Skip to content

Ordinateur portable ya mosala ekangami na CrowdStrike/SentinelOne to ekangami libanda na VPN Kill-Switch oyo ebukani tango ozali kosala na mosika

Mituya ya mbalakaka ekeseni na mikili. Lokasa oyo esaleli 911, nimero ya États-Unis mpe Canada. Bikólo mosusu mingi esalelaka 112, 999, to motángo mosusu. Luka nimero ya mboka na yo.

Kolamuka na bureau ya ndako, chambre ya hôtel, to esika ya mosala ya mosika mpo na komona ete ordinateur portable na yo oyo ebimisami na compagnie elakisaka "Connected, No Internet" na réseau Wi-Fi nionso, eboyi ko charger page ya login ya portail captive ya hôtel to ya aéroport, to ezo crasher na Windows Blue Screen of Death oyo ezangi suka (BSOD) esika ya kofungola ( .PAGE_FAULT_IN_NONPAGED_AREA to mpe SYSTEM_THREAD_EXCEPTION_NOT_HANDLED) ezali likambo ya mbalakaka oyo esalemaka na mosika oyo esɛngaka mbongo mingi. Na ba environnements ya entreprise ya mikolo oyo, lockout total oyo esalemaka presque toujours na moko ya ba mécanismes misato ya sécurité automatique: **quarantine ya Endpoint Detection and Response (EDR) Network Containment oyo e déclenché na CrowdStrike Falcon, SentinelOne, to Microsoft Defender for Endpoint, mobongisi ya sécurité ya mode noyau oyo ebebi oyo ezali kopekisa mise à jour ya système d’exploitation esala démarrage, to Ekangamaki Toujours-On VPN / Zero-Trust Network Access (ZTNA) Kill-Switch (Zscaler Client Connector, Cisco AnyConnect / Secure Client, Palo Alto GlobalProtect, to Fortinet FortiClient) kokanga trafic nionso ya DNS mpe DHCP ya esika kino tunnel ekozala établi. Soki lockout na yo esangisi attaque active ya ransomware to demande ya extorsion, benga Centre d’opérations de sécurité (SOC) ya entreprise na yo mpe tuna esika ofandi banimero ya mbalakaka soki ba infrastructures critiques to ba systèmes ya sécurité ya vie ezo affecter. Mpo na ba crises ya mosala ya mosika oyo etali yango, tala ba guides na biso na ordinateur portable ya mosala bayibi to ebukani tango ozali kosala mobembo mpe récupération ya verrouillage MDM, . kosala na mosika na otɛlɛ moko, mpe internet ya sauvegarde na connectivité.

Lokola ba points d’arrêt ya entreprise ekangami makasi na ba mots de passe ya protection ya tamper, ba comptes ya usager oyo ezali administratif te, mpe encryption ya disque mobimba Microsoft BitLocker to macOS FileVault, ba tricks standard ya résolution ya ba problèmes ya consommateur (lokola ko réinstaller Windows to ko supprimer ba dossiers ya programme) ekolonga to eko déclencher alerte ya menace insider ya gravité makasi na ba CISO na yo tableau de bord ya tableau de bord. Kasi, na ko diagnostiquer soki ozali kokutana na EDR Host Isolation, VPN Captive-Portal Deadlock, to Kernel Driver Bootloop, mpe kotuna équipe na yo ya IT Helpdesk to SecOps mpo na 48-digit BitLocker Recovery Key to One-Time Offline Maintenance / Uncontain Token na nzela ya kobenga na mongongo, okoki zongisa poste na yo ya mosala na miniti 15 uta esika nyonso na mokili.

Sala boye sikoyo

  1. Komeka TE ko effacer, ko réinitialiser, to ko démarrer ordinateur portable ya entreprise na Linux oyo epesami ndingisa te to USB stick oyo ezo craquer mot de passe. Ko démarrer ordinateur portable ya entreprise na disque USB ya libanda ezo déclencher UEFI Secure Boot na Trusted Platform Module (TPM 2.0) E vérifier intégrité ya PCR, ekangamaka mbala moko disque dur sima ya écran BitLocker ya 48 chiffres mpe kotinda alerte ya tampering critique na Centre d’opérations de sécurité (SOC) ya entreprise na yo na moment oyo ordinateur portable ezo reconnecter.
  2. Koyeba soki internet na yo ekangami na Quarantine ya EDR vs. Deadlock ya VPN Kill-Switch. Fungola Command Prompt (cmd.exe) to Fenêtre ya Terminal mpe kokende ping 8.8.8.8 mpe nslookup google.com. Soki paquet moko na moko elongi te na General failure to mpe Transmit failed. Error code 1231 ata soki elembo ya Wi-Fi na yo elobi "Connected," pilote ya filtre ya mur ya moto (ezala EDR Network Containment to VPN Kill-Switch ya makasi) ezali kobwaka ba paquets nionso oyo ezo bima na Plateforme ya filtrage ya Windows (WFP) couche na yango.
  3. Soki ozali na hôtel, café, to aéroport mpe VPN na yo ya Always-On ekangaki page ya login ya Wi-Fi ("Captive Portal Chicken-and-Egg Deadlock"), connecter ordinateur portable na yo na Wi-Fi Hotspot cellulaire ya smartphone na yo LIBOSO. Lokola hotspot ya smartphone na yo esalela te page web ya login ya portail captive, agent na yo ya Always-On VPN to Zscaler ya entreprise ekosala mbala moko ko authentiquer na nzela ya ba données cellulaires ya téléphone na yo, benda na se politique nionso oyo ebongwani to désactiver jeton na IT, pe o permettre yo osenga temporaire Captive Portal Bypass / Disable Password.
  4. Soki ordinateur portable na yo ya Windows ekangami na Écran Bleu ya Liwa oyo ezangi nsuka (BSOD) bootloop après mise à jour ya sécurité ya butu mobimba, photographier exact Stop Code mpe .sys kombo ya fisyé na nse ya écran bleu (lokola csagent.sys to mpe SentinelMonitor.sys). Nkombo ya fisyé wana eyebisaka mbala moko ekipi na yo ya IT soki fisyé ya chaîne EDR to pilote ya noyau oyo ezali na mbeba nde esalaki ete likambo yango ekwea.
  5. Yambo ya kokota na Windows Safe Mode to WinRE Command Prompt na PC ya entreprise, benga IT Helpdesk na yo na téléphone na yo mpe senga bango batanga to batindela yo message ya ordinateur portable na yo ya 48 chiffres BitLocker Recovery Key (oyo ekokani na ba caractères 8 ya liboso ya... Key ID elakisami na écran na yo). Okoki te kofungola commande ya récupération to ko démarrer na Mode sûr na ordinateur portable ya entreprise chiffré sans kokotisa ba chiffres wana 48.
  6. Soki CrowdStrike Falcon, SentinelOne, to Defender for Endpoint etie ordinateur portable na yo na "Network Containment" (Host Isolation), tika kosala ba scripts to ko transferer ba fichiers mpe benga Centre ya opérations ya sécurité ya entreprise (SOC) na yo na téléphone. Limbola malamu nini ozalaki kosala kaka avant lockout (lokola kosala compilateur ya développeur, outil ya test ya pénétration, PowerShell build script, to ko connecter na routeur ya voyage) po analyste ya SOC a vérifier que ezalaki faux positif pe a cliquer "Lift Containment" à partir ya console ya cloud (oyo ekomaka na ordinateur portable na yo automatiquement ata tango ozali na quarantaine).

