央行数字货币CBDC与数字人民币安全取证深度分析

#!/bin/bash
HW_WALLET_FIRMWARE=$1
EXTRACT_DIR="${HW_WALLET_FIRMWARE}_extracted"

echo "[*] === 硬件钱包固件安全取证分析脚本 ==="
echo "[*] 目标固件: ${HW_WALLET_FIRMWARE}"

md5sum "${HW_WALLET_FIRMWARE}" > "${EXTRACT_DIR}_hash.txt"
sha256sum "${HW_WALLET_FIRMWARE}" >> "${EXTRACT_DIR}_hash.txt"

echo "[*] 步骤1: 固件格式识别"
file "${HW_WALLET_FIRMWARE}"
binwalk "${HW_WALLET_FIRMWARE}"

echo "[*] 步骤2: 固件提取"
mkdir -p "${EXTRACT_DIR}"
binwalk -eM "${HW_WALLET_FIRMWARE}" -C "${EXTRACT_DIR}"

echo "[*] 步骤3: 查找敏感文件类型"
find "${EXTRACT_DIR}" -type f \( \
    -name "*.elf" -o -name "*.bin" -o -name "*.key" \
    -o -name "*.pem" -o -name "*.crt" -o -name "*.conf" \
    -o -name "*.json" -o -name "*.xml" -o -name "*.db" \
    -o -name "*.sqlite" -o -name "*.dat" \
\) -exec echo "[!] 发现敏感文件: {}" \;

echo "[*] 步骤4: 提取嵌入式密钥和证书"
grep -rl "BEGIN CERTIFICATE" "${EXTRACT_DIR}" 2>/dev/null
grep -rl "BEGIN RSA" "${EXTRACT_DIR}" 2>/dev/null
grep -rl "BEGIN EC" "${EXTRACT_DIR}" 2>/dev/null
strings "${EXTRACT_DIR}"/*.bin 2>/dev/null | grep -iE "(key|secret|password|seed|mnemonic)"

echo "[*] 步骤5: 查找调试符号和字符串"
find "${EXTRACT_DIR}" -name "*.elf" -exec nm {} \; 2>/dev/null | grep -iE "(debug|test|backdoor|root)"
find "${EXTRACT_DIR}" -name "*.elf" -exec strings {} \; 2>/dev/null | grep -iE "(password|admin|debug|test)"

echo "[*] 步骤6: 识别加密算法特征常量"
strings "${EXTRACT_DIR}"/*.bin 2>/dev/null | grep -iE "(AES|DES|RSA|SM2|SM3|SM4|SHA|ECC)"
echo "[*] 搜索SM2曲线参数..."
strings "${EXTRACT_DIR}"/*.bin 2>/dev/null | grep -E "FFFFFFFE"

echo "[*] 步骤7: 生成取证报告"
cat > "${EXTRACT_DIR}_report.md" << EOF
# 硬件钱包固件取证报告
## 基本信息
- 分析时间: $(date -u +"%Y-%m-%d %H:%M:%S UTC")
- 固件文件: ${HW_WALLET_FIRMWARE}
- MD5: $(md5 -q "${HW_WALLET_FIRMWARE}")
- SHA256: $(shasum -a 256 "${HW_WALLET_FIRMWARE}" | cut -d' ' -f1)
## 提取结果
$(find "${EXTRACT_DIR}" -type f | wc -l) 个文件已提取
## 敏感发现
$(find "${EXTRACT_DIR}" -type f -name "*.key" -o -name "*.pem" -o -name "*.db" 2>/dev/null)
EOF

echo "[*] 取证分析完成，报告已保存至 ${EXTRACT_DIR}_report.md"

title: 数字人民币异常交易行为检测
id: 9a7e3b2c-1d4f-4e8a-b5c6-2f8d9e0a1b3c
status: experimental
description: 检测数字人民币钱包的异常交易行为模式，包括高频交易、大额异常转账和地理不一致
references:
  - https://www.pbc.gov.cn/
author: Blue Team Forensics
date: 2026/07/31
modified: 2026/07/31
tags:
  - attack.defense_evasion
  - attack.t1070
  - attack.initial_access
  - attack.t1078
logsource:
  product: cbdc
  service: e-cny-transaction
detection:
  selection_high_frequency:
    transaction_count:
      field: tx_count_per_minute
      condition: greater_than
      value: 30
    transaction_pattern:
      field: unique_recipients
      condition: greater_than
      value: 15
    time_window: 5m

