Qalabaynta Qalabka Jirka ('Weerarka Gabadha Xun'): Baadhitaanka Laptop-ka ee Aan Lala socon iyo Adkeynta DMA¶

Ku soo noqoshada qolka hudheelka, goobta kormeerka sare ee kastamka madaarka, qolka hadalka shirarka, ama miiska wada shaqaynta ee la wadaago si loo ogaado in laptop-kaaga, casriga ah, ama boorsadaada qalabka cryptocurrency la taabtay, laga guuray, laga soo toosay, ama la furay iyadoo indhahaagu ka maqan tahay waa dhacdo amni oo heersare ah oo loo yaqaan 'cryptography' iyo sirdoonka ka-hortagga sida "Shaqaalaha xun" ee la weeraray Barnaamij-ka-hortagga software-ka caadiga ah ama barnaamijka ka-hortagga waxay u maleynayaan in weeraryahanku ku yaal dhinaca kale ee internetka; Weeraryahan Evil Maid waxa uu haystaa gacmo jidheed oo uu ku galo qalabkaaga 2 ilaa 30 daqiiqo intaad ka maqan tahay quraacda, shirka, ama lagugu hayo qolka kormeerka. Iyada oo ku xidhan casriyaynta weerarka, 90 ilbiriqsi ee helitaanka jidheed ayaa ku filan in lagu xidho ** BadUSB furaha-furaha caagga ah ee ducky ama ** PCIe/Thunderbolt Helitaanka xusuusta tooska ahDMAQalabka leech *** geli laptop hurda, ku dheji $15 CH341A SPI flash programmer ku dheji chip-ka Motherboard-ka BIOS ama ka uriso midda aan qarsoodi ahayn LPC/SPI Baska TPM, ku beddel fiilada USB-C ee ku dallacaadda fiilada maqaar-galaha ee furaha bilaa-waayirka ah (O.MG Cable), ama beddel kuwa aan qarsoodiga ahayn /boot qayb (initramfs) si ay u qabato eraygaaga sirta ah ee diskka buuxa marka xigta aad ku qorto. Weerarada kiosk-ka USB-ga ee garoomada diyaaradaha, la tasho Xakamaynta xogta dukaamada dadweynaha iyo duritaanka BadUSB HID; Haddii darawalkaaga BitLocker, FileVault, ama LUKS uu si lama filaan ah u keeno furaha soo kabashada ee boot ka dib markii qof taabto laptop kaaga, arag BitLocker, FileVault, iyo LUKS sirta soo kabashada furaha qufulka iyo dib u dajinta TPM; iyo haddii qalabkaaga si joogto ah loo qaatay, u beddel Laptop-ka la xado ama talefoonka masax fogaanta iyo qufulka akoonka. Haddii aad ku jirto khatar jireed oo degdeg ah ama aad wajahayso xabsi sharci darro ah, wac lambarka degdegga ah ee degaankaaga (911 Maraykanka iyo Kanada, 112 guud ahaan Midowga Yurub, 999 gudaha Boqortooyada Ingiriiska) ama kala tasho buug-tusahayaga caalamiga ah nambarada degdega ah.

