Tšebeliso ea 'Mele ea Tampering ('Tlhaselo ea 'Evil Maid'): Tlhahlobo e sa Lebelloang ea Laptop le DMA Hardening¶

Ha u khutlela phaposing ea hotele, sebakeng sa tlhahlobo ea litloaelo tsa boema-fofane, sebaka sa ho phomola sebui sa liboka, kapa tafoleng e arolelanoang ea basebetsi-'moho ho fumana hore laptop ea hau, smartphone, kapa cryptocurrency sepache sa hau se ile sa angoa, sa sisinyeha, sa tsosoa borokong, kapa se butsoe ha u sa bo bone ke ketsahalo e phahameng ea ts'ireletso ea 'mele e tsejoang ka "cryptography" le "counter-intelligence" e le **"Evil Maid" Ts'ireletso ea Joaws Lenaneo la khale la li-firewall kapa lenaneo la antivirus le nka hore mohlaseli o ka lehlakoreng le leng la marang-rang; mohlaseli ea Evil Maid o na le **matsoho a ho fihlella hardware ea hau ** bakeng sa metsotso e 2 ho isa ho e 30 ha u le lijong tsa hoseng, kopanong, kapa u koaletsoe ka phaposing ea tlhahlobo. Ho ipapisitsoe le ho rarahana ha mohlaseli, metsotsoana e 90 ea phihlello ea 'mele e lekane ho hokela BadUSB keystroke-ente ea rabara ducky kapa **PCIe/Thunderbolt Direct Memory Access (DMA) sesebelisoa sa leech ** ka har'a laptop e robetseng, kopa $15 CH341A SPI flash programmer ho chip ea BIOS ea motherboard kapa u sunye tse sa ngolisoang. LPC/SPI Bese ea TPM, fapanyetsana thapo ea ho tjhaja ea USB-C bakeng sa thapo e kentsoeng ea keylogger e se nang mohala (O.MG Cable), kapa nka sebaka sa tse sa ngolisoang /boot karohano (initramfs) kahoo e nka poleloana ea lekunutu ea "fill-disk encryption" nakong e tlang ha u e ngola. Bakeng sa litlhaselo tsa kiosk tsa ho tjhaja ka USB boemafofaneng, ikopanye li-blocker tsa data tsa kiosk tsa sechaba le ente ea BadUSB HID; haeba koloi ea hau ea BitLocker, FileVault, kapa LUKS ka tšohanyetso e u khothalletsa hore u fumane senotlolo sa ho hlaphoheloa ka mor'a hore motho e mong a ame laptop ea hau, bona. BitLocker, FileVault, le LUKS encryption recovery keylockout le TPM reset; 'me haeba sesebelisoa sa hau se nkiloe ka ho sa feleng, fetohela ho Laptop e utsoitsoeng kapa phumula ea remoutu ea fono le ho koala ak'haonte. Haeba u le kotsing ea 'mele hang-hang kapa u tobane le ho koalloa ho seng molaong, letsetsa nomoro ea hau ea tšohanyetso ea lehae (911 United States le Canada, 112 ho pholletsa le European Union, 999 United Kingdom) kapa sheba bukana ea rona ea machaba dinomoro tsa tshohanyetso.

