Relay Attack about sniffle HOT 3 OPEN

The methodology is described in this talk: https://hardwear.io/netherlands-2022/presentation/bluetooth-LE-link-layer-relay-attacks.pdf

I hope to release the code for that functionality eventually, though at the time of publication of that research, there was reluctance in our company to release it due to concerns about possible misuse. With that said, you can implement the relay attack functionality as described in the talk with the public Sniffle firmware if you write the host-side "glue" code yourself.

from sniffle.

Yes, that’s what I meant by host side glue.

from sniffle.

It’s mostly just forwarding packets from one side to another, though you do need to keep track of the connection event counter on both sides. If they’re too far out of sync, there will be issues with connection parameter changes. For unencrypted connections, you can change the instant value in connection parameter change requests to avoid issues. For encrypted connections, you need to keep the connection event counters roughly in sync.

from sniffle.