Hadda samee tan¶

1. ** Ha ku qorin sirtaada Full-Disk (BitLocker / LUKS / FileVaultcod-bixiye furaha sirta ah ama furaha soo-kabashada ee laptop-ka.
2. Weerarkii Evil Maid ee caadiga ahaa wuxuu bedelayaa bootloader-ka aan qarsoodiga ahayn ama initramfs Sawirka Laptop-ka oo ay ka maqan tahay Dhaqangelinta Bootka la Cabiray/ama ku xidho qalab hufan USB keylogger dongle inta u dhaxaysa kiiboodhkaaga/goobka iyo laptop-ka) si marka xigta aad ku qorto LUKS ama BitLocker Passphrase, bootloader-ka trojanized ayaa diiwaangeliya eraygaaga sirta ah ee qoraalka ah oo gudbiya ama ku qarinaya saxanka.
3. ** Kahor intaadan taaban kiiboodhka, samee 60-ilbiriqsi baadhis jidheed oo dibadeed ah dhammaan dekedaha, fiilooyinka, iyo boolaladaha chassis ee talefankaga tooshka LED-ka**:
4. ** Ka saar oo hubi USB-C kasta, USB-A, HDMI, Ethernet, iyo fiilada korantada** ee ku xidhan laptop-ka ama ku fadhiya miiskaaga hudheelka. Weeraryahanadu waxay had iyo jeer beddelaan fiilada cad ee dhibbanaha Apple ama fiilada madow ee USB-C iyaga oo u eg O.MG Cable / USB Ninja fiilada (kaaso ka kooban barta marinka Wi-Fi ee qarsoon iyo kontorool yar oo ku qarsoon qolofka isku xirka USB-C ee duraya furayaasha furaha iyo taraafikada).
5. ** Laptop-ka kor u rog oo fiiri boolalyada daboolka hoose iyo cagaha caagga ah ***: Ka raadi biro yar oo cusub P5 Pentalobe, Torx T5, ama Phillips madaxyada isku duubta, shaabadihii daloosha ee maqan, ama tolmada koonaha hoose ee aan fadhiyin biyo nadiif ah sababtoo ah shasigu si degdeg ah ayaa loo furay si loogu dhejiyo fiilada SPI ee gudaha ama M.2 PCIe implant.
6. ** Hubi in laptop-kaaga looga tagay "Sleep / Standby (S3 / S0ix Joogitaanka Casriga ah)" vs. "Si buuxda loo damiyey (S5 / Hibernated S4)" iyadoo aan lala socon ***:
7. Haddii Laptop-kaagu uu hurdo oo keliya (Xidh xidhan) markii uu soo weeraray: Your **Full-Disk encryptionBitLocker, FileVault, LUKSfuraha sirta mugga sareVMK) wuxuu fadhiyaa si qarsoodi ah qoraal cad oo ku dhex jira laptop-kaaga kacsan DRAM Xasuusta ayaa hoos u dhacda waqtiga oo dhan ***. Weeraryahan wata aaladda Thunderbolt/USB4 DMA (oo ku qoran nidaamyada duugga ah ee aan la daboolin), kabka qabow ee RAM, ama shaashadda qufulka ee la yaqaan ayaa akhrin kara xusuusta firfircoon adiga oo aan garanayn eraygaaga sirta ah.
8. **Haddii aad ka shakisan tahay in laptop-ka hurda la faragaliyay ***: Ku hay Badhanka Korontada 10 ilbiriqsi oo buuxa si aad ugu qasabto dami adag oo degdeg ah (nadiifinta furayaasha DRAM ee kacsan) intii aad furka furi lahayd oo aad geli lahayd.
9. ** Ka boot USB Live ah oo la yaqaan oo nadiif ah, akhri-kaliyaUbuntu Live / Tails / SystemRescue lagu hayo qofkaaga mar walba) si loo eego wadaha gudaha ee aan qarsoodi ahayn /boot iyo EFI System Partition (ESP) xashiish**:
10. Haddii aad la shaqeyso Linux LUKS ama Daaqadaha leh BitLocker, Ka-soo-baxa ul USB dibadeed oo nadiif ah oo ku yaal mishiin gaar ah ama la xaqiijiyay ayaa kuu ogolaanaya inaad xadhkaha u geliso fayl kasta /boot/efi/ (ESP) iyo /boot/initramfs-* (sha256sum) oo hubi in wakhtiyada wax ka beddelka qaybinta (stat) is beddelay 2-saac ee saxda ah ee daaqada aad ka maqnayd qolkaaga huteelka.
11. ** Kormeer diiwaannada Dhacdada OS (Windows Event Viewer, macOS unified log, Linux journalctl) laga bilaabo deegaan badbaado leh oo wax-akhris-kaliya ah si loo eego haddii daboolka la furay, qalab USB ah ayaa la geliyey, ama mishiinka dib loo furay intaad maqnayd:
12. Nidaam kasta oo hawleed casri ah waxa uu diiwangeliyaa shaambada qalabka aan bedeli karin ilaa millise seconds mar kasta oo ACPI Lid Switch furmo, nidaamku waxa uu ka toosaa hurdada (Kernel-Power Event ID 42 / 107 Daaqadaha, Wake reason: EC.LidOpen macOS), ama USB cusub VID:PID qalabka ayaa lagu tiriyaa baska dushiisa.
13. Haddii aad tahay bartilmaameed khatar sare leh (Saxafi, qandaraasle difaaca, fulinta, qareenka xuquuqul insaanka, ama saxeexa khasnadda crypto) oo aad hesho caddayn adag oo ku saabsan furitaanka chassis jireed, dib u habeynta BitLocker/TPM PCR lama filaan ah, ama dhacdooyinka toosinta ee aan la ogolayn markaad gacantaada ka baxdo, ula dhaqan qalabka sida gubtay (Quarantine Device*:
14. Ha ku xidhin laptop-ka laga shakisan yahay VPN-ga shirkadda ama gurigaaga Wi-Fi. Adeegso taleefan casri ah oo gooni ah oo nadiif ah (kaas oo jeebka ku jiray) si aad u beddesho aqoonsigaaga, uga noqoto fadhiyada firfircoonafduubka buskudka fadhiga iyo kala noqoshada furaha furaha), oo ku wareeji lacagaha ama siraha adoo isticmaalaya qalab nadiif ah.

Geedka go'aanka: qiimaynta laptop-ka ama qalabka aan lala socon ka dib markii laga shakiyay gelitaanka jirka¶

Raac socodka shaqadan si aad u go'aamiso in qalabkaaga aan la ilaalin jir ahaan la helay ama wax laga beddelay iyo intee heerka dib u habaynta loo baahan yahay:

flowchart TD
    Start["Laabtoob, Taleefanka, ama Wallet-ka Hardware Laga Tagay iyada oo aan lala socon Qolka Hudheelka, Kormeerka Xuduudka, ama Goobta Shaqada"] --> StateCheck{"Waa maxay Gobolka Korontada ee ku jiray Laptop-ka intaad ka maqnayd hantidaada?"}

    StateCheck -->|"Hurdo / Is-taagayn ( Daboolka xidhan, RAM ku shaqeeya) AMA Quful"| HighRiskState["KHATAR SARE: Furayaasha sirta Disk-ga iyo Kukiyada Kalfadhiga waxay ku dhex noolaayeen RAM (U nugul BadUSB, Shaashadda Qufulka, ama Soo saarista DMA/RAM)"]

    StateCheck -->|"Si dhammaystiran loo damiyay (Xiritaanka Qabow S5)"| ColdState["Khatarta RAM-ka HOOSE: Furayaashu kuma jiraan RAM, markaa weeraryahanku waa inuu beddelaa Bootloader (/boot / EFI), Flash SPI BIOS, ama Keylogger Hardware Plant"]

    HighRiskState --> PhysCheck["TALLAABADA 1: Iska hubi furayaasha dibadda, tolidda hoose, dekedaha USB, iyo fiilooyinka ku dallaca ee toosh dhalaalaya ( dib ha u isticmaalin fiilooyinka aan la ilaalin)"]
    ColdState --> PhysCheck

