Physical Device Tampering ('Evil Maid' Attack): Isina Kutariswa Laptop Inspection uye DMA Kuomeswa¶

Kudzokera kukamuri yehotera, nzvimbo yepanhandare yetsika yechipiri yekuongorora, imba yekutandarira yevatauri, kana dhesiki rekugovana rekushanda kuti uwane kuti laptop yako, smartphone, kana cryptocurrency hardware wallet yakabatwa, yakafambiswa, yamutswa kubva kuhope, kana kuvhurwa uchiri kure nemeso ako chiitiko chepamusoro chekuchengetedzwa kwemuviri chinozivikanwa mu cryptography uye counter-intelligence se klzzwxh:0013 A classic software firell kana antivirus chirongwa chinofungidzira kuti anorwisa ari kune rumwe rutivi rwe internet; Evil Maid anorwisa ane maoko-pamaoko ekuwana kune yako hardware ** kwemaminetsi maviri kusvikmakumi matatu iwe usipo pakudya kwemangwanani, mumusangano, kana kuvharirwa mukamuri yekuongorora. Zvichienderana nekunyanya kurongeka kweanorwisa, masekonzi makumi mapfumbamwe ekuwana kwemuviri anokwana kuvhara BadUSB keystroke-jekiseni rabhaucky** kana PCIe/Thunderbolt Direct Memory Access (DMA) mudziyo wekurara mulaptop yakarara, cheka $15 CH341A SPI flash programmer paBIOS chip chemotherboard kana kuhwihwidza zvisina kunyorwa. LPC/SPI TPM bhazi, chinjai USB-C yako yekuchaja tambo yewireless keylogger implant tambo (O.MG Cable), kana kutsiva zvisina kunyorwa /boot chikamu (initramfs) saka inotora yako yakazara-dhisiki encryption passphrase nguva inotevera paunoinyora. Nezve USB yekuchaja kiosk kurwiswa munhandare dzendege, bvunza yeruzhinji yekuchaja kiosk data blockers uye BadUSB HID jekiseni; kana BitLocker yako, FileVault, kana LUKS drive yakangoerekana yakurudzira kiyi yekudzoreredza pabhutsu mushure mekunge mumwe munhu abata laptop yako, ona. BitLocker, FileVault, uye LUKS encryption kudzoreredza kiyi yekuvhara uye TPM reset; uye kana mudziyo wako wakatorwa zvachose, chinja kune yakabiwa laptop kana foni kuretu pukuta uye kukiya account. Kana uri munjodzi yepanyama pakarepo kana kuti wakatarisana nekuvharirwa zvisiri pamutemo, fonera nhamba yako ye emergency emergency (911 muUnited States neCanada, 112 muEuropean Union, 999 muUnited Kingdom) kana bvunza dhairekitori redu repasi rese nhamba dze emergency.

