ILaptop yomsebenzi ivalwe yedwa yiCrowdStrike/SentinelOne okanye itshixiwe yiVPN eyaphukileyo Bulala-Tshintsha ngelixa usebenza ukude.¶

Ukuvuka kwiofisi yasekhaya, kwigumbi lehotele, okanye kwindawo yokusebenzela ekude ukufumanisa ukuba ilaptop ekhutshwe yinkampani yakho ibonisa ukuba "Iqhagamshelwe, Akukho Intanethi" kuyo yonke inethiwekhi ye-Wi-Fi, iyala ukulayisha ihotele okanye kwisikhululo seenqwelomoya iphepha lokungena lesikhululo seenqwelomoya, okanye ukuntlitheka kwiWindows Blue Screen yokufa engapheliyo (BSOD) i-bootloop (PAGE_FAULT_IN_NONPAGED_AREA okanye SYSTEM_THREAD_EXCEPTION_NOT_HANDLED) yimeko engxamisekileyo yokusebenza kude. Kwiimeko zoshishino zale mihla, oku kutshixa ngokupheleleyo phantse ngalo lonke ixesha kubangelwa yenye yeendlela ezintathu zokhuseleko ezizenzekelayo:I-Endpoint Detection and Response (EDR) Network Containment quarantine iqaliswe ngu CrowdStrike Falcon, SentinelOne, okanye Microsoft Defender for Endpoint, a yonakeleyo yokufunyanwa kunye neResponse (EDR) Network Containment quarantine iqaliswe yi CrowdStrike Falcon, SentinelOne, okanye Microsoft Defender for Endpoint, a yonakele uhlaziyo lomqhubi ukuthintela uhlaziyo lomqhubi** ukuthintela uhlaziyo lokuqhuba Njalo-On VPN / Zero-Trust Network Access (ZTNA) Kill-Switch ** (**Zscaler Client Connector, Cisco AnyConnect / Secure Client, Palo Alto GlobalProtect, or Fortinet FortiClient **) ivalela yonke i-DNS yendawo kunye ne-DHCP traffic de kusekwe itonela. Ukuba ukuvala kwakho ngaphandle kubandakanya uhlaselo olusebenzayo lweransomware okanye ukuphanga, qhagamshelana neZiko leMisebenzi yoKhuseleko (SOC) kwaye udibane nengingqi yakho. amanani kaxakeka ukuba iziseko ezingundoqo ezibalulekileyo okanye iinkqubo zokhuseleko lobomi ziyachaphazeleka. Ngeentlekele ezinxulumene nomsebenzi okude, bona izikhokelo zethu ilaptop yokusebenza ibiwe okanye yophukile ngelixa uhamba kunye nokubuyisela i-MDM yokutshixa, usebenza kude nehotele, kwaye ugcino lwe-intanethi kunye noqhagamshelwano.

Ngenxa yokuba iziphelo zenkampani zenziwe lukhuni ngee-passwords ezikhuselayo, ii-akhawunti zabasebenzisi ezingezizo ezolawulo, kunye ne-Microsoft BitLocker* okanye i-macOS FileVault i-encryption egcweleyo yedisk, amaqhinga okucombulula iingxaki zabathengi (njengokufaka kwakhona iWindows okanye ukucinywa kweefolda zenkqubo) ziya kusilela okanye ziqalise i-high-threth-severityer kwibhodi yakho ye-CryretIso. Nangona kunjalo, ngokufumanisa ukuba ujongene ne- **EDR Host Isolation ** , ** VPN Captive-Portal Deadlock ** , okanye ** i-Kernel Driver Bootloop **, kwaye ubuze i-IT Helpdesk okanye iqela le-SecOps yakho ngeyona nto ichanekileyo ** i-48-digit BitLocker Recovery Key ** okanye ** Ixesha elinye loLondolozo lwe-Offline kwi-intanethi, ungabuyisela ilizwi lakho kwi-Offline Ukugcinwa kwe-Offline, * Ungayigcina i-1 kwimizuzu ye-1 ukubuyisela i-Offline ye-Offline. naphi na ehlabathini.

