n0mad1k/bigbrother
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update hardware platform to Orange Pi Zero 3 (4GB) as primary implant

Browse Source 
Replaces RPi 4 as main implant with OPi Zero 3 — 50x55mm footprint,
WiFi 5 + BT 5.0 built-in, 4GB RAM, $29. RPi Zero 2W retained as
jumpbox/beacon role. Updated all hardware tier tables, memory budgets,
OPSEC notes, and operational workflow.
This commit is contained in:
n0mad1k
2026-03-18 08:04:24 -04:00
parent 5694fdc56c
commit 63e317176d
2 changed files with 86 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
BIGBROTHER_DESIGN.md
+84 -52
View File
@@ -1,7 +1,7 @@
# BigBrother: Shadow SOC — Red Team Network Surveillance Platform
> **Version**: 4.0
> **Date**: 2026-03-17
> **Version**: 5.0
> **Date**: 2026-03-18
> **Status**: Implementation Blueprint
---
@@ -33,7 +33,7 @@ BigBrother is a **Shadow SOC** — it gives you the same network visibility a de
The platform operates as two halves:
- **The implant** (Pi or Debian host): captures everything (tcpdump full PCAP), extracts real-time metadata to SQLite (DNS, SNI, credentials, Kerberos, hosts, flows), orchestrates attacks (bettercap, Responder, mitmproxy), and stays hidden (stealth layer).
- **The implant** (Orange Pi Zero 3 or Debian host): captures everything (tcpdump full PCAP), extracts real-time metadata to SQLite (DNS, SNI, credentials, Kerberos, hosts, flows), orchestrates attacks (bettercap, Responder, mitmproxy), and stays hidden (stealth layer).
- **The operator workstation**: runs Zeek against pulled PCAPs to get structured protocol logs (ssl.log, smb.log, http.log, kerberos.log, etc.) showing every service version, every cert, every vulnerability — then uses those findings to decide what to attack.
Custom Python exists only where no existing tool covers the need. bettercap replaces all custom MITM modules. tcpdump replaces custom packet capture. Zeek runs offline on the operator's workstation for deep protocol analysis. The implant captures and extracts; the workstation analyzes.
@@ -303,8 +303,8 @@ Manages tcpdump subprocess for full packet capture. tcpdump handles BPF, rotatio
- **tcpdump flags**: `-i <bridge_if> -G 3600 -W 168 -s 65535 -w <pcap_path> --time-stamp-precision=nano`
- **Post-rotation pipeline**: zstd -19 compress -> AES-256-GCM encrypt -> `.pcap.zst.enc`
- Pi Zero: zstd -3 (fast mode, 5-8x compression, minimal CPU)
- Pi 4/Debian: zstd -19 (max, 10-15x compression on typical PCAPs)
- RPi Zero 2W jumpbox: zstd -3 (fast mode, 5-8x compression, minimal CPU)
- OPi Zero 3/Debian: zstd -19 (max, 10-15x compression on typical PCAPs)
- Disk monitoring: auto-purge oldest PCAPs when threshold hit (85% default)
- PcapNG format for metadata embedding
- **Managed by tool_manager.py**: auto-restart on crash within 5s, PID tracking
@@ -550,7 +550,7 @@ Manage Responder subprocess. Configure via Responder.conf.j2 template. Parse Res
### `mitmproxy_mgr.py` -- mitmproxy Integration
Manage mitmproxy in transparent mode. Uses addon scripts from `config/mitmproxy_addons/` for credential extraction, cloud token capture, file metadata logging. Override default CA CN to match target PKI. Pi 4+ only.
Manage mitmproxy in transparent mode. Uses addon scripts from `config/mitmproxy_addons/` for credential extraction, cloud token capture, file metadata logging. Override default CA CN to match target PKI. OPi Zero 3+ only.