Ita izvi ikozvino¶

1. ** USAnyora yako Yakazara-Disk Encryption (BitLocker / LUKS / FileVault) passphrase, OS login password, kana Master Password mune yekufungidzira laptop kana ikangoerekana yakumbira password kana kiyi yekudzoreredza mushure mekusiiwa isina kutarisirwa **:
2. Iyo yekirasi Evil Maid kurwisa inotsiva iyo isina kunyorwa bootloader kana initramfs mufananidzo uri palaptop usina Measured Boot / Chengetedza Boot enforcement (kana plugs inoonekera USB keylogger dongle pakati pekibhodhi / dock uye laptop) kuitira kuti nguva inotevera yaunonyora yako. LUKS kana BitLocker passphrase, iyo trojanized bootloader inorekodha yako plaintext passphrase uye inoitumira kana kuiviga pa diski.
3. Usati wabata kiibhodhi, ita 60-yechipiri ongororo yekunze yezvese zviteshi, tambo, uye chesi screws pasi penharembozha yako yeLED tochi:
4. Bvisa uye ongorora USB-C yese, USB-A, HDMI, Ethernet, uye tambo yemagetsi yakabairwa mulaptop kana kugara padhesiki repahotera yako. Vapambi vanowanzo chinjanisa chena yemunhu akabatwa chena Apple kana nhema USB-C yekuchaja tambo kuti iite yakafanana O.MG Cable / USB Ninja tambo (iyo ine yakavanzika yeWi-Fi yekupinda nzvimbo uye microcontroller yakavanzwa mukati me USB-C yekubatanidza shell iyo inobaya makiyi uye matanda traffic).
5. Batidza laptop utarise masiruuru evhavha yepasi netsoka dzerabha: Tsvaka mabhururu esimbi matsva pa P5 Pentalobe, Torx T5, kana Phillips screw heads, kushaikwa screw-hole tamper seals, kana musono wepakona wepazasi usingagare nekuti chassis yakavhurwa nekukasira kuti ibatanidze mukati SPI flash clip kana M.2 PCIe kudyara.
6. ** Tarisa uone kana laptop yako yakasiiwa mu "Kurara / Standby (S3 / S0ix Yemazuvano Standby)" vs. "Yakakwana Powered Off (S5 / Hibernated S4)" pasina anotarisira**:
7. ** Kana Laptop yako yaingove Yakarara (Lid Yakavharwa)** apo anorwisa paakaiwana: Yako **Full-Disk Encryption (BitLocker, FileVault, LUKS) master volume encryption kiyi (VMK) yakanga yakagara yakadhirobhewa mumavara akajeka mukati melaptop yako isingachinji DRAM memory chips nguva yese **. Anorwisa ane Thunderbolt/USB4 DMA mudziyo (pane ekare asina kurongeka masisitimu), inotonhora-bhutsu RAM kumisa kurwisa, kana inozivikanwa yekuvhara-screen bypass inogona kuverenga inoshanda memory usingazive password yako.
8. ** Kana iwe uchifungidzira kuti laptop yakarara yakakanganiswa **: Bata iyo yemuviri ** Bhatani reSimba pasi kwemasekonzi gumi akazara ** kumanikidza simba-kudzima ipapo ipapo (kuchenesa makiyi eDRAM) pane kuvhura chivharo nekupinda mukati.
9. ** Boot kubva kune inozivikanwa-yakachena, yekuverenga-chete yekunze Live USB (Ubuntu Live / Tails / SystemRescue inochengetwa pamunhu wako nguva dzese) kuti utarise iyo yemukati drive haina kunyorwa /boot uye EFI System Partition (ESP) hashe**:
10. Kana iwe uchimhanyisa Linux ne LUKS kana Windows ne BitLocker, kubhota kubva kutsvimbo yekunze ye USB yakachena pamushini wakasiyana kana wakasimbiswa kunoita kuti utore faira rese mukati /boot/efi/ (ESP) uye /boot/initramfs-* (sha256sum) uye tarisa kana zvikamu zvekugadzirisa nguva (stat) yakashandurwa panguva chaiyo yemaawa maviri efafitera yawanga wabuda mukamuri rako rehotera.
11. ** Ongorora OS Chiitiko Logs (Windows Event Viewer, macOS unified log, Linux journalctl) kubva munzvimbo yakachengeteka yekuverenga-chete kuti uone kana chivharo chakavhurwa, mudziyo we USB wakaiswa, kana muchina wakatangwa patsva iwe waenda **:
12. Yese yemazuva ano inoshanda sisitimu inorekodha isingachinjike hardware timestamp pasi kusvika kumillisecond pese panovhurwa ACPI Lid Switch, sisitimu inomuka kubva kuhope (Kernel-Power Event ID 42 / 107 paWindows, Wake reason: EC.LidOpen pa macOS), kana USB itsva VID:PID mudziyo wakanyorwa mubhazi.
13. ** Kana iwe uri munhu ane njodzi yakanyanya (mutori wenhau, mugadziri wezvidziviriro, mukuru, gweta rekodzero dzevanhu, kana crypto treasury signer) uye wowana humbowo hwakaoma hwekuvhurwa kwechasi yemuviri, BitLocker/TPM PCR isingatarisirwe kusetwa, kana zviitiko zvekumuka zvisina mvumo uchiri kunze kwako, bata Hardware seyakapiswa (Quarantine Device)**:
14. Usabatanidza iyo inofungidzira laptop kune yako yekambani VPN kana imba Wi-Fi. Shandisa yakaparadzana, yakachena smartphone (yakagara muhomwe yako) kutenderedza zvitupa zvako, kudzora masesheni anoshanda (session kubirwa kwekuki uye kubviswa kwepasskey), uye kuendesa mari kana zvakavanzika uchishandisa hardware yakachena.

Muti wesarudzo: kuongorora laptop isina kutarisirwa kana mudziyo mushure mekufungidzirwa kuwana kwemuviri¶

Tevedza mafambiro ebasa kuti uone kana mudziyo wako usina kutariswa wakawanikwa kana kugadziridzwa uye kuti ndeipi nhanho yekugadzirisa inodiwa:

flowchart TD
    Start["Laptop, Runhare, kana Hardware Wallet Yakasiiwa isina kutarisirwa muHotera Kamuri, Border Inspection, kana Coworking Space."] --> StateCheck{"Ndeipi Simba State Yaive Laptop Uchiri kunze Kwezvako?"}

    StateCheck -->|"Kurara / Kumira (Chivharo Chakavharwa, RAM Inowanikwa) KANA Yakavhurwa"| HighRiskState["NJODZI YAKURU: Disk Encryption Keys & Session Cookies Aigara mu RAM (Inobatwa neBadUSB, Lock-Screen Bypass, kana DMA/RAM Kubvisa)"]

    StateCheck -->|"Yakakwana Powered Off (Cold S5 Shutdown)"| ColdState["KUDZIDZA RAM RISK: Makiyi Aive Asi mu RAM, saka Attacker Anofanirwa Kuchinja Bootloader (/ boot / EFI), Flash SPI BIOS, kana Plant Hardware Keylogger."]