  selection_large_amount:
    transaction_amount:
      field: amount_cny
      condition: greater_than
      value: 50000
    kyc_level:
      field: wallet_kyc_tier
      condition: less_than
      value: 3

  selection_geo_anomaly:
    geo_distance:
      field: distance_km_between_txs
      condition: greater_than
      value: 500
    time_diff:
      field: seconds_between_txs
      condition: less_than
      value: 600

  selection_offline_burst:
    offline_tx_count:
      field: offline_tx_per_hour
      condition: greater_than
      value: 20
    sync_delay:
      field: hours_until_sync
      condition: greater_than
      value: 24

  selection_timestamp_anomaly:
    device_time_skew:
      field: time_offset_seconds
      condition: greater_than
      value: 300
    tx_type:
      field: transaction_type
      condition: equals
      value: "offline_payment"

  condition: selection_high_frequency or selection_large_amount or selection_geo_anomaly or selection_offline_burst or selection_timestamp_anomaly

fields:
  - wallet_id
  - device_id
  - transaction_id
  - amount
  - timestamp
  - kyc_level
  - geolocation
  - transaction_type
  - sync_status

falsepositives:
  - 合法的商户批量收款操作
  - 企业工资发放场景
  - 正常的跨城出差消费

level: high

#!/bin/bash
KNOWN_HASH_DB="/var/lib/cbdc_firmware/hashes.db"
REPORT_DIR="/var/log/cbdc_forensics"
DEVICES_DIR="/dev/sd*"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
REPORT="${REPORT_DIR}/fw_integrity_${TIMESTAMP}.json"

mkdir -p "${REPORT_DIR}"

echo "{"
echo '  "report_type": "hardware_wallet_firmware_integrity",'
echo '  "timestamp": "'"$(date -u +%Y-%m-%dT%H:%M:%SZ)"'",'

TOTAL=0
VERIFIED=0
TAMPERED=0
UNKNOWN=0

for DEVICE in ${DEVICES_DIR}; do
    if [ ! -b "${DEVICE}" ]; then
        continue
    fi

    TOTAL=$((TOTAL + 1))
    DEVICE_NAME=$(basename "${DEVICE}")
    SERIAL=$(udevadm info --query=property --name="${DEVICE}" 2>/dev/null | grep ID_SERIAL= | cut -d= -f2)
    
    echo "[*] 扫描设备: ${DEVICE_NAME} (序列号: ${SERIAL})"
    
    BLOCK_SIZE=512
    SAMPLE_SIZE=1048576
    dd if="${DEVICE}" bs="${BLOCK_SIZE}" count=$((SAMPLE_SIZE / BLOCK_SIZE)) 2>/dev/null | sha256sum | awk '{print $1}' > /tmp/fw_hash_current.txt
    CURRENT_HASH=$(cat /tmp/fw_hash_current.txt)
    
    FOUND=0
    if [ -f "${KNOWN_HASH_DB}" ]; then
        while IFS='|' read -r db_hash db_model db_version db_date; do
            if [ "${CURRENT_HASH}" = "${db_hash}" ]; then
                echo "[+] 设备 ${DEVICE_NAME} 固件验证通过 (型号: ${db_model}, 版本: ${db_version})"
                FOUND=1
                VERIFIED=$((VERIFIED + 1))
                break
            fi
        done < "${KNOWN_HASH_DB}"
    fi
    
    if [ "${FOUND}" -eq 0 ]; then
        echo "[!] 警告: 设备 ${DEVICE_NAME} 固件哈希未在已知库中找到!"
        UNKNOWN=$((UNKNOWN + 1))
        
        strings "${DEVICE}" 2>/dev/null | grep -ciE "(debug|backdoor|test_mode|hidden_api|root_shell)"
        SUSPICIOUS_COUNT=$?
        
        if [ "${SUSPICIOUS_COUNT}" -gt 0 ]; then
            echo "[!!] 高危: 设备 ${DEVICE_NAME} 固件包含可疑字符串!"
            TAMPERED=$((TAMPERED + 1))
            
            dd if="${DEVICE}" bs=1 count=4096 2>/dev/null | xxd | head -50 > "${REPORT_DIR}/${DEVICE_NAME}_header_${TIMESTAMP}.hex"
            
            strings "${DEVICE}" 2>/dev/null | grep -iE "(debug|backdoor|test|password|key|seed)" \
                > "${REPORT_DIR}/${DEVICE_NAME}_suspicious_strings_${TIMESTAMP}.txt"
        fi
    fi
done

cat >> "${REPORT}" <