**Resources**: 100-200MB RAM, 10-20% CPU
@@ -639,7 +639,7 @@ Parse output from all managed tools into structured data:
| `bridge.py` | Transparent inline bridge (USB eth + onboard). No IP on network. 802.1X bypass (silentbridge). STP/BPDU/CDP suppression via ebtables. C watchdog failsafe <15s. | 10MB, 2% |
| `wifi_client.py` | WPA2-PSK/Enterprise WiFi client. wpa_supplicant managed. | 10MB, 1% |
| `reverse_tunnel.py` | autossh reverse SSH. Must be SSH-over-WebSocket or SSH inside TLS (stunnel). Never raw SSH on 443. | 15MB, 1% |
| `cellular_backup.py` | LTE modem HAT (SIM7600/EC25). Out-of-band. Pi 4 only (2W power). | 15MB, 2% |
| `cellular_backup.py` | LTE modem (SIM7600/EC25) via 13-pin header USB. Out-of-band. OPi Zero 3+ only. | 15MB, 2% |
| `ble_emergency.py` | BLE GATT server. PSK auth. Status/kill/reboot. Disabled by default. | 5MB, 0.5% |
| `data_exfil.py` | Priority push (creds immediately), nightly sync (intel), on-demand pull (PCAPs). Respects traffic_mimicry baseline. Falls back through connectivity chain. | 15MB, 2% |
@@ -748,7 +748,7 @@ Click CLI + Rich TUI. Commands: start, stop, status, activate, deactivate, kill,
### `core/engine.py` -- Module Lifecycle Manager
Multiprocess model: each module as separate process. Dependency resolution. Resource budgeting. Hardware tier enforcement (Pi Zero: 4 passive max). Interface conflict detection. Optional scope enforcement. Engagement phase gating (passive_only for N days, then active_allowed).
Multiprocess model: each module as separate process. Dependency resolution. Resource budgeting. Hardware tier enforcement (RPi Zero 2W jumpbox: 4 passive max). Interface conflict detection. Optional scope enforcement. Engagement phase gating (passive_only for N days, then active_allowed).
### `core/capture_bus.py` -- Packet Capture Bus
@@ -789,7 +789,7 @@ Cron-like with jitter. PCAP rotation, health checks, baseline captures, data pru
### `core/resource_monitor.py` -- Resource Monitor
Per-module + per-subprocess RAM/CPU/disk. Hardware tier limits. OOM kill lowest priority. Thermal: THERMAL_WARNING at 55C, shed modules at 70C.
Per-module + per-subprocess RAM/CPU/disk. Hardware tier limits. OOM kill lowest priority. Thermal: THERMAL_WARNING at 55C (OPi Zero 3 needs heatsink), shed modules at 70C.
### `core/kill_switch.py` -- Kill Switch
@@ -925,7 +925,7 @@ Installed by `setup.sh`. Operator runs directly via SSH. BigBrother does not wra
| **Bettercap** | Network attack and monitoring (also managed by BB) |
| **tcpdump** | Packet capture (also managed by BB) |
| **tshark** | Protocol analysis, PCAP processing |
| **mitmproxy** | HTTPS interception (also managed by BB, Pi 4+ only) |
| **mitmproxy** | HTTPS interception (also managed by BB, OPi Zero 3+ only) |
| **iodine** | DNS tunnel |
| **autossh** | Persistent SSH tunnels |
| **aircrack-ng** | WiFi capture/cracking suite |
@@ -936,7 +936,7 @@ Installed by `setup.sh`. Operator runs directly via SSH. BigBrother does not wra
| **pypykatz** | Mimikatz in Python |
| **ldapdomaindump** | AD enumeration |
| **smbmap** | SMB share enumeration |
| **ROADtools** | Azure/Entra ID recon (Pi 4+ only) |
| **ROADtools** | Azure/Entra ID recon (OPi Zero 3+ only) |
---
@@ -944,13 +944,13 @@ Installed by `setup.sh`. Operator runs directly via SSH. BigBrother does not wra
### `setup.sh` -- Idempotent Bootstrap
Detects platform (Pi Zero 2W / Pi 4 / Debian) and installs accordingly.
Detects platform (Orange Pi Zero 3 / RPi Zero 2W jumpbox / Debian host) and installs accordingly.