Danger

Mpo na nini EDR "Containment ya réseau" epesaka kaka nzela na Console ya cloud esolola na ordinateur portable na yo (kaka soki otikali connecté na Wi-Fi). Tango CrowdStrike Falcon, SentinelOne, to Microsoft Defender e isoler ordinateur portable oyo ezali na compromis to oyo ezali na suspect, e bloquer 100 pour cent ya trafic ya navigateur ya usager, email, partage ya SMB SMB, mpe ba demandes ya fichier ping - EXCEPT mpo na tunnel moko ya kobeta motema ya TLS chiffré directement entre capteur EDR na ordinateur portable na yo mpe ba serveurs ya gestion ya cloud ya motekisi (*.crowdstrike.com to mpe *.sentinelone.net). Ko boma Wi-Fi na yo TE to kolongola câble Ethernet na yo TE tango ozali kosolola na IT SecOps. Tant que ordinateur portable na yo ezali na connexion ya Wi-Fi brut to ya smartphone hotspot na internet, analyste ya SOC akoki ko déquarantine ordinateur portable na yo na distance na clic moko na 30 secondes sans ko koma ata jeton moko na clavier na yo.

Nzete ya mikano: Kosala diagnostic ya ba lockouts ya réseau ya ordinateur portable ya entreprise mpe ba bootloops

Salelá diagramme oyo mpo na koyeba malamu couche nini ya bokengi ya entreprise ekangaki ordinateur portable na yo mpe nzela na procédure ya récupération exacte.

flowchart TD
    A["Ordinateur portable ya mosala ya mosika ekangami to ekoki ko connecter te"] --> B{"Ordinateur portable ezo démarrer na bureau ya Windows / macOS?"}
    B -->|"Te: Ezali ko crashes na Boucle ya Écran Bleu (BSOD) to Écran BitLocker"| C{"Nini ezali komonana na écran?"}
    C -->|"BSOD kopesa nkombo csagent.sys, SentinelMonitor.sys, to wdfilter.sys"| D["KERNEL DRIVER BOOTLOOP: Démarrage na WinRE Recovery -> Tyá Fungola BitLocker ya 48 chiffres na IT -> Bolongola fichier ya chaîne oyo ezali na mbeba to bobongola kombo ya pilote na Mode sûr"]
    C -->|"Écran ya récupération ya BitLocker bleu oyo ezali kosenga clé ya 48 chiffres"| E["TPM PCR TRIP: Longola ba docks/drives USB nionso -> Reboot -> Soki kaka basengi yo, benga IT Helpdesk na ID ya Clé ya 8-char pona kozua Clé ya Récupération ya 48 chiffres"]
    B -->|"Oui: Ebandi na Bureau, kasi ZERO internet / accès ya réseau"| F{"Nini esalemaka tango ozali ko vérifier état ya VPN / ZTNA & Wi-Fi?"}
    F -->|"Na Hôtel/Aéroport: Wi-Fi ekangami, kasi lokasa ya kokɔta na Portal Captive ekofungwama te"| G["CAPTIVE PORTAL DEADLOCK: Connecter ordinateur portable na Smartphone Hotspot liboso -> Authentiquer VPN -> To brancher Routeur ya Voyage pona kosilisa login ya portail na téléphone"]
    F -->|"Wi-Fi ya ndako/Hotspot ekangami, kasi ping 8.8.8.8 elobi 'Echec général'."| H{"Client ya VPN ekangami na 'Connecting / Kill-Switch Active' TO EDR ezali Isolating?"}
    H -->|"Client VPN alobi 'Network Lock / Kill Switch Active - Ekoki kokoma na Gateway te'."| I["VPN KILL-SWITCH LOCK: Bobongola na esika ya molunge ya telefone -> To kotia Mot de passe ya Désactiver YANGO mbala moko na Zscaler / AnyConnect / GlobalProtect"]
    H -->|"VPN ezali kokangama to kokata, TO pop-up ya bokengi elobi 'Host Isolated'."| J["CONTAINMENT YA RÉSEAU EDR: Bomba Wi-Fi connecté -> Benga SOC ya entreprise -> Pesa kombo ya hôte -> SOC e cliquer 'Lift Containment' TO epesi Token ya entretien hors ligne"]