    HighRiskState --> PhysCheck["STEP 1: Ongorora Zvekunze Zvikurukuru, Pazasi Seam, USB Ports, uye Matambo ekuchaja Pasi Perachi Rakajeka (Usashandisezve Matambo Asina Kutariswa)"]
    ColdState --> PhysCheck

    PhysCheck --> BootBehavior{"Chii Chinoitika Kana Iwe Ukaongorora Boot Kutendeseka / TPM Zviyero?"}

    BootBehavior -->|"BitLocker / TPM Pakarepo Inoda 48-Digit Yekudzoreredza Kiyi KANA Chengetedza Boot Shows Yakaremara / Yakachinjwa"| BootTamper["Yakasimbiswa BOOT PATH ALTERATION: TPM PCRs (0, 2, 4, 7) Yakawanikwa Yakagadziriswa BIOS Firmware, Option ROM, kana EFI Bootloader."]

    BootBehavior -->|"Bhutsu Kazhinji (Kana Kuongororwa Kuverenga-Chete kuburikidza Nekunze Live USB)"| LogCheck["STEP 2: Ongorora ACPI Lid-Vhura / Wake Logs & USB Yekubatanidza Nhoroondo Panguva Yako Kusipo Hwindo"]

    LogCheck -->|"Logs Ratidza Chivharo Chakavhurwa, USB Chishandiso Yakavharirwa mukati, kana Unexplained Reboot Paunenge Waenda"| ConfirmedTouch["AKASIMBA KUSVIKA KWEMUNHU USINA MBERI"]
    LogCheck -->|"Zero Wake Zviitiko, Zero Reboot Gaps, Intact Screw Seals & Yakasimbiswa / boot Hashes"| CleanPass["Hapana Humbowo hweEmagetsi Wake kana Bhutsu Kugadziriswa -> Simbisa BIOS Password + Kernel DMA Dziviriro + Yakazara Shutdown Policy"]

    BootTamper --> BurnDevice["USAITAI MAPASWEDI PAMUCHINA UYU: Quarantine Hardware, Bvisa Yese Cloud Sessions/SSH Makiyi kubva Kuchena Runhare, uye Mufananidzo Dhivha Forensically."]
    ConfirmedTouch --> BurnDevice

Iwo mashanu ehunyanzvi Vectors e "Evil Maid" Attack¶

Kuti uzive kuti ndezvipi zvinongedzo zvekutsvaga, nzwisisa nzira shanu chaidzo dzinoshandiswa panguva yemaoko-pakurwisa malaptops uye hardware wallet:

Chikamu chekutanga: Kuongororwa kweForensic kweMusikirwo Asina Kutariswa Laptop (Asati Apinda)¶

Kana iwe ukadzokera kukamuri yako yehotera kana kugamuchira laptop yako kumashure mushure mekutarisa muganho uye uchida kuziva kana paine munhu akavhura, akamuka, kana kubaya mudziyo mukati mauri iwe usipo, ita izvi cheki kuitira:

1. Danho 1: Physical Port, Cable, uye Chassis Screw Audit¶

1. ** Chengetedza Chero MaCable Anga Asiiwa Kuseri Mukamuri **:
2. An O.MG Cable kana USB Ninja inotaridzika zana muzana isingazivikanwe kubva kune chaiyo Apple USB-C tambo yakarukwa, Anker tambo, kana Dell USB-C adapta, kudzika kusvika kune laser-etched serial manhamba pane yekubatanidza ruoko.
3. Kana iwe wakasiya tambo ye-USB-C, chidhinha chemagetsi, kana USB hub isina kutarisirwa munzvimbo ine njodzi huru, ** rega kubaya mitsara yayo yedata mulaptop yako *; kana kuchitsiva netambo inozivikanwa-yakanaka kubva mubhegi rako rakavharwa kana isa simba-chete USB data blocker (USB kondomu) munhevedzano nayo.
4. **Ongorora Yepazasi Chivharo Screws & Seam Pasi Raking Tochi Chiedza **:
5. Bata tochi yako ye smartphone pane isina kudzika ** 15-degree angle ("raking light")** pamusoro wega wega screw pazasi pelaptop yako.
6. Masiruuru efekitari akapiswa kamwe chete pachirimwa chegungano ane akachena, yunifomu anodized coating mukati menyeredzi/pamuchinjikwa. Siruuru isina kusirurwa muimba yehotera ine simbi inotaridza mikwerwa yesimbi yesirivha inopenya mukati mesiruu recess, huruva yeblue/red threadlocker yavhiringika, kana kurongeka zvishoma kweplate rearuminiyamu nechekumashure.