Etsa sena hona joale¶

1. ** U SE KE U thaepa Encryption ea hau ea Full-Disk (BitLocker / LUKS / FileVault) phasewete, password ea ho kena ea OS, kapa Master Password ho laptop ea belaelloang haeba ka tšohanyetso e kopa senotlolo kapa senotlolo sa ho hlaphoheloa ka mor'a ho siuoa ho sa hlokomeloe **:
2. Tlhaselo ea khale ea Evil Maid e nka sebaka sa bootloader e sa ngolisoang kapa initramfs setšoantšo ho laptop e se nang Measured Boot / Secure Boot enforcement (kapa e hokela "hardware" e hlakileng ea USB keylogger dongle lipakeng tsa keyboard / boema-kepe le laptop) e le hore nakong e tlang ha u thaepa. LUKS kapa BitLocker passphrase, bootloader ea trojanized e tlaleha poleloana ea hau ea mantsoe e hlakileng ebe ea e fetisetsa kapa ea e pata ho disk.
3. Pele u thetsa keyboard, etsa tlhahlobo ea kantle ea metsotsoana e 60 ea likou tsohle, likhoele, le likurufu tsa chassis tlas'a toche ea LED ea fono ea hau:
4. Ntlolla 'me u hlahlobe USB-C e 'ngoe le e 'ngoe, USB-A, HDMI, Ethernet, le thapo ea motlakase e hoketsoeng laptop kapa u lutse deskeng ea hotele ea hau. Hangata bahlaseli ba fapanyetsana Apple e tšoeu e tloaelehileng ea Apple kapa thapo e ntšo ea USB-C bakeng sa ponahalo e ts'oanang O.MG Cable / USB Ninja cable (e nang le sebaka sa phihlello sa Wi-Fi se patiloeng le microcontroller e patiloeng ka har'a khetla ea sehokelo sa USB-C e kenyang likonopo le ho boloka sephethephethe).
5. Fetolela laptop 'me u hlahlobe likurufu tse ka tlase tsa sekoahelo le maoto a rabara: Batla litšepe tse ncha tse nyane tse nyane tse nyane tse nyane. P5 Pentalobe, Torx T5, kapa Phillips li-screw heads, li-screw-hole tamper seals tse sieo, kapa sekhutlo se tlase se sa luleng hantle hobane chassis e ile ea buleha ka potlako ho hokela sekotwana sa SPI sa kahare kapa M.2 Ho kenngoa ha PCIe.
6. Sheba hore na laptop ea hau e ne e siiloe ka "Boroko / Standby (S3 / S0ix Boemo ba Kajeno)" khahlano le "Completely Powered Off (S5 / Hibernated S4)" ha ho sa lebelloa:
7. Haeba laptop ea hau e ne e Robetse feela (Sekoahelo se Koetsoe) ha mohlaseli a e fumana: Your **Full-Disk Encryption (BitLocker, FileVault, LUKS) senotlolo sa encryption ea molumo (VMK) e ne e lutse e sirelelitsoe ka mongolo o hlakileng ka har'a laptop ea hau e sa fetoheng DRAM memori e sebetsa nako eohle **. Motho ea hlaselang ea nang le sesebelisoa sa Thunderbolt/USB4 DMA (lits'ebetsong tsa khale tse sa kengoang), tlhaselo ea RAM e batang ea boot, kapa senotlolo se tsebahalang sa senotlolo sa senotlolo se ka bala mohopolo o sebetsang ntle le ho tseba phasewete ea hau.
8. Haeba u belaela hore laptop e robetseng e ile ea ferekanngoa: Tšoara Konopo ea Matla fatše bakeng sa metsotsoana e 10 e tletseng ** ho qobella ho tima hang-hang (ho hloekisa linotlolo tsa DRAM tse sa tsitsang) ho e-na le ho bula sekoahelo le ho kena.
9. Buta ho tsoa ho USB ea kantle e tsebahalang e hloekile, e baloang feela (Ubuntu Live / Tails / SystemRescue e lula e le motho oa hau ka linako tsohle) ho hlahloba hore na drive e ka hare e sa ngolisoa /boot le EFI System Partition (ESP) hashe:
10. Haeba u tsamaisa Linux ka LUKS kapa Windows e nang le BitLocker, ho qala ka thupa e hloekileng ea kantle ea USB mochining o arohaneng kapa o netefalitsoeng ho etsa hore faele e 'ngoe le e 'ngoe e kene /boot/efi/ (ESP) le /boot/initramfs-* (sha256sum) 'me u hlahlobe hore na litempe tsa linako tsa phetoho ea karohano (stat) e fetotsoe nakong ea fensetere ea lihora tse 2 ha u ne u le ka ntle ho kamore ea hau ea hotele.
11. Sheba Litlaleho tsa Ketsahalo ea OS (Windows Event Viewer, macOS unified log, Linux journalctl) ho tsoa sebakeng se sireletsehileng sa ho bala feela ho bona hore na sekoahelo se butsoe, sesebelisoa sa USB se kentsoe, kapa mochine o ile oa tsosolosoa ha u ntse u le sieo:
12. Sistimi e 'ngoe le e' ngoe ea sejoale-joale e tlaleha setempe sa linako tse sa fetoheng ho fihlela millisecond neng kapa neng ha ACPI Lid Switch e bula, sistimi e tsoha borokong (Kernel-Power Event ID 42 / 107 ho Windows, Wake reason: EC.LidOpen ho macOS), kapa USB e ncha VID:PID sesebelisoa se baloa ka beseng.
13. Haeba u le motho ea kotsing e kholo (moqolotsi oa litaba, mokonteraka oa ts'ireletso, molaoli, ramolao oa litokelo tsa botho, kapa motho ea saenneng polokelong ea matlotlo ea crypto) mme o fumana bopaki bo tiileng ba ho buloa ha chassis ea 'mele, ho hlophisoa bocha ha BitLocker/TPM PCR e sa lebelloang, kapa liketsahalo tse sa lumelloeng tsa ho tsoha ha u ntse u le sieo, tšoara thepa e chesitsoe (Quarantine Device):
14. Se ke oa hokela laptop ea belaelloang ho VPN ea hau ea khoebo kapa Wi-Fi ea lapeng. Sebelisa smartphone e arohaneng, e hloekileng (e neng e lula ka pokothong ea hau) ho fetola lintlha tsa hau, ho hlakola linako tse sebetsang (ho koeteloa ha li-cookie le ho hlakoloa ha li-passkey), le ho fetisetsa lichelete kapa liphiri ka lisebelisoa tse hloekileng.

Sefate sa liqeto: ho hlahloba laptop kapa sesebelisoa se sa hlokomeloeng ka mor'a hore ho belaelloe hore ho na le phihlello ea 'mele¶

Latela mokhoa ona oa ts'ebetso ho fumana hore na sesebelisoa sa hau se neng se sa hlokomeloe se fumanoe kapa se fetotsoe le hore na ho hlokahala boemo bofe ba ho lokisa:

flowchart TD
    Start["Laptop, Mohala, kapa Hardware Wallet e Tloha e sa Lebelloa Ka Phaposing ea Hotele, Tlhahlobo ea Border, kapa Sebaka sa Tšebetso"] --> StateCheck{"Laptop e ne e le Boemong bofe ba Matla Ha U sa Tsoa ho Bohlokoa ba Hao?"}

    StateCheck -->|"Robetse / Standby (Sekoahelo se koetsoe, RAM e tsamaisoa) KAPA e notletsoe"| HighRiskState["KOTSI E PHAHAMENG: Linotlolo tsa Disk Encryption & Cookies tsa Session li ne li phela ka RAM (Ts'ssceptible to BadUSB, Lock-Screen Bypass, kapa DMA/RAM Extraction)"]

    StateCheck -->|"E Felletse ka Matla (Cold S5 Shutdown)"| ColdState["KOTSI ea RAM e tlase: Linotlolo li ne li le sieo ho RAM, kahoo Mohlaseli o Lokela ho Fetola Bootloader (/boot / EFI), Flash SPI BIOS, kapa Plant Hardware Keylogger."]

