Dzɔdzɔmeŋusẽŋununya ƒe Tɔtrɔ (‘Dɔlanyɔnu Vɔ̃ɖi’ ƒe Amedzidzedze): Kɔmpiutadziɖoɖo si Dzi Womekpɔna O Kple DMA Sesẽ¶

Ne ètrɔ yi amedzrodzeƒexɔ aɖe me, yameʋudzeƒea ƒe dukɔmeviwo ƒe adzɔxeha ƒe evelia ƒe ŋkuléleɖenuŋu teƒe, takpekpea ƒe nuƒola ƒe xɔdɔme, alo dɔwɔhati ƒe kplɔ̃ si wozãna ɖekae be nàkpɔe be woka asi wò kɔmpiutadziɖoɖo, asitelefon, alo cryptocurrency hardware gakotoku ŋu, woʋui, nyɔ tso alɔ̃ me, alo ʋui esime mèle ŋku lém ɖe eŋu o la, enye ŋutilã me dedienɔnɔ ƒe nudzɔdzɔ si me afɔku le ŋutɔ si wonya le nya ɣaɣlawo kple nyatakaka siwo tsi tre ɖe eŋu me be enye "Evil Maid" Amedzidzedze (si dedienɔnɔ tae numekula Joanna Rutkowska). Kɔmpiutadziɖoɖo ƒe dzodoƒe alo dɔlékuiwutike ƒe ɖoɖo xoxo aɖe tsɔe be amedzidzela la le internet ƒe akpa kemɛ; dɔla Vɔ̃ɖitɔ ƒe amedzidzela aɖe si asi ŋutɔŋutɔ ate ŋu akpɔ wò xɔtunuwo aɖabaƒoƒo 2 va ɖo 30 esime nèle adzɔge le ŋdi nuɖuƒe, le kpekpe aɖe me, alo nèlée de xɔ si me woléa ŋku ɖo me. Le amedzidzela ƒe nunya nu la, sɛkɛnd 90 ƒe mɔɖeɖe ŋutɔŋutɔ sɔ gbɔ be woatsɔ aƒo BadUSB keystroke-injection rubber ducky alo PCIe/Thunderbolt Direct Memory Access (DMA) leech device ɖe kɔmpiuta si le alɔ̃ dɔm me, tsɔ $15 CH341A SPI flash programmer ɖe motherboard la ƒe BIOS chip dzi alo nàse nusi wometsɔ nya ɣaɣlawo ŋlɔ o la ƒe ʋeʋẽ LPC/ .SPI TPM bɔs, ɖɔli wò USB-C charging ka kple wireless keylogger implant ka (O.MG Cable), alo nàɖɔli esiwo wometsɔ nya ɣaɣlawo ŋlɔ o /boot mama (initramfs) eyata eléa wò disk bliboa ƒe nyagbe ɣaɣla ƒe nyagbe ɣaɣla ɣebubuɣi si nàŋlɔe. Ne èdi USB charging kiosk ƒe amedzidzedze le yameʋudzeƒewo la, kpɔe ɖa dutoƒo charge kiosk data blockers kple BadUSB HID injection; ne wò BitLocker, FileVault, alo LUKS ʋua bia zi ɖeka be woagbugbɔ safui aɖe ana le boot me le esi ame aɖe ka asi wò kɔmpiuta dzi vɔ megbe la, kpɔ BitLocker, FileVault, kple LUKS nya ɣaɣlawo gbugbɔgaxɔ safui ƒe ʋuʋu kple TPM gbugbɔgaɖoɖo; eye ne woxɔ wò mɔ̃a tegbee la, trɔ ɖe eŋu fifi laptop alo telefon remote tutu kple akɔntabubu lockdown. Ne èle ŋutilã me afɔku me enumake alo nèdze ŋgɔ gaxɔmenɔnɔ si mele se nu o la, ƒo ka na wò nutoa me ƒe xexlẽdzesi kpata (911 le United States kple Canada, . 112 le Europa Dukɔwo ƒe Habɔbɔa katã me la, . 999 le United Kingdom) alo kpɔ míaƒe dukɔwo dome nyatakakawo ƒe nyatakakadzraɖoƒe xexlẽdzesi siwo wozãna kpata.