2. Danho 2: Kutarisa OS Wake, Lid-Open, uye Reboot Logs (Ko Laptop Yakatendeuka Pawakanga Waenda?)¶

Ziva iyo chaiyo nguva hwindo rawanga usiri palaptop (semuenzaniso, 12:15 PM to 01:45 PM). Kunyangwe munhu anorwisa achirova Live USB tsvimbo, ** gap risingatarisirwe kana kutonhora bhutsu mune yako OS uptime, kana ACPI Lid-Open chiitiko pahwindo iro, inoratidza kuti laptop yakashandiswa panyama **:

Pa macOS (MacBook Air / MacBook Pro):¶

Vhura ** Terminal ** uye mhanya uyu murairo kuratidza yega yega ** Chivharo Vhura, Chivharo Chekuvhara, Wake, Kurara, uye Simba-On / Shutdown ** chiitiko chehardware kubva kuSystem Management Controller (SMC / PMU) mumaawa makumi maviri nemana apfuura:

pmset -g log | grep -E "Wake|Sleep|LidOpen|LidClose|Start|Shutdown|DarkWake" | tail -n 60

log show --predicate 'eventMessage contains "USB" or process == "kernel"' --last 4h | grep -iE "usb|appleusb|hid"

PaLinux (Ubuntu, Fedora, Debian, Arch, RHEL):¶

1. Check systemd-journald kune chero zviitiko zvebhoti / kuvhara kana chivharo / shanduko yekurara panguva yekusavapo kwako:

   journalctl --list-boots -n 10
   journalctl --since "4 hours ago" | grep -iE "lid|suspend|wake|usb|new high-speed|hid-generic|thunderbolt|pcie"
   

2. **Simbisa kuti hauna kunyorwa /boot uye /boot/efi partitions haina kuchinjwa apo muchina wakadzimwa **: Tarisai chaizvo Modify uye Change (ctime) inode timestamps yeese kernel mufananidzo, initramfs,uye GRUB EFI binary mukati /boot:

   find /boot -type f -exec stat -c "%y %z %n" {} + | sort
   

   *(Kana paine faira mukati /boot kana /boot/efi ane a Change kana Modify timestamp pawakanga wabuda mukamuri, kana kubva yako yekupedzisira apt/dnf kernel update, ** bootloader yako yakakanganiswa *.)

PaWindows 10/11:¶

Vhura iyo ** Administrator PowerShell** hwindo uye bvunza iyo System Chiitiko Log kune yega ** Simba-On (ID 12), Kuvhara (ID 13), Kurara (ID 42), Muka kubva kuhope (ID 1 / ID 107), uye Kurasika Kwesimba Kusingatarisirwi (ID 41)** mumaawa makumi maviri nemana apfuura:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=@(1, 12, 13, 41, 42, 107); StartTime=(Get-Date).AddHours(-24)} | Select-Object TimeCreated, Id, ProviderName, Message | Format-Table -AutoSize -Wrap

Get-WinEvent -LogName "Microsoft-Windows-DriverFrameworks-UserMode/Operational" -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-12) } | Select-Object TimeCreated, Id, Message

Chikamu chechipiri: Nei Apple Silicon Macs & Yemazuva ano TPM 2.0 + PIN Masisitimu Akaomesesa kune "Akaipa Maid" (Uye Magadzirirwo Awo Zvakanaka)¶

Haasi ese malaptops ari munjodzi yakaenzana yekutambwa kwemuviri. Heano maitiro emazuva ano midzi yekuvimba anoshanda uye iwo chaiwo marongero aunofanirwa kugonesa:

1. Apple Silicon MacBooks (M1, M2, M3, M4)¶

Apple Silicon Macs ndeimwe yeakanyanya Evil-Maid-resistant malaptops akambovakwa apo ** yakadzimwa (S5) ** uye yakagadziridzwa ne ** FileVault + Firmware / Recovery Chengetedzo : - Iyo bhutsu ROM yakasungirirwa musilicon isingachinjiki mukati meM-Series SoC (Hardware Root of Trust) Yese nhanho yebhoti ketani (iBoot -> macOS Kernel -> Cryptographically Signed System Vhoriyamu SSV) inosimbiswa neApple's hardware kiyi isati yaurayiwa. - Chengetedza NAND machipisi hardware-yakavharidzirwa ne ** Yakachengeteka Enclave (AES-XTS) uchishandisa makiyi akasungirirwa kune yako FileVault password ine hardware anti-hammering rate miganho. - **Maseting matatu ekusungirwa aunofanirwa kuona paMacBook yako izvozvi **: 1. ** FileVault IRI PAKA **: ** System Settings > Yakavanzika & Chengetedzo > FileVault -> ON **. 2. ** Dzima Auto-Login & Unoda Pasiwedhi Pakarepo Pakurara **: **System Settings > Kiya Screen -> Inoda password mushure mekunge skrini saver yatanga kana kuratidza kwakadzimwa -> Pakarepo **. 3. **Vhairira Zvisina Kutenderwa USB / Thunderbolt Zvishandiso Kana Yakakiyiwa **: Enda ku **System Settings > Yakavanzika & Chengetedzo > Bvumira zvishongedzo kuti zvibatanidze ** uye zviise ku "Bvunza Zvitsva Zvishandiso" kana "Bvunza Nguva Yese" (usambo "Otomatiki Kana Wakiyiwa" kana "Nguva Dzose"). Kana yaiswa ku "Bvunza Nguva Yese", plugging a BadUSB keystroke injector kana Thunderbolt DMA chishandiso muMacBook yakakiiwa inodonhedza chiteshi musimba-chete modhi uye inovhara ese PCIe/USB data enumeration padanho rekutonga hardware.

