脑机接口安全取证深度分析

# 搭建BCI安全取证分析环境（Ubuntu 22.04+）
sudo apt update && sudo apt install -y \
  ghidra \
  wireshark tshark \
  nmap \
  openocd \
  python3-pip \
  libusb-1.0-0-dev \
  sigrok

pip3 install --user \
  mne \
  numpy scipy matplotlib \
  scapy \
  pyelftools \
  capstone \
  frida-tools \
  bleak

# 安装nRF52840 BLE嗅探工具
git clone https://github.com/NordicSemiconductor/pc-nrfconnect-sniffer.git
cd pc-nrfconnect-sniffer && npm install && npm run build

#!/usr/bin/env python3
import mne
import numpy as np
import hashlib
import sys

def verify_eeg_integrity(edf_path):
    raw = mne.io.read_raw_edf(edf_path, preload=True, verbose=False)
    report = {
        "file": edf_path,
        "channels": len(raw.ch_names),
        "sfreq": raw.info["sfreq"],
        "duration_s": raw.times[-1],
        "total_samples": raw.get_data().shape[1],
    }
    data = raw.get_data()
    data_bytes = data.tobytes()
    report["sha256"] = hashlib.sha256(data_bytes).hexdigest()
    report["md5"] = hashlib.md5(data_bytes).hexdigest()

    sfreq = raw.info["sfreq"]
    for ch_idx, ch_name in enumerate(raw.ch_names):
        ch_data = data[ch_idx]
        std_val = np.std(ch_data)
        mean_val = np.mean(ch_data)
        max_val = np.max(np.abs(ch_data))
        if std_val < 1e-10:
            report[f"ALERT_{ch_name}"] = "FLATLINE - 信号完全静止，可能被截断或篡改"
        elif max_val > 1e-3:
            report[f"WARNING_{ch_name}"] = f"异常振幅 max={max_val:.6f}V"
        psd = np.abs(np.fft.rfft(ch_data))
        freqs = np.fft.rfftfreq(len(ch_data), 1.0 / sfreq)
        gamma_mask = (freqs >= 30) & (freqs <= 100)
        gamma_power = np.mean(psd[gamma_mask])
        total_power = np.mean(psd)
        gamma_ratio = gamma_power / (total_power + 1e-15)
        if gamma_ratio > 0.6:
            report[f"ALERT_{ch_name}_gamma"] = f"异常高频能量比 {gamma_ratio:.4f}"

    diffs = np.diff(raw.times)
    expected_diff = 1.0 / sfreq
    timestamp_jitter = np.max(np.abs(diffs - expected_diff))
    report["timestamp_jitter_max"] = float(timestamp_jitter)
    if timestamp_jitter > expected_diff * 0.5:
        report["ALERT_timestamp"] = "时间戳抖动异常，采样可能被篡改"

    for key, value in report.items():
        print(f"  {key}: {value}")

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <edf_file>")
        sys.exit(1)
    verify_eeg_integrity(sys.argv[1])

#!/usr/bin/env python3
import numpy as np
from scipy import signal as sig

def detect_emg_injection(emg_data, sfreq=200):
    results = {}
    envelope = np.abs(emg_data)
    kernel_size = int(0.05 * sfreq)
    kernel = np.ones(kernel_size) / kernel_size
    smoothed = np.convolve(envelope, kernel, mode="same")
    zero_crossings = np.sum(np.diff(np.sign(emg_data)) != 0)
    expected_zc_range = (sfreq * 0.1, sfreq * 0.8)
    zc_ratio = zero_crossings / len(emg_data)
    results["zero_crossing_rate"] = float(zc_ratio)
    if zc_ratio < 0.05 or zc_ratio > 0.9:
        results["ALERT_zc"] = "异常过零率，可能为合成信号"

    b, a = sig.butter(4, [20 / (sfreq / 2), 450 / (sfreq / 2)], btype="band")
    filtered = sig.filtfilt(b, a, emg_data)
    psd = np.abs(np.fft.rfft(filtered)) ** 2
    freqs = np.fft.rfftfreq(len(filtered), 1.0 / sfreq)
    harmonic_mask = np.zeros(len(freqs), dtype=bool)
    for fundamental in [50, 60]:
        for harmonic in range(1, 6):
            mask = (freqs > fundamental * harmonic - 1) & (freqs < fundamental * harmonic + 1)
            harmonic_mask |= mask
    harmonic_power = np.sum(psd[harmonic_mask])
    total_power = np.sum(psd)
    harmonic_ratio = harmonic_power / (total_power + 1e-15)
    results["powerline_harmonic_ratio"] = float(harmonic_ratio)
    if harmonic_ratio > 0.3:
        results["ALERT_harmonic"] = "工频谐波占比过高，可能存在电注入攻击"

    autocorr = np.correlate(emg_data - np.mean(emg_data), emg_data - np.mean(emg_data), mode="full")
    autocorr = autocorr[len(autocorr) // 2:]
    autocorr = autocorr / (autocorr[0] + 1e-15)
    peaks, _ = sig.find_peaks(autocorr, height=0.3, distance=int(sfreq * 0.01))
    results["autocorr_peaks"] = len(peaks)
    if len(peaks) > 3:
        results["ALERT_autocorr"] = "自相关异常峰值，信号可能含周期性伪造成分"

    for key, value in results.items():
        print(f"  {key}: {value}")

if __name__ == "__main__":
    dummy_emg = np.random.randn(2000) * 0.0001
    detect_emg_injection(dummy_emg)