Wɔ esia fifia¶

1. MÈGAŊLƆ wò Full-Disk Encryption (BitLocker / . LUKS / . FileVault) nyagbegbɔgblɔ, OS ƒe gege ɖe eme ƒe nyagbegbɔgblɔ, alo Master Password yi ɖe kɔmpiutadziɖoɖo si ŋu wole ɖi kem le la me ne kasia wòle nyagbegbɔgblɔ alo safui si woatsɔ agbugbɔe biam le esi wogblẽe ɖi ame aɖeke manɔmee vɔ megbe:
2. Evil Maid ƒe amedzidzedze si wonya nyuie la xɔ ɖe bootloader si wometsɔ nya ɣaɣlawo ŋlɔ o teƒe alo initramfs nɔnɔmetata le kɔmpiuta si dzi Measured Boot / Secure Boot ƒe sedziwɔwɔ mele o (alo tsɔa hardware USB keylogger dongle si me kɔ si le wò keyboard/dock kple kɔmpiutaa dome) ale be ɣebubuɣi tututu si nàŋlɔ wò... LUKS alo BitLocker passphrase, trojanized bootloader la ŋlɔa wò plaintext passphrase eye wòɖonɛ ɖa alo ɣlaae ɖe disk dzi.
3. Hafi nàka asi keyboard la ŋu la, wɔ sɛkɛnd 60 ƒe gotagome ŋutilã me ŋkuléle ɖe ʋɔtruwo, kawo, kple chassis screws katã ŋu le wò fon ƒe LED-kaɖi te:
4. Ðe USB-C, USB-A, HDMI, Ethernet, kple elektrikka ɖesiaɖe si wotsɔ de kɔmpiuta dzi alo bɔbɔ nɔ wò amedzrodzeƒe ƒe kplɔ̃ dzi la ɖa eye nàlé ŋku ɖe eŋu. Zi geɖe la, amedzidzelawo ɖɔlia amesi ŋu wowɔ nuvevii ƒe Apple ɣi alo USB-C ka yibɔ si wozãna ɖaa la tsɔ ɖɔlia ** si ƒe dzedzeme sɔ kple wo nɔewo.O.MG Cable / . USB Ninja cable** (si me Wi-Fi ƒe mɔnu ɣaɣla aɖe kple microcontroller si woɣla ɖe USB-C connector shell me si dea safuiwo ƒoƒo me eye wòŋlɔa ʋuwo ƒe zɔzɔ ɖi).
5. Trɔ kɔmpiutadziɖoɖoa ɖe anyigba eye nàlé ŋku ɖe ete nutsyɔnu ƒe gaviwo kple rababafɔwo ŋu: Di ga yeye siwo wotsɔ nusuekpɔmɔ̃ wɔe le... P5 Pentalobe, . Torx T5, alo Phillips screw tawo, screw-hole tamper seals siwo bu, alo ete dzogoe ƒe seam si menɔa anyi flush o le esi wotsɔ chassis la ʋu kabakaba be woatsɔ SPI flash clip ememetɔ akpe ɖe eŋu alo M.2 PCIe si wotsɔ dea lãme na ame.
6. Kpɔe ɖa be wogblẽ wò kɔmpiutadziɖoɖoa ɖe "Alɔ̃ / Lala (S3 / . S0ix Egbegbe Lala)" vs. "Wotsi Ŋusẽ Kekeake (S5 / Wodɔ alɔ̃ le vuvɔŋɔli S4)" esime ame aɖeke mele ame si o:
7. Ne wò kɔmpiutadziɖoɖoa nɔ Alɔ̃ dɔm ko (Lid Closed) esime amedzidzela la ge ɖe eme la: Wò Full-Disk Encryption (BitLocker, . FileVault, . LUKS) master volume encryption safui ( .VMK) nɔ anyi ɖe nya ɣaɣlawo me le wò kɔmpiutadziɖoɖo ƒe volatile me DRAM memory chips ɣeyiɣi bliboa katã. Amedzidzela si si Thunderbolt/USB4 DMA dɔwɔnu le (le ɖoɖo xoxo siwo womeɖɔ ɖo o dzi), cold-boot RAM freeze attack, alo lock-screen bypass si wonya ate ŋu axlẽ active memory evɔ menya wò password o.
8. Ne èsusu be wotrɔ asi le kɔmpiuta si le alɔ̃ dɔm ŋu: Lé Ŋusẽ ƒe Abɔta ŋutɔŋutɔ ɖe anyi sɛkɛnd 10 blibo be nàzi ŋusẽ-tsi sesẽ enumake dzi (akɔ DRAM safui siwo meʋãna o ŋu) tsɔ wu be nàʋu nutsyɔnu la eye nàge ɖe eme.
9. Dze egɔme tso gotagome Live USB si wonya be ele dzadzɛ, si woate ŋu axlẽ ko (Ubuntu Live / . Tails / . SystemRescue wodzrana ɖo ɖe wò amea dzi ɣesiaɣi) be nàlé ŋku ɖe ememe drive la ƒe unencrypted ŋu /boot kple EFI System Partition (ESP) hashes ƒe nyawo:
10. Ne èwɔ Linux kple... LUKS alo Windows kple BitLocker, ne èdze dɔ gɔme tso gotagome USB-ti dzadzɛ aɖe dzi le mɔ̃ si le vovo alo esi ŋu woɖo kpee dzi la, ana nàte ŋu awɔ hash ɖe faɛl ɖesiaɖe me /boot/efi/ (ESP) kple /boot/initramfs-* (sha256sum) eye nàkpɔe ɖa be mama ƒe tɔtrɔ ƒe ɣeyiɣi ƒe dzesiwo (stat) trɔ le gaƒoƒo 2 tututu ƒe fesre si nèdo le wò amedzrodzeƒexɔa me la me.
11. Dzro OS Nudzɔdzɔwo ƒe Nuŋlɔɖiwo me (Windows Event Viewer, . macOS unified log, . Linux journalctl) tso nuxexlẽ ɖeɖeko ƒe nɔnɔme si le dedie me be nàkpɔe ɖa be woʋu nutsyɔnu la, wotsɔ USB-mɔ̃ aɖe de eme, alo wogbugbɔ mɔ̃a dze dɔ esime mègali o:
12. Egbegbe dɔwɔɖoɖo ɖesiaɖe ŋlɔa xɔtunu ƒe ɣeyiɣi ƒe dzesi si metrɔna o vaseɖe milisekɔnd dzi ɣesiaɣi si ACPI Lid Switch ʋu, dɔwɔɖoɖoa nyɔ tso alɔ̃ me (Kernel-Power Event ID 42 / 107 le Windows dzi, . Wake reason: EC.LidOpen le macOS dzi), alo USB yeye aɖe VID:PID woxlẽa mɔ̃a le bɔs la me.
13. Ne ènye amesi ŋu afɔku le ŋutɔ (nyadzɔdzɔŋlɔla, ametakpɔkpɔ ƒe kontraktɔ, dɔdzikpɔla, amegbetɔ ƒe gomenɔamesiwo ŋuti senyala, alo crypto gaxɔ ƒe asidede agbalẽ te) eye nèkpɔ kpeɖodzi sesẽ be chassis ʋu ŋutɔŋutɔ, BitLocker/TPM PCR gbugbɔgaɖoɖo siwo womele mɔ kpɔm na o, alo nyɔnyrɔ̃ ƒe nudzɔdzɔ siwo ŋu womeɖe mɔ ɖo o esime mele asiwò o la, wɔ nu ɖe ​​xɔtunuawo ŋu abe ɖe wotɔ dzoe ene (Quarantine Device):
14. Mègatsɔ kɔmpiutadziɖoɖo si ŋu wole ɖi kem le la do ka kple wò dɔwɔƒea ƒe VPN alo aƒeme Wi-Fi o. Zã smartphone si le vovo, si le dzadzɛ (si nɔa wò kotoku me) nàtsɔ atrɔ wò ɖaseɖigbalẽwo, ate fli ɖe ɣeyiɣi siwo le dɔ wɔm la me (session cookie hijacking kple passkey ɖeɖeɖa), eye nàtsɔ ga alo nya ɣaɣlawo ana ame bubuwo to xɔtunu dzadzɛwo zazã me.

--- .

Nyametsotsoti: ŋkuléle ɖe kɔmpiuta alo mɔ̃ si dzi womekpɔ o ŋu le esi wosusu be ege ɖe eme ŋutɔŋutɔ vɔ megbe¶

Wɔ ɖe dɔwɔwɔ ƒe ɖoɖo sia dzi be nànya nenye be woge ɖe wò mɔ̃ si dzi womekpɔ o la ŋutɔŋutɔ alo trɔ asi le eŋu kple alesi wòhiã be nàɖɔe ɖo:

flowchart TD
    Start["Kɔmpiutadziɖoɖo, Telefon, alo Dɔwɔnuwo ƒe Gakotoku si Wogblẽ Ðe Amedzrodzeƒexɔ, Liƒodzikpɔƒe, alo Dɔwɔhatiwo ƒe Teƒe si Ame aɖeke Mele O"] --> StateCheck{"Ŋusẽ Nɔnɔme Ka mee Kɔmpiutadziɖoɖoa Nɔ Esime Menɔ Wò Si O?"}

    StateCheck -->|"Alɔ̃ / Lala (Wotu Nutsyɔnu, RAM Ŋusẽ) ALOO Woʋu"| HighRiskState["AFƆKU GÃTƆ: Disk Encryption Keys & Session Cookies Wonɔ agbe le RAM (Ate ŋu Axɔ BadUSB, Lock-Screen Bypass, alo DMA/RAM Extraction)"]