2. Windows 10 / 11 Pro & Enterprise (BitLocker + Pre-Boot TPM PIN + Kernel DMA Protection)¶

By default pa99 muzana yeWindows laptops (Dell, Lenovo, HP, Surface), BitLocker inogadziriswa mukati "TPM-Only" (Transparent Operation) modhi: - Paunodzvanya bhatani remagetsi pane a TPM-Only BitLocker laptop, iyo mabhutsu elaptop akananga kuWindows Lock Screen pasina kukukumbira BitLocker PIN, zvichireva kuti TPM chip yakadzima kiyi yedhiraivha.VMK) uye yakarodha Windows OS mu RAM. - Pane chero laptop inoshandisa ** discrete TPM chip ** yakabatana neCPU kuburikidza neyaamai SPI kana LPC bhazi, munhu anorwisa anovhura chivharo chepasi obva atora $50 logic analyzer paTPM chip's. MOSI/MISO pini ** inoverenga yako yakajeka BitLocker Vhoriyamu Master Key (VMK) kubva pawaya mumasekonzi mashanu (BitPixie / TPM-Sniffing)** usingazive password yako yeWindows. - Kubhowa nzira yese kuenda kuWindows login screen zvakare inofumura iyo Windows kernel, Wi-Fi stack, uye PCIe bhazi risingatarisirwe.

Maitiro ekugonesa Inosungirwa BitLocker Pre-Boot Kutanga PIN (TPM + PIN) paWindows muMaminitsi maviri:¶

Kuwedzera ** Pre-Boot BitLocker PIN ** inomanikidza hardware TPM 2.0 chip kuchengetedza dhisiki encryption kiyi yakakiyiwa mukati meiyo tamper-resistant silicon kudzamara wanyora yako 6-to-20-character pre-boot PIN pane nhema BIOS/BitLocker skrini: 1. Press Win + R, type gpedit.msc, wodzvanya Enter (paWindows 10/11 Pro, Enterprise, kana Dzidzo). 2. Enda ku: ** Kugadzirisa Komputa> Administrative Matemplate> Windows Zvikamu> BitLocker Drive Encryption> Operating System Drives**. 3. Tinya kaviri "Inoda humwe huchokwadi hwekuwedzera pakutanga", isa ku Yakagoneswa, uye isa Gadzirisa TPM yekutanga PIN: ku Require startup PIN with TPM. 4. Vhura ** Administrator Command Prompt ** kana PowerShell uye isa yako itsva pre-boot BitLocker PIN (kubvumidza alphanumeric passphrases, zvakare gonesa "Bvumira maPIN akakwidziridzwa ekutanga" mune imwecheteyo Group Policy folda):

manage-bde -protectors -add C: -TPMAndPIN

3. Linux (LUKS2 + Secure Boot + Unified Kernel Images (UKI) + BIOS Password)¶

PaLinux laptops (Ubuntu, Fedora, Debian, Arch, Qubes OS), mwero LUKS full-disk encryption yatoda kuti unyore pre-boot passphrase drive isati yavhurwa, iyo inomisa passive TPM bhazi kunhuhwidza . Nekudaro, yakajairwa Linux inoisa siya /boot (initramfs uye vmlinuz) isina kunyorwa, ichiita kuti vave panjodzi kune yekare ** maminitsi maviri USB Evil Maid /boot replacement kunze kwekunge watora aya matanho matatu ekuomesa: 1. ** Seta Yakasimba UEFI / BIOS Supervisor Password & Dzima Kunze USB / Network Boot : - Pinda BIOS yelaptop yako (F2, F1, F10, kana Del pasimba-pa) -> enda ku ** Chengetedzo> Administrator / Supervisor Password ** uye isa izwi rakasimba rekuti munhu anorwisa asakwanise kudzvanya. F12 pa boot kurodha USB tsvimbo. 2. ** Gonesa UEFI Yakachengeteka Boot + Nyora Tsika Makiyi / Akasaina Unified Kernel Mifananidzo (sbctl + UKI): - Zvishandiso zvakaita sbctl (Arch, Fedora, Debian, Ubuntu) bundle iyo Linux kernel, kernel command line, uye initramfs mune imwechete cryptographically yakasainwa ** Yakabatana Kernel Image (UKI .efi) yakasimbiswa nekiyi yako yeUEFI Secure Boot hardware (PK / KEK / db) Kana Evil Maid akagadzirisa imwe byte yako initramfs, iyo UEFI firmware inoramba kuita boot uye inoratidza tsvuku ** Chengetedza Boot Kutyora ** yambiro usati wambonyora LUKS password yako. 3. Simbisa IOMMU / Kernel DMA Protection uye Install USBGuard: - Tarisa kuti Linux kernel IOMMU iri kushanda (dmesg | grep -iE "DMAR|IOMMU|AMD-Vi") uye isa usbguard (sudo apt install usbguard) kuvhara kuchangopinzwa HID keyboards (03:*:*) uku chidzitiro chako chakakiiwa.