# 使用nRF52840 Dongle进行BLE流量嗅探
# 需要安装nRF Connect Sniffer固件到Dongle

# 启动BLE嗅探（指定BCI设备常用的广播信道37-39）
python3 ~/pc-nrfconnect-sniffer/src/sniffer_api.py \
  --adapter_index 0 \
  --channel 37 \
  --baudrate 1000000 \
  --file_output bci_ble_capture.pcapng

# 使用tshark分析捕获的BLE流量
tshark -r bci_ble_capture.pcapng -Y "btle" -T fields \
  -e frame.number \
  -e btle.access_address \
  -e btle.advertising_header.pdu_type \
  -e btle.data_header.llid \
  -e btle.ciphertext \
  -e bluetooth.address \
  2>/dev/null | head -100

# 检查BLE配对是否使用安全模式
tshark -r bci_ble_capture.pcapng -Y "smp" -T fields \
  -e smp.authreq \
  -e smp.io_capability \
  -e smp.oob_data_flag \
  -e smp.max_enc_key_size \
  2>/dev/null

# 提取BCI设备广播数据中的设备信息
tshark -r bci_ble_capture.pcapng \
  -Y "btle.advertising_header.pdu_type == 0x00" \
  -T fields \
  -e btle.advertising_data.complete_local_name \
  -e btle.advertising_data.service_uuid_16 \
  -e btle.advertising_data.manufacturer_specific_data \
  2>/dev/null

# 使用HackRF One采集BCI设备2.4GHz频段信号
hackrf_transfer -r bci_raw_signal.bin -f 2440000000 -s 20000000 -g 40 -l 32

# 使用Inspectrum进行信号可视化与参数分析
inspectrum bci_raw_signal.bin &

# 使用GNU Radio进行协议逆向分析
# 基础信号处理流程：低通滤波 -> 解调 -> 帧同步 -> 解码

# 使用Inspectrum导出信号参数
# 1. 加载捕获的信号文件
# 2. 调整FFT大小和窗口类型找到信号中心频率
# 3. 使用Cursor标记帧边界
# 4. 导出帧起始位置和符号速率

# 使用Universal Radio Hacker (URH)进行协议逆向
urh bci_raw_signal.iq &

# 在Linux系统上配置USB流量捕获
# 加载usbmon内核模块
sudo modprobe usbmon

# 查找BCI设备的USB接口
lsusb | grep -i "EEG\|BCI\|neuro\|brain\|g.tec\|Emotiv"

# 使用usbmon捕获特定设备的USB流量
# 假设BCI设备USB地址为1-2
sudo tcpdump -i usbmon2 -w bci_usb_capture.pcap

# 使用USBPcap + Wireshark（Windows环境）分析USB HID数据
tshark -r bci_usb_capture.pcap -Y "usb.transfer_type == 0x01" -T fields \
  -e frame.time \
  -e usb.endpoint_address \
  -e usb.capdata \
  -e usb.data_len \
  2>/dev/null

# 解析BCI USB HID报告描述符，识别数据通道
tshark -r bci_usb_capture.pcap -Y "usb.setup.bRequest == 0x06" \
  -T fields -e usb.capdata 2>/dev/null

# 检测异常的USB控制传输（可能为固件更新或配置修改）
tshark -r bci_usb_capture.pcap \
  -Y "usb.transfer_type == 0x02 && usb.endpoint_address.direction == 0" \
  -T fields -e frame.time -e usb.capdata -e usb.data_len \
  2>/dev/null

# JTAG调试端口检测
# 使用JTAGulator自动扫描BCI设备PCB上的调试端口
sudo picocom -b 115200 /dev/ttyUSB0

# JTAGulator交互扫描
# 设置初始引脚范围
VREF 3.3
VIO 3.3
RANGE 0 27
SCAN

# 使用OpenOCD连接ARM Cortex-M调试端口
openocd -f interface/stlink.cfg -f target/stm32f4x.cfg
# 或使用J-Link
openocd -f interface/jlink.cfg -f target/nrf52.cfg

# 连接后导出完整Flash镜像
telnet localhost 4444
> flash read_bank 0 bci_firmware_dump.bin

# 使用binwalk提取固件文件系统
binwalk -e bci_firmware_dump.bin

# 使用strings提取可读字符串，寻找敏感信息
strings -n 8 bci_firmware_dump.bin | grep -iE "key|password|secret|token|api|update|debug|jtag"