    PhysCheck --> BootBehavior{"Maxaa dhacaya Markaad Kormeerto Daacadnimada Boot / Cabirka TPM?"}

    BootBehavior -->|"BitLocker / TPM waxay si lama filaan ah u dalbanaysaa furaha soo kabashada ee 48-digit AMA Boot ammaan ah oo muujinaya naafo / la beddelay"| BootTamper["BEDDELKA BOOT BOOT EE LA XAQIIJIYAY: TPM PCRs (0, 2, 4, 7) La ogaaday BIOS Firmware-ka la beddelay, Option ROM, ama Bootloader EFI"]

    BootBehavior -->|"Boots Caadi ahaan (ama Akhri-kaliya lagu baadhay USB Live Live ah)"| LogCheck["TALLAABADA 2: Xisaabi daboolka furan/Wake Logs & Connection USB inta lagu jiro daaqadda maqnaanshahaaga ACPI"]

    LogCheck -->|"Logs wuxuu muujinayaa fur furka, Aaladda USB-ga oo ku xidhan, ama dib-u-billow aan la sharraxin markaad maqan tahay"| ConfirmedTouch["LA XAQIIJIYAY GELINTA JIDHKA OO AAN LA OGGOLIN"]
    LogCheck -->|"Dhacdooyinka soo jeedka eber, nusqaamaha dib u kicinta eber, shaabadaha isku dhufashada ee aan saxda ahayn & la xaqiijiyay / xadhkaha kabaha"| CleanPass["Ma jiro wax caddayn ah oo ku saabsan toosinta elektaroonigga ah ama wax ka beddelka kabaha -> Dhaqan geli erayga sirta ah ee BIOS + Ilaalinta DMA Kernel + Siyaasadda Xiritaanka buuxda"]

    BootTamper --> BurnDevice["Haku qorin Password-yada Mashiinkan: Karantiil Hardware, Ka Noqo Dhammaan Kulamada Darruuraha/Furayaasha SSH Taleefanka Nadiif ah, iyo Sawirka Si Rasmi ah"]
    ConfirmedTouch --> BurnDevice

5-ta Farsamo ee Farsamada ee Weerarkii "Shaqeeyaha Xun".¶

Si aad u ogaatid waxa tilmaanta forensic-ka ah ee la raadinayo, faham shanta farsamooyin ee dhabta ah ee la isticmaalo inta lagu guda jiro weerarrada gacan-ka-hadalka ee ka dhanka ah laptops iyo boorsooyinka qalabka:

Wajiga 1: Baadhitaanka Dambiga ah ee Laptop-ka Shakiga ah ee Aan Lala socon (Kahor Intaysan Soo galin)¶

Haddii aad ku soo noqoto qolkaaga hudheelka ama aad dib u hesho laptop-kaaga ka dib kormeerka xadka oo aad rabto in aad ogaato in qof furay, soo kacay, ama ku xidhay qalab intaad maqnayd, samee hubinnadan si:

1. Tallaabada 1: Deked Jireed, Cable, iyo Chassis Screw Audit¶

1. Karantiil wixii fiilooyin ah ee qolka gadaasha loogaga tagay:
2. ah O.MG Cable ama USB Ninja waxay u egtahay 100 boqolkiiba inaan laga sooci karin fiilada dhabta ah ee Apple USB-C, fiilada Anker, ama adabtarada Dell USB-C, ilaa nambarada taxanaha ah ee leysarka ku dhejisan ee gacanta isku xirka.
3. Haddii aad uga tagtay fiilada USB-C, leben korantada, ama xuddunta USB iyada oo aan lala socon meel khatar sare leh, ** jooji ku xidhidhiyaha khadadka xogtaada laptop-kaaga *; ama ku beddel fiilada la yaqaan ee boorsadaada xidhan ama dhig ** xannibaadaha xogta USB-kaliya (Kondhomka USB) oo taxane ah.
4. ** Kormeer furayaasha daboolka hoose & tolliinka hoostiisa iftiinka tooshashka ee shida**:
5. Tooshka taleefankaaga casriga ku qabo xagal gacmeed 15-degree ("iftiin raking") ku dul wareeji madax kasta oo ku yaal xagga hoose ee laptop-kaaga.
6. Furayaasha warshadda ee hal mar ruxay goobta shirkadu waxay leeyihiin dahaar anodized ah oo nadiif ah oo isku mid ah gudaha boosaska xiddigta/iskutallaabta. Fure laga furay qolka huteelka oo leh bir bir ah ayaa tusinaysa ** xagashada biraha iftiimaya ee birta ah ee ku dhex jira fasalka birta**, boodhka buluuga/guduudka ah ee khalkhaliyay, ama habacsanaan yar oo saxan aluminium ah oo hoose oo ay la socdaan fiilooyinka hawo-mareenka dambe.