    StateCheck -->|"Wotsi Ŋusẽ Kplu Kplu (Cold S5 Shutdown) ."| ColdState["RAM ƑE AFƆKU SI GBƆNA: Safuiwo Menɔ RAM me O, eyata Ele Be Amedzidzela Natrɔ Asi Le Bootloader (/boot / EFI), Flash SPI BIOS, alo Plant Hardware Keylogger"]

    HighRiskState --> PhysCheck["ATA 1: Lé ŋku ɖe Gome Screws, Bottom Seam, USB Ports, kple Charging Cables Le Tomekaɖi Si Klẽna Te (Mègazã Ka Siwo Mekpɔa Ame O La Gbugbɔ Zã O)"]
    ColdState --> PhysCheck

    PhysCheck --> BootBehavior{"Nukae Dzɔna Ne Èlé ŋku ɖe Boot Integrity / TPM Dzidzenuwo ŋu?"}

    BootBehavior -->|"BitLocker / TPM Bia Kasia 48-Digit Recovery Key ALOO Dedienɔnɔ Boot Fia Nuwɔametɔ / Trɔtrɔ"| BootTamper["BOOT MƆ ƑE TƆTRƆ SI WOÐO ÐE EDZI: TPM PCR (0, 2, 4, 7) Wokpɔ BIOS Firmware, Option ROM, alo EFI Bootloader si Wotrɔ Asi Le"]

    BootBehavior -->|"Edzea egɔme Zi geɖe (Alo Woléa ŋku ɖe Nuxexlẽ Ko Ŋu To External Live USB dzi)"| LogCheck["ATA 2: Dzro ACPI Lid-Open / Wake Logs & USB Kadodo Ŋutinya me le Wò Manɔmanɔ Fesre Me"]

    LogCheck -->|"Nuŋlɔɖiwo Fia Nutsyɔnu si Woʋu, USB-mɔ̃ si Wode Do, alo Gbugbɔgadze Si Womeɖe Me O Esi Wòmegali O"| ConfirmedTouch["WOÐO ÐE EDZI BE WOAÐO ŊU BE WOAÐE MƆ ŊU BE WOAÐO ŊU"]
    LogCheck -->|"Zero Wake Nudzɔdzɔwo, Zero Reboot Gaps, Intact Screw Seals & Woɖo kpe /boot Hashes dzi"| CleanPass["Kpeɖodzi aɖeke meli be Elektrɔnik Wake alo Boot Trɔtrɔ -> Enforce BIOS Password + Kernel DMA Protection + Full Shutdown Policy"]

    BootTamper --> BurnDevice["MÈGAŊLƆ NYAGBLƆÐIWO ÐE MƆ̃ SIA ME O: Ðe Hardware Ðeɖe Ðe Ame Ŋu, Ðe Cloud Sessions/SSH Keys Katã ɖa le Clean Phone me, eye Image Drive Forensically"]
    ConfirmedTouch --> BurnDevice

--- .

Mɔ̃ɖaŋununya Vektor 5 siwo na "Dɔlanyɔnu Vɔ̃ɖi" ƒe Amedzidzedze¶

Be nànya ʋɔnudrɔ̃ƒe ƒe kpeɖodzi siwo nàdi la, se aɖaŋu ŋutɔŋutɔ atɔ̃ siwo wozãna le asiwɔwɔ ɖe kɔmpiuta dzi kple kɔmpiutadziɖoɖowo dzi ŋutɔŋutɔ gɔme:

--- .

Akpa 1: Ʋɔnudrɔ̃ƒe ƒe Dzodzro le Kɔmpiutadziɖoɖo si Wosusu be Ame aɖeke Mekpɔa Ame O Ŋu (Hafi Woage Ðe Eme) .¶

Ne ètrɔ yi wò amedzrodzeƒexɔ me alo xɔ wò kɔmpiuta si dzi nèƒoa nu tsoe le liƒoa me toto vɔ megbe eye nèdi be yeanya ne ame aɖe ʋu, nyɔ, alo tsɔ mɔ̃ aɖe de eme esime mèle adzɔge o la, ke wɔ dodokpɔ siawo ɖe ɖoɖo nu:

1. Afɔɖeɖe 1: Dzɔdzɔmeŋusẽ ƒe Melidzeƒe, Ka, kple Chassis Screw Audit¶

1. Tsɔ Ka Ðesiaɖe Si Wogblẽ Ðe Xɔa Me Ðeɖe Ðe Go:
2. An ** .O.MG Cable** alo ** .USB Ninja** edzena 100 le alafa me be womate ŋu ade vovototo Apple USB-C ka vavã si wolɔ̃, Anker ka, alo Dell USB-C adapter gbɔ o, vaseɖe xexlẽdzesi siwo wotsɔ laser ŋlɔ ɖe kadodoa ƒe abɔta dzi.
3. Ne ègblẽ USB-C ka, elektrikŋusẽnamɔ̃, alo USB-mɔ̃ aɖe ɖi ame aɖeke manɔmee le nɔnɔme si me afɔku le ŋutɔ me la, dzudzɔ eƒe nyatakakawo tsɔtsɔ de wò kɔmpiuta dzi; tsɔ ka si wonya be enyo tso wò akplo si wotu nu ɖo me ɖɔ li alo nàda USB data blocker si zãa ŋusẽ ko (USB kɔndɔm) si kplɔ wo nɔewo ɖo kplii.
4. Dzro Ete Nutsyɔnu Screws & Seam Te Raking Flashlight Kekeli:
5. Lé wò smartphone ƒe akaɖi ɖe dzogoe si me goglo o si nye 15-degree ("raking light") le screw head ɖesiaɖe si le wò laptop ƒe gɔme la dzi.
6. Factory screws torqued zi ɖeka le assembly dɔwɔƒea ƒe anodized nutsyɔnu dzadzɛ, ɖekawɔwɔ le ɣletivi/atitsoga ƒe ʋuƒoawo me. Kplu aɖe si woɖe le amedzrodzeƒexɔ aɖe me si ŋu gakpo ƒe akpa aɖe le la ɖe klosalo ga si le keklẽm ƒe ʋuʋu le gavi ƒe doa me, kaƒomɔ̃ ƒe ke blɔ/dzẽ si tɔtɔ, alo aluminum-gbadzɛ si le ete ƒe ɖoɖo si mesɔ o vie le megbe yaƒoƒomɔ̃awo ŋu fiana.