Yenza oku ngoku¶

1. Sukuzama ukosula, ukuseta ngokutsha, okanye uqalise ilaptop yeshishini kwiLinux engagunyaziswanga okanye iphasiwedi-eqhekeze intonga ye-USB. Ukuvula ilaptop yeshishini kwi-USB yangaphandle iihambo UEFI Secure Boot kunye Imodyuli yePlatform eThenjiweyo (TPM 2.0) i-PCR ihlola ingqibelelo, itshixa ngokukhawuleza i-hard drive emva kokuthumela i-48 i-tamper ebaluleke kakhulu kwiscreen sakho. Iziko leMisebenzi yoKhuseleko yenkampani (SOC) ngalo mzuzu ilaptop iphinda iqhagamshela.
2. Misa ukuba i-intanethi yakho ivalwe yi-EDR Quarantine vs. i-VPN Kill-Switch Deadlock. Vula i-Command Prompt (cmd.exe) okanye Terminal window kwaye uqhube ping 8.8.8.8 kwaye nslookup google.com. Ukuba ** yonke ipakethi enye ayiphumeleli nge General failure okanye Transmit failed. Error code 1231** nangona i-icon yakho ye-Wi-Fi isithi "Iqhagamshelwe," umqhubi wecebo lokucoca umlilo (inokuba yi-EDR Network Containment okanye i-VPN engqongqo Kill-Switch) iwisa zonke iipakethi eziphumayo kwi-Windows Filtering Platform (WFP) umaleko.
3. Ukuba usehotele, kwikhefi, okanye kwisikhululo seenqwelomoya kunye ne-VPN ehlala ivuliwe ivala i-Wi-Fi yekhasi lokungena ("Captive Portal Chicken-and-Egg Deadlock"), qhagamshela ilaptop yakho kwiselula yeWi-Fi Hotspot yeselula yakho KUQALA. Ngenxa yokuba i-hotspot ye-smartphone yakho ayisebenzisi phepha lewebhu elibanjwayo, inkampani yakho yenkampani iqinisekisa i-VPN ngokukhawuleza, iSebenzisa ifowuni yakho rhoqo. wisa phantsi nawuphi na umgaqo-nkqubo ohlaziyiweyo okanye ukhubaze ithokheni evela kwi-IT, kwaye ikuvumela ukuba ucele ixeshana Captive Portal Bypass / Disable Password.
4. ** Ukuba ilaptop yakho yeWindows ibambekile kwiscreen sokufa esiBlue (BSOD) i-bootloop emva kohlaziyo lokhuseleko lobusuku, fota kanye Stop Code kwaye .sys Igama lefayile ezantsi kwekhusi elizuba (njenge csagent.sys okanye SentinelMonitor.sys).** Elo gama lefayile lixelela iqela lakho le-IT ngoko nangoko ukuba ifayile yetshaneli ye EDR engalunganga okanye umqhubi wekernel ubangele ingozi.
5. Phambi kokungena kwiMowudi eKhuselekileyo yeWindows okanye iWinRE Command Prompt kwiPC yeshishini, fowunela i-IT Helpdesk kwifowuni yakho uze ubacele bakufundele okanye bakuthumelele iSMS kwiLaptop yakho enamanani angama-48 iSitshixo soBuyiselo seBitLocker (esidibanisa noonobumba abasi-8 bokuqala Key ID iboniswe kwiscreen sakho). Awunakuvula umyalelo wokubuyisela okanye uqalise kwiNdlela eKhuselekileyo kwilaptop yeshishini efihliweyo ngaphandle kokungena loo manani angama-48.
6. Ukuba i-CrowdStrike Falcon, i-SentinelOne, okanye i-Defender ye-Endpoint ibeke i-laptop yakho kwi-"Network Containment" (I-Host Isolation), yeka ukusebenzisa izikripthi okanye ukudlulisa iifayile kwaye ufowunele iZiko leMisebenzi yoKhuseleko yenkampani (SOC) ngefowuni. Cacisa kanye oko ubukwenza kanye phambi kokuba uvale i-lockout (njengokusebenzisa umqambi wokudibanisa umphuhlisi, isixhobo sokudibanisa umphuhlisi okanye isixhobo sokudibanisa i-Power ke umhlalutyi we-SOC unokuqinisekisa ukuba ibiyinto yobuxoki kwaye ucofe "Phakamisa isiqulatho" kwikhonsoli yelifu (efikelela kwilaptop yakho ngokuzenzekelayo nokuba uvalelwe).

Umthi wesigqibo: Ukuxilonga ukuvalwa kwenethiwekhi yelaptop kunye ne-bootloops¶

Sebenzisa le tshati ukuze uchonge ukuba loluphi umaleko wokhuseleko lweshishini olutshixe ilaptop yakho kunye nendlela eya kweyona nkqubo yokubuyisela.

flowchart TD
    A["ILaptop yoMsebenzi ekude itshixiwe ngaphandle okanye ayikwazi ukuQhagamshela"] --> B{"Ngaba ilaptop iqala kwiWindows / macOS desktop?"}
    B -->|"Hayi: Ukonakala kwiscreen esiBlue (BSOD) Loop okanye iBitLocker Screen"| C{"Yintoni eboniswa kwiscreen?"}
    C -->|"BSOD ethiya igama csagent.sys, SentinelMonitor.sys, okanye wdfilter.sys"| D["I-KERNEL DRIVER BOOTLOOP: UkuQalisa ukuBuyisela kwakhona kweWinRE -> Faka iSitshixo seBitLocker esineedijithi ezingama-48 ukusuka kwi-IT -> Cima ifayile yesitishi esinempazamo okanye uthiye ngokutsha umqhubi kwiNdlela eKhuselekileyo."]
    C -->|"Isikrini soBuyiselo seBlue BitLocker sicela isitshixo samanani angama-48"| E["TPM PCR UHAMBO: Khupha zonke iidokhi ze-USB / iidrive -> Qalisa kwakhona -> Ukuba usacelwa, fowunela i-IT Helpdesk ene-8-char Key ID ukufumana isitshixo soBuyiselo sedijithi ezingama-48."]
    B -->|"Ewe: Iibhutsi kwi-Desktop, kodwa i-ZERO intanethi / ukufikelela kwinethiwekhi"| F{"Kwenzeka ntoni xa ujonga iVPN / ZTNA & ubume beWi-Fi?"}
    F -->|"KwiHotele/Isikhululo seenqwelomoya: I-Wi-Fi iqhagamshelwe, kodwa iphepha lokungena kwi-Captive Portal aliyi kuvula"| G["I-CAPTIVE PORTAL DEADLOCK: Qhagamshela ilaptop kwi-smartphone Hotspot kuqala -> Qinisekisa i-VPN -> Okanye iplagi kwi-Travel Router ukuze ugqibezele ukungena kwi-portal kwifowuni"]
    F -->|"Ikhaya/Hotspot Wi-Fi iqhagamshelwe, kodwa i-ping 8.8.8.8 ithi 'Ukusilela ngokubanzi'"| H{"Ngaba umxhasi weVPN ubambekile 'kuQhagamshela / Bulala-Ukutshintsha okusebenzayo' OKANYE yi-EDR yodwa?"}
    H -->|"Umxhasi weVPN uthi 'Isitshixo seNethiwekhi / Bulala uTshintsho olusebenzayo-Alunakufikelelwa kwiSango'"| I["I-VPN BULALA-TSHINTSHA ISIXHELO: Tshintshela kwi-hotspot yefowuni -> Okanye faka i-IT ngexesha elinye lokukhubaza igama lokugqithisa kwi-Zscaler / AnyConnect / GlobalProtect"]
    H -->|"I-VPN icinyiwe okanye ayidityaniswanga, OKANYE ukhuseleko oluzivelelayo luthi 'Umamkeli Wodwa'"| J["I-EDR NETWORK CONTAINMENT: Gcina i-Wi-Fi iqhagamshelwe -> Fowunela i-SOC ye-Corporate -> Nika igama lomamkeli-> Ucofa i-SOC 'Phakamisa isiqulatho' OKANYE unike uMqondiso wokuGcinwa kwe-Offline"]