    HighRiskState --> PhysCheck["MOHATO OA 1: Hlahloba Li-Screws tsa Kantle, Seam se ka Tlase, Li-ports tsa USB, le Lithapo tse tjhajang Tlas'a Tochi e Khanyang (O se ke oa Sebelisa Lithapo Tse sa Lebelloang Hape)"]
    ColdState --> PhysCheck

    PhysCheck --> BootBehavior{"Ho Etsahala'ng ha U Hlahloba Botšepehi ba Boot / Litekanyo tsa TPM?"}

    BootBehavior -->|"BitLocker / TPM Hang-hang e Batla Senotlolo sa 48-Digit Recovery KAPA Lipontšo tse Sireletsehileng tsa Boot li holofetse / li fetotsoe"| BootTamper["CONFIRMED BOOT PATH ALTERATION: TPM PCRs (0, 2, 4, 7) Firmware e fetotsoeng ea BIOS e fumanoeng, Option ROM, kapa EFI Bootloader"]

    BootBehavior -->|"Boots ka tloaelo (Kapa E hlahlobiloe ho Bala Feela ka USB ea kantle e phelang)"| LogCheck["MOHATO 2: Hlahloba ACPI Lid-Open / Wake Logs & Nalane ea Khokahano ea USB Nakong ea Fesetere ea Ha U le Sieo"]

    LogCheck -->|"Li-Logs Show Lid li Buletsoe, Sesebelisoa sa USB se hoketsoe, kapa Reboot e sa Hlalosoang Ha U Tsamaea"| ConfirmedTouch["E TIISETSOE KAMOHELO E SA TUMELLANG HO FIHLELA 'Mmeng"]
    LogCheck -->|"Liketsahalo tsa Zero Wake, Likheo tsa ho Qala hape tsa Zero, Litiiso tsa Sekheo se sa Tiisitsoeng & Li netefalitsoe / boot Hashes"| CleanPass["Ha ho na bopaki ba ho tsosoa ha elektroniki kapa ho feto-fetoha ha Boot -> Tiisa password ea BIOS + Ts'ireletso ea Kernel DMA + Leano le Felletseng"]

    BootTamper --> BurnDevice["U SE KE U TLA KENYA LIPASWERU MOCHING ONA: Quarantine Hardware, Hlakola All Cloud Session/SSH Keys ho tsoa ho Hloekileng Mohala, le Image Drive Forensically"]
    ConfirmedTouch --> BurnDevice

Li-Vector tse 5 tsa Tekheniki tsa Tlhaselo ea "Evil Maid".¶

Ho tseba hore na ke lintlha life tseo u lokelang ho li batla, utloisisa mekhoa e mehlano ea sebele e sebelisoang nakong ea litlhaselo tsa matsoho khahlanong le li-laptops le li-wallet tsa hardware:

Mokhahlelo oa 1: Tlhahlobo ea Forensic ea Laptop e sa Mohlokomeletsoeng (Pele ho Kena)¶

Haeba u khutlela kamoreng ea hau ea hotele kapa u amohela laptop ea hau ka mor'a tlhahlobo ea moeli 'me u batla ho tseba hore na ho na le motho ea ileng a bula, a tsosoa, kapa a kentse sesebelisoa ho eona ha u le sieo, etsa licheke tsena ka tatellano:

1. Mohato oa 1: Physical Port, Cable, le Chassis Screw Audit¶

1. **Bea ka thoko lithapo life kapa life tse neng li siiloe ka phaposing **:
2. E O.MG Cable kapa USB Ninja e shebahala ka liperesente tse 100 e ke ke ea khetholloa ho tloha ho thapo e lohiloeng ea Apple USB-C ea 'nete, thapo ea Anker, kapa adaptara ea Dell USB-C, ho ea fihla linomorong tsa serial tse kentsoeng ka laser mokokotlong oa sehokelo.
3. Haeba u siile thapo ea USB-C, setene sa motlakase, kapa hub ea USB e sa hlokomeloe sebakeng se kotsi haholo, ** emisa ho hokela melaetsa ea data ho laptop ea hau **; e ka 'na ea e nkela sebaka ka thapo e tsebahalang e tsoang mokotleng oa hau o tiisitsoeng kapa u behe se thibelang data ea USB feela (Khohlopo ea USB) ka letoto le eona.
4. Sheba Sekoaelo se ka Tlase le Seam Tlas'a Leseli la Leseli la Raking:
5. Tšoara toche ea smartphone ea hau sebakeng se sa tebang 15-degree angle ("raking light") ho theosa le hlooho e 'ngoe le e 'ngoe ea screw botlaseng ba laptop ea hau.
6. Likurufu tsa fektheri tse torque hanngoe setsing sa ho kopanya li na le lintja tse hloekileng, tse tšoanang le tsa anodized ka har'a sebaka sa linaleli/sefapano. Sekurufu se neng se sa koaheloa ka phaposing ea hotele se nang le tšepe e bonts'ang **mekhoro ea tšepe e khanyang ka har'a sekoti **, lerōle le ferekaneng le bolou/khubelu, kapa poleiti ea aluminium e tlase e sa tsamaisane hantle le likotoana tse ka morao.