2. Afɔɖeɖe 2: OS Wake, Lid-Open, kple Reboot Logs Kpɔkpɔ (Ðe Kɔmpiutadziɖoɖoa Trɔ Esime Mègali oa?)¶

De dzesi ɣeyiɣi si tututu nènɔ adzɔge tso kɔmpiutadziɖoɖoa gbɔ (le kpɔɖeŋu me, 12:15 PM to 01:45 PM). Ne amedzidzela aɖe dze Live USB stick gɔme, vovototo alo vuvɔ ƒe gɔmedzedze le wò OS ƒe dɔwɔwɔɣi si mèle mɔ kpɔm na o, alo ACPI Lid-Open nudzɔdzɔ aɖe le fesre ma me hã la, ɖo kpe edzi be wotrɔ asi le kɔmpiutaa ŋu ŋutɔŋutɔ:

Le macOS dzi (MacBook Air / . MacBook Pro):¶

Ʋu Terminal eye nàwɔ sedede sia be nàɖe Lid Open, Lid Close, Wake, Sleep, kple Power-On/Shutdown hardware nudzɔdzɔ ɖesiaɖe si tso System Management Controller (SMC / . PMU) le gaƒoƒo 24 siwo va yi me:

pmset -g log | grep -E "Wake|Sleep|LidOpen|LidClose|Start|Shutdown|DarkWake" | tail -n 60

log show --predicate 'eventMessage contains "USB" or process == "kernel"' --last 4h | grep -iE "usb|appleusb|hid"

Le Linux dzi (Ubuntu, . Fedora, . Debian, . Arch, . RHEL):¶

1. Kpɔe ɖa systemd-journald na boot/shutdown nudzɔdzɔ ɖesiaɖe alo lid/sleep ƒe tɔtrɔ le wò anyimanɔmanɔ me:

   journalctl --list-boots -n 10
   journalctl --since "4 hours ago" | grep -iE "lid|suspend|wake|usb|new high-speed|hid-generic|thunderbolt|pcie"
   

2. Kpɔe ɖa be wò unencrypted /boot kple /boot/efi wometrɔ asi le mamawo ŋu esime mɔ̃a tsi dzo o: Kpɔ nusi tututu wònye ɖa Modify kple Change (ctime) inode ɣeyiɣidzesiwo na kernel nɔnɔmetata ɖesiaɖe, . initramfs, kple GRUB EFI binary le eme /boot:

   find /boot -type f -exec stat -c "%y %z %n" {} + | sort
   

   (Ne faɛl aɖe le eme /boot alo /boot/efi na a Change alo Modify ɣeyiɣi ƒe dzesi esime nèdo le xɔa me, alo tso esime nèdo le xɔa me zi mamlɛtɔ apt/ .dnf kernel update, wotrɔ asi le wò bootloader ŋu.)

Le Windows 10 / 11 dzi la:¶

Ʋu Administrator PowerShell fesre eye nàbia System Event Log na Power-On (ID 12), Nutsitsidɔ (ID 13), Alɔ̃dɔdɔ (ID 42), Nyɔ tso Alɔ̃ me (ID 1 / . ID 107), kple Ŋusẽ si Womekpɔ Mɔ Na O (ID 41) le gaƒoƒo 24 siwo va yi me:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=@(1, 12, 13, 41, 42, 107); StartTime=(Get-Date).AddHours(-24)} | Select-Object TimeCreated, Id, ProviderName, Message | Format-Table -AutoSize -Wrap

Get-WinEvent -LogName "Microsoft-Windows-DriverFrameworks-UserMode/Operational" -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-12) } | Select-Object TimeCreated, Id, Message

--- .

Akpa 2: Nusitae Apple Silicon Macs & Egbegbe TPM 2.0 + PIN Systems Sesẽna Na "Evil Maid" (Kple Alesi Nàwɔ Ðoɖo Wo Nyuie)¶

Menye kɔmpiutadziɖoɖowo katãe woate ŋu atrɔ asi le wo ŋu ŋutɔŋutɔ sɔsɔe o. Alesi egbegbe hardware roots of trust wɔa dɔe kple ɖoɖo siwo tututu wòle be nàwɔ dɔe nye esi:

1. Apple ƒe Silicon MacBooks (M1, . M2, . M3, . M4) .¶

Apple Silicon Macs le nuƒlelawo ƒe kɔmpiuta siwo te ŋu nɔa te ɖe Evil-Maid nu wu siwo wowɔ kpɔ ne wotsi ŋusẽ (S5) eye woɖoe kple FileVault + Firmware/Gbugbɔgaxɔ Dedienɔnɔ: - Woŋlɔa boot ROM la ɖe silicon si metrɔna o me le M-series SoC (Hardware Root of Trust). Afɔkpa ƒe kɔsɔkɔsɔa ƒe akpa ɖesiaɖe (iBoot -> macOS Kernel -> Cryptographically De asi ete System Volume SSV) woɖo kpe edzi to Apple ƒe hardware key dzi hafi wowɔe. - Nudzraɖoƒe NAND chips nye hardware-encrypted to Secure Enclave (AES-XTS) safui siwo wobla ɖe wò FileVault nyagbegbɔgblɔ ŋu zazã kple hardware anti-hammering rate limits. - Ðoɖo 3 siwo wòle be nàɖo kpee le wò MacBook dzi fifia: 1. FileVault le ON: Dɔwɔɖoɖo ƒe Ðoɖowo > Adzamenyawo & Dedienɔnɔ > FileVault -> ON. 2. Tsi Auto-Login & Bia Nyagbegbe Enumake le Alɔ̃dɔdɔ: Dɔwɔɖoɖo ƒe Ðoɖowo > Ʋu Screen -> Bia nyagbegbɔgblɔ le screen saver gɔmedzedze alo ɖeɖefia tsi megbe -> Enumake. 3. Xɔ USB / Dziɖegbe ƒe Kpekpeɖeŋunu Siwo Meɖe Mɔ Na O Ne Wo Tu: Yi Dɔwɔɖoɖo ƒe Ðoɖowo > Adzamenyawo & Dedienɔnɔ > Ðe mɔ na kpeɖeŋutɔwo be woado ka eye nàɖoe ɖe "Bia Kpekpeɖeŋunu Yeyewo" alo "Bia Ɣesiaɣi" (mègawɔ "Automatically When Unlocked" alo "Ɣesiaɣi" gbeɖe o). Ne woɖoe ɖe "Bia Ɣesiaɣi" la, plugging a BadUSB keystroke injector alo Thunderbolt DMA dɔwɔnu ɖe MacBook si wotu me tsɔa ʋɔtrua ƒua gbe ɖe ŋusẽ-ko ƒe nɔnɔme me eye wòxea mɔ na PCIe/USB nyatakakawo katã xexlẽ le hardware controller ƒe ɖoɖo nu.