Chikamu chechitatu: DIY Physical Tamper Detection Seals yeYakakwira-Njodzi Kufamba ("Glitter Nail Polish" & Haven)¶

Vakuru vehungwaru, vaongorori vehardware, uye vatori venhau vanoferefeta vanoshandisa nzira mbiri dzisingadhure, dzisingakanganwiki dzekuona tamper-detective:

1. Iyo "Glitter Nail Polish + Macro Photo" Screw Seal (Uncounterfeitable Entropy)¶

Yakajairwa kushambadzira "VOID KANA YABVISWA" holographic zvimiti zvinogona kutengwa paAmazon nemadhora gumi, kupepetwa, uye kutsiviwa nechinamira chakafanana. Glitter nail polish haigoneke nemasvomhu : 1. Tenga bhodhoro re$5 reclear nail polish rakazadzwa nemulti-colored, multi-sized metallic glitter flakes. 2. Penda diki diki rekupenya kweporishi yezvipikiri ** maviri akadzoreredzwa epasi-akavharira screws** (kuvharira sikuruu musoro kune yakatenderedza chassis simbi) uye nepakati pazasi seam yelaptop yako (kana kupfuura tepi inonamira bhegi rako relaptop rakaputirwa). 3. Kana yaoma, tora ** yepamusoro-resolution macro foto ** yega yega inopenya chisimbiso uchishandisa yako smartphone kamera (inogara muhomwe yako). 4. Nei munhu anorwisa asingakwanisi kuikunda: Kunyange munhu wacho akatakura mhando chaiyo yekupenya kwezvipikiri, iyo random 2D geometric orientation, kugovera ruvara, nemakona anopindirana e80 ega ega anopenya anoita chigunwe chakasiyana. Paunodzokera kukamuri yako yehotera, tora mufananidzo wechipiri wechisimbiso chisimbiso kubva pakona imwechete uye enzanisa iyo "Pamberi" uye "Mushure" mafoto pafoni yako: kana imwe screw yakatenderedzwa kunyange ne5 madhigirii, inopenya pateni inoshanduka zvinooneka.

2. Kusandura Sipare Old Android Phone kuita YePhysical Hotel Room Intrusion Sensor (Haven App)¶

• Yakagadzirwa ne Guardian Project uye **Rusununguko rwePress Foundation **, iyo yemahara yakavhurika sosi Android app Haven: Keep Watch inoshandura chero yasara foni yeAroid kuita inofamba, ruzha, vibration (accelerometer), uye ambient light detector.
• Usati wasiya laptop yako mukamuri rehotera rakachengeteka kana dhirowa, isa foni yakasara ichimhanya Haven pamusoro pelaptop yako mukati medhirowa rakavharwa kana bhegi: kana paine munhu akavhura dhirowa (kuchinja ambient light sensor kuverenga) kana kubata laptop, Haven inotora mafoto chinyararire, inorekodha odhiyo, uye inotumira yakavanzika Sigina yambiro kune yekutanga foni muhomwe yako.

3. Kuyambuka International Borders & Airport Secondary Inspections Zvakachengeteka¶

Kana iwe ukafamba kune dzimwe nyika kuburikidza nenzvimbo dzine njodzi huru uko tsika kana vatungamiriri vepabhodha vanogona kutora malaptop nemafoni kusaonekwa: 1. ** Famba uine yakatsaurirwa "Yakachena Kufamba / Burner" Laptop uye Runhare **: Usambofa wakatakura yako yekutanga kambani yekushandira, yehupenyu hwese password vault, kana makiyi eSSH kuyambuka miganhu ine njodzi. Takura yakachena Chromebook kana ichangobva kufananidzwa laptop ine chete chaiwo mafaera anodiwa parwendo irworwo, uye pinda basa rakasimba zvakanyanya pamusoro peyakatenderwa kure desktop desktop mushure mekusvika. 2. **Kudzima zvachose (S5) Maminitsi gumi Usati Wapinda muImba YeCustoms **: Vhara iyo laptop uye foni zvachose pasi (Power Off) isati yaburuka mundege saka DRAM inoora zvachose uye biometric unlock (Face ID / Touch ID) yakaremara nekuda kwechirevo chakasimba chealphanumeric passphrase.