2. Mohato oa 2: Ho hlahloba OS Wake, Lid-Open, le Reboot Logs (Na Laptop e ile ea Bulela Ha U Tsamaea?)¶

Hlokomela nako e nepahetseng ea fensetere eo u neng u le hole le laptop (mohlala, 12:15 PM to 01:45 PM). Le ha mohlaseli a butse thupa ea Live USB, ** lekhalo le sa lebelloang kapa boot e batang nakong ea ts'ebetso ea hau ea OS, kapa ketsahalo ea ACPI Lid-Open ka fensetere eo, e paka hore laptop e ne e qhekelitsoe **:

Ho macOS (MacBook Air / MacBook Pro):¶

Bula ** Terminal ** 'me u tsamaise taelo ena ho hlahisa ketsahalo e' ngoe le e 'ngoe ** Sekoahelo se Bulehileng, Sekoahelo se Koala, Tsoha, Boroko, le Power-On/Shutdown** ketsahalo ea hardware ho tswa ho System Management Controller (SMC / PMU) nakong ea lihora tse 24 tse fetileng:

pmset -g log | grep -E "Wake|Sleep|LidOpen|LidClose|Start|Shutdown|DarkWake" | tail -n 60

log show --predicate 'eventMessage contains "USB" or process == "kernel"' --last 4h | grep -iE "usb|appleusb|hid"

Ho Linux (Ubuntu, Fedora, Debian, Arch, RHEL):¶

1. Hlahloba systemd-journald bakeng sa liketsahalo life kapa life tsa ho qalisa / ho koala kapa liphetoho tsa sekwahelo / boroko nakong ea ha u le sieo:

   journalctl --list-boots -n 10
   journalctl --since "4 hours ago" | grep -iE "lid|suspend|wake|usb|new high-speed|hid-generic|thunderbolt|pcie"
   

2. ** Netefatsa hore ha oa ngoloa /boot le /boot/efi li-partitions ha lia ka tsa fetoloa ha mochini o ntse o tima **: Sheba hantle Modify le Change (ctime) litempe tsa linako tsa inode tsa setšoantšo se seng le se seng sa kernel, initramfs, le GRUB EFI binary ka hare /boot:

   find /boot -type f -exec stat -c "%y %z %n" {} + | sort
   

3. (Haeba faele e teng ka hare /boot kapa /boot/efi e na le Change kapa Modify setempe sa nako ha o ne o le ka ntle ho phaposi, kapa ho tloha qetellong apt/dnf ntlafatso ea kernel, ** bootloader ea hau e senyehile *.)

Ho Windows 10/11:¶

Bula fensetere ea Administrator PowerShell 'me u botsitse Log ea Ketsahalo ea Sistimi bakeng sa Matla a ho Bulela (ID 12), koala (ID 13), Robala (ID 42), Tsoha Borokong (ID 1 / ID 107), le Tahlehelo ea Matla a sa Lebelloang (ID 41) lihoreng tse 24 tse fetileng:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=@(1, 12, 13, 41, 42, 107); StartTime=(Get-Date).AddHours(-24)} | Select-Object TimeCreated, Id, ProviderName, Message | Format-Table -AutoSize -Wrap

Get-WinEvent -LogName "Microsoft-Windows-DriverFrameworks-UserMode/Operational" -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-12) } | Select-Object TimeCreated, Id, Message

Mokhahlelo oa 2: Hobaneng Apple Silicon Macs & Modern TPM 2.0 + PIN Litsamaiso li thata ho feta "Evil Maid" (Le mokhoa oa ho li hlophisa hantle)¶

Ha se lilaptop tsohle tse kotsing ea ho hlekefetsoa 'meleng. Mona ke kamoo metso ea sejoale-joale ea ts'epo e sebetsang le litlhophiso tse nepahetseng tseo u tlamehang ho li lumella:

1. Apple Silicon MacBooks (M1, M2, M3, M4)¶

Apple Silicon Mac ke tse ling tsa lilaptop tsa bareki tse hanyetsanang le Evil-Maid tse kileng tsa hahoa S5) mme e hlophisitsoe ka Firmware + Firmware/Recovery Security: - Boot ROM e kenngoa ka silicon e ke keng ea fetoha ka hare ho M-Series SoC (Hardware Root of Trust). Mohato o mong le o mong oa ketane ea boot (iBoot -> macOS Kernel -> Bolumo ea Sisteme e saennoeng ka mokhoa oa Cryptographically SSV) e netefatsoa ke senotlolo sa lisebelisoa tsa Apple pele e etsoa. - Lits'oants'o tsa polokelo tsa NAND li kentsoe ka har'a hardware ke Secure Enclave (AES-XTS) ho sebelisa linotlolo tse tlamelletsoeng ho password ea hau ea FileVault e nang le meeli ea sekhahla sa ho hanyetsa hammering ea hardware. - **Litlhophiso tse 3 tse tlamang tseo u tlamehang ho li netefatsa ho MacBook ea hau hona joale *: 1. FileVault E BUTSE: Litlhophiso tsa Tsamaiso > Lekunutu & Tshireletso > FileVault -> HO BUTSWA. 2. Thibela ho Kena ka Otho 'me U Hloka Lekunutu Hang Hang ha U Robala: Litlhophiso tsa Tsamaiso > Notlela Skrine -> Hloka phasewete ka mor'a hore skrini se qale kapa pontšo e tingoe -> Hang-hang. 3. Thibela lisebelisoa tse sa lumelloeng tsa USB / Thunderbolt ha e notletsoe: E ea ho Litlhophiso tsa Tsamaiso > kunutu le Tšireletso > Lumella lisebelisoa hore li hokahane 'me u li behe ho **otsa Lisebelisoa tse Ncha"* kapa **"Botsa Nako le Nako" (le ka mhla "Ka Kakaretso HaU Notlolloa" kapa "Kamehla"). Ha e setetsoe ho "Ask Every Time", plugging a BadUSB keystroke injector kapa Thunderbolt DMA sesebelisoa ka har'a MacBook e notletsoeng e theola boema-kepe hore e be mokhoa oa matla feela ebe e thibela palo eohle ea data ea PCIe/USB boemong ba taolo ea lisebelisoa.