Scénarios 1: Ordinateur portable ekangami na quarantaine na EDR "Contention ya réseau" (CrowdStrike, SentinelOne, Défenseur)

Ba ordinateurs portables ya entreprise ya mikolo oyo esalaka ba capteurs ya niveau ya noyau Endpoint Detection and Response (EDR) na esika ya ba logiciels antivirus ya consommation ya bonkoko. Tango capteur ya EDR emoni comportement oyo ekokani na cyberattack - lokola ingénieur logiciel oyo azali ko compiler binaire oyo ezali na signature te, analyste ya ba données oyo azali ko tambuisa script ya automation ya PowerShell to Python complexe, designer oyo azali kofungola feuille de calcul activée na macro, to voyageur oyo azali ko connecter na réseau ya hôtel oyo ezali na compromis oyo ezali kobimisa ba paquets ya spoofing ya ARP - playbook automatisé e déclenchaka Network Bokangami (Isolation ya hôte).

Ndenge nini koyeba quarantaine ya Contention ya Réseau ya EDR

Na bokeseni na chute ya Wi-Fi ya momesano, quarantaine ya EDR elakisaka bilembo ya tekiniki ya sikisiki mpenza:

  1. Wi-Fi Elakisaka "Connected" to "Internet te, Secured," Nzokande Ba Appareils LAN Local Ezali Invisible: Okoki te ping routeur na yo moko ya ndako (192.168.1.1), ekoki te konyata na imprimante ya réseau local, mpe ping 8.8.8.8 ezongaka General failure to mpe Transmit failed mbala moko (<1 ms) mpo ete Plateforme ya filtrage ya Windows ya capteur EDR (WFP) pilote ya callout e intercepter pe ebwakaka paquet nionso ya TCP/UDP/ICMP avant ekoma jamais na carte Wi-Fi.
  2. Ba Sessions ya Bureau à distance actif, Slack, Zoom, mpe Navigateur ekangamaka na mbala moko: Na kati ya 2 secondes ya déclencheur ya comportement, prise nionso ekangamaka mbala moko.
  3. Ko vérifier Status ya EDR Local na nzela ya Line ya Commandement (Droits ya Admin esengeli te):
  4. CrowdStrike Falcon: Fungola Esengi ya komande (cmd.exe) mpe kokima mbangu sc query csagent. Soki elakisaka STATE: 4 RUNNING, mpe kopota mbangu netstat -ano | findstr :443 elakisi ete seul oyo ezali kosala ESTABLISHED ba connexions ya sortie na ordinateur portable mobimba ezali ya CSFalconService.exe kosolola na ba adresses IP ya lipata ya AWS/CrowdStrike, hôte na yo azali na Falcon Network Containment.
  5. SentinelOne: Tala elembo ya nguba ya SentinelOne ya violet na plateau ya système (to barre ya menu na macOS). Tango isolé, état ya agent etangami ** .Network Quarantined / . Disconnected from Network by Management** **.
  6. Microsoft Defender for Endpoint (MDE): Toast ya notification ya Windows Security ekoki koloba na mokuse "Eloko oyo ekabwani na administrateur na yo," while MsSense.exe etikali kaka processus oyo epesami nzela na nzela ya mur ya moto.

Ndenge nini kosala un-quarantine na mosika (Online Cloud Release vs. Offline Maintenance Token)

Ezali na banzela mibale oyo Centre na yo ya opérations ya sécurité informatique (SOC) ekoki kobimisa quarantaine ya EDR:

Nzela ya bozongisi nzoto Tango Esalaka Procédure ya Etape na Etape ya sikisiki na ba SecOps ya IT
Nzela A: Kozanga kopekisa lipata na mopepe (Lokito koleka: 30 Secondes) Ntango ordinateur portable na yo ezali na connexion internet brute oyo ezali kosala (lokola Wi-Fi ya ndako na yo to esika ya Wi-Fi cellulaire ya smartphone na yo - TE portail captif ya hôtel oyo ezali authentiqué te). 1. Connecter Wi-Fi ya ordinateur portable na yo na routeur ya ndako to smartphone cellular hotspot na yo.
2. Benga Bureau / SOC ya Service IT na yo na téléphone mpe pesa Nkombo ya hôte ya ordinateur na yo (tambolisa hostname na Ebongiseli ya komande).
3. Analyste ya SOC atali alerte déclenchée na portail CrowdStrike Falcon, SentinelOne, to Defender, a marquer yango lokola faux positif bénine, mpe a cliquer "Lift Containment" / "Reconnect to Network."
4. Lokola canal ya gestion chiffré ya capteur EDR epesami nzela na nzela ya mur ya quarantine, ordinateur portable na yo ezuaka commande ya déverrouillage na kati ya 15 à 60 secondes mpe accès internet mobimba ezongaka automatiquement sans reboot.
Nzela B: Token / Passphrase ya entretien ya mbala moko hors ligne (Ntango Cloud Channel Ezali Bloqué) Ntango okangami sima ya portail Wi-Fi ya hôtel/avion oyo ezali authentiqué te to tango politique ya mur ya moto oyo ebebi ekangaki ata motema ya lipata ya EDR. 1. Lokola capteur ya EDR ekoki te kokoma na console ya cloud kino okokota na portail Wi-Fi ya hôtel (mpe okoki ko charger portail Wi-Fi ya hôtel te tango capteur ya EDR ezali ko quarantaine navigateur na yo), yebisa analyste ya SOC que ozali na état hors ligne / captive-portal.
2. Analyste ya SOC alukaka ordinateur portable na yo spécifique Unique Agent ID (AID) na console na bango mpe ebimisaka Jeton ya entretien ya mbala moko oyo etali dispositif (CrowdStrike) to Passphrase ya Agent ya 24 caractères (SentinelOne).
3. Na kosalelaka esika ya komande oyo etombolami to UI ya agent, kotia elembo (CsUninstallTool.exe /maintenance to mpe sentinelctl unprotect -k "<passphrase>") mpo na ko décharger pilote ya filtre ya confinement na esika.