2. Tallaabo 2: Hubinta OS Wake, Fur- Fur, iyo Dib-u-boot Logs (Laptop-ku ma shiray intaad maqan tahay?)¶

U fiirso wakhtiga saxda ah ee daaqada aad ka maqnayd laptop-ka (tusaale, 12:15 PM to 01:45 PM). Xitaa haddii uu weeraryahanku kabo usha tooska ah ee USB, ** faraqa lama filaan ah ama kabaha qabow ee wakhtigaaga OS, ama dhacdada Daboolka Furan ee ACPI inta lagu jiro daaqadaas, waxay caddaynaysaa in laptop-ka jir ahaan la farsameeyay ***:

Marka loo eego macOS (MacBook Air / MacBook Pro):¶

Fur ** Terminal *** oo socodsii amarkan si aad u muujiso mid kasta ** Fur Furan, Xidho Daboolka, Soo jeedka, Hurdada, iyo Daar-Damashada** Dhacdada qalabka ee Maamulaha Nidaamka (System Controller).SMC / PMU) 24-kii saac ee la soo dhaafay:

pmset -g log | grep -E "Wake|Sleep|LidOpen|LidClose|Start|Shutdown|DarkWake" | tail -n 60

log show --predicate 'eventMessage contains "USB" or process == "kernel"' --last 4h | grep -iE "usb|appleusb|hid"

Linux (Ubuntu, Fedora, Debian, Arch, RHEL):¶

1. Hubi systemd-journald Dhacdo kasta oo bootin/xirmo ah ama beddelaad dabool/hurdo ah inta aad maqan tahay:

   journalctl --list-boots -n 10
   journalctl --since "4 hours ago" | grep -iE "lid|suspend|wake|usb|new high-speed|hid-generic|thunderbolt|pcie"
   

2. ** Xaqiiji in qarsoodigaagu aanu qarsoodi ahayn /boot iyo /boot/efi Qaybaha looma bedelin inta mishiinku dansan yahay ***: Hubi xaqiiqda Modify iyo Change (ctime) waqti aan caadi ahayn ee sawir kasta oo kernel ah, initramfsiyo GRUB EFI binary gudaha /boot:

   find /boot -type f -exec stat -c "%y %z %n" {} + | sort
   

3. (Haddii uu jiro fayl gudaha ah /boot ama /boot/efi wuxuu leeyahay a Change ama Modify timestamp markii aad ka maqnayd qolka, ama ilaa kaagii u dambeeyay apt/dnf Cusboonaysiinta kernel, ** bootloaderkaaga waa la faragaliyay **.)

Ku shaqeeya Windows 10/11:¶

Fur ** Maamulaha PowerShell** daaqadda oo weydii Diiwaanka Dhacdada Systemka mid kasta oo Awood-DaranID 12), xidhid (ID 13), hurdo (ID 42Hurdada ka kac (ID 1 / ID 107), iyo Luminta Awoodda lama filaanka ah (ID 41* 24-kii saac ee la soo dhaafay:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=@(1, 12, 13, 41, 42, 107); StartTime=(Get-Date).AddHours(-24)} | Select-Object TimeCreated, Id, ProviderName, Message | Format-Table -AutoSize -Wrap

Get-WinEvent -LogName "Microsoft-Windows-DriverFrameworks-UserMode/Operational" -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-12) } | Select-Object TimeCreated, Id, Message

Wajiga 2: Waa maxay sababta Apple Silicon Macs & Casriga ah TPM 2.0 + PIN Nidaamyadu Way Ku Adag Yihiin "Adoonta Xumaanta" (iyo Sida Loo Sameeyo Xaqa)¶

Dhammaan laptop-yada si isku mid ah uma nugul yihiin faragelinta jirka. Waa kuwan sida xididada casriga ah ee kalsoonida u shaqeeyaan iyo goobaha saxda ah ee ay tahay inaad awood u yeelato:

1. Apple Silicon MacBooks (M1, M2, M3, M4)¶

Apple Silicon Macs waxay ka mid yihiin laptops-yada macaamiisha u adkeysi badan Evil-Maid waligood la dhisay markii ** damiyay (S5** oo lagu habeeyey FileVault + Firmware/Ammaanka Soo kabashada: - Bootka ROM-ka wuxuu ku dhejiyay silikon aan la beddeli karin gudaha M-series SoC (Hardware Root of Trust). Marxalad kasta oo silsiladda bootka ah (iBoot -> macOS Kernel -> Cabbirka Nidaamka Saxeexa Qarsoodi ahaan SSV) waxaa xaqiijiya furaha qalabka Apple ka hor inta aan la dilin. - Xirmooyinka NAND ee kaydinta waxaa sir ah hardware-ka-qaran ** Secure Enclave (AES-XTS** adoo isticmaalaya furayaasha ku xidhan eraygaaga sirta ah ee FileVault oo wata xadka heerka ka-hortagga hammering hardware. - ** 3-da hab ee qasabka ah waa inaad ka xaqiijisaa MacBookgaaga hadda ***: 1. **FileVault wuu daaran yahay ***: ** Dejinta nidaamka> Qarsoodi & Amniga> FileVault -> Daaran ***. 2. **Dami si otomaatig ah u gal oo u baahan erayga sirta ah isla markaaba hurdada : ** Settings Settings > Lock Screen -> Baahan erayga sirta ah ka dib marka shaashaddu bilaabato ama bandhigga la damiyo -> Isla markiiba. 3. Xidhi waxyaabaha aan la ogolayn ee USB / Thunderbolt Marka la xidho **: Tag ** Settis Settings > Privacy & Security > U ogolow qalabyada inay ku xidhmaan oo dhig **"Weydii qab cusub" ama **"Weydii maralba"* (waligaa *"Si toos ah maka la furo" ama *"Mar alba"). Marka lagu rakibo "Weydii wakhti kasta", xidhidh a BadUSB Injector injector ama Thunderbolt DMA qalab MacBook quful ah ayaa ku ridaya dekedda qaab awood-keliya oo xannibaya dhammaan xogta PCIe/USB ee heerka kontoroolka qalabka.