2. Windows 10 / 11 Pro & Enterprise (BitLocker + Pre-Boot TPM PIN + Kernel DMA Protection)¶

Ka ho sa feleng ho liperesente tse 99 tsa lilaptop tsa Windows (Dell, Lenovo, HP, Surface), BitLocker e hlophisitsoe ho "TPM-Only" (Tshebetso e pepeneneng): - Ha o tobetsa konopo ea matla ho a TPM-Only BitLocker laptop, ** lihoete tsa laptop li toba Windows Lock Screen ntle le ho u kopa PIN ea BitLocker **, ho bolelang hore chip ea TPM e ile ea hlakola senotlolo sa master drive (VMK) ebe o kenya Windows OS ho RAM. - Ho laptop efe kapa efe e sebelisang **discrete TPM chip ** e hokahaneng le CPU ka board ea mama SPI kapa LPC bese, mohlaseli ea bulang sekoahelo se ka tlase ebe o qhekella tlhahlobo ea kelello ea $50 ho chip ea TPM. MOSI/MISO pin e bala mongolo oa hau oa BitLocker Volume Master Key (VMK) ho tloha mohala ka metsotsoana e 5 (BitPixie / TPM-Sniffing) ntle le ho tseba phasewete ea hau ea Windows. - Ho qala ho fihla skrineng sa ho kena sa Windows ho boetse ho pepesa kernel ea Windows, stack ea Wi-Fi, le bese ea PCIe e sa lebelloa.

Mokhoa oa ho bulela PIN e tlamang BitLocker Pre-Boot Startup PIN (TPM + PIN) ho Windows ka Metsotso e 2:¶

Ho eketsa Pre-Boot BitLocker PIN ho qobella hardware TPM 2.0 chip ho boloka senotlolo sa "disk encryption" se notletsoe ka har'a silicon ea eona e sa thibeleng ho fihlela u thaepa PIN ea hau ea pele ea litlhaku tse 6 ho isa ho tse 20 skrineng e ntšo ea BIOS/BitLocker: 1. Tobetsa Win + R, mofuta gpedit.msc, ebe o tobetsa Enter (ho Windows 10/11 Pro, Enterprise, kapa Education). 2. Tsamaisa ho: **Tlhahiso ea Khomphuta > Lithempleite tsa Tsamaiso > Likarolo tsa Windows > Encryption ea BitLocker Drive > Lits'ebetso tsa Tsamaiso **. 3. Penya habeli "E hloka netefatso ea tlatsetso qalong", e behe ho E lumelletsoe, ebe o seta Lokisa PIN ea ho qala TPM: ho Require startup PIN with TPM. 4. Bula Administrator Command Prompt kapa PowerShell ebe u seta PIN ea hau e ncha ea BitLocker (ho lumella li-passphrases tsa alphanumeric, hape u nolofalletse "Lumella li-PIN tse ntlafalitsoeng bakeng sa ho qala" foldareng e tšoanang ea Pholisi ea Sehlopha):

manage-bde -protectors -add C: -TPMAndPIN

3. Linux (LUKS2 + Secure Boot + Unified Kernel Images (UKI) + BIOS Password)¶

Ho lilaptop tsa Linux (Ubuntu, Fedora, Debian, Arch, Qubes OS), maemo LUKS encryption ea disk e felletseng e se e hloka hore o thaepe poleloana ea pele ea boot pele koloi e bula, e emisang ho fofonela ha bese ea TPM . Leha ho le joalo, Linux e tloaelehileng e kenya matsatsi a phomolo /boot (initramfs le vmlinuz) e sa ngolisoa, e ba etsa hore ba hlaselehe habonolo metsotso e 2 ea USB Evil Maid /boot replacement ntle le haeba o nka mehato ena e meraro e thatafatsang: 1. ** Beha Lekunutu le Matla la UEFI / BIOS 'me u thibele Boot ea kantle ea USB/Network: - Kenya BIOS ho laptop ea hau (F2, F1, F10, kapa Del ka matla-on) -> e-ea ho ** Tšireletso > Molaoli / Mohlokomeli Password ** 'me u behe poleloana e matla e le hore mohlaseli a se ke a tobetsa F12 bootng ho kenya thupa ea USB. 2. Lumella UEFI Sireletsehile Boot + Ngolisa Linotlolo tsa Tloaelo / Litšoantšo tsa Kernel tse saenneng (sbctl + UKI): - Lisebelisoa tse kang sbctl(Arch, Fedora, Debian, Ubuntu) bokella Linux kernel, kernel command line, le initramfs ho seketsoana se le seng se saenneng ka mokhoa oa sephiri Unified Kernel Image (UKI .efi) e netefalitsoe ke senotlolo sa hau sa UEFI Secure Boot (PK / KEK / db). Haeba Mosebeletsi ea Mobe a fetola li-byte tsa hau initramfs, firmware ea UEFI e hana ho e qalisa 'me e hlahisa temoso e khubelu Secure Boot Violation pele u ngola phasewete ea hau ea LUKS. 3. ** Netefatsa IOMMU / Kernel DMA Protection le Kenya USBGuard: - Sheba hore na Linux kernel IOMMU e sebetsa (dmesg | grep -iE "DMAR|IOMMU|AMD-Vi") ebe kenya usbguard(sudo apt install usbguard) ho thibela e sa tsoa kenngoa HID keyboards (03:*:*) ha skrini sa hau se notletsoe.

