硬件供应链安全取证深度分析

ChipWhisperer CLI 连接目标设备
chipwhisperer-hardware --capture --samples 100000 --trigger-mode power

python3 -c "
import numpy as np
traces = np.load('capture_traces.npy')
for i in range(traces.shape[0]):
    mean_power = np.mean(traces[i])
    std_power = np.std(traces[i])
    if std_power > 0.15:
        print(f'[!] Trace {i}: abnormal variance detected (std={std_power:.4f})')
"

使用近场探针扫描芯片表面
python3 -c "
import struct, json

def analyze_em_map(em_data_file):
    with open(em_data_file, 'rb') as f:
        header = f.read(64)
        width = struct.unpack('<I', header[0:4])[0]
        height = struct.unpack('<I', header[4:8])[0]
        freq_mhz = struct.unpack('<f', header[8:12])[0]
        data = f.read()

    pixels = np.frombuffer(data, dtype=np.float32).reshape(height, width)
    threshold = np.mean(pixels) + 3 * np.std(pixels)
    anomalies = np.argwhere(pixels > threshold)

    print(f'EM scan: {width}x{height} at {freq_mhz}MHz')
    print(f'Threshold: {threshold:.4f}')
    print(f'Anomalous hotspots: {len(anomalies)}')
    for y, x in anomalies[:10]:
        print(f'  Hotspot at ({x}, {y}): {pixels[y, x]:.4f}')

analyze_em_map('em_scan_001.bin')
"

物理取证检查清单执行脚本
python3 -c "
import json, datetime

checklist = {
    'visual_inspection': {
        'description': 'PCB 目视检查',
        'tools': ['体视显微镜', 'UV 灯'],
        'check_points': [
            '多余焊锡桥接',
            '非原厂元件',
            'PCB 走线异常',
            '隐藏元件或飞线',
            '丝印信息与实物不符'
        ],
        'status': 'pending'
    },
    'xray_analysis': {
        'description': 'X 射线成像分析',
        'tools': ['工业 CT'],
        'check_points': [
            '封装内部结构异常',
            '芯片堆叠层检查',
            '焊球/引线键合异常',
            '额外裸片（Die）检测'
        ],
        'status': 'pending'
    },
    'sem_analysis': {
        'description': '扫描电子显微镜分析',
        'tools': ['SEM + FIB'],
        'check_points': [
            '金属层拓扑比对',
            '逻辑门级结构验证',
            '额外互连检测',
            '修改痕迹识别'
        ],
        'status': 'pending'
    },
    'electrical_test': {
        'description': '电性能测试',
        'tools': ['逻辑分析仪', '示波器'],
        'check_points': [
            '静态功耗基线比对',
            '动态功耗异常检测',
            '时序特性验证',
            'I/O 特性验证'
        ],
        'status': 'pending'
    }
}

report = {
    'device': 'Supermicro X11SSZ-F',
    'serial': 'SN-2024-HW-001',
    'analyst': 'Blue Team Forensics',
    'timestamp': datetime.datetime.now().isoformat(),
    'checklist': checklist
}

with open('hw_forensics_checklist.json', 'w') as f:
    json.dump(report, f, indent=2, ensure_ascii=False)

print(f'Created hardware forensics checklist: hw_forensics_checklist.json')
print(f'Check items: {sum(len(v[\"check_points\"]) for v in checklist.values())}')
"

BOM 审计与芯片型号验证脚本
python3 -c "
import csv, hashlib, json

expected_bom = [
    {'ref': 'U1', 'part': 'Intel Xeon E-2176G', 'manufacturer': 'Intel', 'lot': 'LOT-2024-Q1-001'},
    {'ref': 'U2', 'part': 'Winbond W25Q256JV', 'manufacturer': 'Winbond', 'lot': 'WB-2024-03-001'},
    {'ref': 'U3', 'part': 'Nuvoton NPCT650', 'manufacturer': 'Nuvoton', 'lot': 'NV-2024-02-001'},
    {'ref': 'U4', 'part': 'Broadcom BCM5720', 'manufacturer': 'Broadcom', 'lot': 'BC-2024-01-001'},
    {'ref': 'U5', 'part': 'ASPEED AST2600', 'manufacturer': 'ASPEED', 'lot': 'AS-2024-Q1-001'},
    {'ref': 'J1', 'part': 'SPI Flash W25Q128', 'manufacturer': 'Winbond', 'lot': 'WB-2024-03-002'}
]

def audit_bom(actual_bom_file, expected_bom):
    anomalies = []
    with open(actual_bom_file) as f:
        reader = csv.DictReader(f)
        actual_bom = list(reader)

    for actual in actual_bom:
        ref = actual.get('ref', '')
        expected = next((e for e in expected_bom if e['ref'] == ref), None)
        if not expected:
            anomalies.append({'ref': ref, 'issue': 'UNKNOWN_COMPONENT', 'detail': 'Not in expected BOM'})
            continue
        if actual.get('part') != expected['part']:
            anomalies.append({'ref': ref, 'issue': 'PART_MISMATCH', 'expected': expected['part'], 'actual': actual.get('part')})
        if actual.get('manufacturer') != expected['manufacturer']:
            anomalies.append({'ref': ref, 'issue': 'MANUFACTURER_MISMATCH', 'expected': expected['manufacturer'], 'actual': actual.get('manufacturer')})
        if actual.get('lot') != expected['lot']:
            anomalies.append({'ref': ref, 'issue': 'LOT_MISMATCH', 'expected': expected['lot'], 'actual': actual.get('lot'), 'severity': 'HIGH'})

    return anomalies

results = audit_bom('actual_bom.csv', expected_bom)
print(f'BOM audit complete: {len(results)} anomalies found')
for r in results:
    print(f'  [{r[\"issue\"]}] {r[\"ref\"]}: {r.get(\"detail\", r.get(\"actual\", \"\"))} (expected: {r.get(\"expected\", \"N/A\")})')
"