Scénarios 2: Ebukani Toujours-On VPN Kill-Switch to ZTNA Captive-Portal Deadlock

Ezali boni soki ordinateur portable na yo ezali te na quarantaine na SecOps, kasi na esika na yango ezali kotambwisa entreprise Toujours-On VPN to Zero-Trust Network Access (ZTNA) client (Zscaler Client Connector, Cisco AnyConnect / Cisco Secure Client na Module ya Visibilité ya Réseau, Palo Alto GlobalProtect, to Netskope) configuré na Strict Kill-Switch ("Fail-Closed" / "Kokanga trafic nionso oyo ezali ya entreprise te tango ozali na confiance te")?

1. Kosilisa "Empate ya Portal ya bokangami ya hôtel / aéroport" (Motambo ya nsoso mpe makei) .

Talá ntina oyo bankóto ya bato oyo basalaka na mosika bakangamaka na baordinatɛrɛ na bango ya moke ntɔngɔ nyonso na ba otɛlɛ, na ba cafés mpe na libándá ya mpɛpɔ:

  • Pona kozua accès internet na Wi-Fi ya hôtel to ya aéroport, esengeli ofungola navigateur web, ozua redirection na nzela ya HTTP/DNS na page ya login ya hôtel (captive.apple.com to mpe neverssl.com), mpe koma nimero ya shambre na yo mpe nkombo ya nsuka.
  • Nzokande, ordinateur portable na yo ya ordinateur Always-On VPN Kill-Switch emoni ete Wi-Fi ya hôtel ezali "Réseau Non-Corporatif Inconfiance" mpe ekangaka mbala moko ba demandes nionso ya HTTP mpe DNS ya mboka kino tunnel ya VPN chiffré na siège ya entreprise eko connecter.
  • Tunnel ya VPN ekoki kozala na boyokani te kino okokoma nimero ya chambre na yo na lokasa ya bokɔti ya hôtel, mpe oko koki te ko charger lokasa ya bokɔti ya hôtel mpo VPN Kill-Switch ezali kokanga navigateur na yo.

Salelá moko ya ba méthodes minei ya bypass oyo e prouvé mpo na kobuka impasse mbala moko sans que ozala na besoin ya ba droits ya admin:

+-----------------------------------------------------------------------+
|  4 WAYS TO BREAK A VPN KILL-SWITCH CAPTIVE PORTAL DEADLOCK            |
|                                                                       |
|  METHOD 1 (Smartphone USB/Wi-Fi Tethering + MAC Clone / Travel Router)|
|  Authenticate the hotel captive portal on a pocket Travel Router      |
|  (or Android Wi-Fi Share), then connect your work laptop to the       |
|  already-authenticated router Wi-Fi.                                  |
|                                                                       |
|  METHOD 2 (Built-In Mini Captive Portal Browser Inside VPN Client)    |
|  Click the Zscaler / GlobalProtect / AnyConnect tray icon ->          |
|  Click "Captive Portal Detected / Open Login Window".                 |
|                                                                       |
|  METHOD 3 (Gateway IP Direct Entry in Browser)                        |
|  Run `ipconfig` -> Find "Default Gateway" (e.g., 10.0.0.1) ->         |
|  Type `http://10.0.0.1` directly into Edge/Chrome address bar.        |
|                                                                       |
|  METHOD 4 (Authenticate on Phone First -> Call IT for Disable Code)   |
|  Tether laptop to Phone Cellular Data -> Get Zscaler/VPN Disable      |
|  Password from IT -> Pause VPN for 10 min -> Join Hotel Wi-Fi.        |
+-----------------------------------------------------------------------+
  1. Méthode 1 - Trick ya Pont Wi-Fi ya Smartphone to Routeur ya Voyage ya Poche (Esalaka 100 pour cent ya temps):
  2. Ordinateur portable na yo ya mosala ekoki koyeba bokeseni te kati na réseau Wi-Fi ya hôtel oyo ezali authentiqué te mpe routeur personnel oyo si ekoti na portail ya hôtel.
  3. Soki ozali na téléphone Android (Wi-Fi Sharing): Kangisa téléphone Android na yo na Wi-Fi ya hôtel, silisa login ya portail captive ya numéro ya chambre na écran ya téléphone na yo, sima fungola Mobile Hotspot ya téléphone na yo (ba téléphones Samsung Pixel/Android ya mikolo oyo esimbaka mbala moko Wi-Fi Repeater / Wi-Fi Sharing mode, ko diffuser Wi-Fi ya hôtel na yo na nzela ya téléphone na yo hotspot na ba données cellulaires zéro oyo basalelaka). Kangisa ordinateur portable na yo ya mosala na esika ya molunge ya telefone na yo: VPN ekangama mbala moko.
  4. Soki omemi Routeur ya Voyage ya Pocket (lokola GL.iNet Beryl/Slate; tala kosala na mosika na otɛlɛ moko): Sangisa routeur ya mobembo na Wi-Fi ya hôtel, silisa login ya hôtel na nzela ya navigateur ya smartphone na yo, mpe connecter ordinateur portable na yo ya mosala na port WPA3 Wi-Fi to Ethernet ya routeur ya mobembo na yo.
  5. Méthode 2 - Tyá IP ya Porte par défaut local directement na navigateur na yo (http://10.x.x.x):
  6. Mbala mingi, proxy DNS VPN Kill-Switch to Zscaler e détourner kaka bolukaki ya kombo ya domaine DNS (ko bloquer neverssl.com to mpe google.com), nzokande ezali kaka kopesa nzela na ba paquets IP ya sous-réseau local brut ekoma na porte ya routeur local na boumeli ya 60 secondes sima ya association Wi-Fi.
  7. Fungola Motindo ya komande (cmd.exe), type ipconfig, mpe tala adresse IP Default Gateway na nse Wireless LAN adapter Wi-Fi (na ndakisa, 172.16.0.1 to mpe 192.168.20.1).
  8. Fungola navigateur na yo mpe koma http://172.16.0.1 (kosalela http://, ata mokolo moko te https://, mpe mituya ya sikisiki uta na Porte na yo ya Liboso) mbala moko na barre ya adresse. Yango ebetaka contrôleur ya portail captif ya hôtel directement par IP sans besoin ya résolution DNS, ebimaka na écran ya login.
  9. Méthode 3 - Salelá bouton ya Zscaler / GlobalProtect / AnyConnect "Fungola Portal captive" to Bobandi lisusu ya Service:
  10. Na Connecteur ya Client Zscaler (ZCC): Fungola fenêtre ya Zscaler na plateau ya système, finá More -> ** Ezali ndenge moko na .Troubleshoot** -> ** Ezali ndenge moko na .Restart Service** (oyo esengaka mot de passe te mpe efungolaka fenêtre ya détection ya portail captive ya mokuse ya 30 secondes na tango ya re-initialisation).
  11. Na Palo Alto GlobalProtect: Finá na menu ya milɔngɔ misato na likoló na lobɔkɔ ya mobali ya esika oyo bakobima na saani ya GlobalProtect -> Settings -> ** Ezali ndenge moko na .General** -> soki état elobi "Captive Portal Detected," finá na bleu ** .Remediate** bouton mpo na kofungola mini-navigateur ya GlobalProtect oyo ezali na boîte de sable.