Imeko 1: ILaptop ivalwe yi-EDR "Isiqulatho seNethiwekhi" (CrowdStrike, SentinelOne, Defender)¶

Iilaptops zamashishini zanamhlanje zisebenzisa i-kernel-level ** Ukubonwa kwe-Endpoint and Response (EDR)** izinzwa endaweni yesoftware ye-antivirus yabathengi. Xa inzwa ye-EDR ibona ukuziphatha okufana ne-cyberattack - njengenjineli yesofthiwe equlunqa ibhinari engabhalwanga, umhlalutyi wedatha osebenzisa i-PowerShell okanye i-Python automation script, umyili ovula i-spreadsheet esinikwe amandla amakhulu, okanye umhambi odibanisa kwinethiwekhi yehotele ephazamisekileyo ekhupha i-ARP spoofing ipakethe ye-automation Ukwahlukaniswa)**.

Uyiqaphela njani i-EDR Network Containment quarantine¶

Ngokungafaniyo nokwehla kwe-Wi-Fi eqhelekileyo, ukuvalelwa kwe-EDR kubonakalisa iimpawu zobugcisa ezithile:

1. Imiboniso ye-Wi-Fi "Iqhagamshelwe" okanye "Akukho Intanethi, ikhuselwe," ukanti izixhobo ze-LAN zasekhaya azibonakali: Awukwazi ukubethelela irutha yakho yasekhaya (192.168.1.1), ayinakuprinta kumnatha womnatha womshicileli, kunye ping 8.8.8.8 iimbuyekezo General failure okanye Transmit failed ngokukhawuleza (<1 ms) kuba isivamvo se-EDR se-Windows Filtering Platform (WFP) umqhubi wecallout ubamba kwaye awise yonke ipakethe ye-TCP/UDP/ICMP ngaphambi kokuba ifike kwikhadi le-Wi-Fi.
2. I-Desktop eKude esebenzayo, iSlack, Sondeze, kunye neeSeshini zeSikhangeli Sikhenkce Ngaxeshanye: Kwimizuzwana emi-2 yesiqhumiso sokuziphatha, i sokethi nganye iyavalwa ngaxeshanye.
3. Ukujonga iNdawo ye-EDR yeNdawo ngeLayini yoMyalelo (Akukho malungelo oLawulo aFungekayo):
4. CrowdStrike Falcon: Vula i-Command Prompt (cmd.exe) kwaye ubaleke sc query csagent. Ukuba ibonisa STATE: 4 RUNNING, kwaye ukubaleka netstat -ano | findstr :443 ibonisa ukuba kuphela esebenzayo ESTABLISHED uqhagamshelo oluphumayo kuyo yonke ilaptop yeya CSFalconService.exe uthetha ne AWS/CrowdStrike cloud dilesi ye IP, umamkeli wakho uku Falcon Network Containment.
5. SentinelOne: Jonga i-ayikhoni yekhaka elimfusa leSentinelOne kwitreyi yenkqubo (okanye ibha yemenyu kwi-macOS). Xa ibekwe yodwa, imo yearhente ifundeka Network Quarantined / Disconnected from Network by Management.
6. I-Microsoft Defender ye-Endpoint (MDE): Isaziso soKhuseleko se-Windows sethowusti sinokuthi ngokufutshane "Esi sixhobo sibekwe sodwa ngumlawuli wakho," ngelixa MsSense.exe ihlala ikuphela kwenkqubo evunyelweyo kwi-firewall.

Ukufumana njani ukungavalelwa umntu ukude (Ukukhutshwa kwelifu kwi-Intanethi vs. Umqondiso wokuGcinwa kweOffline)¶

Kukho iindlela ezimbini iZiko leMisebenzi yoKhuseleko lwe-IT (SOC) inokukhulula i-EDR yokuvalelwa:

Imeko yesi-2: Yophukile rhoqo-Ivuliwe VPN Kill-Switch okanye ZTNA Captive-Portal Deadlock¶

Kuthekani ukuba ilaptop yakho ** ayivalelwanga yedwa yiSecOps, kodwa endaweni yoko iqhuba ishishini ** Ihlala ivuliwe VPN** okanye ** Zero-Trust Network Access (ZTNA) ** umxhasi (*Zscaler Client Connector, Cisco AnyConnect/ Cisco Secure Client with Network Visibility Module, Palo Alto NekopetsGlobalconfigured a) Kill-Switch ("I-Fail-Closed" / "Vimba zonke iitrafikhi ezingezizo ezombutho xa ungathenjwa")**?

1. Ukusombulula "Ihotele / Isikhululo seenqwelomoya sokuBamba iPortal Deadlock" (Inkukhu-ne-Iqanda Trap)¶

Nasi isizathu sokuba amawakawaka abasebenzi abakude bavaleleke ngaphandle kwiilaptop zabo qho kusasa kwiihotele, kwiikhefi nakwizikhululo zeenqwelomoya:

• Ukufumana ukufikelela kwi-intanethi kwihotele okanye kwisikhululo seenqwelomoya i-Wi-Fi, kufuneka uvule isikhangeli sewebhu, uthunyelwe kwakhona nge-HTTP/DNS ukuya kwiphepha lokungena lendawo lehotele (captive.apple.com okanye neverssl.com), kwaye uchwetheze inombolo yegumbi lakho nefani.
• **Nangona kunjalo **, ilaptop yenkampani yakho Ihlala Ivuliwe VPN Kill-Switch ibona ukuba ihotele iWi-Fi yi "Network Non-Corporate Network" kwaye kwangoko ivalela zonke izicelo zeHTTP kunye neDNS de kube itonela yeVPN efihliweyo ukuya kwikomkhulu lenkampani idibanisa.
• I-tunnel ye-VPN ** ayikwazi ukudibanisa ** ude uthayiphe inombolo yegumbi lakho kwiphepha lokungena kwihotele, kwaye ** awukwazi ukulayisha iphepha lokungena kwihotele ** kuba i-VPN Kill-Switch ivimbela isiphequluli sakho.