2. Windows 10/11 Pro & Enterprise (BitLocker + Pre-Boot TPM PIN + Kernel DMA Protection)¶

Sida caadiga ah 99 boqolkiiba laptops Windows (Dell, Lenovo, HP, Dusha sare), BitLocker waxaa lagu habeeyey gudaha "TPM-Only" Qaabka (Hawlgalka Daah-furnaanta): - Markaad riixdo batoonka korontada ee a TPM-Only Laptop-ka BitLocker, ** Laptop-ku wuxuu si toos ah ugu socdaa shaashadda Windows Lock Screen isagoon ku weydiinin BitLocker PIN**, taasoo la micno ah in TPM chip uu si toos ah u furfuray furaha darawalnimadaVMK) oo ku shubtay Windows OS RAM. - Laptop kasta oo adeegsada ** Chip TPM Discrete** oo ku xidhan CPU iyada oo loo sii marayo Motherboard-ka SPI ama LPC baska, weeraryahan furay daboolka hoose oo gooyay $50 falanqeeye macquul ah oo ku dul dhejinaya TPM chip's MOSI/MISO pin ** wuxuu akhriyaa qoraalkaaga cad ee BitLocker Volume Master Key (VMKSi toos ah uga bax siliga 5 ilbiriqsi gudahood (BitPixie / TPM-Sniffing*** Adigoon aqoon eraygaaga Windows-ka - Ku kicinta ilaa shaashadda galitaanka Windows waxay sidoo kale daaha ka qaadaysaa kernel-ka Windows, xirmada Wi-Fi, iyo baska PCIe iyadoo aan lala socon.

Sida loo suurtogeliyo qasab ah BitLocker Pre-boot PIN bilowgaTPM + PIN* Daaqadaha 2 daqiiqo gudahood:¶

Ku darista PinLocker-ka-hor-u-bootka ayaa ku qasbaya qalabka TPM 2.0 Chip si aad u ilaaliso furaha sirta diskka ee gudaha silikoon u adkaysta ilaa aad jidh ahaan ugu qorto 6-ilaa-20-jidh PIN-ka-boot-kaaga shaashadda madow ee BIOS/BitLocker: 1. Riix Win + R, nooca gpedit.msc, oo taabo Enter (ku Windows 10/11 Pro, Enterprise, ama Education). 2. U soco: ** Habaynta Kombuyuutarka> Qaababka Maamulka> Qaybaha Windows> Sirta Wadista BitLocker> Wadayaasha Nidaamka Hawlgelinta**. 3. Laba-guji "Waxay u baahan tahay xaqiijin dheeraad ah bilowga", u dhig Furt-gal, oo deji Ku xidhi furaha TPM PIN: to Require startup PIN with TPM. 4. Fur ** Amarka Maamulka Degdegga ah ** ama PowerShell oo deji furkaaga cusub ee BitLocker PIN (si loogu oggolaado ereyada furaha alfanumeric, sidoo kale awood "Oggolow PIN-ka la xoojiyey ee bilowga" isla galka Siyaasadda Kooxda):

manage-bde -protectors -add C: -TPMAndPIN

3. LinuxLUKS2 + Secure Boot + Unified Kernel Images (UKI) + BIOS Password)¶

Laptops Linux ah (Ubuntu, Fedora, Debian, Arch, Qubes OS), heerka LUKS Sireeynta diskka buuxa waxay mar hore kaaga baahan tahay inaad ku qorto erayga sirta ah ee boot-ka ka hor inta aan darawalku furin, taas oo joojisa dhuuqin baska TPM ee dadban. Si kastaba ha ahaatee, Linux caadiga ah rakibo fasax /boot (initramfs iyo vmlinuzaan qarsoodi ahayn, taasoo ka dhigaysa inay u nugul yihiin kuwa caadiga ah ** 2-daqiiqo USB Evil Maid /boot Beddelka *** ilaa aad qaaddo saddexdan tillaabo ee adag: 1. ** Deji erayga sirta ah ee Kormeeraha UEFI/BIOS iyo dami USB-ga Kabaha Shabakadda**: - Geli laptop-kaaga BIOS (F2, F1, F10, ama Del marka la shido) -> tag Security> Administrator / Supervisor Password oo dhig kelmad adag oo sir ah si aanu weeraryahanku u cadaadin F12 marka la booteeyo si loo shubo usha USB 2. Dari UEFI Boot Sugan + Diiwaangelinta Furayaasha Gaarka ah / Sawirrada Kernel Midaysan ee Saxiixan (sbctl + UKI: - Qalabka sida sbctl (Arch, Fedora, Debian, Ubuntu) xidho kernel Linux, khadka taliska kernel, iyo initramfs galay hal sirdoon oo saxeexan ** Sawirka Kernel MidaysanUKI .efi** waxaa xaqiijiyay furahaaga qalabka UEFI Secure Boot (PK / KEK / db). Haddii addoonta xun ay wax ka beddesho hal byte ee kaaga initramfs, firmware-ka UEFI wuu diiday inuu xidho oo soo bandhigo digniinta cas Secure Boot Violation ka hor intaadan waligaa qorin eraygaaga sirta ah ee LUKS. 3. ** Xaqiiji IOMMU / Kernel DMA Protection iyo Ku rakib USBGuard**: - Hubi in Linux kernel IOMMU uu firfircoon yahay (dmesg | grep -iE "DMAR|IOMMU|AMD-Vi") oo rakib usbguard (sudo apt install usbguard) in la xannibo dhawaan la geliyey HID kiiboodhka (03:*:*) inta shaashaddaadu xiran tahay.