2. Kobongisa "Adaptateur VPN Zombie / Boucle DNS oyo ebukani (127.0.0.1 to mpe 100.64.0.1)" Nsima ya Crash moko."

Ezali boni soki ozali na ndako na Wi-Fi na yo ya momesano, mpe nsima ya pile ya ordinateur portable na yo ekufi to ekweyi tango ozali connecté na VPN ya entreprise, ordinateur portable na yo ebandi na zéro résolution DNS (ba sites internet elobi DNS_PROBE_FINISHED_NXDOMAIN, mpe okoki kutu te kosilisa kombo ya domaine ya serveur VPN ya entreprise mpo na ko reconnecter VPN)?

Yango esalemaka ntango client VPN ekweyi kozanga kozongisa na bopeto ba paramètres DNS ya carte Wi-Fi na yo, kotika adaptateur ya réseau na yo elakisama libela na IP ya tunnel virtuel oyo ekufá (100.64.0.1 mpo na Zscaler/Tailscale CGNAT to 127.0.0.1):

  1. Flush Cache ya DNS ya Windows mpe Catalogue ya Winsock (Esalaka Sans Droits ya Admin mpo na DNS Flush):
  2. Fungola Command Prompt mpe kosala ipconfig /flushdns.
  3. Kima mbangu nslookup vpn.yourcompany.com 8.8.8.8 (kozwa esika na yango vpn.yourcompany.com na kombo ya hôte ya porte VPN ya entreprise na yo). Na kobakisáká 8.8.8.8 kino na nsuka ya nslookup commande, o contourner résolveur local ya DNS local oyo ebukani ya ordinateur portable na yo mpe o requêter DNS public ya Google directement (soki port 53 ezali ouvert) mpo na koyekola adresse IP numérique brute ya porte VPN ya entreprise na yo.
  4. Kokangama na Porte ya VPN ya Société na kosalelaka Addresse IP na yango ya nimero brute:
  5. Soki Cisco AnyConnect to GlobalProtect elongi te na "Ekoki kosilisa adresse ya serveur te," ko coller adresse IP numérique brute (203.0.113.50) mbala moko na kati ya boîte ya serveur VPN (soki epesameli nzela na politiki) to benga IT mpo na kozwa Zscaler / VPN App-Profile Disable Password mpo na kozongisa adaptateur ya réseau virtuel (ncpa.cpl).

Scénarios 3: Kozonga sima na Écran bleu ya pilote ya noyau ya EDR (BSOD) Bobandi ya mosala

Na sanza ya nsambo 2024, mise à jour ya configuration ya chaîne oyo ezali ya mabe epusamaki na capteur CrowdStrike Falcon Windows (csagent.sys / Channel File 291) esalaki ete ba machines Windows ya entreprise 8,5 millions na mokili mobimba ekita na mbala moko PAGE_FAULT_IN_NONPAGED_AREA Blue Screen of Death bootloop avant système d'exploitation ekoki kutu ko connecter na internet pona ko télécharger fixation. Ba booloops ya ndenge moko esalemaka mbala na mbala tango SentinelOne (SentinelMonitor.sys), Mobateli ya Microsoft (WdFilter.sys), to Ba pilotes ya filtre VPN NDIS ekutani na mise à jour cumulative ya Windows.

Po pilote oyo azali ko crasher azali configuré lokola ** .BOOT_START (Start = 0) pilote ya noyau**, Windows e chargeaka yango na mémoire na tango ya seconde ya liboso mpenza ya démarrage - kala avant Wi-Fi to gestion ya cloud e initialiser. Nzela se moko ya kobongisa a BOOT_START bootloop ya pilote ya noyau ezali localement na nzela ya Environnement ya Récupération ya Windows (WinRE).