# 使用Ghidra进行深度逆向分析
# 启动Ghidra并加载固件二进制文件
ghidraRun &

#!/usr/bin/env python3
import hashlib
import struct
import sys

def analyze_bci_firmware(firmware_path):
    with open(firmware_path, "rb") as f:
        data = f.read()

    report = {"file": firmware_path, "size_bytes": len(data)}
    report["md5"] = hashlib.md5(data).hexdigest()
    report["sha256"] = hashlib.sha256(data).hexdigest()

    magic_offsets = []
    known_bci_magic = {
        b"\x27\x05\x19\x56": "uImage (U-Boot)",
        b"UBI#": "UBI volume",
        b"\x7fELF": "ELF binary",
        b"MZ": "PE/COFF (Windows CE)",
        b"\x02\x00\x00\x90": "ARM exception vector",
    }
    for magic, desc in known_bci_magic.items():
        offset = data.find(magic)
        if offset != -1:
            magic_offsets.append({"offset": offset, "magic": magic.hex(), "type": desc})
    report["detected_formats"] = magic_offsets

    key_material_offsets = []
    patterns = [b"BEGIN RSA PRIVATE KEY", b"BEGIN EC PRIVATE KEY", b"BEGIN PRIVATE KEY",
                b"\x30\x82", b"\x30\x81"]
    for pattern in patterns:
        offset = data.find(pattern)
        if offset != -1:
            key_material_offsets.append({"offset": offset, "pattern": pattern[:4].hex()})
    report["potential_key_material"] = key_material_offsets

    debug_markers = []
    for marker in [b"DEBUG", b"GDB", b"JTAG", b"SWD", b"UART", b"printf", b"breakpoint"]:
        count = data.count(marker)
        if count > 0:
            debug_markers.append({"marker": marker.decode(), "count": count})
    report["debug_markers"] = debug_markers

    version_strings = []
    import re
    for match in re.finditer(rb"(?:v|V|version|VERSION)[0-9][0-9.\-_a-zA-Z]{2,20}", data):
        version_strings.append(match.group().decode(errors="replace"))
    report["version_strings"] = list(set(version_strings))[:20]

    if not key_material_offsets:
        report["SECURITY_ASSESSMENT"] = "未发现明文密钥材料 - 签名验证可能存在于加密区域"
    else:
        report["SECURITY_ASSESSMENT"] = f"发现{len(key_material_offsets)}处潜在密钥材料 - 高风险"

    for key, value in report.items():
        print(f"  {key}: {value}")

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <firmware_file>")
        sys.exit(1)
    analyze_bci_firmware(sys.argv[1])

# 审计BCI配套软件的本地数据存储

# 查找BCI相关数据目录
find / -maxdepth 4 -iname "*eeg*" -o -iname "*bci*" -o -iname "*neuro*" -o \
  -iname "*brain*" -o -iname "*emotiv*" -o -iname "*muse*" -o \
  -iname "*neuralink*" 2>/dev/null | head -30

# 检查SQLite数据库中的神经数据记录
for db in $(find ~/ -maxdepth 5 -name "*.db" -o -name "*.sqlite" 2>/dev/null); do
    if sqlite3 "$db" ".tables" 2>/dev/null | grep -iqE "eeg|signal|channel|session|record"; then
        echo "=== Found BCI database: $db ==="
        sqlite3 "$db" ".schema" 2>/dev/null | head -30
        sqlite3 "$db" "SELECT name FROM sqlite_master WHERE type='table'" 2>/dev/null
        echo "---"
    fi
done

# 检查BCI应用目录中的EDF/BDF数据文件
find ~/ -maxdepth 5 \( -name "*.edf" -o -name "*.bdf" -o -name "*.gdf" \) 2>/dev/null | while read f; do
    echo "File: $f"
    echo "  Size: $(stat -f%z "$f") bytes"
    echo "  Modified: $(stat -f '%Sm' "$f")"
    echo "  SHA256: $(shasum -a 256 "$f" | cut -d' ' -f1)"
done

# 检查浏览器存储的BCI云端数据缓存
find ~/Library -maxdepth 5 -iname "*neuro*" -o -iname "*eeg*" -o -iname "*bci*" 2>/dev/null | head -20
find ~/.config -maxdepth 4 -iname "*neuro*" -o -iname "*eeg*" -o -iname "*bci*" 2>/dev/null | head -20

#!/usr/bin/env python3
import subprocess
import json
import sys

def audit_bci_cloud_traffic(capture_file):
    cmd = [
        "tshark", "-r", capture_file, "-Y",
        "http || tls || tcp.port==443",
        "-T", "fields",
        "-e", "frame.time",
        "-e", "ip.src",
        "-e", "ip.dst",
        "-e", "tcp.port",
        "-e", "tls.handshake.extensions_server_name",
        "-e", "http.host",
        "-e", "http.request.uri",
        "-e", "tls.handshake.type",
        "-e", "http.request.method",
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    lines = result.stdout.strip().split("\n")

    bci_cloud_hosts = []
    unencrypted_eeg = []
    suspicious_endpoints = []

    for line in lines:
        fields = line.split("\t")
        if len(fields) < 3:
            continue
        sni = fields[4] if len(fields) > 4 else ""
        host = fields[5] if len(fields) > 5 else ""
        uri = fields[6] if len(fields) > 6 else ""
        method = fields[8] if len(fields) > 8 else ""

        if any(kw in (sni + host + uri).lower() for kw in
               ["eeg", "bci", "neuro", "brain", "signal", "neural", "cortex"]):
            bci_cloud_hosts.append({
                "sni": sni, "host": host, "uri": uri, "method": method
            })
            if not sni and not host:
                unencrypted_eeg.append({"uri": uri, "method": method})

        if any(kw in (sni + host).lower() for kw in
               ["pastebin", "ngrok", "webhook", "requestbin", "pipedream"]):
            suspicious_endpoints.append({"sni": sni, "host": host, "uri": uri})

    print(f"=== BCI Cloud Traffic Audit Report ===")
    print(f"BCI相关云端连接数: {len(bci_cloud_hosts)}")
    for h in bci_cloud_hosts[:20]:
        print(f"  SNI={h['sni']} Host={h['host']} URI={h['uri'][:60]}")
    print(f"未加密EEG传输: {len(unencrypted_eeg)}")
    for u in unencrypted_eeg[:10]:
        print(f"  [CRITICAL] 明文神经数据传输: URI={u['uri']}")
    print(f"可疑外部端点: {len(suspicious_endpoints)}")
    for s in suspicious_endpoints[:10]:
        print(f"  [WARNING] 数据可能外传: {s['sni']} {s['host']}")