使用 flashrom 提取 SPI Flash 固件镜像
flashrom -p linux_spi:dev=/dev/spidev0.0 -r firmware_dump.bin

binwalk 提取固件结构
binwalk firmware_dump.bin

计算固件哈希并与官方基准比对
sha256sum firmware_dump.bin
sha256sum -c firmware_known_good.sha256

使用 UEFITool 解析固件结构
UEFITool firmware_dump.bin

固件差异分析脚本
python3 -c "
import hashlib, os, struct

def extract_firmware_regions(fw_path):
    regions = []
    with open(fw_path, 'rb') as f:
        data = f.read()

    bios_region_sig = b'\x5A\xA5\xF0\x0F'
    pos = 0
    while True:
        idx = data.find(bios_region_sig, pos)
        if idx == -1:
            break
        if idx >= 16:
            descriptor_sig = data[idx-16:idx]
            regions.append({'offset': idx-16, 'type': 'IFD_DESCRIPTOR', 'size': idx+4-pos})
        pos = idx + 4

    for marker, name in [(b'FVH', 'EFI_FIRMWARE_VOLUME'), (b'$FDC', 'FLASH_DESCRIPTOR_CENTER')]:
        idx = data.find(marker)
        if idx != -1:
            regions.append({'offset': idx, 'type': name, 'data_hash': hashlib.sha256(data[idx:idx+65536]).hexdigest()})

    return regions

def compare_firmware(baseline_path, suspect_path):
    with open(baseline_path, 'rb') as f:
        baseline = f.read()
    with open(suspect_path, 'rb') as f:
        suspect = f.read()

    if len(baseline) != len(suspect):
        print(f'[!] Size mismatch: baseline={len(baseline)}, suspect={len(suspect)}')

    diffs = []
    for i in range(min(len(baseline), len(suspect))):
        if baseline[i] != suspect[i]:
            diffs.append(i)

    if not diffs:
        print('[+] Firmware images are identical')
    else:
        print(f'[!] Found {len(diffs)} byte differences')
        contiguous_regions = []
        start = diffs[0]
        end = diffs[0]
        for d in diffs[1:]:
            if d == end + 1:
                end = d
            else:
                contiguous_regions.append((start, end))
                start = d
                end = d
        contiguous_regions.append((start, end))

        for s, e in contiguous_regions[:20]:
            region_size = e - s + 1
            baseline_hex = baseline[s:s+16].hex()
            suspect_hex = suspect[s:s+16].hex()
            print(f'  Diff at 0x{s:08X}-0x{e:08X} ({region_size} bytes):')
            print(f'    Baseline: {baseline_hex}')
            print(f'    Suspect:  {suspect_hex}')

    return diffs

diffs = compare_firmware('firmware_baseline.bin', 'firmware_dump.bin')
with open('firmware_diff_report.json', 'w') as f:
    import json
    json.dump({'total_diffs': len(diffs), 'diff_offsets': diffs[:100]}, f)
"

chipsec_main --module secureboot.bootauth
chipsec_main --module secureboot.amd
chipsec_main --module common.secureboot

chipsec_util spi info
chipsec_util spi dump spi_dump.bin

python3 -c "
from chipsec.hal.spi import SPI
from chipsec import chipset

cs = chipset.cs()
spi = SPI(cs)

fw_size = spi.get_spi_size()
print(f'SPI Flash size: {fw_size / 1024 / 1024:.1f} MB')

regions = spi.get_SPI_regions()
for region_name, region in regions.items():
    print(f'Region: {region_name}')
    print(f'  Offset: 0x{region[\"offset\"]:08X}')
    print(f'  Size: 0x{region[\"size\"]:08X}')
    print(f'  Limit: 0x{region[\"limit\"]:08X}')
"

检查 UEFI 持久化机制
python3 -c "
import subprocess, json, re

def check_uefi_persistence():
    findings = []

    result = subprocess.run(['efibootmgr', '-v'], capture_output=True, text=True)
    if result.returncode == 0:
        for line in result.stdout.split('\n'):
            if 'File(' in line or 'PciRoot' in line:
                path_match = re.search(r'File\(([^)]+)\)', line)
                if path_match:
                    boot_path = path_match.group(1)
                    if boot_path.lower().endswith(('.efi',)):
                        findings.append({
                            'type': 'EFI_BOOT_OPTION',
                            'path': boot_path,
                            'detail': line.strip()
                        })

    try:
        with open('/sys/firmware/efi/efivars/SecureBoot-*', 'rb') as f:
            data = f.read()
            sb_status = data[-1]
            findings.append({
                'type': 'SECURE_BOOT_STATUS',
                'enabled': sb_status == 1,
                'detail': 'Secure Boot is ' + ('enabled' if sb_status == 1 else 'DISABLED')
            })
    except FileNotFoundError:
        findings.append({'type': 'SECURE_BOOT_STATUS', 'enabled': False, 'detail': 'EFI variables not accessible'})

    try:
        with open('/sys/firmware/efi/efivars/BootOrder-*', 'rb') as f:
            boot_order = f.read()
            findings.append({'type': 'BOOT_ORDER', 'raw': boot_order.hex()})
    except FileNotFoundError:
        pass

    return findings

results = check_uefi_persistence()
print(f'UEFI persistence check: {len(results)} findings')
for r in results:
    print(f'  [{r[\"type\"]}] {r.get(\"detail\", r.get(\"path\", \"\"))}')
"