Mokhahlelo oa 3: Litiiso tsa DIY Physical Tamper Detection bakeng sa Maeto a Kotsi e Phahameng ("Glitter Nail Polish" & Haven)¶

Liofisiri tsa bohlale, bafuputsi ba hardware, le baqolotsi ba litaba ba lipatlisiso ba sebelisa mekhoa e 'meli e sa bitseng, e ke keng ea lebaloa ea ho lemoha lintho tsa 'mele:

1. The "Glitter Nail Polish + Macro Photo" Screw Seal (Uncounterfeitable Entropy)¶

Li-stickers tsa "VOID IF FOVED" tsa khoebo li ka rekoa Amazon ka $ 10, ea ebolloa, 'me ea nkeloa sebaka ke setikara se tšoanang. **Polisi e benyang ea manala ha e lebalehe ka lipalo **: 1. Reka botlolo ea $5 ea **polense e hlakileng ea manala e tlatsitsoeng ka mebala e mengata, li-flakes tsa tšepe tse ngata tse boholo bo fapaneng **. 2. Penta lesela le lenyenyane la poleche e benyang ho phunyeletsa likurufu tse peli tse khurumelitsoeng ka tlase tse khurumelitsoeng ka tlase (ho kenyelletsa hlooho ea sekoahelo ho tšepe ea chassis e potolohileng) le ho tšela moroko o ka tlase oa laptop ea hau (kapa ka mose ho theipi e koalang mokotla oa hau oa laptop o kentsoeng ka marako). 3. Hang ha e omella, nka foto ea boemo bo holimo ea tiiso e 'ngoe le e 'ngoe e benyang u sebelisa kh'amera ea hau ea smartphone (e lulang ka pokothong ea hau). 4. Hobaneng mohlaseli a sa khone ho e hlola: Leha mohlaseli a na le mofuta o tšoanang hantle oa poleli ea manala e benyang, **tebelelo e sa reroang ea 2D ea geometric, kabo ea mebala, le li-angles tse fetang tse 80 tse benyang ** li etsa monwana o ikhethang. Ha u khutlela kamoreng ea hau ea hotele, nka foto ea bobeli ea screw seal ho tloha lehlakoreng le le leng 'me u bapise lifoto tsa "Pele" le "Kamora" fonong ea hau: haeba screw e le 'ngoe e ne e fetotsoe ke likhato tse 5, paterone ea glitter e fetoha ka mokhoa o hlakileng.

2. Ho Fetolela Fono ea Khale ea Android ea Spare hore e be Sensor ea Intrusion ea Kamore ea hoteleng (Haven App)¶

• E thehiloe ke Guardian Project le Freedom of the Press Foundation, sesebelisoa sa mahala sa Android se bulehileng Haven: Keep Watch e fetola mohala o fe kapa o fe oa Android hore e be motsamao, molumo, vibrate (accelerometer) le sebui sa mabone a ambient.
• Pele u siea laptop ea hau ka phaposing e sireletsehileng ea hotele kapa laeng, beha mohala o se nang mohala o sebetsa Haven ka holim'a laptop ea hau ka har'a lae kapa mokotla o koetsoeng: haeba mang kapa mang a bula lai (ho fetola molumo oa sensor ea leseli) kapa a ama laptop, Haven e nka linepe ka khutso, e rekota molumo, ebe e romela tlhokomeliso e patiloeng Signal fonong ea mantlha e ka pokothong ea hau.

3. Ho Tšela Meeli ea Machabeng le Litlhahlobo tsa Sekondari tsa Boema-fofane ka Polokeho¶

Haeba u etela linaheng tse ling ka libaka tse kotsi haholo moo litloaelo kapa liofisiri tsa moeli li ka nkang lilaptop le mehala moo ho sa bonahaleng: 1. ** Eta ka Laptop e Inehetseng ea "Maeto a Hloekileng / Burner" le Mohala**: Le ka mohla u se ke ua nka sebaka sa hau sa mantlha sa mosebetsi, polokelo ea password ea bophelo bohle, kapa linotlolo tsa SSH ho tšela meeli e kotsi haholo. E-ba le Chromebook e hloekileng kapa laptop e nang le litšoantšo tse ncha e nang le lifaele tse khethehileng feela tse hlokahalang bakeng sa leeto leo, 'me u fihlele mosebetsi oa bohlokoa ka ho fetisisa ka mor'a hore u fihle. 2. Ho tima ka ho feletseng (S5) Metsotso e 10 Pele o Kena Holong ea Meetlo: Koala laptop le mohala ka botlalo (Power Off) pele o theoha sefofaneng kahoo DRAM e senyeha ka ho feletseng le ho notlolloa ka biometric (Face ID / Touch ID) e koaletsoe molemong oa poleloana e matla ea alphanumeric.