Nhamba dzenharaunda dzechimbichimbi uye zvirongwa zveagency¶

Kukanganisa kwemuviri nehardware yekombuta, kudyara zvakavharika makiyi makiyi, kana muganho usina kutenderwa / espionage yehotera kunofanirwa kutaurwa kune nyika inopikisa-intelligence uye cyber-defense agency:

• United States neCanada:
• Emergency Services: Dial 911 kana iwe ukawana munhu anopinda mumba mako muhotera kana pekugara.
• Federal Bureau of Investigation (FBI) Counterintelligence & Cyber Division / IC3: Kana uri mufambi wekuUS, kondirakiti yezvidziviriro, muongorori, kana mukuru ane laptop kana nharembozha yakakanganiswa kunze kana muhotera, shuma chiitiko ichi kuFBI Field Office Counterintelligence squad yako yemunharaunda** kana ku ic3.gov uye cisa.gov/report (chengetedza tambo yakakanganiswa kana laptop isina kubatwa mubhegi reFaraday yeFBI forensic lab kuongororwa).
• ** Canadian Security Intelligence Service (CSIS) & Cyber Center**: Fonera 1-833-CYBER-88 kana kubata CSIS (613-993-9620) kune vanofungidzirwa kukanganisa mudziyo wekunze.
• United Kingdom:
• Emergency Services: Dial 999 (kana 101 zvemapurisa).
• ** National Cyber ​​Security Center (NCSC) & National Protective Security Authority (NPSA)**: Hurumende yeUK, vadzidzi, uye vafambi vebhizinesi vanofanirwa kutevedzera NCSC / NPSA Overseas Yekufamba Chishandiso Guidance uye vataure vanofungidzirwa kuti hardware yemuviri inokanganisa kuburikidza ncsc.gov.uk.
• European Union:
• Emergency Services: Dial 112 kumatunhu ese enhengo dzeEU.
• ** National CSIRTs / Domestic Security Agencies (ANSSI France, BSI Germany, AIVD/NCSC-NL Netherlands)**: Taura zvinofungidzirwa firmware kana Hardware implants kune yako yenyika CSIRT yehardware SPI/UEFI forensic verification.
• Australia neNew Zealand:
• Emergency Services: Dial 000 muAustralia kana 111 muNew Zealand.
• ** Australian Cyber ​​Security Center (ACSC / ASD) & ASIO Outreach**: Fonera 1300 CYBER1 (1300 292 371).
• India neAsia-Pacific:
• India (CERT-In / Emergency): Dial 112 yemapurisa kana kushuma hardware/firmware kuchengetedza zviitiko ku incident@cert-in.org.in.

Mibvunzo inowanzo bvunzwa¶

Nei laptop yangu yeWindows yakangoerekana yamira kubhowa zvakajairika ndokubvunza BitLocker Recovery Kiyi yangu ine manhamba makumi mana nemasere mushure mekunge ndaisiya mukamuri rangu rehotera?¶

Kana BitLocker inogoneswa paWindows laptop, iyo hardware Yakavimbika Platform Module (`TPM 2.0`) inoyera cryptographic SHA-256 hash yeBIOS yako / UEFI firmware (`PCR 0`), sarudzo ROMs (`PCR 2`), UEFI Boot Manager (`PCR 4`), uye Chengetedza Boot state (`PCR 7`) pese painobatidzwa laptop. Kana mumwe munhu akabata laptop yako iwe uchiri kunze kwekamuri uye yakangoerekana yamira pahwindo rebhuruu ichida yako 48-manhamba BitLocker Recovery Key, chimwe chezvinhu zviviri zvakaitika: ingave yepamutemo BIOS update ichangobva kuiswa, kana kuti mumwe munhu akachinja bhutsu yako yeBIOS, akaremara Chengetedza Boot, akadzvanya chimuti chekunze che USB, kana kugadzirisa yako bootloader firmware., zvichiita kuti TPM PCR hashes ichinje uye ichikonzera BitLocker's anti-tamper kukiya. Usaise kiyi yako yekudzoreredza ine manhamba makumi mana nemasere kudzamara waongorora matanda eBIOS neketani yebhutsu, nekuti kutaipa kiyi yako yekudzoreredza munzvimbo yakakanganiswa bhutsu inofumura drive yako.

Kana ndikakiya Windows yangu kana Mac skrini (Win+L / Ctrl+Cmd+Q) usati waenda kuchitoro chekofi kana hotera, mumwe munhu anogona here kuibaya kuburikidza nechiteshi che USB-C?¶

Zvinoenderana nezvirongwa zviviri: Chekutanga, kana mumwe munhu abaya a BadUSB keystroke injector (`Flipper Zero` kana `Rubber Ducky`) mulaptop yakakiyiwa, iyo fake keyboard inogona kungonyora mubhokisi repassword pane yekukiya skrini (haigone kuvhura terminal nepo skrini yakakiiwa). Chechipiri, zvisinei, kana iyo laptop ine yekare Thunderbolt 3/4 kana USB4 chiteshi isina Kernel DMA Dziviriro yakagoneswa, yakasarudzika PCIe DMA hardware chishandiso (`PCILeech`) inogona kuverenga nekunyora system RAM zvakananga kuburikidza nePCIe bhazi iyo skrini yakavharwa. Kugonesa Kernel DMA Dziviriro muWindows (`System Information > Kernel DMA Protection: On`) kana kuseta macOS **Bvumira zvishongedzo kuti zvibatane -> Bvunza Nguva Yese ** inovhara USB-C/Thunderbolt kuwana data zvachose apo skrini yakavharwa.