提取 Cisco IOS 固件镜像
binwalk -e cisco_ios_image.bin

查找固件中的硬编码后门特征
strings cisco_ios_image.bin | grep -iE '(password|secret|backdoor|debug|hidden)'
strings cisco_ios_image.bin | grep -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'

检查固件中的异常网络连接
strings cisco_ios_image.bin | grep -oP '\d+\.\d+\.\d+\.\d+:\d+'

binwalk 固件模块列表
binwalk --dd '.*' cisco_ios_image.bin

Juniper 设备固件完整性检查
request system snapshot

show system firmware
request system software integrity checksum

检查 Juniper ScreenOS 后门（CVE-2015-7755）
show version
show configuration | match ssh

FPGA 配置比特流提取与分析
openocd -f interface/ftdi/ft232r.cfg -f cpld/xilinx-xc.cfg \
  -c "pld load 0 firmware.bit" -c shutdown

python3 -c "
import hashlib

def analyze_fpga_bitstream(bitstream_path):
    with open(bitstream_path, 'rb') as f:
        data = f.read()

    print(f'Bitstream size: {len(data)} bytes')
    print(f'SHA-256: {hashlib.sha256(data).hexdigest()}')

    xilinx_magic = bytes([0x0F, 0xF0, 0x0F, 0xF0])
    idx = data.find(xilinx_magic)
    if idx != -1:
        print(f'Xilinx sync word found at offset: 0x{idx:08X}')

    for marker, name in [(b'XILINX', 'Xilinx Bitstream'), (b'ALTERA', 'Intel/Altera Bitstream'), (b'LATTICE', 'Lattice Bitstream')]:
        if marker in data:
            print(f'Detected: {name}')

    return {'size': len(data), 'hash': hashlib.sha256(data).hexdigest()}

result = analyze_fpga_bitstream('fpga_config.bin')
"

通用网络设备固件后门特征扫描
python3 -c "
import subprocess, re, hashlib

def scan_device_firmware(target_ip, firmware_path):
    iocs = {
        'hardcoded_ips': [],
        'hardcoded_creds': [],
        'suspicious_strings': [],
        'hidden_services': []
    }

    with open(firmware_path, 'rb') as f:
        data = f.read()

    ip_pattern = rb'(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})'
    for match in re.finditer(ip_pattern, data):
        ip = match.group().decode('utf-8', errors='ignore')
        octets = ip.split('.')
        if all(0 <= int(o) <= 255 for o in octets):
            if ip.startswith('0.') or ip.startswith('127.'):
                continue
            iocs['hardcoded_ips'].append({'ip': ip, 'offset': match.start()})

    cred_patterns = [
        rb'(?:password|passwd|pwd)\s*[=:]\s*(\S+)',
        rb'(?:secret|key)\s*[=:]\s*(\S+)',
        rb'(?:enable\s+password)\s+(\S+)',
    ]
    for pattern in cred_patterns:
        for match in re.finditer(pattern, data, re.IGNORECASE):
            iocs['hardcoded_creds'].append({
                'credential': match.group().decode('utf-8', errors='ignore'),
                'offset': match.start()
            })

    suspicious = [b'backdoor', b'hidden', b'debug_mode', b'rootkit', b'sniffer', b'tap']
    for keyword in suspicious:
        for match in re.finditer(keyword, data, re.IGNORECASE):
            iocs['suspicious_strings'].append({
                'keyword': keyword.decode(),
                'offset': match.start(),
                'context': data[max(0, match.start()-32):match.end()+32].hex()
            })

    return iocs

results = scan_device_firmware('192.168.1.1', 'firmware_extracted.bin')
print('IOC Scan Results:')
for category, items in results.items():
    if items:
        print(f'  {category}: {len(items)} findings')
        for item in items[:5]:
            print(f'    {item}')
"

BMC 安全配置审计
python3 -c "
import subprocess, json, re

def audit_bmc_security(bmc_ip, bmc_user='ADMIN'):
    findings = []

    result = subprocess.run(
        ['ipmitool', '-I', 'lanplus', '-H', bmc_ip, '-U', bmc_user, '-P', 'test',
         'channel', 'info'],
        capture_output=True, text=True, timeout=10
    )

    if result.returncode == 0:
        for line in result.stdout.split('\n'):
            if 'Authentication Type' in line:
                findings.append({
                    'check': 'AUTH_TYPE',
                    'detail': line.strip(),
                    'risk': 'HIGH' if 'NONE' in line or 'RCMP+' in line else 'MEDIUM'
                })