Sebenzisa enye yezi **indlela ezine ezingqiniweyo zokudlula ** ukwaphula umqobo ngokukhawuleza ngaphandle kokufuna amalungelo olawulo:

+-----------------------------------------------------------------------+
|  4 WAYS TO BREAK A VPN KILL-SWITCH CAPTIVE PORTAL DEADLOCK            |
|                                                                       |
|  METHOD 1 (Smartphone USB/Wi-Fi Tethering + MAC Clone / Travel Router)|
|  Authenticate the hotel captive portal on a pocket Travel Router      |
|  (or Android Wi-Fi Share), then connect your work laptop to the       |
|  already-authenticated router Wi-Fi.                                  |
|                                                                       |
|  METHOD 2 (Built-In Mini Captive Portal Browser Inside VPN Client)    |
|  Click the Zscaler / GlobalProtect / AnyConnect tray icon ->          |
|  Click "Captive Portal Detected / Open Login Window".                 |
|                                                                       |
|  METHOD 3 (Gateway IP Direct Entry in Browser)                        |
|  Run `ipconfig` -> Find "Default Gateway" (e.g., 10.0.0.1) ->         |
|  Type `http://10.0.0.1` directly into Edge/Chrome address bar.        |
|                                                                       |
|  METHOD 4 (Authenticate on Phone First -> Call IT for Disable Code)   |
|  Tether laptop to Phone Cellular Data -> Get Zscaler/VPN Disable      |
|  Password from IT -> Pause VPN for 10 min -> Join Hotel Wi-Fi.        |
+-----------------------------------------------------------------------+

1. Indlela yoku-1-I-Smartphone Wi-Fi Bridge okanye iPocket Travel Router Trick (Isebenza nge-100 yepesenti yeXesha):
2. Ilaptop yakho yomsebenzi ayinakukwazi ukuxela umahluko phakathi kwenethiwekhi ye-Wi-Fi yehotele engavunywanga kunye nerutha yobuqu esele ingenile *kwingosi yehotele.
3. Ukuba unefowuni ye-Android (ukwabelana nge-Wi-Fi): Qhagamshela ifowuni yakho ye-Android kwi-Wi-Fi yehotele, gcwalisa inombolo yegumbi lokungena kwi-portal yokungena kwiscreen sefowuni yakho, emva koko uvule ifowuni yakho I-Hotspot yeselula (iifowuni zanamhlanje ze-Samsung / ze-Android zixhasa ngaxeshanye **I-Wi-Fi Repeater / Wi-Fi Ukwabelana ngefowuni ngefowuni yakho ye-Wi-Fi ye-Wi-Fi yefowuni ye-Wi-Fi yokusasaza idatha yakho esetyenzisiweyo). Qhagamshela ilaptop yakho yomsebenzi kwi-hotspot yefowuni yakho: iVPN iqhagamshela kwangoko.
4. Ukuba uphethe iPocket Travel Router (efana ne-GL.iNet Beryl/Slate; bona usebenza kude nehotele): Qhagamshela irutha yohambo kwiWi-Fi yehotele, gqibezela ukungena ehotele usebenzisa isikhangeli se-smartphone yakho, uze uqhagamshele ilaptop yakho yasemsebenzini kwirutha yakho yohambo iWPA3 Wi-Fi okanye i-Ethernet port.
5. Indlela yesi-2-Chwetheza i-IP yeSango eliMiselweyo lasekuhlaleni ngqo kwiBrowser yakho (http://10.x.x.x):
6. Rhoqo, i-VPN Kill-Switch okanye i-Zscaler DNS proxy iqweqwedisa kuphela ** DNS igama lesizinda sokukhangela ** (ukuvala neverssl.com okanye google.com), ngelixa usavumela iipakethi ze-IP ze-subnet ekrwada ukuba zifikelele kwisango le-router yendawo yemizuzwana engama-60 emva kombutho we-Wi-Fi.
7. Vula i-Command Prompt (cmd.exe), uhlobo ipconfig, kwaye ujonge kwi Isango eliMiselweyo idilesi yeIP phantsi Wireless LAN adapter Wi-Fi (umzekelo, 172.16.0.1 okanye 192.168.20.1).
8. Vula isikhangeli sakho kwaye uchwetheze http://172.16.0.1 (usebenzisa http://, zange https://, kunye namanani achanekileyo asuka kwiSango lakho eliMiselweyo) ngqo kwibha yedilesi. Oku kubetha isilawuli sephothali yehotele ngokuthe ngqo nge-IP ngaphandle kokufuna isisombululo se-DNS, ivelela isikrini sokungena.
9. Indlela yesi-3 -Sebenzisa iZscaler / GlobalProtect / AnyConnect "Vula iPortal Captive" Iqhosha okanye uqalise kwakhona iNkonzo:
10. Kwi-Zscaler Client Connector (ZCC): Vula ifestile yeZscaler kwitreyi yenkqubo, cofa More -> Troubleshoot -> Restart Service (engayifuniyo igama lokugqithisa kwaye ivula ifestile emfutshane yama-30 yemizuzwana yokubanjwa kwesango ngexesha lokuqaliswa kwakhona).
11. KwiPalo Alto GlobalProtect: Cofa imenyu enemigca emithathu kwicala eliphezulu lasekunene le-GlobalProtect tray pop-up -> Settings -> General -> ukuba imeko ithi "Isango lokubanjwa lifunyenwe," cofa eluhlaza okwesibhakabhaka Remediate iqhosha lokumisela i-GlobalProtect's sandboxed mini-browser.