Ndinogona here kuongorora bhodhi rangu reUEFI / BIOS firmware kubva mukati meLinux kana Windows kuti ndione kana Evil Maid akavhenekera firmware implant?¶

Ehe. Vhura-sosi firmware kuchengetedza maturusi akagadzirwa neIntel uye kuchengetedza vaongorori, kunyanya CHIPSEC (`github.com/chipsec/chipsec`) uye fwupd (`fwupdmgr security`) paLinux, inokutendera kuti urase yako live SPI flash ROM mufananidzo zvakananga kubva kubhodhi reamai (`chipsec_util spi dump rom.bin`), chengetedza kana hardware BIOS Nyora Dziviriro (`BIOS_CNTL` `BLE`/`BWE` bits uye `PR0-PR4` Yakachengetedzwa Range marejista) yakakiyiwa zvakanaka, uye enzanisa yako SPI flash cryptographic hash inopesana nemugadziri weBIOS mufananidzo.

Zvakachengeteka here kukiya laptop yangu kana hardware crypto wallet mukati mehotera kamuri yekuchengetedza yemagetsi?¶

Usambovimba neyakajairwa hotera kamuri yemagetsi keypad yakachengeteka kudzivirira kubva kune Evil Maid kurwiswa. Anenge ese ehotera emagetsi akachengeteka ane universal mechanic bypass kiyi yakavanzwa kuseri kwepurasitiki logo bheji pane yepamberi, pamwe neyefekitori master override kodhi (`000000` kana `999999`) inozivikanwa nevashandi vepahotera. Kana imba yehotera yakachengeteka iriyo yako yega sarudzo, isa yako powered-off laptop mukati a tamper-inooneka serialized security bag (kana kuisa chisimbiso chinopenya-chipikiri-chiporidzi pamusono) saka iwe unozoziva nekukurumidza kana mudziyo wako wakabatwa.

Chii chinonzi "Hibernation (S4)" vs. "Kurara (S3 / S0ix)", uye Hibernation inodzivirira kubva kuRAM / DMA Evil Maid kurwiswa?¶

Pakapinda laptop Kurara (`S3` kana `S0ix`), iyo RAM machipisi anoramba akabatidzwa uye bata makiyi ako akacheneswa disk encryption mundangariro inoshanduka. Kana laptop ichipinda chokwadi Hibernation (`S4`), iyo inoshanda sisitimu inonyora zviri mukati me RAM mune encrypted hibernation faira (`hiberfil.sys` kana encrypted swap) pane yakavharidzirwa SSD, inochenesa master disk encryption kiyi, uye inocheka ese emagetsi kubhodhi reamai uye RAM zvachose (kungofanana nekuvhara kwakazara). Naizvozvo, ese ari maviri ** Yakazara Shutdown (`S5`) ** uye ** Hibernation (`S4`) padhiraivha yakachengetedzwa ne-pre-boot BitLocker PIN kana LUKS passphrase ** chengetedza RAM yako kubva kuDMA uye kutonhora-bhoti kurwiswa, kupihwa Yakachengeteka Boot uye BIOS password kudzivirira. `/boot` kukanganisa.

Mazano anoenderana¶

• Public kuchaja kiosk data blocker (USB kondomu) uye BadUSB HID jekiseni
• BitLocker, FileVault, uye LUKS encryption kudzoreredza kiyi yekuvhara uye TPM reset
• BIOS uye UEFI firmware inogadziridza zvidhinha, kurasikirwa kwesimba, uye Dual-BIOS Flashback
• Laptop yakabiwa kana foni: pukuta kure uye kukiya account
• Cryptocurrency wallet drain uye mbeu-mutsara wekukanganisa
• Nhamba dzenjodzi nenyika

Nzvimbo uye nhungamiro yepamutemo¶

• National Institute of Standards uye Technology (NIST) (United States): Special Publication 800-147B (BIOS Protection Guidelines for Servers and Workstations) & SP 800-155 (BIOS Integrity Measurement Guidelines).
• National Security Agency (NSA) & Cybersecurity uye Infrastructure Security Agency (CISA) (United States): * Kuomesa UEFI Yakachengeteka Boot, Yakavimbika Platform Module (TPM 2.0) Pre-Boot PIN Configuration, uye Mitigating Thunderbolt/PCIe Direct Memory Access (DMA) Kurwisa*.
• National Cyber ​​Security Center (NCSC) & National Protective Security Authority (NPSA) (United Kingdom): * Supply Chain uye Overseas Travel Physical Device Security, Tamper-Evident Seals, uye Boot Integrity Verification *.
• Microsoft Hardware Security Documentation & Linux Kernel IOMMU / fwupd Host Security Specification (HSI): Kernel DMA Dziviriro (VT-d / AMD-Vi) uye BitLocker Countermeasures Kurwisa Discrete TPM Bhazi Kufema.