    result = subprocess.run(
        ['ipmitool', '-I', 'lanplus', '-H', bmc_ip, '-U', bmc_user, '-P', 'test',
         'user', 'list', '1'],
        capture_output=True, text=True, timeout=10
    )

    if result.returncode == 0:
        for line in result.stdout.split('\n'):
            if 'ENABLED' in line:
                findings.append({
                    'check': 'ACTIVE_USER',
                    'detail': line.strip(),
                    'risk': 'INFO'
                })
            if 'ADMIN' in line and 'root' not in line.lower():
                findings.append({
                    'check': 'PRIVILEGED_USER',
                    'detail': line.strip(),
                    'risk': 'MEDIUM'
                })

    result = subprocess.run(
        ['ipmitool', '-I', 'lanplus', '-H', bmc_ip, '-U', bmc_user, '-P', 'test',
         'dcmi', 'parameters', 'get', '11'],
        capture_output=True, text=True, timeout=10
    )

    findings.append({
        'check': 'SOL_STATUS',
        'detail': 'Serial Over LAN checked',
        'risk': 'INFO'
    })

    return findings

results = audit_bmc_security('10.0.0.100')
print(f'BMC security audit: {len(results)} findings')
for r in results:
    print(f'  [{r[\"risk\"]}] {r[\"check\"]}: {r[\"detail\"]}')
"

HBA 卡固件版本检查
lspci -vv -d 1000:  | grep -i "firmware"
lspci -nn | grep -i fibre

MegaCLI/storcli 存储控制器检查
storcli /c0 show all
storcli /c0/fall show detail

Emulex HBA 固件检查
hbacmd HBAAttributes 00:00:00:00:00:00:00:00

QLogic HBA 固件检查
qlcli fwping -d 0

硬盘/SSD 固件信息收集
smartctl -a /dev/sda
smartctl -l firmware /dev/sda

hdparm -I /dev/sda
hdparm --dco-identify /dev/sda

NVMe SSD 固件审计
nvme id-ctrl /dev/nvme0
nvme list
nvme smart-log /dev/nvme0

TPM 2.0 状态检查
tpm2_getcap properties-fixed | grep -i "TPM2_PT_FAMILY"
tpm2_getcap properties-fixed | grep -i "TPM2_PT_MANUFACTURER"
tpm2_getcap properties-variable
tpm2_pcrread sha256

tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements | head -50

验证 PCR 完整性
python3 -c "
import subprocess, json

def verify_tpm_pcrs():
    result = subprocess.run(['tpm2_pcrread', 'sha256'], capture_output=True, text=True)
    if result.returncode != 0:
        return {'error': 'Failed to read PCR values'}

    pcrs = {}
    for line in result.stdout.split('\n'):
        if 'sha256:' in line:
            parts = line.strip().split(':')
            if len(parts) >= 2:
                pcr_index = parts[0].strip()
                pcr_value = parts[1].strip() if len(parts) > 2 else ''
                pcrs[pcr_index] = pcr_value

    known_good_pcrs = {
        ' 0': '0000000000000000000000000000000000000000000000000000000000000000',
        ' 1': '0000000000000000000000000000000000000000000000000000000000000000',
        ' 2': '0000000000000000000000000000000000000000000000000000000000000000',
        ' 7': '0000000000000000000000000000000000000000000000000000000000000000',
    }

    tampering_detected = []
    for pcr_idx, expected in known_good_pcrs.items():
        actual = pcrs.get(pcr_idx.strip(), '')
        if actual and expected != '0000000000000000000000000000000000000000000000000000000000000000':
            if actual != expected:
                tampering_detected.append({
                    'pcr': pcr_idx.strip(),
                    'expected': expected[:32] + '...',
                    'actual': actual[:32] + '...'
                })

    return {
        'pcr_count': len(pcrs),
        'tampering_detected': tampering_detected,
        'status': 'COMPROMISED' if tampering_detected else 'CLEAN'
    }

result = verify_tpm_pcrs()
print(f'TPM PCR verification: {result[\"status\"]}')
print(f'PCR registers read: {result[\"pcr_count\"]}')
for item in result['tampering_detected']:
    print(f'  [!] PCR {item[\"pcr\"]} tampering detected')
"

CHIPSEC 平台完整性检查
chipsec_main
chipsec_main --module common.secureboot
chipsec_main --module common.uefi
chipsec_main --module common.bios_wp

Intel Boot Guard 验证
python3 -c "
from chipsec.hal.intel import intel
from chipsec import chipset

cs = chipset.cs()

bgt_status = cs.read_register('BootGuardStatus')
print(f'BootGuard Status Register: 0x{bgt_status:08X}')

if bgt_status & 0x1:
    print('[+] Intel Boot Guard is ENABLED')
else:
    print('[!] Intel Boot Guard is DISABLED or not supported')

bgt_config = cs.read_register('BootGuardConfig')
print(f'BootGuard Config Register: 0x{bgt_config:08X}')
"