2. Windows 10 / 11 Pro & Dɔwɔƒe (BitLocker + Pre-Boot TPM PIN + Kernel DMA Protection) .¶

Le gɔmedzedzea me le Windows kɔmpiutawo ƒe alafa memama 99 (Dell, Lenovo, HP, Surface) dzi la, woɖo BitLocker ɖe "TPM-Only" (Dɔwɔwɔ si me kɔ) mode: - Ne èzi ŋusẽ ƒe dzesi dzi le a TPM-Only BitLocker laptop, laptop la dzea egɔme tẽ yia Windows Lock Screen la dzi evɔ mebiaa BitLocker PIN tso asiwò o, si fia be TPM chip la ɖe master drive key la gɔme le eɖokui si (VMK) eye wòtsɔ Windows OS la de RAM me. - Le laptop ɖesiaɖe si zãa discrete TPM chip si do ƒome kple CPU to motherboard tɔ dzi SPI alo LPC bus, si nye amedzidzela si ʋua ete ƒe nutsyɔnu eye wòblaa $50 logic analyzer ɖe TPM chip la dzi MOSI/ .MISO pin xlẽa wò nuŋɔŋlɔ gbadzaa BitLocker Volume Master Key (VMK) tso ka la dzi tututu le sɛkɛnd 5 me (BitPixie / . TPM-Sniffing) evɔ mènya wò Windows ƒe nyagbe ɣaɣla o. - Ne èdze egɔme vaseɖe Windows ƒe gege ɖe eme ƒe screen dzi la, eɖea Windows kernel, Wi-Fi stack, kple PCIe bus hã ɖe go esime womekpɔa edzi o.

Ale Si Nàwɔ Awɔ BitLocker Do Ŋgɔ Na Dzedze Gɔmedzedze PIN (TPM + PIN) le Windows dzi le Aɖabaƒoƒo 2 me:¶

Pre-Boot BitLocker PIN tsɔtsɔ kpee zi xɔtunuawo dzi TPM 2.0 chip be nàna disk encryption key la nanɔ eƒe silicon si te ŋu trɔa asi le eŋu la me vaseɖe esime nàŋlɔ wò PIN si me ŋɔŋlɔdzesi 6 va ɖo 20 le do ŋgɔ na gɔmedzedze la ŋutɔŋutɔ le BIOS/BitLocker ƒe screen yibɔa dzi: 1. Zi edzi Win + R, ŋlɔ ** .gpedit.msc, eye nàzi Enter dzi (le Windows 10/11 Pro, Enterprise, alo Education dzi). 2. Yi: Kɔmpiuta ƒe Ðoɖowɔwɔ > Dɔwɔɖoɖowo ƒe Nɔnɔmetatawo > Windows ƒe Akpawo > BitLocker Drive Encryption > Dɔwɔɖoɖo ƒe Ʋuwo. 3. Zi "Bia kpeɖodzi bubuwo le gɔmedzedzea me" dzi zi eve, ɖoe ɖe Enabled, eye nàɖo Tsɔ TPM gɔmedzedze PIN: ɖe ** .Require startup PIN with TPM. 4. Ʋu Administrator Command Prompt alo PowerShell eye nàɖo wò BitLocker PIN yeye si nèdze do ŋgɔ (be nàɖe mɔ ɖe ŋɔŋlɔdzesiwo ƒe nyagbewo ŋu la, na "Allow enhanced PINs for startup" hã nawɔ dɔ le Group Policy ƒe agbalẽdzraɖoƒe ma ke me):

manage-bde -protectors -add C: -TPMAndPIN

3. Linux (LUKS2 + Secure Boot + Unified Kernel Images (UKI) + BIOS Password) .¶

Le Linux kɔmpiutadziɖoɖowo dzi (Ubuntu, . Fedora, . Debian, . Arch, . Qubes OS), dzidzenu LUKS full-disk encryption bia xoxo be nàŋlɔ do ŋgɔ na gɔmedzedze ƒe nyagbe aɖe hafi ʋua naʋu, si tɔa te passive TPM bus sniffing. Ke hã, Linux ƒe ɖoɖowɔɖi siwo wozãna ɖaa la dzona /boot (initramfs kple vmlinuz) si wometsɔ nya ɣaɣlawo ɣla o, si wɔe be woate ŋu adze bɔbɔe na aɖabaƒoƒo 2 ƒe USB Evil Maid si wonya nyuie /boot ɖɔliɖɔli negbe ɖe nèwɔ afɔɖeɖe etɔ̃ siawo be nàsesẽe: 1. Ðo UEFI / BIOS Dzikpɔla ƒe Nyagbegbɔgblɔ Sesẽ & Trɔ asi le gotagome USB/Network Boot ŋu: - Ŋlɔ wò kɔmpiutadziɖoɖoa ƒe BIOS (F2, . F1, . F10, alo Del at power-on) -> yi Security > Administrator / Supervisor Password eye nàɖo nyagbe sesẽ aɖe ale be amedzidzela mate ŋu azi edzi o F12 le boot me be woatsɔ USB-ti aɖe ade eme. 2. Na UEFI Secure Boot nawɔ dɔ + Ŋlɔ Safui Siwo Trɔ asi le / De asi Ðekawɔwɔ Kernel Nɔnɔmetatawo Te (sbctl + UKI): - Dɔwɔnu siwo le abe ** .sbctl** (Arch, . Fedora, . Debian, . Ubuntu) bundle Linux kernel, kernel sedede fli, kple initramfs ɖe Unified Kernel Image (UKI .efi) woɖo kpe edzi to wò UEFI Secure Boot hardware key (PK / . KEK / . db). Ne Dɔlanyɔnu Vɔ̃ɖi aɖe trɔ asi le wò byte ɖeka ŋu initramfs, UEFI firmware gbe be yemadze egɔme o eye wòɖea nuxlɔ̃ame dzĩ si nye Secure Boot Violation fiana hafi nàŋlɔ wò LUKS nyagbe ɣaɣla gbeɖeka. 3. Ðo kpe edzi IOMMU / . Kernel DMA Protection kple Install USBGuard: - Kpɔe ɖa be Linux kernel IOMMU le dɔ wɔm hã (dmesg | grep -iE "DMAR|IOMMU|AMD-Vi") eye nàda ** .usbguard** (sudo apt install usbguard) be woaxe mɔ ɖe nusiwo wotsɔ de eme yeyee nu HID keyboardwo ( .03:*:*) esime wò screen la le ʋuʋu.

--- .