2. Ukulungisa "I-Adapter ye-Zombie VPN / eyaphukileyo i-DNS Loopback (127.0.0.1 okanye 100.64.0.1)" Emva kweNtlekele¶

Kuthekani ukuba usekhaya kwi-Wi-Fi yakho yesiqhelo, kwaye emva kokuba ibhetri yakho yelaptop ibhubhile okanye yonakele ngelixa uqhagamshelwe kwi-VPN yeshishini, iibhutsi zelaptop yakho zixhonywe nge-*zero DNS isisombululo ** (iiwebhusayithi zithi DNS_PROBE_FINISHED_NXDOMAIN, kwaye awukwazi nokusombulula igama lesizinda seseva yeVPN ukuphinda uqhagamshele iVPN)?

Oku kwenzeka xa umxhasi we-VPN ephazamiseka ngaphandle kokubuyisela ngokucocekileyo useto lwe-DNS yekhadi lakho le-Wi-Fi, ushiya iadaptha yakho yenethiwekhi ikhombe ngokusisigxina kwitonela ye-IP efileyo (100.64.0.1 yeZscaler/Tailscale CGNAT okanye 127.0.0.1):

1. Guqula i-Windows DNS Cache kunye ne-Winsock Catalog (Isebenza Ngaphandle kwamaLungelo oLawulo lwe-DNS Flush):
2. Vula i-Command Prompt kwaye uqhube ipconfig /flushdns.
3. Baleka nslookup vpn.yourcompany.com 8.8.8.8 (ukutshintsha vpn.yourcompany.com ngegama lomamkeli wesango lenkampani yakho yeVPN). Ngokuhlomela 8.8.8.8 ukuya ekupheleni kwe nslookup Umyalelo, udlula isisombululi seDNS esaphukileyo selaptop yakho kwaye ubuze iDNS kaGoogle kawonke wonke ngokuthe ngqo (ukuba izibuko 53 livuliwe) ukufunda idilesi ye-IP yamanani ekrwada yesango lakho leshishini leVPN.
4. Qhagamshela kwiSango leNkampani yeVPN usebenzisa idilesi ye-IP yenombolo ekrwada:
5. Ukuba iCisco AnyConnect okanye iGlobalProtect ayiphumelelanga nge "Ayinakuyicombulula idilesi yeseva," coma idilesi ye-IP yamanani ekrwada (203.0.113.50) ngqo kwibhokisi yomncedisi weVPN (ukuba kuvunyelwe ngumgaqo-nkqubo) okanye ufowunele i-IT ukufumana i- Zscaler / VPN App-Profile Khubaza Igama eliyimfihlo ukuseta kwakhona iadaptha yenethiwekhi yenyani (ncpa.cpl).

Imeko 3: Ukufumana kwakhona kwi-EDR Kernel Driver Blue Screen (BSOD) IBootloop¶

NgoJulayi 2024, uhlaziyo olungasebenziyo lwesitishi lutyhalelwe kwi-CrowdStrike Falcon Windows sensor (csagent.sys / IFayile yesitishi 291)* ibangele ukuba oomatshini beWindows abazizigidi ezisisi-8.5 kwihlabathi liphela bawa ngephanyazo PAGE_FAULT_IN_NONPAGED_AREA Isikrini esiluhlaza se-bootloop yokufa ngaphambi kokuba inkqubo yokusebenza iqhagamshele kwi-intanethi ukukhuphela ukulungiswa. Iibootloops ezifanayo ziyenzeka ngamaxesha athile xa SentinelOne (SentinelMonitor.sys), Microsoft Defender (WdFilter.sys), okanye **VPN NDIS izihluzi abaqhubi ** zingqubana nohlaziyo oluqokelelweyo lweWindows.

Kuba umqhubi wokuntlitheka uqwalaselwe njenge BOOT_START (Start = 0) umqhubi we-kernel, iWindows iyilayisha kwinkumbulo ngexesha lesibini sokuqala sokuqalisa - kudala phambi kokuba i-Wi-Fi okanye ulawulo lwamafu luqalise. Ekuphela kwendlela yokulungisa a BOOT_START i-kernel driver bootloop ikwindawo yasekuhlaleni igqitha kwiMeko-bume yoBuyiselo yeWindows (WinRE).

+-----------------------------------------------------------------------+
|  HOW TO BREAK AN EDR KERNEL DRIVER BSOD BOOTLOOP VIA WinRE            |
|                                                                       |
|  1. Force-interrupt boot 2-3 times (or hold Shift + Restart on        |
|     Recovery screen) until "Choose an option" blue menu appears.      |
|  2. Click Troubleshoot -> Advanced options -> Command Prompt          |
|     (or Startup Settings -> F4/F5 Safe Mode).                         |
|  3. Read the 8-character "Recovery Key ID" on screen to your IT       |
|     Helpdesk over the phone -> Type the 48-digit BitLocker Key.       |
|  4. In WinRE Command Prompt, locate the Windows partition (`C:` or    |
|     `D:`), delete the corrupted `.sys` channel file or rename the     |
|     faulty driver folder, and type `wpeutil reboot`.                  |
+-----------------------------------------------------------------------+

INyathelo ngeNyathelo yoBuyiselo lweWinRE yaseKhaya (Ikhokelwe kwidesika yakho yoNcedo ye-IT kwifowuni)¶