**System packages**: python3, python3-venv, python3-dev, build-essential, libssl-dev, libffi-dev, libpcap-dev, bridge-utils, ebtables, iptables, nftables, iproute2, net-tools, tcpdump, tshark, nmap, masscan, dnsutils, hostapd, dnsmasq, wireless-tools, wpasupplicant, aircrack-ng, wireguard-tools, cryptsetup, curl, wget, git, jq, tmux, screen, autossh, bluez, libbluetooth-dev, ppp, usb-modeswitch, iodine, bettercap, proxychains-ng, socat, sshuttle, stunnel4
**Python venv** (`.venv/`): click, rich, pyyaml, cryptography, scapy, impacket, certipy-ad, bloodhound, dnslib, requests, dpkt, pyjwt, python-magic, numpy, graphviz, jinja2, zstandard, mitmproxy (Pi 4+ only)
**Python venv** (`.venv/`): click, rich, pyyaml, cryptography, scapy, impacket, certipy-ad, bloodhound, dnslib, requests, dpkt, pyjwt, python-magic, numpy, graphviz, jinja2, zstandard, mitmproxy (OPi Zero 3+ only)
**Tools from GitHub/pipx** (to `/opt/tools/`): Responder, CrackMapExec/NetExec, Chisel, Ligolo-ng, mitm6, evil-winrm, enum4linux-ng, kerbrute, Coercer, PetitPotam.py, pypykatz, ldapdomaindump, smbmap, ROADtools (Pi 4+)
**Tools from GitHub/pipx** (to `/opt/tools/`): Responder, CrackMapExec/NetExec, Chisel, Ligolo-ng, mitm6, evil-winrm, enum4linux-ng, kerbrute, Coercer, PetitPotam.py, pypykatz, ldapdomaindump, smbmap, ROADtools (OPi Zero 3+)
**Directories**: `storage/{config,pcaps,creds,dns_logs,sni_logs,intel,baseline,audit,tool_logs,logs}` mode 700
@@ -1002,7 +1002,7 @@ connectivity:
failover_chain: [wireguard, tailscale, reverse_tunnel, cellular_backup]
security:
encryption_key_derive: "argon2id" # argon2id | pbkdf2 (Pi Zero)
encryption_key_derive: "argon2id" # argon2id | pbkdf2 (RPi Zero 2W jumpbox)
dead_man_switch:
enabled: false
interval_hours: 24
@@ -1010,7 +1010,7 @@ security:
capture:
pcap_rotation_hours: 1
pcap_compression: "zstd"
pcap_compression_level: 19 # Pi Zero: auto-downgrade to 3
pcap_compression_level: 19 # RPi Zero 2W jumpbox: auto-downgrade to 3
pcap_format: "pcapng"
snap_length: 65535
bpf_filter: "full_capture"
@@ -1081,25 +1081,49 @@ exclude: [10.10.99.0/24] # OT segment
## 14. Hardware Tiers
**Primary implant**: Orange Pi Zero 3 (4GB) — 50x55mm, Allwinner H618, 4x Cortex-A53 @ 1.5GHz, WiFi 5 + BT 5.0, 1x GbE, ~$29.
**Minimum SD card**: 128GB high-endurance industrial. With zstd -19 (10-15x on PCAPs), effective ~1.2TB PCAP storage. tmpfs for SQLite WAL files, buffer writes through tmpfs with async flush.
**Power**: Minimum 5V/3A dedicated. Consider PoE splitter. selftest checks power source.
| Capability | Pi Zero 2W (512MB) | Pi 4 (4GB) | Debian Host |
|---|:---:|:---:|:---:|
| **Max passive modules** | 4 | All 16 | All 16 |
| **Max active modules** | 1 (bettercap only) | 6 | Unlimited |
| **bettercap** | Maybe (85MB headroom) | Yes | Yes |
| **mitmproxy** | No | Yes | Yes |
| **Snap length** | 65535 (full) | 65535 (full) | 65535 (full) |
| **PCAP compression** | zstd -3 (fast) | zstd -19 (max) | zstd -19 (max) |
| **Key derivation** | pbkdf2 | argon2id | argon2id |
| **LKM rootkit** | No | No | Yes |
| **Cellular modem** | No (power) | Yes | Yes |
| **overlayfs** | Yes (30MB) | Yes (200MB) | N/A |
| **ROADtools** | No | Yes | Yes |
**OS**: Armbian Debian 12 Bookworm (kernel 6.12). NOT Kali — Armbian base with individual tools installed for stability, smaller footprint, and better OPSEC.