硬件供应链攻击 IOC 关联分析脚本
python3 -c "
import json, hashlib, datetime

def create_hw_supply_chain_ioc():
    ioc_report = {
        'report_id': f'HW-SCA-{datetime.datetime.now().strftime(\"%Y%m%d\")}-001',
        'classification': 'CONFIDENTIAL',
        'incident_type': 'Hardware Supply Chain Attack',
        'mitre_attack': ['T1195.001', 'T1542.001', 'T1199'],
        'affected_assets': [
            {
                'asset_type': 'Server',
                'model': 'Supermicro X11SSZ-F',
                'serial': 'SN-2024-HW-001',
                'location': 'DC-Rack-42-U15',
                'compromise_level': 'CRITICAL'
            }
        ],
        'indicators': {
            'firmware_hashes': {
                'suspicious_spi': hashlib.sha256(b'suspicious_firmware_sample').hexdigest(),
                'known_good_spi': hashlib.sha256(b'known_good_firmware_baseline').hexdigest()
            },
            'network_indicators': [
                {'type': 'IP', 'value': '203.0.113.42', 'context': 'C2 callback from BMC'},
                {'type': 'Domain', 'value': 'update-service.cloudns.biz', 'context': 'Firmware update endpoint'}
            ],
            'host_indicators': [
                {'type': 'File', 'path': '/dev/mtd0', 'hash': 'abnormal_read_pattern'},
                {'type': 'Process', 'name': 'ipmitool', 'context': 'Unauthorized BMC access'}
            ],
            'hardware_indicators': [
                {'type': 'Component', 'ref': 'U7', 'expected': 'N/A', 'actual': 'Soldered IC - 8-pin SOIC'},
                {'type': 'PCB', 'location': 'Near BMC chip', 'finding': 'Extra trace routing to unused pad'}
            ]
        },
        'timeline': [
            {'date': '2024-01-15', 'event': 'Device delivered from vendor'},
            {'date': '2024-01-20', 'event': 'Device deployed to production'},
            {'date': '2024-06-15', 'event': 'Anomalous BMC network traffic detected'},
            {'date': '2024-06-20', 'event': 'Hardware forensics initiated'},
            {'date': '2024-07-01', 'event': 'Physical tampering confirmed'}
        ],
        'evidence_strength': {
            'strong_evidence': ['SPI flash firmware mismatch', 'Physical IC identification', 'PCB trace anomaly'],
            'medium_evidence': ['BMC network callback', 'Power consumption anomaly'],
            'weak_evidence': ['Unfamiliar component manufacturer', 'Delivery chain gap']
        }
    }

    return ioc_report

report = create_hw_supply_chain_ioc()
with open('hw_supply_chain_ioc_report.json', 'w') as f:
    json.dump(report, f, indent=2, ensure_ascii=False)

print(f'IOC report generated: {report[\"report_id\"]}')
print(f'Strong evidence items: {len(report[\"evidence_strength\"][\"strong_evidence\"]})')
print(f'Network indicators: {len(report[\"indicators\"][\"network_indicators\"])}')
"

title: 硬件供应链 - BMC/IPMI 异常认证活动
id: a7c4e1f2-8b3d-4a9e-b5c6-d7e8f9a0b1c2
status: experimental
description: 检测 BMC/IPMI 接口的异常认证活动，可能指示硬件供应链攻击中的带外管理滥用
references:
  - https://attack.mitre.org/techniques/T1199/
author: Blue Team Forensics
date: 2026/07/18
tags:
  - attack.persistence
  - attack.t1199
  - hardware_supply_chain
logsource:
  product: linux
  service: syslog
detection:
  selection_bmc_auth:
    - 'ipmi[.*]: authentication failure'
    - 'ipmi[.*]: unauthorized attempt'
    - 'ipmi[.*]: channel access'
  selection_bmc_config:
    - 'ipmi[.*]: configuration change'
    - 'bmc[.*]: firmware update'
    - 'bmc[.*]: user management'
  timeframe: 1h
  condition: selection_bmc_auth | count() > 5 or selection_bmc_config
falsepositives:
  - Legitimate BMC administration
  - Scheduled firmware updates
level: high
---
title: 硬件供应链 - UEFI 固件完整性验证失败
id: b8d5f2a3-9c4e-4b0a-c6d7-e8f9a0b1c2d3
status: experimental
description: 检测 UEFI 固件完整性验证失败事件，可能指示固件供应链篡改
references:
  - https://attack.mitre.org/techniques/T1542/001/
author: Blue Team Forensics
date: 2026/07/18
tags:
  - attack.defense_evasion
  - attack.t1542.001
  - hardware_supply_chain
logsource:
  product: linux
  service: kernel
detection:
  selection_uefi_error:
    - 'efi:*: Secure Boot verification failed'
    - 'efi:*: Signature verification error'
    - 'kernel: Secure Boot disabled'
    - 'efivar:*: unauthorized NVRAM modification'
  selection_tpm_error:
    - 'tpm:*: PCR value mismatch'
    - 'tpm:*: measurement verification failed'
  timeframe: 10m
  condition: selection_uefi_error or selection_tpm_error
falsepositives:
  - Legitimate Secure Boot configuration changes
  - BIOS update procedures
level: critical
---
title: 硬件供应链 - SPI Flash 异常访问
id: c9e6a3b4-0d5f-4c1b-d7e8-f9a0b1c2d3e4
status: experimental
description: 检测对 SPI Flash 存储器的异常直接访问，可能指示固件提取或篡改行为
author: Blue Team Forensics
date: 2026/07/18
tags:
  - attack.collection
  - attack.t1195.001
  - hardware_supply_chain
logsource:
  product: linux
  service: kernel
detection:
  selection_mtd_access:
    - 'mtd:*: direct access'
    - 'spi:*: unauthorized access'
  selection_flashrom:
    ProcessName: 'flashrom'
    ParentImage|endswith:
      - '/bin/bash'
      - '/bin/sh'
  selection_chipsec:
    ProcessName|contains: 'chipsec'
  condition: selection_mtd_access or selection_flashrom or selection_chipsec
falsepositives:
  - Authorized firmware update procedures
  - Hardware maintenance operations
level: high