+-----------------------------------------------------------------------+
|  HOW TO BREAK AN EDR KERNEL DRIVER BSOD BOOTLOOP VIA WinRE            |
|                                                                       |
|  1. Force-interrupt boot 2-3 times (or hold Shift + Restart on        |
|     Recovery screen) until "Choose an option" blue menu appears.      |
|  2. Click Troubleshoot -> Advanced options -> Command Prompt          |
|     (or Startup Settings -> F4/F5 Safe Mode).                         |
|  3. Read the 8-character "Recovery Key ID" on screen to your IT       |
|     Helpdesk over the phone -> Type the 48-digit BitLocker Key.       |
|  4. In WinRE Command Prompt, locate the Windows partition (`C:` or    |
|     `D:`), delete the corrupted `.sys` channel file or rename the     |
|     faulty driver folder, and type `wpeutil reboot`.                  |
+-----------------------------------------------------------------------+

Etape na Etape Bozongisi ya WinRE ya esika (Etambwisami na Bureau na yo ya lisalisi ya IT na Telephone)

  1. Kokota na Environnement ya Récupération ya Windows (WinRE):
  2. Nsima ya ba démarrage mibale oyo elandani oyo elongi te, Windows 10 mpe Windows 11 elakisaka automatiquement écran bleu Recovery ("Emonani lokola Windows e chargeaki malamu te").
  3. Finá na ** .See advanced repair options** -> ** Ezali ndenge moko na .Troubleshoot** -> ** Ezali ndenge moko na .Advanced options** -> ** Ezali ndenge moko na .Command Prompt** (oyo ezali mbangu mpe esengaka ba reboots moke koleka Mode sûr).
  4. Kofungola Disque Chiffré Na Fungola Na Yo Ya Bozongisi BitLocker Ya 48 Chiffres:
  5. Lokola disque dur ya entreprise na yo ezali chiffré na BitLocker, WinRE eko lakisa mbala moko écran bleu oyo ekoloba: "Tia clé ya récupération ya disque oyo" elongo na ID ya clé (8 caractères hexadécimales, lokola A1B2C3D4).
  6. Benga IT Helpdesk ya compagnie na yo na smartphone na yo, tanga bango Nkombo ya hôte / Asset Tag ya ordinateur portable na yo mpe ID ya Clé BitLocker ya 8 caractères, mpe sala ete technicien atanga lisusu Clé de récupération numérique ya BitLocker ya 48 chiffres (ebongisami na ba blocs mwambe ya 6 chiffres). Tyá ba chiffres 48 na bokebi mpe finá Enter.
  7. Boyeba Lettre Nini ya Disque Esimbaka Installation Na Yo Ya Windows Na kati Ya WinRE:
  8. Na kati ya environnement ya récupération ya WinRE, mbala mingi disque Windows na yo ya monene epesamaka lettre ya disque D: to ** .E:** na esika ya C: (mpo partition EFI/Recovery ya moke oyo ebombami ezuaka C:).
  9. Type dir C:\Windows mpe kofina mikanda Enter. Soki elobi File Not Found, ya kokoma dir D:\Windows kino okokuta mokanda ya motuka oyo ezali na ya yo Windows dossier.
  10. Kosala bolongoli ya fichier ya chaîne oyo epesami ndingisa na motɛki to kobongola nkombo ya mokumbi motuka (Na malako ya IT):
  11. Mpo na mise à jour ya fichier ya chaîne ya CrowdStrike oyo ebebi: Kende na répertoire ya pilote ya CrowdStrike (cd /d C:\Windows\System32\drivers\CrowdStrike to mpe D:\Windows\System32\drivers\CrowdStrike), vérifier fichier ya chaîne oyo ebebi oyo elakisaki na équipe na yo ya IT (na ndakisa, del C-00000291*.sys), mpe finá Enter. Po chaîne .sys ba fichiers ezali ba mises à jour ya mibeko dynamique au lieu ya noyau csagent.sys moteur, ko supprimer fichier ya chaîne oyo ebebi epesaka Windows na capteur Falcon nzela ya ko démarrer propre mpe ko télécharger fichier ya chaîne fixe na cloud.
  12. Mpo na VPN ya Troisième Partie Corrompu to Driver ya Filtre ya Sécurité: Na instruction ya administrateur IT na yo, changer kombo ya crash spécifique .sys mokumbi motuka (ren C:\Windows\System32\drivers\<FaultyDriver>.sys <FaultyDriver>.sys.bak) to ko désactiver valeur ya début ya service na yango na registre hors ligne (reg load HKLM\OfflineSystem C:\Windows\System32\Config\SYSTEM), na nsima komá ** .wpeutil reboot** mpo na kobanda lisusu na Windows normalement.

Warning

Mpo na nini osengeli ata moke te kokabola fungola na yo ya bozongisi ya BitLocker ya 48 chiffres na nzela ya chat to email oyo e vérifié te. Soki IT Helpdesk na yo epesi Fungola na yo ya bozongisi ya BitLocker ya 48 chiffres na nzela ya telefone mpo na kobongisa démarrage, kokoma yango ata moke te na mokanda ya kokangama oyo ekangami na ordinateur portable to kobomba yango na projet ya email oyo ezali na chiffrement te. Moto nyonso oyo azali na fungola wana ya 48 chiffres akoki ko déchiffrer disque dur ya entreprise na yo mobimba hors ligne. Simbá ete ba environnements ya entreprise oyo etambwisami malamu (Microsoft Intune / Entra ID / MBAM) automatiquement ebalukaka (ezongisaka) clé ya sika ya récupération ya BitLocker na fond noki soki ordinateur portable na yo ebandi lisusu na Windows mpe e connecter na réseau ya entreprise.