### Pi Zero 2W Memory Budget (Passive Mode)
| Capability | OPi Zero 3 (4GB) | RPi Zero 2W Jumpbox | Debian Host |
|---|:---:|:---:|:---:|
| **Max passive modules** | All 16 | 4 | All 16 |
| **Max active modules** | 6 | 0 (jumpbox only) | Unlimited |
| **bettercap** | Yes | No | Yes |
| **mitmproxy** | Yes | No | Yes |
| **Snap length** | 65535 (full) | 65535 (full) | 65535 (full) |
| **PCAP compression** | zstd -19 (max) | zstd -3 (fast) | zstd -19 (max) |
| **Key derivation** | argon2id | pbkdf2 | argon2id |
| **LKM rootkit** | No | No | Yes |
| **Cellular modem** | Yes (via header USB) | No | Yes |
| **overlayfs** | Yes (200MB) | Yes (30MB) | N/A |
| **ROADtools** | Yes | No | Yes |
| **WiFi attacks (Evil Twin)** | Yes (built-in) | No | Yes |
| **Inline bridge** | Via USB Ethernet adapter | No | Yes (dual NIC) |
### OPi Zero 3 Memory Budget (Full Active)
| Component | RAM (MB) |
|---|---|
| OS + kernel | ~110 |
| Python interpreter + libs | ~55 |
| Core framework + tool_manager | ~25 |
| tcpdump | ~5 |
| bettercap | ~30 |
| 16 passive Python modules | ~200 |
| Responder | ~30 |
| mitmproxy | ~150 |
| Stealth modules | ~50 |
| Connectivity | ~55 |
| Intel modules | ~55 |
| **TOTAL** | **~765** |
| **Headroom** | **~3.3GB** |
### RPi Zero 2W Memory Budget (Jumpbox Mode)
| Component | RAM (MB) |
|---|---|
@@ -1117,25 +1141,32 @@ exclude: [10.10.99.0/24] # OT segment
| **TOTAL** | **~325** |
| **Headroom** | **~85** |
Extra 85MB headroom (vs 35MB in v3.2) means bettercap could potentially run for a single active capability (ARP spoof) on Pi Zero.
RPi Zero 2W serves as a lightweight jumpbox/beacon only — passive sniffing, callback beacon, lightweight recon. No active attack capability. Deploy where the OPi Zero 3 won't fit or as a decoy/expendable device.
### Pi 4 Memory Budget (Full Active)
### Hardware Notes
| Component | RAM (MB) |
|---|---|
| OS + kernel | ~110 |
| Python interpreter + libs | ~55 |
| Core framework + tool_manager | ~25 |
| tcpdump | ~5 |
| bettercap | ~30 |
| 16 passive Python modules | ~200 |
| Responder | ~30 |
| mitmproxy | ~150 |
| Stealth modules | ~50 |
| Connectivity | ~55 |
| Intel modules | ~55 |
| **TOTAL** | **~765** |
| **Headroom** | **~3.3GB** |
**Orange Pi Zero 3 (Primary Implant)**
- Dimensions: 50x55mm (half the size of RPi4's 85x56mm)
- WiFi 5 (802.11ac) + BT 5.0 built-in — supports evil twin, wireless recon
- 1x USB 2.0 Type-A on board + 2x USB 2.0 via 13-pin expansion header
- LTE modem connects via 13-pin header USB breakout (solder + heat shrink)
- No eMMC — use 128GB+ high-endurance industrial microSD with overlayfs
- 0.8W idle / ~3.5W load — can run on small battery pack or PoE splitter
- No native PoE — use external passive PoE hack (solder buck converter to barrel/USB-C)
- Allwinner H618 (Cortex-A53 @ 1.5GHz) — adequate for all network pentest tools
- Single Ethernet port — inline bridge requires USB Ethernet adapter
**RPi Zero 2W (Jumpbox/Beacon)**
- Passive sniffing + callback beacon only
- Deploys in locations where OPi Zero 3 won't fit or as decoy/expendable
- 512MB RAM limits to 4 passive modules max
- No active attack capability
**USB Peripheral Layout (OPi Zero 3)**
- Main USB-A port: USB storage or additional peripheral
- 13-pin header USB #1: LTE modem (cellular C2 backup)
- 13-pin header USB #2: Available for GPS or additional peripheral
- Built-in WiFi handles evil twin / wireless recon — no external adapter needed for most ops
---
@@ -1221,9 +1252,10 @@ scripts. Operator workstation scripts pull data and run analysis.