#!/bin/bash
HW_SCAN_REPORT="/tmp/hw_supply_chain_scan_$(date +%Y%m%d_%H%M%S).txt"
echo "=== Hardware Supply Chain Security Scan ===" > "$HW_SCAN_REPORT"
echo "Scan Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$HW_SCAN_REPORT"
echo "Hostname: $(hostname)" >> "$HW_SCAN_REPORT"
echo "" >> "$HW_SCAN_REPORT"

echo "=== BIOS/UEFI Information ===" >> "$HW_SCAN_REPORT"
dmidecode -t bios 2>/dev/null >> "$HW_SCAN_REPORT"
echo "" >> "$HW_SCAN_REPORT"

echo "=== System Manufacturer ===" >> "$HW_SCAN_REPORT"
dmidecode -s system-manufacturer 2>/dev/null >> "$HW_SCAN_REPORT"
dmidecode -s system-product-name 2>/dev/null >> "$HW_SCAN_REPORT"
dmidecode -s system-serial-number 2>/dev/null >> "$HW_SCAN_REPORT"
echo "" >> "$HW_SCAN_REPORT"

echo "=== Baseboard Information ===" >> "$HW_SCAN_REPORT"
dmidecode -t baseboard 2>/dev/null >> "$HW_SCAN_REPORT"
echo "" >> "$HW_SCAN_REPORT"

echo "=== Processor Information ===" >> "$HW_SCAN_REPORT"
dmidecode -t processor 2>/dev/null >> "$HW_SCAN_REPORT"
echo "" >> "$HW_SCAN_REPORT"

echo "=== Memory Device Inventory ===" >> "$HW_SCAN_REPORT"
dmidecode -t memory 2>/dev/null | grep -A 18 "Memory Device" >> "$HW_SCAN_REPORT"
echo "" >> "$HW_SCAN_REPORT"

echo "=== Storage Device Firmware Versions ===" >> "$HW_SCAN_REPORT"
for disk in /dev/sd[a-z] /dev/nvme[0-9]n[0-9]; do
    if [ -b "$disk" ]; then
        echo "Device: $disk" >> "$HW_SCAN_REPORT"
        smartctl -i "$disk" 2>/dev/null | grep -iE "(model|serial|firmware|capacity)" >> "$HW_SCAN_REPORT"
        echo "---" >> "$HW_SCAN_REPORT"
    fi
done
echo "" >> "$HW_SCAN_REPORT"

echo "=== PCI Device Enumeration ===" >> "$HW_SCAN_REPORT"
lspci -nn 2>/dev/null >> "$HW_SCAN_REPORT"
echo "" >> "$HW_SCAN_REPORT"

echo "=== USB Device Enumeration ===" >> "$HW_SCAN_REPORT"
lsusb 2>/dev/null >> "$HW_SCAN_REPORT"
echo "" >> "$HW_SCAN_REPORT"

echo "=== Network Interface MAC Addresses ===" >> "$HW_SCAN_REPORT"
ip link show 2>/dev/null | grep -E "(link/ether|state)" >> "$HW_SCAN_REPORT"
echo "" >> "$HW_SCAN_REPORT"

echo "=== Loaded Kernel Modules (Driver Verification) ===" >> "$HW_SCAN_REPORT"
lsmod 2>/dev/null >> "$HW_SCAN_REPORT"
echo "" >> "$HW_SCAN_REPORT"

echo "=== BMC/IPMI Status ===" >> "$HW_SCAN_REPORT"
ipmitool lan print 2>/dev/null >> "$HW_SCAN_REPORT" || echo "IPMI not available or requires authentication" >> "$HW_SCAN_REPORT"
echo "" >> "$HW_SCAN_REPORT"

echo "=== Secure Boot Status ===" >> "$HW_SCAN_REPORT"
if [ -d /sys/firmware/efi ]; then
    mokutil --sb-state 2>/dev/null >> "$HW_SCAN_REPORT" || echo "mokutil not available" >> "$HW_SCAN_REPORT"
    cat /sys/firmware/efi/efivars/SecureBoot-* 2>/dev/null | xxd | tail -1 >> "$HW_SCAN_REPORT"
else
    echo "System is not booted in UEFI mode" >> "$HW_SCAN_REPORT"
fi
echo "" >> "$HW_SCAN_REPORT"

echo "=== CHIPSEC Scan (if available) ===" >> "$HW_SCAN_REPORT"
if command -v chipsec_main &>/dev/null; then
    chipsec_main 2>&1 | head -100 >> "$HW_SCAN_REPORT"
else
    echo "CHIPSEC not installed" >> "$HW_SCAN_REPORT"
fi
echo "" >> "$HW_SCAN_REPORT"

echo "=== Tamper Indicators ===" >> "$HW_SCAN_REPORT"
dmesg 2>/dev/null | grep -iE "(tamper|hardware error|mce|machine check)" >> "$HW_SCAN_REPORT"
mcelog --client 2>/dev/null >> "$HW_SCAN_REPORT"
echo "" >> "$HW_SCAN_REPORT"

echo "=== Anomaly Summary ===" >> "$HW_SCAN_REPORT"
ANOMALY_COUNT=0

if ! command -v chipsec_main &>/dev/null; then
    echo "[WARNING] CHIPSEC not installed - firmware integrity check incomplete" >> "$HW_SCAN_REPORT"
    ANOMALY_COUNT=$((ANOMALY_COUNT + 1))
fi