Linomoro tsa libaka tsa tšohanyetso le liprothokholo tsa mekhatlo¶

Tšitiso ea 'mele ea lisebelisoa tsa khomphutha, ho lema li-keylogger tse patiloeng, kapa bohloela bo sa lumelloeng ba moeli / hotele bo lokela ho tlaleheloa mekhatlo ea naha ea bohloela le ts'ireletso ea marang-rang:

• United States le Canada:
• Litšebeletso tsa Tšohanyetso: Daela 911 ha o ka fumana motho ya kenang hoteleng kapa moo o dulang teng.
• Boro ba Federal of Investigation (FBI) Counterintelligence & Cyber Division / IC3: Ha o le moeti wa US, mokonteraka wa tshireletso, mmatlisisi, kapa molaodi eo laptop ya hae kapa mohala wa hae o sebeditsweng kantle kapa hoteleng, tlaleha ketsahalo ena ho FBI Field Office Counterintelligence Squad kapa ho ic3.gov le cisa.gov/report (boloka thapo e senyehileng kapa laptop e sa kang ea angoa ka mokotleng oa Faraday bakeng sa tlhahlobo ea lab ea forensic ea FBI).
• Tšebeletso ea Bohlale ba Tšireletso ea Canada (CSIS) & Cyber Centre: Letsetsa 1-833-CYBER-88 kapa ikopanye le CSIS (613-993-9620) bakeng sa seo ho belaelloang hore ke ts'ebeliso ea lisebelisoa tsa kantle ho naha.
• United Kingdom:
• Litšebeletso tsa Tšohanyetso: Daela 999 (kapa 101 bakeng sa mapolesa).
• Setsi sa Naha sa Ts'ireletso ea Cyber ​​(NCSC) & Bolaoli ba Naha ba Tšireletso (NPSA): Mmuso wa UK, barutehi, le baeti ba dikgwebo ba lokela ho latela **NCSC / NPSA Tataiso ea Sesebediswa sa Maeto a Overseas ** mme ba tlalehe ho belaelloa hore ho na le ts'ebetso ea lisebelisoa tsa 'mele ka ncsc.gov.uk.
• European Union:
• Litšebeletso tsa Tšohanyetso: Daela 112 ho phatlalla le linaha tsohle tseo e leng litho tsa EU.
• Li-CSIR tsa Naha / Mekhatlo ea Tšireletso ea Malapeng (ANSSI Fora, BSI Jeremane, AIVD/NCSC-NL Netherlands): Tlaleha li-implants tsa firmware kapa hardware ho CSIRT ea hau ea naha bakeng sa netefatso ea forensic ea hardware SPI/UEFI.
• Australia le New Zealand:
• Litšebeletso tsa Tšohanyetso: Daela 000 Australia kapa 111 New Zealand.
• Setsi sa Tšireletso ea Cyber ​​ea Australia (ACSC / ASD) & ASIO Outreach: Letsetsa 1300 CYBER1 (1300 292 371).
• India le Asia-Pacific:
• India (CERT-In / Boemo ba Tšohanyetso): Daela 112 bakeng sa mapolesa kapa tlaleha liketsahalo tsa ts'ireletso ea hardware / firmware ho incident@cert-in.org.in.

Lipotso tse botsoang khafetsa¶

Hobaneng ha laptop ea ka ea Windows e ile ea emisa ka tšohanyetso ho qala ka mokhoa o tloaelehileng ebe e kopa senotlolo sa ka sa 48-digit BitLocker Recovery hang ka mor'a hore ke e siee ka phapusing ea ka ea hotele?¶

Ha BitLocker e nolofalitsoe ho laptop ea Windows, hardware Trusted Platform Module (`TPM 2.0`) e lekanya li-cryptographic SHA-256 hash tsa firmware ea hau ea BIOS/UEFI (`PCR 0`), khetho ea ROM (`PCR 2`), UEFI Boot Manager (`PCR 4`), le Secure Boot state (`PCR 7`) nako le nako ha laptop e bulela. Haeba motho e mong a ile a ama laptop ea hau ha u ntse u tsoa ka phapusing 'me ka tšohanyetso e ema skrineng se seputsoa e batla senotlolo sa hau sa ho khutlisa BitLocker sa linomoro tse 48, e' ngoe ea lintho tse peli e etsahetse: ebang ke ntlafatso e nepahetseng ea BIOS e sa tsoa kenngoa, kapa motho e mong o fetotse odara ea hau ea boot ea BIOS, a holofatsa Secure Boot, a bulela thupa ea kantle ea USB, kapa a fetola firmware ea hau ea bootloader., ho etsa hore li-hashes tsa TPM PCR li fetohe le ho tsosa ho koaloa ha anti-tamper ea BitLocker. Se ke oa kenya senotlolo sa hau sa ho fumana lintlha tse 48 ho fihlela o hlahloba lits'oants'o tsa BIOS le ketane ea boot, hobane ho thaepa senotlolo sa hau sa ho hlaphoheloa sebakeng se senyehileng sa boot ho pepesa koloi ea hau.

Haeba ke notlela Windows kapa Mac skrine ea ka (Win+L / Ctrl+Cmd+Q) pele u tsamaea lebenkeleng la kofi kapa hoteleng, na ho na le motho ea ka e senyang ka boema-kepe ba USB-C?¶

E ipapisitse le litlhophiso tse peli: Ea pele, haeba motho a plug a BadUSB keystroke ente (`Flipper Zero` kapa `Rubber Ducky`) ka har'a laptop e notletsoeng, keyboard ea bohata e ka thaepa feela ka har'a lebokose la senotlolo se skrineng sa senotlolo (ha e khone ho bula terminal ha skrini se notletsoe). Ea bobeli, leha ho le joalo, haeba laptop e na le ea khale Thunderbolt 3/4 kapa boema-kepe ba USB4 ntle le Ts'ireletso ea Kernel DMA e lumelletsoeng, sesebelisoa sa hardware se khethehileng sa PCIe DMA (`PCILeech`) o khona ho bala le ho ngola RAM ea sistimi ka kotloloho ka bese ea PCIe ha skrini se notletsoe. E nolofalletsa Tšireletso ea Kernel DMA ka Windows (`System Information > Kernel DMA Protection: On`) kapa ho seta macOS **Lumella lisebelisoa ho hokela -> Botsa Nako le Nako ** e thibela phihlello ea data ea USB-C/Thunderbolt ka botlalo ha skrini se notletsoe.