Wajiga 3: DIY DIY Baadhista Xadgudubka Jirka ee Shaabadaynta Khatarta Sarreeysa ee Safarka Haven)¶

Saraakiisha sirdoonka, cilmi-baarayaasha qalabka, iyo saxafiyiinta wax baadha waxay adeegsadaan laba farsamood oo aan qaali ahayn oo aan la ilaawi karin

1. The "Diyaarad dhalaalaysa + Sawirka Macro" ee shaabaddaUncounterfeitable Entropy)¶

Ganacsiga caadiga ah ee "VOID HADDII LA TIRTIRO" istiikarrada holographic waxaa laga iibsan karaa Amazon $10, la diiray, waxaana lagu bedeli karaa sticker isku mid ah. **Cidiyaha dhalaalaysa xisaab ahaan lama iloobi karo ***: 1. Iibso $5 dhalo ah ** cidiya cad oo ay ka buuxaan midabyo badan, dhalaal bir ah oo cabbir badan *. 2. Ku rinji daab yar oo cidi dhalaalaysa oo dhalaalaysa guud ahaan laba biro ee daboolka hoose ee dib loo furay (isku xidhka madaxa birta chassis-ka ee ku xeeran) iyo guud ahaan ** tolmada hoose ee laptop kaaga (ama cajalad daboolaysa boorsadaada laptop-ka daboolan). 3. Mar haddii ay engegto, qaado ** sawir macro ah oo heer sare ah ** shaabad kasta oo dhalaalaysa adiga oo isticmaalaya kamaradda casriga ah (taas oo ku jirta jeebkaaga). 4. **Sababta uu weeraryahanku uga adkaan karin ***: Xataa haddii uu weerarku sido isla astaanta saxda ah ee cidiyaha dhaldhalaalka ah, ** hanuuninta joomatari 2D random, qaybinta midabka, iyo xaglaha is dulsaaran ee 80 fallaadho dhaldhalaal shaqsi ah *** waxay sameeyaan far muuqaal gaar ah. Markaad ku soo noqoto qolkaaga hudheelka, ka soo qaad sawir labaad oo shaabad ah oo isku mid ah oo barbar dhig sawirada "Kahor" iyo "Ka dib" ee telefoonkaaga: haddii hal mar la rogay xitaa 5 digrii, qaabka dhalaalaya ayaa si muuqata u beddelaya.

2. U-rogista Taleefanka Hore ee Android-ka ee loo beddelo Dareemka Qolka Soo Galitaanka Hudheelka Jirka ah (Haven App)¶

• Waxaa sameeyay **Mashruuca Ilaaliyaha *** iyo ** Xorriyadda Aasaaska Saxafada ***, abka Android-ka bilaashka ah ee furan Haven: Keep Watch u beddelo talefan kasta oo firaaqo ah oo Android ah dhaqdhaqaaq, dhawaaq, gariir (xawaare), iyo qalabka wax sheega nalka ambient.
• Kahor intaadan kaga tagin laptop-kaaga qolka huteelka badbaado leh ama khaanad, dhig taleefoonka firaaqada ah inuu socdo Haven midig korka laptop kaaga gudaha khaanadaha ama boorsada xiran: haddii qof uu furo khaanadda (beddelaya akhriska dareemayaasha nalka ambient) ama taabto laptop-ka, Haven si aamusnaan ah u sawirta, duubista codka, oo u soo dirta digniinta sir ah Signal taleefanka aasaasiga ah ee jeebkaga ku jira.

3. Ka Gudbida Xuduudaha Caalamiga ah & Kormeerka Sare ee Madaarka¶

Haddii aad u safarto si caalami ah iyada oo loo marayo xukunada khatarta sare leh halkaasoo kastamka ama saraakiisha xuduuduhu ay ka qaadi karaan laptop-yada iyo taleefannada indhaha: 1. ** Lasoco Laabtoob iyo Taleefan "Safar Nadiif ah/Gubi" u go'ay ***: Waligaa ha qaadan goobtaada shaqada ee shirkada aasaasiga ah, furaha noloshaada, ama furayaasha SSH ee xuduudaha khatarta sare leh. Sido Chromebook nadiif ah ama laptop sawir cusub leh oo ay ku jiraan kaliya faylalka gaarka ah ee loo baahan yahay safarkaas, oo si adag u gal shaqada xasaasiga ah ee fadhiga fog ee la xaqiijiyay ka dib markaad timaaddo. 2. ** Korontadu Gebi ahaanteedS5) 10 daqiiqo ka hor inta aanad galin Hoolka Kastamka ***: xidh laptop-ka iyo telefoonka gabi ahaanbaPower Offka hor inta aanad ka soo degin diyaaradda si DRAM si buuxda u qudhunto oo loo furo biometric (Face ID / Touch ID) waa la curyaamiyay isagoo door bidaaya sirta xarfaha ee adag.

Lambarada degdega ah ee gobolka iyo borotokoolka wakaalada¶

Faragelinta jirka ee qalabka kombiyuutarka, beerista furayaasha qalabka qarsoon, ama basaaska xudduudaha/hoteelka aan la fasaxin waa in lagu wargeliyaa sirdoonka qaranka iyo wakaaladaha difaaca internetka:

• **Mareykanka iyo Kanada ***:
• Adeegyada Degdega ah: garaac 911 haddii aad ka ogaato qof ku soo duulay qolkaaga hudheelka ama hoyga.
• ** Xafiiska Baarista FederaalkaFBILa-dagaalanka sirdoonka & Qaybta internetka / IC3**: Haddii aad tahay socdaale Mareykan ah, qandaraasle difaaca, cilmi-baare, ama maamule oo laptop-kiisa ama taleefankiisa lagu xad-gudbay dibadda ama hoteel, u sheeg shilka agagaarkaaga FBI Field Office Counterintelligence Squad ama ic3.gov iyo cisa.gov/report (ku ilaali fiilada la jeexjeexay ama laptop-ka oo aan la taaban bacda Faraday si loo baaro shaybaadhka dambi-baarista ee FBI).
• ** Adeegga Sirdoonka Amniga Kanada (CSIS) & Xarunta Internetka ***: Wac 1-833-CYBER-88 ama la xidhiidh CSIS (613-993-9620) ee looga shakisan yahay faragelinta aaladaha jireed ee ajnabiga ah.
• ** Boqortooyada Ingiriiska ***:
• Adeegyada Degdega ah: garaac 999 (ama 101 Booliiska).
• ** Xarunta Amniga Internetka ee QarankaNCSC& Hay'adda Ilaalinta Amniga Qaranka (NPSA*: Dawlada UK, aqoonyahanka, iyo dadka safarka ah waa inay raacaan ** NCSC / NPSA Tilmaamaha Aaladaha Safarka Dibadda oo ay ka warbixiyaan tuhunka faragelinta qalabka jirka ee ncsc.gov.uk.
• *Midowga Yurub:
• Adeegyada Degdega ah: garaac 112 dhammaan dalalka xubnaha ka ah Midowga Yurub.
• ** CSIRT-yada Qaranka / Hay'adaha Amniga Gudaha (ANSSI Faransiiska, BSI Jarmalka, AIVD/NCSC-NL Nederlaan)**: U soo sheeg qalabka firmware-ka laga shakisan yahay ama qalabka lagu rakibo ee qarankaaga CSIRT si loo caddeeyo qalabka SPI/UEFI.
• ** Australia iyo New Zealand ***:
• Adeegyada Degdega ah: garaac 000 gudaha Australia ama 111 ee New Zealand.
• ** Xarunta Amniga Cyberka ee AustraliyaACSC / ASD) & Wacyigelinta ASIO ***: Wac 1300 CYBER1 (1300 292 371).
• Hindiya iyo Aasiya-Baasifik ***:
• Hindiya (CERT-In / Xaalad degdeg ah): garaac 112 booliiska ama u soo sheeg shilalka amniga hardware/firmware incident@cert-in.org.in.

Su'aalaha soo noqnoqda¶

Muxuu laptop-ka Windows-ka si lama filaan ah u joojiyay inuu si caadi ah u bootiyo oo uu u weydiiyo furaha soo kabashada ee 48-god ee BitLocker ka dib markii aan kaga tagay qolkayga huteelka?¶

Marka BitLocker lagu furo laptop-ka Windows, qalabka Module Platform la Aaminsanyahay (`TPM 2.0`) wuxuu cabbiraa SHA-256 cryptographic hash-ka BIOS/UEFI firmware-kaaga (`PCR 0`ROM-yada ikhtiyaarka ah (`PCR 2`), Maareeyaha Bootka UEFI (`PCR 4`), iyo gobolka Boot ee sugan (`PCR 7`) mar kasta oo uu laptop-ku shido. Haddii qof taabto laptop-kaaga markaad qolka ka maqnayd oo ay si lama filaan ah u istaagto muraayad buluug ah oo dalbanaysa furahaaga soo kabashada ee 48-god ee BitLocker, mid ka mid ah laba arrimood ayaa dhacay: mid cusub oo cusub oo BIOS ah oo hadda la rakibay, ama qof ayaa beddelay nidaamka bootloader kaaga, naafo Secure Boot, bootiyay usha USB dibadeed, ama wax ka beddelay bootloader firmware kaaga, taasoo keenaysa in TPM PCR hashes beddelaan oo kiciyaan xannibaadda ka-hortagga xad-gudubka ee BitLocker. Ha gelin furaha soo kabashada ee 48-god ah ilaa aad ka hubiso diiwaanka BIOS iyo silsilada boot, sababtoo ah ku qorista furahaaga soo kabashada ee jawiga bootka ah ee la jabiyay waxay daaha ka qaadaysaa darawalkaaga.

Haddii aan xidho shaashadda Windows ama Mac (Win+L / Ctrl+Cmd+Q) ka hor inta aanad ka bixin dukaan kafeega ama hudheelka, qof weli miyuu jabsan karaa dekedda USB-C?¶

Waxay ku xidhan tahay laba hab: Marka hore, haddii qof ku xidho a BadUSB cirbadeynta furaha (`Flipper Zero` ama `Rubber Ducky`) Laptop-ka xiran, kiiboodhka beenta ah wuxuu ku qori karaa oo keliya sanduuqa sirta ah ee shaashadda qufulka (ma furi karo terminal inta ay shaashadda xiran tahay). Marka labaad, si kastaba ha ahaatee, haddii laptop-ka uu leeyahay ka weyn Thunderbolt 3/4 ama USB4 iyada oo aan la ilaalin Kernel DMA, qalab hardware PCIe DMA gaar ah (`PCILeech`) si toos ah ayuu u akhrin karaa una qori karaa nidaamka RAM ee baska PCIe inta ay shaashadda xiran tahay. Fududeynta Ilaalinta DMA Kernel gudaha Windows (`System Information > Kernel DMA Protection: On`) ama dejinta macOS ** Oggolow qalabyada inay ku xidhmaan -> Weydii wakhti kasta ** waxay xannibaysaa gelitaanka xogta USB-C / Thunderbolt gabi ahaanba inta shaashadda ay xidhan tahay.

