n0mad1k/bigbrother
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WireGuard as primary C2 — zero traffic when idle, on-demand connect. Tailscale moves to fallback.

Browse Source
This commit is contained in:
n0mad1k
2026-03-17 16:03:21 -04:00
parent b6d9d7a738
commit 5694fdc56c
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
BIGBROTHER_DESIGN.md
+5 -5
View File
@@ -634,8 +634,8 @@ Parse output from all managed tools into structured data:
| Module | Purpose | Resources |
|---|---|---|
| `tailscale.py` | Primary operator access via Tailscale mesh VPN. Pre-auth key, engagement ACL tags. OPSEC: check baseline for existing Tailscale traffic first. | 30MB, 2% |
| `wireguard.py` | Fallback VPN to operator endpoint. Lower overhead. Preferred when Tailscale would be a new destination. | 5MB, 1% |
| `tailscale.py` | Fallback operator access via Tailscale mesh VPN. Convenient but chatty — maintains connection to coordination servers. Only use if target network already has Tailscale traffic or WireGuard is blocked. | 30MB, 2% |
| `wireguard.py` | **Primary C2.** WireGuard to operator's self-hosted endpoint. `PersistentKeepalive = 0` — tunnel exists but generates **zero traffic** until operator connects. No beacons, no heartbeats, no coordination servers. Completely silent while idle, instant access when operator sends a packet. | 5MB, 1% |
| `bridge.py` | Transparent inline bridge (USB eth + onboard). No IP on network. 802.1X bypass (silentbridge). STP/BPDU/CDP suppression via ebtables. C watchdog failsafe <15s. | 10MB, 2% |
| `wifi_client.py` | WPA2-PSK/Enterprise WiFi client. wpa_supplicant managed. | 10MB, 1% |
| `reverse_tunnel.py` | autossh reverse SSH. Must be SSH-over-WebSocket or SSH inside TLS (stunnel). Never raw SSH on 443. | 15MB, 1% |
@@ -998,8 +998,8 @@ network:
modem_device: "/dev/ttyUSB0"
connectivity:
primary: "tailscale"
failover_chain: [tailscale, wireguard, reverse_tunnel, cellular_backup]
primary: "wireguard" # Zero traffic when idle, instant access on demand
failover_chain: [wireguard, tailscale, reverse_tunnel, cellular_backup]
security:
encryption_key_derive: "argon2id" # argon2id | pbkdf2 (Pi Zero)
@@ -1285,7 +1285,7 @@ Tasks:
30. **Bridge mode** -- No IP, no MAC on network. Physical inspection only.
31. **MAC profile** -- Device appears as consumer electronics (Fire TV, Roku, etc.), not Raspberry Pi.
32. **Tailscale** -- Check baseline for existing traffic before using. Prefer WireGuard otherwise.
32. **WireGuard primary** -- Zero traffic when idle (`PersistentKeepalive = 0`). Self-hosted endpoint, no third-party coordination servers. Tailscale only as fallback if WireGuard is blocked or target already has Tailscale traffic.
33. **Reverse SSH** -- SSH-over-WebSocket or inside TLS (stunnel). Never raw SSH on 443.
34. **Data exfil** -- Timed to match baseline upload patterns via traffic_mimicry.
35. **bettercap REST API** -- Bound to 127.0.0.1 only. Not network-visible.