Akpa 3: DIY Ŋutilã me Tamper Detection Nutrenuwo na Afɔku Gã Mɔzɔzɔ ("Glitter Nail Polish" & Haven) .¶

Nyatakakaxɔlawo, xɔtunu ŋuti numekulawo, kple nyadzɔdzɔŋlɔla siwo le numekuku wɔm zãa mɔnu eve siwo mexɔ asi o, siwo womate ŋu aŋlɔ o, siwo wotsɔ dea dzesi nusiwo gblẽ le ame ŋu le ŋutilã me:

1. "Glitter Nail Polish + Macro Foto" Screw Nutrenu (Uncounterfeitable Entropy) .¶

Woate ŋu aƒle asitsatsa ƒe "VOID IF REMOVED" holographic stickers siwo wozãna ɖaa le Amazon ɖe $10 nu, woaɖe wo ɖa, eye woatsɔ sticker si sɔ kple wo nɔewo aɖo wo teƒe. Glitter nail polish nye akɔntabubu si womate ŋu awɔ aʋatsotɔe o: 1. Ƒle $5 ƒe aŋetu si nye ** ɖa si me kɔ si me wotsɔ ga glitoto siwo le amadede vovovowo me, siwo ƒe lolome le vovovo** yɔ fũ. 2. Da dab sue aɖe si nye glitter nail polish ɖe eve recessed bottom-cover screws (si xea mɔ na screw ta na chassis ga si ƒo xlãe) kple to ete seam si le wò laptop (alo to tape si xea wò padded laptop kotoku). 3. Ne enya ƒu ko la, tsɔ wò smartphone fotoɖemɔ̃ (si nɔa wò kotoku me) tsɔ macro foto si ƒe lolome deŋgɔ ɖe glitter seal ɖesiaɖe ŋu. 4. Nusitae amedzidzela mate ŋu aɖu edzi o: Ne amedzidzela la tsɔ glitter nail polish ƒe dzesi ɖeka pɛpɛpɛ hã la, random 2D geometric orientation, color distribution, kple overlap angles of 80 individual glitter flakes wɔa asibidɛ ƒe dzesi tɔxɛ aɖe le ŋutilã me. Ne ètrɔ yi wò amedzrodzeƒexɔ me la, ɖe gavi ƒe nutrenu ƒe foto evelia tso dzogoe ma ke dzi eye nàtsɔ foto siwo le "Do ŋgɔ" kple "Emegbe" asɔ kple wo nɔewo le wò fon dzi: ne wotrɔ gavi ɖeka dzidzenu 5 gɔ̃ hã la, keklẽ ƒe nɔnɔmea trɔna wòdzena.

2. Trɔtrɔ Android Telefon Xoxo Si Wogblẽ Ðe Ame Ŋu wòazu Amedzrodzeƒe Xɔme ƒe Nukpɔkpɔ Ŋuti Nukpɔnu Ŋutɔŋutɔ (Haven App) .¶

• Dzɔla Dɔwɔɖoɖo kple Nyadzɔdzɔŋlɔlawo ƒe Ablɔɖe Gɔmeɖoanyi, si nye Android dɔwɔnu si woate ŋu azã femaxee ** ye wɔe.Haven: Keep Watch** trɔa Android-telefon ɖesiaɖe si susɔ la wòzua ʋuʋudedi, gbeɖiɖi, ʋuʋudedi (accelerometer), kple ambient light detector.
• Hafi nàgblẽ wò kɔmpiutadziɖoɖo ɖe amedzrodzeƒexɔ ƒe dedienɔƒe alo agbatsɔkeke me la, da telefon si susɔ la ɖe dɔ me Haven le wò kɔmpiuta dzi tututu le agbatsɔnu alo akplo si wotu me: ne ame aɖe ʋu agbalẽdzraɖoƒea (etrɔ ambient light sensor ƒe nuxexlẽ) alo ka asi kɔmpiutaa ŋu la, . Haven eɖea foto kpoo, léa odio ɖe mɔ̃ dzi, eye wòɖoa Dzesi ƒe nuxlɔ̃ame si wotsɔ nya ɣaɣlawo ŋlɔ ɖe telefon vevitɔ si le wò kotoku me la gbɔ.

3. Dukɔwo Dome Liƒowo Tso & Yameʋudzeƒe Evelia Dzodzrowo Dedie¶

Ne èzɔ mɔ yi dukɔwo dome to ʋɔnudrɔ̃ƒe siwo me afɔku le ŋutɔ afisi dukɔmeviwo alo liƒodzikpɔlawo ate ŋu atsɔ kɔmpiutadziɖoɖowo kple telefonwo adzoe le afisi ame aɖeke makpɔ wo o la: 1. Mɔzɔzɔ kple "Mɔzɔzɔ Dzadzɛ / Dzobibi" Kɔmpiutadziɖoɖo kple Telefon: Mègatsɔ wò dɔwɔƒea ƒe dɔwɔƒe vevitɔ, wò agbeme nyagbe ɣaɣlawo ƒe nudzraɖoƒe, alo SSH safuiwo to liƒo siwo me afɔku le ŋutɔ dzi gbeɖe o. Tsɔ Chromebook dzadzɛ alo kɔmpiuta si dzi woɖe nɔnɔmetata yeyee si me faɛl tɔxɛ siwo hiã na mɔzɔzɔ ma koe le ɖe asi, eye nàkpɔ dɔ veviwo pɛpɛpɛ to adzɔge kplɔ̃dziɖoɖo si ŋu woɖo kpee dzi ne èva ɖo. 2. Elektrikŋusẽ Tsi keŋkeŋ (S5) Aɖabaƒoƒo 10 Hafi Nàge Ðe Dukɔmeviwo ƒe Dukɔmeviwo ƒe Dɔwɔƒea: Tsi kɔmpiutadziɖoɖoa kple telefon la keŋkeŋ (Power Off) hafi aɖi le yameʋua me ale be DRAM nagblẽ keŋkeŋ eye biometric naʋu (Face ID / . Touch ID) nye nuwɔametɔ tsɔ da asi ɖe ŋɔŋlɔdzesiwo ƒe nyagbe sesẽ aɖe dzi.

--- .

Nutome ƒe xexlẽdzesi siwo ku ɖe nudzɔdzɔ kpatawo ŋu kple dɔwɔƒea ƒe ɖoɖowo¶

Ele be woagblɔ kɔmpiutadziɖoɖowo ƒe asitɔtrɔ ŋutɔŋutɔ, xɔtunu siwo wotsɔ ŋlɔa nu le adzame ƒe safuiwo dodo, alo liƒo/amedzrodzeƒe ƒe ŋkutsala si ŋu womeɖe mɔ ɖo o na dukɔa ƒe nyatakakaxɔlawo kple Internet dzi takpɔhawo:

• United States kple Canada:
• Dɔwɔƒe Kpata: Ƒo ka 911 ne èke ɖe ame aɖe si ge ɖe wò amedzrodzeƒexɔ alo wò nɔƒe ŋu.
• Dukɔa ƒe Numekuku Dɔwɔƒe (FBI) Tsitretsiɖeŋunyawo & Internet Dzi Mamã / . IC3: Ne ènye United States mɔzɔla, aʋawɔnyawo ŋuti kontraktɔ, numekula, alo dɔdzikpɔla si ƒe kɔmpiuta alo telefon trɔ asi le duta alo amedzrodzeƒe aɖe la, gblɔ nudzɔdzɔa na wò nutoa me FBI Field Office Counterintelligence Squad alo le ** .ic3.gov** kple cisa.gov/report (dzra ka alo kɔmpiuta si dzi wotrɔ asi le si ŋu womeka asi o ɖo ɖe Faraday kotoku me hena FBI ƒe ʋɔnudrɔ̃ƒe ƒe numekuku).
• Canada ƒe Dedienɔnɔ Ŋuti Nyatakaka Dɔwɔƒe (CSIS) & Cyber Centre: Ƒo ka na 1-833-CYBER-88 alo nàte ɖe CSIS ŋu (613-993-9620) le esi wosusu be dutatɔwo ƒe mɔ̃ ŋutɔŋutɔwo ƒe asitɔtrɔ le eŋu ta.
• Fiaɖuƒe Ðeka:
• Dɔwɔƒe Kpata: Ƒo ka 999 (alo 101 na kpovitɔwo).
• Dukɔa ƒe Internet Dzi Dedienɔnɔ Dɔwɔƒe (NCSC) & Dukɔa ƒe Dedienɔnɔ Ŋuti Dɔwɔƒe (NPSA): Ele be UK dziɖuɖu, agbalẽnyalawo, kple dɔwɔƒewo ƒe mɔzɔlawo nawɔ ɖe NCSC / NPSA Duta Mɔzɔzɔ Mɔ̃ɖaŋu Mɔfiame dzi eye woagblɔ nusiwo wosusu be wotrɔ asi le xɔtunu ŋutɔŋutɔwo ŋu to ** dzi.ncsc.gov.uk**.
• Europa Dukɔwo ƒe Ðekawɔha:
• Dɔwɔƒe Kpata: Ƒo ka 112 le EU-dukɔwo katã me.
• Dukɔa ƒe CSIRTwo / Aƒeme Dedienɔnɔ Dɔwɔƒewo (ANSSI France, ƒe 1999 me. BSI Germany, ƒe 1999 me. AIVD/ .NCSC-NL Netherlands): Ka nya ta tso nusiwo wosusu be wonye firmware alo hardware implants ŋu na wò dukɔa ƒe CSIRT hena hardware SPI/UEFI forensic verification.
• Australia kple New Zealand:
• Dɔwɔƒe Kpata: Ƒo ka 000 le Australia alo ** .111** le New Zealand.
• Australiatɔwo ƒe Internet dzi Dedienɔnɔ Dɔwɔƒe (ACSC / . ASD) & ASIO ƒe Kpekpeɖeŋunana: Yɔ 1300 CYBER1 (1300 292 371).
• India kple Asia-Pacific:
• India (CERT-In / Kpata): Ƒo ** .112** na kpovitɔwo alo agblɔ hardware/firmware dedienɔnɔ nudzɔdzɔwo na incident@cert-in.org.in.

--- .

Nya siwo wobiaa amewo enuenu¶

Nukatae nye Windows kɔmpiutadziɖoɖoa dzudzɔ dɔwɔwɔ le mɔ nyuitɔ nu zi ɖeka eye wòbia nye BitLocker Recovery Key si me xexlẽdzesi 48 le esi megblẽe ɖe nye amedzrodzeƒexɔ me teti?¶

Ne BitLocker le dɔ wɔm le Windows kɔmpiuta dzi la, hardware la Nuƒolanɔƒe ƒe Mɔ̃ si Dzi Woka Ðo (`TPM 2.0`) . dzidzea wò BIOS/UEFI dɔwɔnua ƒe nya ɣaɣla SHA-256 hash (`PCR 0`), tiatiawɔblɔɖe ROMwo (`PCR 2`), UEFI ƒe Dɔwɔɖoɖowo Dzikpɔla (`PCR 4`), kple Secure Boot ƒe nɔnɔme (`PCR 7`) ɣesiaɣi si kɔmpiutadziɖoɖoa ʋu. Ne ame aɖe ka asi wò kɔmpiuta dzi esime nèle xɔa me eye wòtɔ zi ɖeka le screen blɔ aɖe dzi nɔ wò BitLocker Recovery Key si ƒe xexlẽdzesi nye xexlẽdzesi 48 dim la, nu eve dometɔ ɖekae dzɔ: BIOS ƒe yeye si le se nu si woda ɖe eme teti koe nye ema, . alo ame aɖe trɔ wò BIOS ƒe gɔmedzedze ƒe ɖoɖo, ewɔ Secure Boot nuwɔametɔe, ewɔ gotagome USB stick, alo trɔ asi le wò bootloader firmware ŋu, si na TPM PCR hashes trɔ eye wòhe BitLocker ƒe anti-tamper lockdown vɛ. Mègaŋlɔ wò xexlẽdzesi 48 ƒe safui si nàtsɔ agbugbɔ axɔ o vaseɖe esime nàlé ŋku ɖe BIOS ƒe nuŋlɔɖiwo kple boot chain ŋu, elabena ne èŋlɔ wò recovery key ɖe boot nɔnɔme si ŋu wotrɔ asi le me la, eɖea wò drive la ɖe go.

Ne metu nye Windows alo Mac ƒe screen (Win+L / . Ctrl+Cmd+Q) hafi adzo le kɔfidzraƒe alo amedzrodzeƒe aɖe la, ɖe ame aɖe ate ŋu agate ŋu age ɖe eme to USB-C-doa dzia?¶

Enɔ te ɖe ɖoɖo eve dzi: Gbã la, ne ame aɖe tsɔ ka a BadUSB ƒe safui ƒe ƒoƒo ƒe atike (`Flipper Zero` alo `Rubber Ducky`) ɖe kɔmpiutadziɖoɖo si wotu me la, ɖeko aʋatso keyboard la ate ŋu aŋlɔ ɖe nyagbegbɔgblɔ ƒe aɖaka si le ʋɔtrua ƒe screen la dzi (mate ŋu aʋu terminal esime wotu screen la o). Gake evelia, ne kɔmpiutadziɖoɖoa ƒe xoxotɔ le esi Thunderbolt 3/4 alo USB4 ʋɔtru si me Kernel DMA Takpɔkpɔ mele dɔ wɔm o, si nye PCIe DMA ƒe xɔtunu tɔxɛ aɖe (`PCILeech`) ate ŋu axlẽ system RAM ahaŋlɔe tẽ to PCIe bus dzi esime wotu screen la. Nuwɔwɔ na ame Kernel DMA Takpɔkpɔ le Windows me (`System Information > Kernel DMA Protection: On`) alo ɖoɖo macOS **Ðe mɔ na kpeɖeŋutɔwo be woado ka -> Bia Ɣesiaɣi** xea mɔ na USB-C/Thunderbolt ƒe nyatakakawo ƒe gege ɖe eme keŋkeŋ esime wotu screen la.

Ðe mate ŋu awɔ scan na nye motherboard ƒe UEFI / BIOS firmware tso Linux alo Windows me akpɔe ɖa be Evil Maid aɖe klẽ firmware implant aɖe hã?¶

Ɛ̃. Open-source firmware dedienɔnɔ dɔwɔnu siwo Intel kple dedienɔnɔ ŋuti numekulawo to vɛ, koŋ CHIPSEC ƑE NUÐEÐEŊUTI (`github.com/chipsec/chipsec`) kple fwupd (`fwupdmgr security`) . le Linux dzi la, ɖe mɔ na wò be nàtsɔ wò live SPI flash ROM nɔnɔmetata la aƒu gbe tẽ tso motherboard la dzi (`chipsec_util spi dump rom.bin`), kpɔe ɖa be hardware BIOS Nuŋɔŋlɔ Takpɔkpɔ (`BIOS_CNTL` `BLE`/ .`BWE` bits kple `PR0-PR4` Protected Range registers) wotu nyuie, eye nàtsɔ wò SPI flash cryptographic hash asɔ kple ewɔla ƒe BIOS nɔnɔmetata si dziɖuɖua da asi ɖo.