Ma iskaan karaa Motherboard-ka UEFI/BIOS firmware-ka Linux ama Windows-ka si aan u eego inay Evil Maid soo ifisay qalab firmware ah?¶

Haa Aaladaha badbaadada firmware-ka-furan ee ay sameeyeen Intel iyo baarayaasha amniga, gaar ahaan CHIPSEC (`github.com/chipsec/chipsec`) iyo fwupd (`fwupdmgr security`) Linux, waxay kuu oggolaaneysaa inaad si toos ah uga daadiso sawirkaaga SPI flash ROM-ka tooska ah Motherboard-ka (`chipsec_util spi dump rom.bin`), xaqiiji in qalabka BIOS qoraalka ilaalinta (`BIOS_CNTL` `BLE`/`BWE` qaniinyo iyo `PR0-PR4` Diiwangelinta Range ee la ilaaliyo) si sax ah ayaa loo quful, oo is barbar dhig xashiishkaaga SPI flash cryptographic hash ka soo saaraha rasmiga ah ee BIOS.

Ammaan ma tahay in aan xidho laptop-kayga ama kiishashka crypto ee qalabkayga gudaha qolka hudheelka ee badbaadada elektarooniga ah?¶

Weligaa ha isku hallayn qolka caadiga ah ee hudheelka furaha elektiroonigga ah si aad uga ilaaliso weerarka Evil Maid. Ku dhawaad ​​hudheel kasta oo badbaado elektaroonig ah waxa uu leeyahay dalool farsamo oo caalami ah oo lagu maro gadaasha summada caagga ah ee ku taal guddiga hore, iyo sidoo kale koodka sareynta warshadda (`000000` ama `999999`) ay yaqaanaan shaqaalaha hoteelka. Haddii qolka huteelka nabdoon yahay doorashadaada kaliya, dhig laptop kaaga dansan gudaha a bacda amniga ee taxanaha ah (ama ku dheji shaabad sawir leh oo dhalaalaysa-cidi-polish ah oo tollayn ah) si aad isla markiiba u ogaan doonto haddii qalabkaaga la taabtay.

Waa maxay "Hibernation"S4)" vs. "HurdoS3 / S0ix", oo Hibernation ma ka ilaaliyaa RAM / DMA Evil Maid werarada?¶

Marka uu soo galo laptop-ka Hurdo (`S3` ama `S0ix`), Chips-yada RAM-ka ayaa sii shidan oo ku haya furaha sirta diskkaga ee la furay iyagoo ku jira xusuusta kacsan. Marka uu laptop run galo Hibernation (`S4`), nidaamka qalliinka waxa uu ku qorayaa waxa RAM ku jira fayl qarsoon oo qarsoon (`hiberfil.sys` ama isku beddelasho sir ah) oo ku saabsan SSD-da sir ah, waxay nadiifisaa furayaasha sirta diskka, waxayna ka jartaa dhammaan tamarta korantada Motherboard-ka iyo RAM gebi ahaanba (sida xirid buuxda). Sidaa darteed, labadaba ** Xiritaanka buuxa (Full Shutdown)`S5`*** iyo ** Hibernation (`S4`) wadista ay ilaalinayso boot-ka hore ee BitLocker PIN ama erayga sirta ah ee LUKS** ka ilaali RAM-kaaga ka hortagga DMA iyo weerarada kabaha qabow, oo ay bixiso Secure Boot iyo erayga sirta ah ee BIOS `/boot` faragalin.

Tilmaamaha la xidhiidha¶

• Dallacaadda dadweynaha ee kiosk data blocker (kondomka USB) iyo duritaanka BadUSB HID
• BitLocker, FileVault, iyo LUKS sirta soo kabashada furaha qufulka iyo dib u dajinta TPM
• BIOS iyo UEFI firmware waxay cusboonaysiiyaan leben, awood lumin, iyo Dual-BIOS Flashback
• Laptop ama telefoon la xaday: masax fog iyo xidhid akoonka
• Daadi boorsada lacagta loo yaqaan 'Cryptocurrency wallet' iyo abuurka- weedha ayaa tanaasul sameeyay
• Nambarada degdega ah wadan ahaan

Ilaha iyo hanuuninta rasmiga ah¶

• Machadka Heerarka iyo Tignoolajiyada Qaranka (NIST) (Mareykanka): * Daabacaada Gaarka ah 800-147B (Hagaha Ilaalinta BIOS ee Adeegayaasha iyo Goobaha Shaqada) & SP 800-155 (BIOS Tilmaamaha Qiyaasta Sharafta)*.
• Hay'adda Nabad Sugidda Qaranka (NSA& Hay'adda Ammaanka Kaabayaasha InternetkaCISA(Mareykanka): * Adkeynta UEFI Secure Boot, Module Platform la Aaminsan yahay (TPM 2.0Isku-habaynta PIN-ka-hor-boot, iyo Yaraynta Thunderbolt/PCIe Helitaanka Xusuusta Tooska ah (DMA) Weeraro*.
• Xarunta Amniga Internetka ee QarankaNCSC& Hay'adda Ilaalinta Amniga Qaranka (NPSA) (United Kingdom): * Silsiladda Sahayda iyo Safarka Dibadda ee Badbaadada Aaladda Jirka, Shaabada Cad-cad, iyo Xaqiijinta daacadnimada Boot*.
• Dukumentiyada Amniga Hardware Microsoft & Linux Kernel IOMMU / fwupd Tilmaamaha Amniga Martigeliyaha (HSI): * Ilaalinta DMA Kernel (VT-d / AMD-Vi) iyo Tallaabooyinka ka-hortagga ah ee TPM baska urin*.