Mituya ya mbalakaka ya etuka mpe ba protocoles ya agence

Atako quarantaine ya ordinateur portable ya mosali moko ya mosika ezalaka mbala mingi conflit ya lokuta ya isolé to captive-portal, lockout ya mbalakaka ya EDR to mbonge ya BSOD na mbala moko na kati ya baninga ya mosala ebele ekoki kopesa signal soit panne ya motekisi ya mokili mobimba to incident ya ransomware ya entreprise oyo ezali kosala:

  • Etats-Unis mpe Canada: Soki quarantaine ya EDR to bootloop ya bato ebele esali impact na **ba centres ya dispatch 911, ba postes ya travail clinique ya lopitalo, ba salles ya urgence, to infrastructure ya aviation/transit, activer mbala moko Continuité des opérations (COOP) / Protocoles ya papier ya temps d’arrêt ya esika mpe benga 911 mpo na ba urgences ya sécurité ya vie. Lakisa makambo ya cyber ya ba infrastructures critiques oyo epalangani mingi na CISA (Agence ya cybersécurité et sécurité infrastructure) na 1-844-SAY-CISA (1-844-729-2472 to mpe cisa.gov/report) mpe Centre canadien ya sécurité cybernétique na 1-833-CYBER-88.
  • Royaume-Uni: Benga 999 mpo na makambo ya mbalakaka ya bokengi ya bomoi. Ba incidents ya cyber ya entreprise mpe ba événements ya confinement ya ransomware oyo etali ba organisations ya Royaume-Uni esengeli koyebisa na Centre national de sécurité cybernétique (NCSC) via ncsc.gov.uk.
  • Union européenne: Benga 112 pona ba services ya urgence. Na se ya Directive NIS2 ya UE (Directive (UE) 2022/2555) mpe Article 33 ya GDPR, ba entités ya secteur critique esengeli koyebisa ba perturbations ya misala ya minene to makambo ya bokengi na CSIRT (Equipe ya réponse ya ba incidents ya sécurité informatique) mpe ENISA ya ekolo na bango.
  • Australie mpe Nouvelle-Zélande: Benga 000 na Australie to 111 na Nouvelle-Zélande mpo na misala ya mbalakaka. Koyebisa makambo ya bokangami to ya kozwa mbongo na cybersécurité ya entreprise na Centre ya cyber sécurité australienne (ASD ACSC) ya Direction ya ba signaux ya Australie** na 1300 CYBER1 (1300 292 371) to CERT NZ / NCSC NZ.
  • India mpe Asie-Pacifique: Benga 112 na Inde (mpe koyebisa makambo ya cyber ya ebongiseli na CERT-In), 119 na Japon mpe Corée du Sud, to 995 na Singapour (SingCERT). Mpo na mituya ya mbalakaka ya mokili mobimba, talá banimero ya mbalakaka.

Tip

Mema "$30 Pocket Travel Router" mpe Smartphone USB Tethering Cable na Your Laptop Bag: Défense moko ya malamu koleka contre ba entreprises Always-On VPN captive-portal lockouts tango ozali kosala mobembo ezali routeur ya voyage ya taille ya poche (lokola routeur GL.iNet) couplé na câble ya ba données USB-C mpo na smartphone na yo. Lokola ozali ko authentiquer Wi-Fi ya hôtel to ya avion na écran ya smartphone na yo na nzela ya routeur ya voyage, agent Zscaler to AnyConnect ya ordinateur portable na yo ya entreprise amonaka kaka jamais réseau WPA3 ya propre, privé, pré-authentiqué mpe jamais e déclenchaka kill-switch na yango ya captive-portal.

Mituna oyo batunaka mingi

Pourquoi CrowdStrike Falcon to SentinelOne ba quarantine ordinateur portable na ngai ya musala tango nazalaki kosala eloko ya mabe te?

Ba agents modernes ya Détection et Réponse d’Endpoint (EDR) e scanner kaka te pona ba signature ya virus oyo eyebani; balandaka bizaleli ya mosala na tango ya solo, injection ya mémoire, mpe ba arguments ya ligne ya commande na nzela ya heuristics ya comportement (`IOAs` - Ba indicateurs ya Attaque). Misala ya mibeko oyo emonanaka mingi oyo mbala mingi e triplaka Contention ya Réseau EDR automatique ezali na ba développeurs logiciels oyo bazali kosala ba scripts ya botongi ya mboka oyo ezali na signature te to ba débogateurs, basali ya IT oyo bazali kosala `nmap` to ba commandes ya découverte ya réseau ya PowerShell, ko brancher clavier macro ya style caoutchouc-ducky USB oyo epesami ndingisa te, to ko connecter na routeur Wi-Fi ya hôtel oyo e configurer mabe oyo e déclenchaka mibeko ya défense ya ARP-spoofing / Man-in-the-Middle. Kobenga SOC na yo mbala moko epesaka nzela na analyste atala nzete ya processus mpe asala liste blanche ya activité na yo na ba minutes.

Soki ordinateur portable na ngai ezali na Contention ya Réseau EDR, équipe na ngai ya IT ekoki kaka komona écran na ngai to ko déquarantine ngai na distance?

Oui, soki ordinateur portable na yo ezali kaka connecté na réseau Wi-Fi oyo ezali kosala (lokola routeur na yo ya ndako to hotspot cellulaire ya smartphone na yo). Tango CrowdStrike Falcon, SentinelOne, to Microsoft Defender for Endpoint etie ordinateur portable na Network Containment, pilote ya filtre ya noyau ekangaka trafic nionso ya usager normal tout en gardant explicitement tunnel de gestion TLS chiffré dédié ouvert entre capteur EDR ya ordinateur portable na console ya cloud. Na nzela ya tunnel wana ya gestion, analyste na yo ya SOC akoki kofungola coquille ya diagnostic à distance (`Real Time Response` na CrowdStrike to `Live Response` na Defender) mpe finá "Lift Containment" mpo na kozongisa accès na yo ya réseau na 30 secondes sans que ozala na besoin ya ko type eloko.

Pourquoi ordinateur portable na ngai ya mosala esengaki na mbalakaka Clé de récupération ya BitLocker ya 48 chiffres tango na brancher yango na monitore ya hôtel to na station de docking USB-C?