1. Faka iMeko yoBuyiselo yeWindows (WinRE):
2. Emva kweebhutsi ezimbini ezilandelelanayo ezingaphumelelanga, Windows 10 kunye Windows 11 bonisa ngokuzenzekelayo iblue Ukubuyisela ("Kukhangeleka ngathi iWindows ayilayishanga ngokuchanekileyo") isikrini.
3. Cofa See advanced repair options -> Troubleshoot -> Advanced options -> Command Prompt (ekhawulezayo kwaye ifuna ukuqaliswa kwakhona okumbalwa kuneMowudi eKhuselekileyo).
4. Vula iDrive eFihliweyo ngeSitshixo sakho soBuyiselo seBitLocker eneDijiti ezingama-48:
5. Ngenxa yokuba ihard drive yakho iguqulelwe ngokuntsonkothileyo ngeBitLocker, iWinRE izakubonisa kwangoko isikrini esiluhlaza sithi: "Faka iqhosha lokubuyisela kule drive" kunye ne-*Sitshixo se-ID (8 oonobumba aba hexadecimal, abafana A1B2C3D4)**.
6. Fowunela iDesika yoNcedo ye-IT yenkampani yakho kwi-smartphone yakho, uzifundele ilaptop yakho Igama lomamkeli / iTag ye-Asethi kunye ne- 8 ye-ID ye-BitLocker eneenombolo ezisi-8, kwaye ucele igcisa lifunde Isitshixo soBuyiselo seBitLocker esineedijithi ezingama-48 (zihlanganiswe kwiibhloko ezisibhozo ezinamanani asi-6). Chwetheza amanani angama-48 ngononophelo kwaye ucinezele Enter.
7. Chonga ukuba yeyiphi iLetter Drive ebambe uFakelo lwakho lweWindows ngaPhakathi kweWinRE:
8. Ngaphakathi kwendawo yokubuyisela ye-WinRE, i-Windows drive yakho engundoqo ihlala yabelwe ileta yokuqhuba D: okanye E: endaweni ye C: (kuba i-EFI encinci efihliweyo / isahlulelo soBuyiselo sithatha C:).
9. Uhlobo dir C:\Windows kwaye ucinezele Enter. Ukuba ithi File Not Found, uhlobo dir D:\Windows ude ufumane unobumba wokuqhuba oqulethe eyakho Windows ifolda.
10. Yenza ukucinywa kweFayile yoMthengisi-oGunyaziweyo weFayile okanye ukuQamba ngokutsha uMqhubi (ngeMiyalelo ye-IT):
11. Ngohlaziyo lweFayile yeCrowdStrike yeCrowdStrike yoRhwaphilizo: Khangela kulawulo lomqhubi lweCrowdStrike (cd /d C:\Windows\System32\drivers\CrowdStrike okanye D:\Windows\System32\drivers\CrowdStrike), qinisekisa ifayile yetshaneli eyonakeleyo echazwe liqela lakho le-IT (umzekelo, del C-00000291*.sys), kwaye cinezela Enter. Ngokuba itshaneli .sys iifayile ziluhlaziyo lwemithetho eguqukayo kunokuba ngundoqo csagent.sys injini, ukucima ifayile yetshaneli eyonakeleyo ivumela iWindows kunye neFalcon sensor ukuba iqale ngokucocekileyo kwaye ikhuphele ifayile yesitishi esisigxina efini.
12. Ukwenzela i-VPN yeQela leSithathu eRhwaphilizayo okanye uMqhubi weSihluzo soKhuseleko: Ngokomyalelo womlawuli wakho we-IT, yithiya ngokutsha impazamo ethile. .sys umqhubi (ren C:\Windows\System32\drivers\<FaultyDriver>.sys <FaultyDriver>.sys.bak) okanye khubaza ixabiso lenkonzo yalo kwirejista engaphandle kweintanethi (reg load HKLM\OfflineSystem C:\Windows\System32\Config\SYSTEM), emva koko uchwetheze wpeutil reboot ukuqalisa kwakhona kwiWindows ngokwesiqhelo.

Iinombolo zengingqi zikaxakeka kunye neeprothokholi ze-arhente¶

Ngelixa uvalelo lwelaptop yomsebenzi omnye luqhele ukuba lungquzulwano olungeyonyani olungeyonyani okanye lwesango lokubanjwa, ukuvalwa ngequbuliso kwe-EDR ngaxeshanye okanye igagasi le-BSOD kubasebenzi osebenza nabo abaninzi kunokubonisa nokuba kukho ukuphuma komthengisi wehlabathi okanye isiganeko esisebenzayo se-ransomware yeshishini:

• I-United States kunye neKhanada: Ukuba i-EDR i-quarantine okanye i-bootloop yobunzima ichaphazela ** amaziko okuthunyelwa kwe-911, iindawo zokusebenzela zesibhedlele, amagumbi ongxamiseko, okanye i-aviation/transit infrastructure , ngokukhawuleza yenza kusebenze indawo yendawo ** Ukuqhubeka kokuSebenza (COOP) / IiProtocol zePhepha lexesha lokuPhuma ** kwaye ubize ** 911 kwiimeko ezingxamisekileyo zokhuseleko lobomi. Xela iziganeko ezixhaphakileyo zeziseko zophuhliso ze-cyber ku CISA (i-Cybersecurity and Infrastructure Security Agency) 1-844-SAY-CISA (1-844-729-2472 okanye cisa.gov/report) kunye Iziko laseKhanada loKhuseleko lweCyber e 1-833-CYBER-88.
• United Kingdom: Fowunela 999 kwiimeko ezingxamisekileyo zokhuseleko ebomini. Izehlo ze-cyber zeshishini kunye neziganeko zokuqulathwa kwe-ransomware ezichaphazela imibutho yase-UK kufuneka zixelwe kwi-Iziko leSizwe loKhuseleko lwe-Cyber ​​(NCSC) nge ncsc.gov.uk.
• I-European Union: Cofa 112 kwiinkonzo zongxamiseko. Ngaphantsi kwe-I-EU NIS2 Directive (Umyalelo (i-EU) 2022/2555) kunye ne-Inqaku le-GDPR le-33, amacandelo abalulekileyo kufuneka achaze ukuphazamiseka okubalulekileyo kokusebenza okanye iziganeko zokhuseleko kwilizwe labo i-CSIRT (iQela lokuPhendula ngeSihlo seKhompyutha) kunye ne-*ENISA.
• ** I-Australia kunye neNew Zealand: ** Fowuna ** 000 ** e-Australia okanye ** 111 ** eNew Zealand ngeenkonzo zongxamiseko. Ingxelo yeshishini lokhuseleko lwe-cybersecurity izehlo okanye ukuphanga kwi-Iziqondiso ze-Australian Directorate's Australian Cyber Security Centre (ASD ACSC) e 1300 CYBER1 (1300 292 371) okanye CERT NZ / NCSC NZ.
• ** I-Indiya kunye ne-Asia-Pacific: ** Ukudayela ** 112 ** e-Indiya (kwaye uxele iziganeko ze-cyber zombutho ku- ** CERT-In ** ), ** 119 ** eJapan naseMzantsi Korea, okanye ** 995 ** eSingapore ( ** SingCERT ** ). Ngeenombolo zikaxakeka zamazwe ngamazwe, bona amanani kaxakeka.

Imibuzo edla ngokubuzwa¶

Kutheni le nto iCrowdStrike Falcon okanye iSentinelOne yandivalela yodwa ilaptop yomsebenzi xa ndingenzi nto imbi?¶

I-ejenti zangoku zokuFumana kunye neMpendulo (EDR) aziskeneli nje iisignesha ezaziwayo zentsholongwane; babeka iliso kwindlela yokuziphatha kwexesha lokwenyani, inaliti yememori, kunye neengxoxo zomgca womyalelo usebenzisa i-heuristics yokuziphatha (`IOAs` - Izalathisi zoHlaselo). Imisebenzi eqhelekileyo esemthethweni ehlala ihambela i-EDR Network Containment ibandakanya abaphuhlisi besoftware abasebenzisa imibhalo yokwakha yasekhaya engasayinwanga okanye idebugger, abasebenzi be-IT abasebenzayo. `nmap` okanye Imiyalelo yokufunyanwa kwenethiwekhi ye-PowerShell, ukuplaga kwi-USB yerabha-yedada-style macro keypad engagunyaziswanga, okanye ukuqhagamshela kwihotele engafanelekanga i-Wi-Fi router eyenza i-ARP-spoofing / Man-in-the-Middle defense. Ukufowunela i-SOC yakho kwangoko kuvumela umhlalutyi ukuba ahlole umthi wenkqubo kwaye enze umsebenzi wakho ube mhlophe ngemizuzu.

Ukuba ilaptop yam ikwi-EDR Network Containment, ngaba iqela lam le-IT lisasibona isikrini sam okanye lingandivaleli ndedwa ukude?¶

Ewe, okoko nje ilaptop yakho isaqhagamshelene nenethiwekhi ye-Wi-Fi esebenzayo (efana nerutha yakho yasekhaya okanye i-smartphones hotspot yeselula). Xa i-CrowdStrike Falcon, i-SentinelOne, okanye i-Microsoft Defender ye-Endpoint ibeka i-laptop kwi-Network Containment, umqhubi wesihluzi se-kernel uvimba zonke i-traffic eqhelekileyo yabasebenzisi ngelixa egcina ngokucacileyo itonela yolawulo lwe-TLS efihliweyo evulekileyo phakathi kwe-EDR ye-laptop kunye ne-cloud console. Ngalo tonela yolawulo, umhlalutyi wakho we-SOC unokuvula iqokobhe lokuxilonga elikude (`Real Time Response` kwi CrowdStrike okanye `Live Response` kwi-Defender) kwaye ucofe u-"Lift Containment" ukubuyisela ukufikelela kwinethiwekhi yakho ngemizuzwana engama-30 ngaphandle kokufuna ukuchwetheza nantoni na.

Kwakutheni ukuze ilaptop yam yomsebenzi ngokukhawuleza icele isitshixo soBuyiselo seBitLocker esineedijithi ezingama-48 xa ndisihlohla kwimonitha yehotele okanye kwisikhululo sokumisa i-USB-C?¶

Iilaptops zeShishini zeWindows zisebenzisa imodyuli ye-motherboard **Iimodyuli yeQonga eliThenjiweyo (TPM 2.0)** itshiphu ukulinganisa eyona hardware kunye nolungelelwaniso lokuqalisa kwangaphambili (**Iirejista zoLungiselelo lweQonga `PCR 0, 2, 4, 7, 11`**) ngalo lonke ixesha ucofa iqhosha lamandla. Ukuba uplagi kwidokhi yendudumo, idrayivu ye-USB yangaphandle, okanye i-hub esweni eguqula i-UEFI yokuqalisa okanye i-PCIe DMA ibhasi yebhasi phambi kweebhutsi ze-Windows, i-TPM ibona utshintsho lomlinganiselo we-hardware kwaye iyala ukukhulula isitshixo sokuguqulela ngokuzenzekelayo, ibangele i-BitLocker yakho yokuBuyisela i-BitLocker yedijithi ezingama-48 njengokhuseleko lokukhusela ubusela. Okokuqala, ** khupha zonke izincedisi ze-USB, iidokhi, kunye neentambo ze-HDMI kwaye uqalise kwakhona i-laptop ngokwayo ** - iipesenti ezingama-90 zexesha, umlinganiselo we-TPM uhambelana kwakhona kunye neebhutsi ze-laptop ngqo kwi-Windows ngaphandle kokufuna isitshixo samanani angama-48.