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <pcap_file>")
        sys.exit(1)
    audit_bci_cloud_traffic(sys.argv[1])

# 审计BCI设备Linux驱动安全

# 查找BCI相关内核模块
lsmod | grep -iE "hid|usb|bluetooth|eeg|bci|neuro"
dmesg | grep -iE "eeg\|bci\|hid\|bluetooth" | tail -30

# 检查USB设备描述符中的潜在攻击面
lsusb -v -d $(lsusb | grep -i "eeg\|neuro\|brain\|bci" | awk '{print $2}') 2>/dev/null

# 检查BLE GATT服务暴露的特征值
# 使用bluetoothctl扫描
bluetoothctl scan on
sleep 5
bluetoothctl devices | grep -i "eeg\|bci\|neuro\|muse\|emotiv"
bluetoothctl scan off

# 使用gatttool连接并枚举BCI设备GATT特征
gatttool -b XX:XX:XX:XX:XX:XX --characteristics
gatttool -b XX:XX:XX:XX:XX:XX --char-read -a 0x0003

# 使用nRF Connect CLI枚举BLE服务
nrfutil device scan
nrfutil device info

# 审计BCI Python SDK依赖安全
pip3 list --format=json 2>/dev/null | python3 -c "
import json, sys
pkgs = json.load(sys.stdin)
bci_related = ['mne', 'brainflow', 'pyeeg', 'scipy', 'numpy',
               'openbci', 'pyserial', 'bleak']
for pkg in pkgs:
    if any(kw in pkg['name'].lower() for kw in bci_related):
        print(f\"{pkg['name']}=={pkg['version']}\")
"

# 使用safety检查已知漏洞
pip3 install safety
safety check -r <(pip3 freeze | grep -iE "mne|brainflow|scipy|numpy|bleak")

# 扫描BCI设备Web管理界面
nmap -sV -sC -p 80,443,8080,8443,9090 bci_device_ip

# 使用Nikto扫描已知漏洞
nikto -h http://bci_device_ip:8080

# 使用OWASP ZAP进行自动化安全扫描
zap-cli quick-scan -s all -r http://bci_device_ip:8080

# 手动测试BCI Web管理API
curl -v http://bci_device_ip:8080/api/v1/eeg/channels \
  -H "Authorization: Bearer <token>"

# 检查API是否允许未认证访问敏感端点
for endpoint in "/api/v1/eeg/data" "/api/v1/config" "/api/v1/firmware" \
  "/api/v1/admin" "/api/v1/export" "/api/v1/sessions" "/api/v1/users"; do
    status=$(curl -s -o /dev/null -w "%{http_code}" "http://bci_device_ip:8080${endpoint}")
    echo "[${status}] ${endpoint}"
done

# 检查WebSocket接口（实时EEG数据流）
wscat -c "ws://bci_device_ip:8080/ws/eeg-stream" --no-check

#!/usr/bin/env python3
import numpy as np
from scipy import stats, signal as sig

def detect_eeg_forgery(eeg_data, sfreq=256, channels=None):
    if channels is None:
        channels = list(range(eeg_data.shape[0]))

    results = {"total_channels": len(channels), "alerts": []}

    for ch_idx in channels:
        ch_data = eeg_data[ch_idx]
        ch_results = {}

        k2, p_val = stats.normaltest(ch_data)
        ch_results["normality_p_value"] = float(p_val)
        if p_val > 0.99:
            ch_results["alert"] = "信号过于接近高斯分布，可能为合成信号"
            results["alerts"].append(f"CH{ch_idx}: 异常高斯性")

        psd, freqs = sig.welch(ch_data, fs=sfreq, nperseg=min(256, len(ch_data)))
        alpha_mask = (freqs >= 8) & (freqs <= 13)
        beta_mask = (freqs >= 13) & (freqs <= 30)
        theta_mask = (freqs >= 4) & (freqs <= 8)
        alpha_power = np.sum(psd[alpha_mask])
        beta_power = np.sum(psd[beta_mask])
        theta_power = np.sum(psd[theta_mask])
        total_power = np.sum(psd)
        ch_results["alpha_ratio"] = float(alpha_power / (total_power + 1e-15))
        ch_results["beta_ratio"] = float(beta_power / (total_power + 1e-15))
        ch_results["theta_ratio"] = float(theta_power / (total_power + 1e-15))

        if ch_results["alpha_ratio"] < 0.01 and sfreq >= 128:
            ch_results["alert"] = "Alpha波段能量异常低，不符合清醒闭眼状态"
            results["alerts"].append(f"CH{ch_idx}: Alpha缺失")

