when the Nexus 5 is the Bluetooth slave responding to the first LMP packet. To switch between different attack modes have a look at the updated README.

The code that we developed to validate and brute force E0 encryption keys is online. The slides of my KNOB attack SEC19 talk are also online. As we can see from the slides, the KNOB attack is not conducted while two Bluetooth devices are pairing, but when two devices are connecting (establishing a new encrypted session).

Our KNOB repository is online, and it includes our PoC. For more information visit knobattack.com

The camera-ready version of Nearby Threats: Reversing‚ Analyzing‚ and Attacking Google’s “Nearby Connections” on Android is available here We also released a proof of concept code to perform the Soft AP manipulation attack.

I recently open-sourced the code that I developed for the MiniCPS challenges for the SWaT Security Showdown (S3) event in 2017. Here is the code. The init.sh contains the list of commands that I run on a local testing machine and on the remote AWS instances that we used during the event.