Ngaba ndingasivala isiqhagamshelo soMxumi weZscaler, iCisco AnyConnect, okanye iGlobalProtect ngokwam ndisebenzisa uMphathi weWindows Task?¶

Hayi, kwilaptop yenkampani eqwalaselwe ngokufanelekileyo, awukwazi ukubulala `ZSATray.exe`, `CSFalconService.exe`, `vpnagent.exe`, okanye `PanGPS.exe` ukusuka kuMphathi woMsebenzi. Ezi arhente zokhuseleko zisebenza njenge **IiNkqubo eziKhuselweyo zeWindows (`Protected Process Light / PPL` / `ELAM` Iinkonzo ezichasene noMalware)** ezizezakhe `SYSTEM` kunye nabaqhubi bokuzikhusela be-kernel; nokuba umsebenzisi unamalungelo omlawuli wasekhaya, iWindows iyala `Access Denied` xa uzama ukuphelisa inkonzo yokhuseleko ye-PPL ngaphandle kwe-cryptographic **Ukhuseleko lweTamper / iProfayile ye-App Khubaza igama lokugqithisa** elenziwe kwikhonsoli yelifu yeshishini.

Kuthekani ukuba ndisebenza kwindawo yexesha elahlukileyo kwaye Idesika yoNcedo ye-IT yenkampani yam ilele xa ilaptop yam itshixwa ngaphandle?¶

Okokuqala, jonga ukuba ngaba umbutho wakho unalo **24/7 iziko lokuSebenza kwezoKhuseleko (SOC) okanye i-On-Call Major Incident Hotline** eyahlukileyo kwidesika yoncedo ye-IT yasemini (uninzi lwamashishini asebenzisa i-CrowdStrike okanye i-SentinelOne ikhontrakthi ene-24/7 eLawulwayo yokuFumana kunye neMpendulo [`MDR`] iqela okanye ugcine inombolo yasemva kweeyure zomsebenzi PagerDuty escalation number edweliswe kwi-intranethi yomqeshwa wakho okanye kwi-onboarding sheet). Okwesibini, ukuba utshixo lwakho sisiSitshixo seSitshixo soBuyiselo seBitLocker**, jonga ukuba ungangena na kwishishini lakho **Microsoft 365 / yeSazisi seNgeniso "kwiakhawunti yam" portal (`myaccount.microsoft.com/device-list`)** kwisikhangeli sakho se-smartphone usebenzisa i-app yakho ye-MFA yokuqinisekisa - iinkampani ezininzi zivumela abasebenzi ukuba bajonge eyabo ilaptop enamanani angama-48 esixhobo sokubuyisela i-BitLocker yesitshixo sokuzibuyisela ngefowuni yabo.

Kutheni i-Wi-Fi yam yasekhaya iyeka ukusebenza kwilaptop yam yomsebenzi kanye emva kokuba ndiqhawule uqhagamshelo kwi-VPN yeshishini?¶

Olunye ulungelelwaniso lwe-VPN yequmrhu lisebenzisa into ebizwa ngokuthi ** "Ihlala i-Quarantine / i-Trusted Network Detection (TND)"** evala ngabom lonke ufikelelo lwe-intanethi nanini na xa itonela ye-VPN ivaliwe ngelixa ingaphandle kwesakhiwo se-ofisi yenkampani, ukuze kuthintelwe ukukhutshwa kwedatha ye-tunnel. Kwezinye iimeko, ukuqhawula i-VPN kushiya idilesi yeseva ye-DNS endala (`10.x.x.x`) igcinwe kwiadaptha yakho ye-Wi-Fi ukuze umzila wakho wasekhaya ungasombululi iidilesi zewebhu. Ngokulula ** phinda uqhagamshele kwi-VPN yenkampani ** (okanye uqhube `ipconfig /flushdns` kwaye utshintshe i-Wi-Fi iValiwe kwaye i-On) ukuze iindlela zakho zetrafikhi zicoceke kwisango leshishini eligunyazisiweyo.

Izikhokelo ezinxulumeneyo¶

• Ilaptop yokusebenza ibiwe okanye yophukile ngelixa uhamba: I-MDM lock kunye ne-zero-downtime recovery
• Ukusebenza kude nehotele
• Gcina i-intanethi kunye noqhagamshelwano
• Ukhuseleko lomsebenzi olungxamisekileyo kunye nobumfihlo bedatha

Imithombo kunye nezikhokelo ezisemthethweni¶

• I-CISA (i-Cybersecurity kunye ne-Arhente yoKhuseleko lweziSeko): UkuLungisa iNqaku eliBanzi lokuFumana kunye nokuPhendula (EDR) i-Kernel Sensor Outages kunye neNkqubo yokuFumana i-BitLocker kwiSikali.
• I-Microsoft Corporation (iMicrosoft Funda): IsiKhokelo soBuyiselo seBitLocker: ULungiso lweengxaki zokuThixwa koQinisekiso lwe-TPM PCR kunye nokusebenzisa iWinRE Command Prompt ukuLungisa iBoot-Critical Drivers kunye neMicrosoft Defender for Endpoint Machine Isolation Architecture.
• NIST (Iziko leSizwe leMigangatho kunye neTekhnoloji): NIST Special Publication 800-207: Zero Trust Architecture (ZTA) kunye ne NIST SP 800-83 Rev. 1: Isikhokelo soThintelo lweSihlo soMalware kunye nokuPhathwa kweeDesktop neeLaptop.
• CrowdStrike, Inc. & SentinelOne: Falcon Sensor Network Containment Architecture, uLondolozo lweNkqubo yokuLayishwa kweFayile, kunye noXwebhu loBuyiselo lweFayile.
• IiNkqubo ze-Zscaler kunye neCisco: *UkuPhathwa kwePortal yokuBamba kwi-Always-On Zero Trust Network Access (ZTNA) kunye neMigaqo-nkqubo yokuFirewall eNgqongileyo *.