        signal_range = np.max(ch_data) - np.min(ch_data)
        ch_results["peak_to_peak"] = float(signal_range)
        if signal_range > 0.001:
            ch_results["alert"] = "峰峰值异常大，可能含注入成分"
            results["alerts"].append(f"CH{ch_idx}: 异常振幅")

        autocorr = np.correlate(ch_data - np.mean(ch_data), ch_data - np.mean(ch_data), mode="full")
        autocorr = autocorr[len(autocorr) // 2:]
        autocorr = autocorr / (autocorr[0] + 1e-15)
        ch_results["autocorr_lag1"] = float(autocorr[1]) if len(autocorr) > 1 else 0
        ch_results["autocorr_lag10"] = float(autocorr[10]) if len(autocorr) > 10 else 0

        ch_results["stats"] = {
            "mean": float(np.mean(ch_data)),
            "std": float(np.std(ch_data)),
            "skewness": float(stats.skew(ch_data)),
            "kurtosis": float(stats.kurtosis(ch_data)),
        }
        results[f"channel_{ch_idx}"] = ch_results

    if len(results["alerts"]) > len(channels) * 0.5:
        results["OVERALL_ASSESSMENT"] = "HIGHForgery_Risk - 多通道异常，伪造概率较高"
    elif len(results["alerts"]) > 0:
        results["OVERALL_ASSESSMENT"] = "MODERATE_Risk - 部分通道异常，需进一步验证"
    else:
        results["OVERALL_ASSESSMENT"] = "LOW_Risk - 信号特征符合生理模式"

    for key, value in results.items():
        if key != "alerts":
            print(f"  {key}: {value}")
    if results["alerts"]:
        print(f"  alerts: {results['alerts']}")

if __name__ == "__main__":
    fake_eeg = np.random.randn(8, 25600) * 0.00002
    detect_eeg_forgery(fake_eeg)

title: BCI Device Unusual BLE Pairing Attempt
id: 7a3b1c2d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects unusual BLE pairing attempts to BCI medical devices from unknown sources
references:
  - https://example.com/bci-security-guidelines
author: x7peeps-blue-team
date: 2026/07/20
tags:
  - attack.credential_access
  - attack.t1557
  - bci
  - medical_device
logsource:
  product: linux
  service: bluetooth
detection:
  selection_pairing:
    EventID: 16
    Message|contains:
      - 'pairing'
      - 'bond'
      - 'auth'
  selection_bci_device:
    DeviceName|contains:
      - 'EEG'
      - 'BCI'
      - 'Neuro'
      - 'Brain'
      - 'Muse'
      - 'Emotiv'
      - 'g.tec'
      - 'Blackrock'
  selection_unknown_source:
    SourceAddress|startswith:
      - 'AA:BB'
      - '11:22'
  condition: selection_pairing and selection_bci_device and selection_unknown_source
fields:
  - DeviceName
  - SourceAddress
  - EventTime
  - Message
falsepositives:
  - Authorized BCI device pairing during clinical setup
level: high

title: BCI Neural Data Exfiltration to External Endpoint
id: 8b4c2d3e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects potential exfiltration of EEG/neural data to unauthorized external endpoints
references:
  - https://example.com/bci-data-exfiltration
author: x7peeps-blue-team
date: 2026/07/20
tags:
  - attack.exfiltration
  - attack.t1048
  - bci
  - neural_data
logsource:
  category: proxy
  product: any
detection:
  selection_eeg_upload:
    url|contains:
      - '/eeg'
      - '/signal'
      - '/neural'
      - '/brain'
      - '/channel'
      - '/session'
    http_method:
      - 'POST'
      - 'PUT'
  selection_external:
    destination|is_in:
      - 'external_endpoints.txt'
  filter_known_cloud:
    destination|endswith:
      - '.neuralink.com'
      - '.emotiv.com'
      - '.muse.ai'
      - '.openbci.com'
  condition: selection_eeg_upload and selection_external and not filter_known_cloud
fields:
  - source_ip
  - destination
  - url
  - http_method
  - bytes_sent
  - user_agent
falsepositives:
  - None expected for unauthorized endpoints
level: critical

title: BCI Firmware Integrity Check Failure
id: 9c5d3e4f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects BCI device firmware integrity verification failure events
author: x7peeps-blue-team
date: 2026/07/20
tags:
  - attack.defense_evasion
  - attack.t1562
  - bci
  - firmware
logsource:
  product: windows
  service: system
detection:
  selection_event:
    EventID: 1001
    Source|contains:
      - 'BCI'
      - 'Firmware'
      - 'EEG'
      - 'MedicalDevice'
  selection_failure:
    Level:
      - 'Error'
      - 'Warning'
    Message|contains:
      - 'integrity'
      - 'signature'
      - 'hash mismatch'
      - 'verification failed'
      - 'tamper'
  condition: selection_event and selection_failure
fields:
  - DeviceName
  - FirmwareVersion
  - ExpectedHash
  - ActualHash
  - EventTime
falsepositives:
  - Known firmware update in progress
level: critical