A na nka skena firmware ea board ea ka ea UEFI / BIOS ho tsoa ka har'a Linux kapa Windows ho bona hore na Evil Maid e bonesitse kemiso ea firmware?¶

Ee. Lisebelisoa tsa ts'ireletso tsa firmware tse bulehileng tse ntlafalitsoeng ke Intel le bafuputsi ba ts'ireletso, ka ho khetheha CHIPSEC (`github.com/chipsec/chipsec`) le fwupd (`fwupdmgr security`) ho Linux, e u lumella ho lahla setšoantšo sa hau sa SPI flash ROM ka kotloloho ho tsoa ho boardboard (`chipsec_util spi dump rom.bin`), netefatsa hore na hardware ea BIOS Ngola Tšireletso (`BIOS_CNTL` `BLE`/`BWE` likotoana le `PR0-PR4` Protected Range registers) e notletsoe hantle, 'me u bapise hash ea hau ea SPI flash khahlano le setšoantšo sa BIOS sa moetsi oa semmuso.

Na ho bolokehile ho notlela laptop ea ka ea laptop kapa hardware crypto wallet ka har'a kamore ea hotele e sireletsehileng ea elektroniki?¶

Le ka mohla u se ke ua itšetleha ka "keypad" ea elektroniki ea kamore e tloaelehileng ea hotele ho itšireletsa khahlanong le tlhaselo ea Evil Maid. Hoo e ka bang tšireletso e 'ngoe le e 'ngoe ea elektronike ea hotele e na le senotlolo sa bokahohleng se patiloeng ka mor'a beche ea logo ea polasetiki karolong e ka pele, hammoho le khoutu ea ho feta ea feme.`000000` kapa `999999`) tse tsejoang ke basebetsi ba hoteleng. Haeba sebaka se sireletsehileng sa kamore ea hotele e le khetho ea hau feela, beha laptop ea hau ea motlakase ka har'a serialized mokotlana oa tšireletso o hlakileng (kapa kenya setiiso se fototsoeng sa glitter-nail-polilish seam) e le hore u tsebe hang-hang hore na sesebelisoa sa hau se ile sa angoa.

"Hibernation" ke eng?S4)" vs. "Robala (S3 / S0ix)", 'me na Hibernation e sireletsa khahlanong le litlhaselo tsa RAM / DMA Evil Maid?¶

Ha laptop e kena Robala (`S3` kapa `S0ix`), li-chips tsa RAM li lula li le matla 'me li tšoara linotlolo tsa hau tsa "decrypted encryption" mohopolong o sa tsitsang. Ha laptop e kena 'nete Hibernation (`S4`), sistimi ea ts'ebetso e ngola litaba tsa RAM ho faele ea hibernation e patiloeng (`hiberfil.sys` kapa swap e patiloeng) ho SSD e patiloeng, e hlakola linotlolo tsa master disk encryption, 'me e fokotsa matla ohle a motlakase ho board ea mama le RAM ka botlalo (feela joalo ka ho koala ka botlalo). Ka hona, ka bobeli ** Ho koala ka botlalo (`S5`)** le **Hibernation (`S4`) koloing e sirelelitsoeng ke PIN ea pele ea boot ea BitLocker kapa LUKS passphrase** sireletsa RAM ea hau khahlanong le DMA le litlhaselo tse batang, hafeela Secure Boot le password ea BIOS thibela `/boot` tampering.

Litataiso tse amanang¶

• Thibelo ea data ea kiosk ea sechaba (khohlopo ea USB) le ente ea BadUSB HID
• BitLocker, FileVault, le LUKS encryption recovery keylockout le TPM reset
• BIOS le UEFI firmware apdeite setene, tahlehelo ea matla, le Dual-BIOS Flashback
• Laptop e utsoitsoeng kapa mohala: hlakola ka hole le ho koala ak'haonte
• Cryptocurrency sepache drain le ho sekisetsa peo-polelo
• Linomoro tsa maemo a tshohanyetso ho ea ka linaha

Mehloli le tataiso ea semmuso¶

• Setsi sa Naha sa Maemo le Thekenoloji (NIST) (United States): Phatlalatso e Khethehileng 800-147B (Litataiso tsa Tšireletso ea BIOS bakeng sa Basebeletsi le Litsi tsa Mosebetsi) & SP 800-155 (Litaelo tsa Tekanyo ea Botšepehi ba BIOS).
• Setsi sa Naha sa Tšireletso (NSA) & Setsi sa Tšireletso ea Cybersecurity le Infrastructures (CISA) (United States): * Ho thatafatsa UEFI Secure Boot, Trusted Platform Module (TPM 2.0) Tlhophiso ea PIN ea Pre-Boot, le ho Fokotsa phihlello ea Memory ea Thunderbolt/PCIe (DMA) Litlhaselo*.
• Setsi sa Naha sa Ts'ireletso ea Cyber ​​(NCSC) & Bolaoli ba Naha ba Tšireletso (NPSA) (United Kingdom): Supply Chain le Overseas Travel Physical Device Security, Tamper-Evident Seals, le Boot Integrity Verification.
• Litokomane tsa Microsoft Hardware Security & Linux Kernel IOMMU / fwupd Tlhaloso ea Tšireletso ea Host (HSI): * Tšireletso ea Kernel DMA (VT-d / AMD-Vi) le Mehato ea Lipallo tsa BitLocker Khahlanong le Discrete TPM Bus Sniffing*.