Ba ordinateurs portables ya Enterprise Windows esalelaka puce **Trusted Platform Module (TPM 2.0)** ya carte mère mpo na komeka matériel ya sikisiki mpe configuration ya liboso ya démarrage (**Platform Configuration Registers `PCR 0, 2, 4, 7, 11`**) mbala nyonso oyo ozali kofina bouton ya nguya. Soki o brancher dock ya nkake, lecteur USB ya libanda, to hub ya monitor oyo ebongoli ordre ya démarrage ya UEFI to layout ya bus PCIe DMA avant Windows e démarrer, TPM e détecter changement ya mesure matériel mpe eboyi kobimisa clé ya déchiffrement automatiquement, ekosenga Clé ya Récupération ya BitLocker ya 48 chiffres na yo lokola protection ya prévention ya moyibi. Ya liboso, **longola ba accessoires USB nionso, ba docks, mpe ba câbles HDMI mpe rebooter ordinateur portable yango moko** - 90 pour cent ya temps, mesure ya TPM ekokani lisusu mpe ordinateur portable eko démarrer mbala moko na Windows sans besoin ya touche ya 48 chiffres.

Nakoki kopekisa Zscaler Client Connector, Cisco AnyConnect, to GlobalProtect ngai moko na kosalelaka Windows Task Manager?

Te, na ordinatɛrɛ ya moke ya kompanyi oyo ebongisami malamu, okoki koboma te `ZSATray.exe`, . `CSFalconService.exe`, . `vpnagent.exe`, to `PanGPS.exe` uta na Mokambi ya misala. Ba agents oyo ya sécurité ezo tambola lokola **Windows Protected Processes (`Protected Process Light / PPL` / . `ELAM` Ba services anti-Malware)** oyo ezali ya `SYSTEM` na ba chauffeurs ya komibatela ya noyau; ata soki mosaleli azali na ba privilèges ya administrateur local, Windows ewanganaka `Access Denied` tango ozali koluka kosilisa service ya sécurité PPL sans cryptographique **Tamper Protection / App-Profile Disable Password** oyo esalemi na console ya cloud ya entreprise.

Ezali boni soki nazali kosala na fuseau horaire mosusu mpe IT Helpdesk ya kompanyi na ngai ezali kolala ntango ordinatɛrɛ na ngai ya moke ekangami?

Ya liboso, tala soki ebongiseli na yo ezali na **Centre d’opérations de sécurité 24/7 (SOC) to Line ya téléphone ya ba incidents minene na appel** oyo ekabwani na Bureau d’Aide ya IT ya mokolo oyo esalemaka mingi (ba entreprises mingi oyo esalelaka contrat ya CrowdStrike to SentinelOne na contrat ya Détection mpe Réponse 24/7 Managed [`MDR`] ekipi to kobatela nimero ya escalation ya PagerDuty sima ya ngonga oyo etangami na intranet ya mosali na yo to na lokasa ya onboarding). Ya mibale, soki lockout na yo ezali **BitLocker Recovery Key écran**, tala soki okoki kokota na portail ya entreprise na yo **Microsoft 365 / Entra ID "My Account" (`myaccount.microsoft.com/device-list`)** uta na navigateur ya smartphone na yo na kosalelaka appli na yo ya authenticateur MFA - ba entreprises mingi epesaka nzela na basali kotala 48 chiffres ya ordinateur portable na bango moko ya 48 chiffres ya BitLocker recovery key self-service na nzela ya téléphone portable na bango.

Mpo na nini Wi-Fi na ngai ya ndako etiki kosala na ordinateur portable na ngai ya mosala mbala moko nsima ya kokata boyokani na VPN ya kompanyi?

Ba configurations mosusu ya VPN ya entreprise esalelaka fonctionnalité oyo babengi **"Always-On Quarantine / Trusted Network Detection (TND)"** oyo ekangaka na nko accès internet nionso tango nionso tunnel ya VPN ekangami tango ezali libanda ya immeuble physique ya bureau ya entreprise, na tina ya kopekisa exfiltration ya ba données na tunnel split. Na makambo mosusu, kokata boyokani ya VPN etikaka adresse ya serveur DNS virtuel ya kala (`10.x.x.x`) caché na adaptateur Wi-Fi na yo mpo routeur na yo ya ndako ekoki ko résoudre ba adresses web te. Bobele **kozongela boyokani na VPN ya kompanyi** (to kotambola `ipconfig /flushdns` mpe kobongola Wi-Fi Off mpe On) mpo ete mobembo na yo ekende pɛto na nzela ya porte ya kompanyi oyo epesami ndingisa.

Ba guides oyo etali yango

Maziba mpe bokambi ya Leta

  • CISA (Agence ya sécurité cybersécurité mpe ya sécurité ya infrastructure): Kobongisa ba panne ya capteur ya noyau ya détection mpe réponse ya point final (EDR) mpe ba procédures ya récupération ya BitLocker na échelle.
  • Microsoft Corporation (Microsoft Learn): Buku ya bozongisi ya BitLocker: Kosilisa mikakatano ya ba blocages ya validation ya TPM PCR mpe kosalela WinRE Command Prompt mpo na kobongisa ba pilotes ya démarrage critique mpe Microsoft Defender mpo na Architecture ya isolement ya Machine ya Endpoint.
  • NIST (Institut national ya ba normes mpe technologie): Publiation spéciale ya NIST 800-207: Architecture ya confiance zéro (ZTA) mpe NIST SP 800-83 Rev. 1: Guide ya prévention mpe traitement ya ba incidents ya ba malware mpo na ba bureaux mpe ba ordinateurs portables.
  • CrowdStrike, Inc. & SentinelOne: Architecture ya bokangami ya réseau ya capteur falcon, ba procédures ya déchargement ya jeton ya entretien, mpe mikanda ya récupération ya fichier ya chaîne.
  • Zscaler & Cisco Systems: Kosimba détection ya portail captif na accès ya réseau ya confiance zéro toujours-on (ZTNA) mpe ba politiques ya mur ya feu ya makasi oyo ekangami na panne.