#!/bin/bash
LOG_DIR="/var/log/bci_monitor"
HISTORY_FILE="/var/lib/bci_baseline.db"
ALERT_FILE="/tmp/bci_hunt_$(date +%Y%m%d_%H%M%S).log"
BLE_WHITELIST="/etc/bci/ble_whitelist.conf"

mkdir -p "$LOG_DIR"

echo "========================================" > "$ALERT_FILE"
echo "BCI Security Hunt Report - $(date)" >> "$ALERT_FILE"
echo "========================================" >> "$ALERT_FILE"
echo "" >> "$ALERT_FILE"

echo "[Phase 1] Scanning for BCI-related BLE devices..."
bluetoothctl devices 2>/dev/null | grep -iE "eeg|bci|neuro|brain|muse|emotiv|g.tec|blackrock" | while read line; do
    mac=$(echo "$line" | awk '{print $2}')
    name=$(echo "$line" | cut -d' ' -f3-)
    if [ -f "$BLE_WHITELIST" ] && ! grep -q "$mac" "$BLE_WHITELIST"; then
        echo "[CRITICAL] 未授权BCI设备: $name ($mac)" >> "$ALERT_FILE"
    fi
done

echo "[Phase 2] Checking BCI process integrity..."
ps aux 2>/dev/null | grep -iE "eeg|bci|neuro|brainflow|mne" | grep -v grep | while read line; do
    pid=$(echo "$line" | awk '{print $2}')
    exe=$(readlink -f /proc/"$pid"/exe 2>/dev/null)
    md5=$(md5sum "$exe" 2>/dev/null | awk '{print $1}')
    echo "[INFO] BCI进程: PID=$pid EXE=$exe MD5=$md5" >> "$ALERT_FILE"
done

echo "[Phase 3] Checking BCI data files for unauthorized access..."
find /home /tmp /var/data -maxdepth 4 \( -name "*.edf" -o -name "*.bdf" -o -name "*.gdf" -o -name "*eeg*.csv" \) -newer /tmp/.bci_last_scan 2>/dev/null | while read f; do
    owner=$(stat -c '%U' "$f" 2>/dev/null)
    perms=$(stat -c '%a' "$f" 2>/dev/null)
    size=$(stat -c '%s' "$f" 2>/dev/null)
    if [ "$perms" -gt 644 ] 2>/dev/null; then
        echo "[WARNING] BCI数据文件权限过大: $f (owner=$owner perms=$perms size=$size)" >> "$ALERT_FILE"
    fi
done
touch /tmp/.bci_last_scan

echo "[Phase 4] Checking BCI network connections..."
ss -tlnp 2>/dev/null | grep -iE "eeg\|bci\|neuro\|brainflow" | while read line; do
    echo "[INFO] BCI监听端口: $line" >> "$ALERT_FILE"
done

netstat -tunap 2>/dev/null | grep -iE "eeg\|bci\|neuro" | grep ESTABLISHED | while read line; do
    remote=$(echo "$line" | awk '{print $5}')
    echo "[WARNING] BCI外部连接: $line" >> "$ALERT_FILE"
done

echo "[Phase 5] Checking for BCI USB devices..."
lsusb 2>/dev/null | grep -iE "eeg\|neuro\|brain\|bci\|g.tec\|emotiv\|blackrock\|openbci" | while read line; do
    echo "[INFO] BCI USB设备: $line" >> "$ALERT_FILE"
done

echo "" >> "$ALERT_FILE"
echo "========================================" >> "$ALERT_FILE"
critical_count=$(grep -c "\[CRITICAL\]" "$ALERT_FILE" 2>/dev/null || echo 0)
warning_count=$(grep -c "\[WARNING\]" "$ALERT_FILE" 2>/dev/null || echo 0)
echo "Summary: CRITICAL=$critical_count WARNING=$warning_count" >> "$ALERT_FILE"
echo "========================================" >> "$ALERT_FILE"

cat "$ALERT_FILE"

#!/usr/bin/env python3
import mne
import numpy as np
import sys
import os
import glob

SCAN_DIRS = ["/home", "/tmp", "/var/data", "/opt/bci"]
ALERT_THRESHOLDS = {
    "max_amplitude_uv": 300,
    "min_channels": 1,
    "max_channels": 256,
    "max_sampling_rate": 30000,
    "flatline_threshold_s": 5,
    "correlation_threshold": 0.99,
}

def scan_for_eeg_files():
    eeg_files = []
    for scan_dir in SCAN_DIRS:
        for ext in ["*.edf", "*.bdf", "*.gdf", "*.fif"]:
            eeg_files.extend(glob.glob(os.path.join(scan_dir, "**", ext), recursive=True))
    return eeg_files

def analyze_eeg_file(filepath):
    alerts = []
    try:
        raw = mne.io.read_raw_edf(filepath, preload=True, verbose=False)
    except Exception:
        try:
            raw = mne.io.read_raw_bdf(filepath, preload=True, verbose=False)
        except Exception:
            return [{"type": "PARSE_ERROR", "file": filepath, "severity": "INFO"}]

    data = raw.get_data()
    n_channels, n_samples = data.shape
    sfreq = raw.info["sfreq"]

    if n_channels < ALERT_THRESHOLDS["min_channels"] or n_channels > ALERT_THRESHOLDS["max_channels"]:
        alerts.append({"type": "ABNORMAL_CHANNEL_COUNT", "value": n_channels, "severity": "WARNING"})