BIOS_AGE=$(dmidecode -s bios-version 2>/dev/null | head -1)
echo "[INFO] Current BIOS version: $BIOS_AGE" >> "$HW_SCAN_REPORT"

SB_STATE=$(mokutil --sb-state 2>/dev/null || echo "unknown")
if echo "$SB_STATE" | grep -qi "disabled"; then
    echo "[ALERT] Secure Boot is DISABLED" >> "$HW_SCAN_REPORT"
    ANOMALY_COUNT=$((ANOMALY_COUNT + 1))
fi

echo "[INFO] Total anomalies detected: $ANOMALY_COUNT" >> "$HW_SCAN_REPORT"

echo "Scan complete. Report saved to: $HW_SCAN_REPORT"

import hashlib
import json
import os
import struct
import sys
from datetime import datetime


class HardwareSupplyChainAnalyzer:
    def __init__(self, report_dir="/tmp/hw_sca"):
        self.report_dir = report_dir
        os.makedirs(report_dir, exist_ok=True)
        self.findings = []

    def add_finding(self, severity, category, description, evidence=None):
        finding = {
            "timestamp": datetime.utcnow().isoformat(),
            "severity": severity,
            "category": category,
            "description": description,
            "evidence": evidence or {}
        }
        self.findings.append(finding)
        marker = {"CRITICAL": "!!!", "HIGH": "!!", "MEDIUM": "!", "LOW": "~"}
        print(f"[{marker.get(severity, ' ')}] {category}: {description}")

    def analyze_firmware_image(self, firmware_path, baseline_path=None):
        with open(firmware_path, "rb") as f:
            fw_data = f.read()

        fw_hash = hashlib.sha256(fw_data).hexdigest()
        self.add_finding("INFO", "FIRMWARE_HASH",
                         f"Firmware SHA-256: {fw_hash}",
                         {"path": firmware_path, "size": len(fw_data)})

        if baseline_path and os.path.exists(baseline_path):
            with open(baseline_path, "rb") as f:
                bl_data = f.read()

            if len(fw_data) != len(bl_data):
                self.add_finding("HIGH", "FIRMWARE_SIZE_MISMATCH",
                                 f"Size: suspect={len(fw_data)}, baseline={len(bl_data)}",
                                 {"diff": abs(len(fw_data) - len(bl_data))})

            diff_count = sum(1 for a, b in zip(fw_data, bl_data) if a != b)
            diff_ratio = diff_count / max(len(fw_data), 1)
            if diff_ratio > 0.01:
                self.add_finding("CRITICAL", "FIRMWARE_CONTENT_DIFF",
                                 f"Significant differences: {diff_count} bytes ({diff_ratio:.2%})",
                                 {"diff_count": diff_count, "diff_ratio": diff_ratio})
            elif diff_count > 0:
                self.add_finding("MEDIUM", "FIRMWARE_CONTENT_DIFF",
                                 f"Minor differences: {diff_count} bytes ({diff_ratio:.4%})",
                                 {"diff_count": diff_count})

    def scan_for_suspicious_strings(self, firmware_path, indicators=None):
        if indicators is None:
            indicators = {
                "hardcoded_ips": [],
                "backdoor_markers": [b"backdoor", b"rootkit", b"hidden_debug",
                                     b"secret_shell", b"tap_dance", b"covert_channel"],
                "crypto_weakness": [b"DES", b"MD5", b"RC4", b"NULL_KEY"],
                "suspicious_urls": []
            }

        with open(firmware_path, "rb") as f:
            data = f.read()

        ip_pattern = struct.pack("BBBB", 0, 0, 0, 0)

        for keyword in indicators.get("backdoor_markers", []):
            offset = 0
            while True:
                idx = data.find(keyword, offset)
                if idx == -1:
                    break
                context = data[max(0, idx-32):idx+len(keyword)+32]
                self.add_finding("HIGH", "SUSPICIOUS_STRING",
                                 f"Backdoor marker '{keyword.decode()}' at offset 0x{idx:08X}",
                                 {"offset": idx, "context_hex": context.hex()})
                offset = idx + len(keyword)

        for keyword in indicators.get("crypto_weakness", []):
            idx = data.find(keyword)
            if idx != -1:
                self.add_finding("MEDIUM", "WEAK_CRYPTO",
                                 f"Weak crypto marker '{keyword.decode()}' at offset 0x{idx:08X}",
                                 {"offset": idx})

        return len(data)

    def analyze_spi_flash_descriptor(self, spi_path):
        with open(spi_path, "rb") as f:
            data = f.read()

        descriptor_sig = bytes([0x5A, 0xA5, 0xF0, 0x0F])
        idx = data.find(descriptor_sig)

        if idx == -1:
            self.add_finding("MEDIUM", "NO_IFD_FOUND",
                             "No Intel Flash Descriptor signature found")
            return