Ðe wòle dedie be matu nye kɔmpiuta alo hardware crypto gakotoku ɖe amedzrodzeƒexɔ ƒe elektrɔnik dedienɔƒe mea?¶

Mègaɖo ŋu ɖe amedzrodzeƒexɔ ƒe elektrɔnik safui si wozãna ɖaa ŋu gbeɖe be nàkpɔ ɖokuiwò ta tso Dɔlanyɔnu Vɔ̃ɖi ƒe amedzidzedze me o. Amedzrodzeƒea ƒe elektrɔnik dedienɔƒe ɖesiaɖe kloe ƒe safui si wozãna le xexeame katã ƒe mɔ̃ si wotsɔna toa safui si woɣla ɖe plastik ƒe dzesidegbalẽvi si le ŋgɔgbekpa dzi la megbe, kpakple dɔwɔƒea ƒe master override code (`000000` alo `999999`) si amedzrodzeƒedɔwɔlawo nya. Ne amedzrodzeƒexɔ me dedienɔƒe koe nye wò tiatia la, da wò kɔmpiuta si dzi elektrikŋusẽ le la ɖe a tamper-evident serialized dedienɔnɔ ƒe akplo (alo nàtsɔ glitter-nail-polish nutrenu si woɖe fotoe la asisi ɖe ʋuƒoa dzi) ale be nànya enumake ne woka asi wò mɔ̃a ŋu.

Nukae nye "Alɔ̃dɔdɔ le vuvɔŋɔli (S4)" vs. "Alɔ̃dɔdɔ (S3 / . S0ix)", eye ɖe Hibernation kpɔa ame ta tso RAM / DMA Evil Maid ƒe amedzidzedzewo mea?¶

Ne kɔmpiutadziɖoɖo aɖe ge ɖe eme Alɔ̃dɔdɔ (`S3` alo `S0ix`) ., RAM chips-awo gakpɔtɔ le dɔ wɔm eye woléa wò disk encryption keys siwo woɖe le eme la ɖe ŋkuɖodzinu si meʋãna o me. Ne kɔmpiutadziɖoɖo aɖe ge ɖe nyateƒe me Vuvɔŋɔli ƒe alɔ̃dɔdɔ (`S4`) ., dɔwɔɖoɖoa ŋlɔa RAM me nyawo ɖe vuvɔŋɔli ƒe alɔ̃dɔdɔ ƒe faɛl si wotsɔ nya ɣaɣlawo ŋlɔ me (`hiberfil.sys` alo swap si wotsɔ nya ɣaɣlawo ŋlɔe) le SSD si wotsɔ nya ɣaɣlawo ŋlɔe dzi, . ekɔa master disk encryption keys la ŋu, eye wòtsoa elektrikŋusẽ katã si le motherboard kple RAM la ŋu keŋkeŋ (abe alesi woatɔ te dɔ bliboe ene). Eyata, wo ame evea siaa **Tɔtrɔ Blibo (`S5`)** kple **Alɔ̃dɔdɔ le Vuvɔŋɔli (`S4`) le ʋu si wokpɔ ta na to Do ŋgɔ na gɔmedzedze BitLocker PIN alo LUKS nyagbegbɔgblɔ** kpɔ wò RAM ta tso DMA kple vuvɔ-dzedze ƒe amedzidzedzewo me, nenye be Secure Boot kple BIOS nyagbegbɔgblɔ xe mɔ na `/boot` asitɔtrɔ le ame ŋu.

--- .

Mɔfiame siwo do ƒome kplii¶

• Dutoƒo fexexe ƒe kiosk data blocker (USB kɔndɔm) kple BadUSB HID dodo
• BitLocker, FileVault, kple LUKS nya ɣaɣlawo gbugbɔgaxɔ safui ƒe ʋuʋu kple TPM gbugbɔgaɖoɖo
• BIOS kple UEFI firmware update brick, ŋusẽ ƒe bu, kple Dual-BIOS Flashback
• Laptop alo telefon si wofi: adzɔge tutu kple akɔntabubu ƒe mɔxexe
• Cryptocurrency gakotoku ƒe tsidzɔƒe kple nuku-nyagbe ƒe nugblẽfexexe
• Xexlẽdzesi siwo woxɔna kpata le dukɔwo nu

--- .

Dzɔtsoƒewo kple dziɖuɖumegãwo ƒe mɔfiame¶

• Dukɔa ƒe Dzidzenuwo Kple Mɔ̃ɖaŋununya Ŋuti Nusrɔ̃ƒe (NIST) (United States): Agbalẽ Tɔxɛ 800-147B (BIOS Takpɔkpɔ Mɔfiamewo na Servers kple Dɔwɔƒewo) & SP 800-155 (BIOS ƒe Fɔmaɖimaɖi Dzidzedze Mɔfiamewo).
• Dukɔa ƒe Dedienɔnɔ Dɔwɔƒe (NSA) & Internet Dzi Dedienɔnɔ Kple Dɔwɔƒewo ƒe Dedienɔnɔ Dɔwɔƒe (CISA) (United States): * Sesẽ UEFI Dedienɔnɔ Boot, Kakaɖedzi Platform Module (TPM 2.0) PIN ƒe Ðoɖowɔwɔ Do Ŋgɔ Na Dɔwɔwɔ, Kple Dziɖegbe/PCIe Tsã Ŋkuɖodzinu ƒe Mɔɖeɖe Dzi Ðeɖe Akpɔtɔ (DMA) Amedzidzedzewo*.
• Dukɔa ƒe Internet Dzi Dedienɔnɔ Dɔwɔƒe (NCSC) & Dukɔa ƒe Dedienɔnɔ Ŋuti Dɔwɔƒe (NPSA) (United Kingdom): Nuwo ƒe Kɔsɔkɔsɔ kple Duta Mɔzɔzɔ Ŋutilãmenuwo ƒe Dedienɔnɔ, Tamper-Evident Seals, kple Boot Integrity Verification.
• Microsoft Hardware Dedienɔnɔ Ŋuti Nuŋlɔɖiwo & Linux Kernel IOMMU / . fwupd Host Dedienɔnɔ Ŋuti Nyatakaka (HSI): *Kernel DMA Takpɔkpɔ (VT-d / . AMD-Vi) kple BitLocker Tsitretsitsi Ðe Discrete TPM Bus Sniffing * ŋu.