    if sfreq > ALERT_THRESHOLDS["max_sampling_rate"]:
        alerts.append({"type": "ABNORMAL_SAMPLING_RATE", "value": sfreq, "severity": "WARNING"})

    for ch_idx in range(n_channels):
        ch_data = data[ch_idx]
        max_amp = np.max(np.abs(ch_data))
        if max_amp > ALERT_THRESHOLDS["max_amplitude_uv"] * 1e-6:
            alerts.append({
                "type": "EXCESSIVE_AMPLITUDE",
                "channel": raw.ch_names[ch_idx],
                "value_uv": float(max_amp * 1e6),
                "severity": "HIGH"
            })

        flatline_count = 0
        for i in range(1, len(ch_data)):
            if abs(ch_data[i] - ch_data[i-1]) < 1e-12:
                flatline_count += 1
            else:
                flatline_duration = flatline_count / sfreq
                if flatline_duration > ALERT_THRESHOLDS["flatline_threshold_s"]:
                    alerts.append({
                        "type": "FLATLINE_DETECTED",
                        "channel": raw.ch_names[ch_idx],
                        "duration_s": float(flatline_duration),
                        "severity": "HIGH"
                    })
                flatline_count = 0

    if n_channels >= 2 and n_samples > 100:
        corr_matrix = np.corrcoef(data[:min(n_channels, 16)])
        np.fill_diagonal(corr_matrix, 0)
        max_corr = np.max(corr_matrix)
        if max_corr > ALERT_THRESHOLDS["correlation_threshold"]:
            i, j = np.unravel_index(np.argmax(corr_matrix), corr_matrix.shape)
            alerts.append({
                "type": "SUSPICIOUS_CHANNEL_CORRELATION",
                "channels": f"{raw.ch_names[i]}-{raw.ch_names[j]}",
                "correlation": float(max_corr),
                "severity": "MEDIUM"
            })

    return alerts

def main():
    print("BCI Data Security Scanner")
    print("=" * 50)
    eeg_files = scan_for_eeg_files()
    print(f"发现 {len(eeg_files)} 个EEG数据文件")

    all_alerts = []
    for filepath in eeg_files:
        file_alerts = analyze_eeg_file(filepath)
        if file_alerts:
            print(f"\n[ALERTS] {filepath}")
            for alert in file_alerts:
                print(f"  [{alert['severity']}] {alert['type']}: {alert.get('value', alert.get('value_uv', 'N/A'))}")
                all_alerts.append({"file": filepath, **alert})

    print(f"\n扫描完成: 共发现 {len(all_alerts)} 个安全告警")
    high_count = sum(1 for a in all_alerts if a.get("severity") == "HIGH")
    if high_count > 0:
        print(f"其中高风险告警 {high_count} 个，建议立即调查")

if __name__ == "__main__":
    main()

rule BCI_Firmware_Backdoor_Signatures
{
    meta:
        description = "Detects potential backdoor signatures in BCI device firmware"
        author = "x7peeps-blue-team"
        date = "2026-07-20"
        severity = "critical"
        reference = "bci-forensics-analysis"

    strings:
        $debug_shell = "debug_shell" nocase
        $uart_cmd = "uart_command" nocase
        $raw_dump = "raw_signal_dump" nocase
        $tcp_listen = "tcp_listen" nocase
        $hardcoded_key = { 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F }
        $eeg_exfil_cmd = "POST /upload/eeg" nocase
        $signal_proxy = "signal_proxy" nocase
        $override_cal = "override_calibration" nocase
        $inject_mode = "injection_mode" nocase
        $bypass_verify = "bypass_verification" nocase
        $test_backdoor = "test_backdoor" nocase
        $admin_secret = "admin_secret_123" nocase
        $default_token = "default_auth_token" nocase

    condition:
        uint16(0) == 0x0200 or uint32(0) == 0x464C457F or
        uint16(0) == 0x2705 or uint32(0) == 0x55424923
        and any of them
}

rule BCI_EEG_Forgery_Patterns
{
    meta:
        description = "Detects synthetic EEG signal patterns in data files"
        author = "x7peeps-blue-team"
        date = "2026-07-20"
        severity = "high"

    strings:
        $edf_header = "0       " nocase
        $biodsml_header = "BIOSEMI"
        $fake_timestamp = "2099-01-01"
        $uniform_pattern = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

    condition:
        $edf_header at 0 or $biodsml_header at 0
        and ($fake_timestamp or #uniform_pattern > 10)
}

rule BCI_C2_Communication_Patterns
{
    meta:
        description = "Detects C2 communication patterns from compromised BCI systems"
        author = "x7peeps-blue-team"
        date = "2026-07-20"
        severity = "critical"

    strings:
        $c2_beacon = "neural_beacon" nocase
        $c2_checkin = "brain_checkin" nocase
        $c2_cmd = "signal_command" nocase
        $c2_exfil = "cortex_upload" nocase
        $base64_eeg = "ZXV0" ascii
        $encoded_signal = "c2hvcnRfYnVyc3Q" ascii
        $reverse_shell = "/bin/sh" nocase
        $python_connect = "python.*connect.*sock" nocase

    condition:
        any of ($c2_*) or (2 of ($base64_eeg, $encoded_signal, $reverse_shell, $python_connect))
}

rule BCI_BLE_Injection_Payloads
{
    meta:
        description = "Detects BLE injection payloads targeting BCI EEG data streams"
        author = "x7peeps-blue-team"
        date = "2026-07-20"
        severity = "high"

    strings:
        $ble_pdu = { AA FE }
        $eeg_marker = { 52 4D 4B 5F 45 45 47 }
        $fake_sample = { 00 00 80 3F 00 00 80 3F 00 00 80 3F }
        $injection_header = "INJ:" ascii
        $ble_connect_req = { 05 00 }
        $auth_bypass = { 01 00 00 00 00 00 }

    condition:
        $ble_pdu at 0 and ($eeg_marker or $fake_sample or $injection_header)
        or ($ble_connect_req at 0 and $auth_bypass)
}

