Symmetric-key login protocol
I think my definition of 'simple' is different from yours. : )


  Are there any evident attacks on it?


It's vulnerable to man-in-the-middle attacks, like:

Step 9: M replaces $\langle b_{U}, v'_{U}, h'_{U} \rangle$ with $\langle b_{U}, v_{M}, h_{M} \rangle$, where they've calculated their own random bit string and used their own key to encrypt it. Now M can log in as U (and U can't).

That means it's probably no more secure than if you left out the server identification in step 4. and all the related $v_S$ and $h_S$. The identification isn't strong, because there's no authentication for any of the other data exchanged.