Knob

Today CyberWire aired my interview about the KNOB attack with Dave Bittner.

I’ve pushed the code to perform the KNOB attack also when the Nexus 5 is the Bluetooth slave responding to the first LMP packet. To switch between different attack modes have a look at the updated README.

In this post I’m trying to address some discussion points and misconceptions about the KNOB attack. Attribution Researchers from CISPA discovered the KNOB attack Partially true. The KNOB attack was discovered by myself (Daniele Antonioli) from SUTD, Nils Ole Tippenhauer from CISPA, and Kasper Rasmussen from the University of Oxford.

The code that we developed to validate and brute force E0 encryption keys is online. The slides of my KNOB attack SEC19 talk are also online. As we can see from the slides, the KNOB attack is not conducted while two Bluetooth devices are pairing, but when two devices are connecting (establishing a new encrypted session).

Our KNOB repository is online, and it includes our PoC. For more information visit knobattack.com

The embargo is over! The information about The KNOB is Broken: Exploiting Low Entropy in the Encryption Key Negotiation Of Bluetooth BR/EDR, including our research paper, CVE details, and media coverage, are publicly available at knobattack.