        self.add_finding("INFO", "IFD_FOUND",
                         f"Intel Flash Descriptor at offset 0x{idx:08X}")

        if idx + 20 <= len(data):
            regions = struct.unpack_from("<HHHH", data, idx + 4)
            region_names = ["Flash", "BIOS", "ME", "GbE", "Platform"]
            for i, (start, limit) in enumerate(zip(regions[::2], regions[1::2])):
                if i < len(region_names):
                    self.add_finding("INFO", "FLASH_REGION",
                                     f"{region_names[i]} region: offset=0x{start:04X}, limit=0x{limit:04X}",
                                     {"region": region_names[i], "offset": start, "limit": limit})

    def check_bmc_configuration(self, bmc_ip):
        import subprocess
        findings_before = len(self.findings)

        try:
            result = subprocess.run(
                ["ipmitool", "-I", "lanplus", "-H", bmc_ip, "-U", "ADMIN", "-P", "",
                 "user", "list", "1"],
                capture_output=True, text=True, timeout=10
            )
            if result.returncode == 0 and "ADMIN" in result.stdout:
                self.add_finding("HIGH", "DEFAULT_BMC_CREDENTIALS",
                                 f"BMC at {bmc_ip} accepts default ADMIN credentials",
                                 {"bmc_ip": bmc_ip, "output": result.stdout[:200]})
        except (subprocess.TimeoutExpired, FileNotFoundError):
            self.add_finding("INFO", "BMC_CHECK_SKIP",
                             f"BMC connectivity check skipped for {bmc_ip}")

        return len(self.findings) - findings_before

    def generate_report(self):
        report = {
            "scan_timestamp": datetime.utcnow().isoformat(),
            "total_findings": len(self.findings),
            "findings_by_severity": {},
            "findings": self.findings
        }

        for f in self.findings:
            sev = f["severity"]
            report["findings_by_severity"][sev] = report["findings_by_severity"].get(sev, 0) + 1

        report_path = os.path.join(self.report_dir,
                                    f"hw_sca_report_{datetime.utcnow().strftime('%Y%m%d_%H%M%S')}.json")
        with open(report_path, "w") as f:
            json.dump(report, f, indent=2, ensure_ascii=False)

        print(f"\nReport saved to: {report_path}")
        print(f"Total findings: {report['total_findings']}")
        for sev, count in report["findings_by_severity"].items():
            print(f"  {sev}: {count}")

        return report


if __name__ == "__main__":
    analyzer = HardwareSupplyChainAnalyzer()
    analyzer.add_finding("INFO", "SCAN_START", "Hardware Supply Chain Analysis initiated")
    print("Hardware Supply Chain Analyzer initialized")
    print("Usage: Provide firmware images or BMC IPs for analysis")

rule Hardware_Trojan_Backdoor_Strings {
    meta:
        description = "Detects common backdoor marker strings in hardware firmware images"
        author = "Blue Team Forensics"
        date = "2026-07-18"
        reference = "Hardware Supply Chain Forensics"
        severity = "critical"
        mitre_attack = "T1195.001"

    strings:
        $backdoor1 = "backdoor" ascii nocase
        $backdoor2 = "rootkit" ascii nocase
        $backdoor3 = "hidden_debug" ascii nocase
        $backdoor4 = "secret_shell" ascii nocase
        $backdoor5 = "tap_dance" ascii nocase
        $covert1 = "covert_channel" ascii nocase
        $covert2 = "data_exfil" ascii nocase
        $covert3 = "exfiltrate" ascii nocase

    condition:
        uint16(0) == 0x5A5A or uint32(0) == 0x0FF0A55A or uint32(0) == 0x464C457F
        and 2 of ($backdoor*, $covert*)
}

rule UEFI_Bootkit_Indicators {
    meta:
        description = "Detects indicators of UEFI bootkit presence"
        author = "Blue Team Forensics"
        date = "2026-07-18"
        reference = "BlackLotus / MosaicRegressor analysis"
        severity = "critical"
        mitre_attack = "T1542.001"

    strings:
        $efi_mz = { 4D 5A }
        $bootkit1 = "Windows Boot Manager" ascii
        $bootkit2 = "bootmgrfw.efi" ascii
        $suspicious1 = "SetVirtualAddressMap" ascii
        $suspicious2 = "ExitBootServices" ascii
        $hook_pattern = { 48 89 05 ?? ?? ?? ?? FF D0 }
        $svc_pattern = { 48 83 EC ?? 48 89 ?? 24 ?? 48 8B ?? }

    condition:
        $efi_mz at 0
        and $bootkit1 and ($suspicious1 or $suspicious2)
        and ($hook_pattern or $svc_pattern)
}

rule SPI_Flash_Tampering_Evidence {
    meta:
        description = "Detects signs of SPI Flash tampering in firmware images"
        author = "Blue Team Forensics"
        date = "2026-07-18"
        severity = "high"
        mitre_attack = "T1195.001"

    strings:
        $ifd_sig = { 5A A5 F0 0F }
        $neuron = "Intel ME" ascii
        $amd_psp = "AMD PSP" ascii
        $amd_agesa = "AGESA" ascii
        $padding_ff = { FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF }

    condition:
        $ifd_sig at 0
        and (#padding_ff > 1000)
        and not ($neuron at 0x100000)
}