# 使用nRF52840嗅探N1设备BLE通信
# 发现的漏洞点：
# 1. 设备使用BLE Just Works配对，无MITM保护
# 2. EEG数据流使用AES-128加密但密钥可从配对过程提取
# 3. 设备名称广播中包含设备序列号（可关联患者身份）

# 嗅探N1 BLE广播数据
tshark -r n1_ble_capture.pcapng -Y "btle.advertising_header.pdu_type == 0x00" \
  -T fields -e btle.advertising_data.complete_local_name \
  -e btle.advertising_data.manufacturer_specific_data 2>/dev/null

# 解密EEG数据流（使用提取的会话密钥）
python3 -c "
from Crypto.Cipher import AES
import struct

session_key = bytes.fromhex('extracted_key_here')
iv = bytes.fromhex('extracted_iv_here')
cipher = AES.new(session_key, AES.MODE_CBC, iv)

with open('encrypted_eeg_packet.bin', 'rb') as f:
    encrypted_data = f.read()

decrypted = cipher.decrypt(encrypted_data)
channels = struct.unpack(f'<{1024}f', decrypted[:4096])
print(f'解码通道数: {len(channels)}')
print(f'前8通道值: {channels[:8]}')
"

#!/usr/bin/env python3
from scapy.layers.bluetooth4LE import *
from scapy.layers.bluetooth import *
import struct

def analyze_bci_ble_injection(pcap_file):
    packets = rdpcap(pcap_file)
    injection_events = []
    timing_anomalies = []

    prev_timestamp = None
    for pkt in packets:
        if not pkt.haslayer(BTLE):
            continue

        timestamp = float(pkt.time)

        if pkt.haslayer(BTLEData):
            btle_data = pkt[BTLEData]
            if hasattr(btle_data, 'att_opcode'):
                att_op = btle_data.att_opcode
                if att_op == 0x12:
                    handle = btle_data.att_handle
                    value = btle_data.att_value if hasattr(btle_data, 'att_value') else b''

                    if len(value) >= 8:
                        channel_data = struct.unpack(f'<{len(value)//4}f', value)
                        is_suspicious = True
                        for val in channel_data:
                            if abs(val) < 1e-8 or abs(val) > 0.01:
                                is_suspicious = False
                                break
                        if is_suspicious and len(channel_data) >= 4:
                            injection_events.append({
                                "timestamp": timestamp,
                                "handle": handle,
                                "data_preview": channel_data[:8],
                                "reason": "信号值过于均匀，疑似合成数据"
                            })

        if prev_timestamp is not None:
            interval = timestamp - prev_timestamp
            if interval < 0.001 or interval > 0.5:
                timing_anomalies.append({
                    "timestamp": timestamp,
                    "interval": interval,
                    "reason": "BLE数据包间隔异常"
                })
        prev_timestamp = timestamp

    print(f"=== BCI BLE Injection Analysis Report ===")
    print(f"数据包总数: {len(packets)}")
    print(f"疑似注入事件: {len(injection_events)}")
    for evt in injection_events[:10]:
        print(f"  [{evt['timestamp']}] Handle={evt['handle']} {evt['reason']}")
        print(f"    数据预览: {evt['data_preview']}")
    print(f"时序异常: {len(timing_anomalies)}")
    for anom in timing_anomalies[:10]:
        print(f"  [{anom['timestamp']}] 间隔={anom['interval']:.6f}s {anom['reason']}")

    return injection_events, timing_anomalies

# 固件哈希比对分析
# 从设备提取的运行固件
shasum -a 256 extracted_running_firmware.bin
# 厂商官方发布的固件
shasum -a 256 vendor_official_firmware_v2.3.1.bin

# 使用BinDiff比较固件差异
# 1. 在Ghidra中加载两个固件（官方 vs 提取）
# 2. 运行BinDiff插件进行函数级比对
# 3. 发现3个新增函数和12个修改函数

# 搜索后门通信特征
strings extracted_running_firmware.bin | grep -iE "c2|command|inject|remote|activate|beacon"

# 分析新增的网络通信功能
ghidra_analyze() {
    echo "分析固件网络相关函数..."
    strings extracted_running_firmware.bin | grep -E "^https?://" | sort -u
    strings extracted_running_firmware.bin | grep -E "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" | sort -u
    strings extracted_running_firmware.bin | grep -E "POST|GET|PUT|DELETE" | sort -u
}

# 检查OTA更新包签名
openssl dgst -sha256 -verify vendor_public_key.pem -signature ota_update.sig ota_update.bin