```
Tasks:
- Full integration on Pi Zero (4 passive + tcpdump), Pi 4 (all 16 + bettercap), Debian
- Full integration on OPi Zero 3 (all 16 + bettercap), RPi Zero 2W jumpbox (4 passive + tcpdump), Debian
- 72-hour soak test (memory leaks, disk, thermal, bettercap stability)
- Pi Zero: verify 325MB budget, thermal under 55C, bettercap feasibility test
- RPi Zero 2W jumpbox: verify 325MB budget, thermal under 55C
- OPi Zero 3: verify 765MB budget with heatsink, thermal under 55C sustained
- Capture bus stress test (throughput, backpressure)
- SQLite contention test (16 modules + tool_output_parser writing concurrently)
- bettercap crash/restart cycle test (ARP restoration timing)
@@ -1242,8 +1274,8 @@ Tasks:
### Pre-Deployment
1. **Sanitize hardware** -- Remove labels. Generic enclosure.
2. **MAC profile** -- Select innocuous device profile from innocuous_macs.db BEFORE connecting. Match DHCP hostname + vendor class + TCP stack to profile.
1. **Sanitize hardware** -- Remove labels. Generic enclosure. OPi Zero 3 fits in a small project box or 3D-printed case resembling a network adapter.
2. **MAC profile** -- Select innocuous device profile from innocuous_macs.db BEFORE connecting. Match DHCP hostname + vendor class + TCP stack to profile. Spoof both Ethernet MAC and built-in WiFi MAC.
3. **Hostname** -- Matches selected MAC profile (e.g., "amazon-fire-tv", not "kali").
4. **SSH keys** -- Fresh per engagement. Neutral key comment.
5. **Tailscale** -- Per-engagement auth key. Hostname matches profile.
@@ -1284,7 +1316,7 @@ Tasks:
### Network Footprint
30. **Bridge mode** -- No IP, no MAC on network. Physical inspection only.
31. **MAC profile** -- Device appears as consumer electronics (Fire TV, Roku, etc.), not Raspberry Pi.
31. **MAC profile** -- Device appears as consumer electronics (Fire TV, Roku, etc.), not Orange Pi or Raspberry Pi. Both Ethernet and WiFi MACs spoofed.
32. **WireGuard primary** -- Zero traffic when idle (`PersistentKeepalive = 0`). Self-hosted endpoint, no third-party coordination servers. Tailscale only as fallback if WireGuard is blocked or target already has Tailscale traffic.
33. **Reverse SSH** -- SSH-over-WebSocket or inside TLS (stunnel). Never raw SSH on 443.
34. **Data exfil** -- Timed to match baseline upload patterns via traffic_mimicry.
OPERATIONAL_WORKFLOW.md
+2 -2
View File
@@ -4,8 +4,8 @@
> **Network**: 10.0.1.0/24, flat, no VLANs, no AD domain
> **Infrastructure**: Ubiquiti EdgeRouter (10.0.1.1), Netgear ProSAFE managed switch (no DAI, no DHCP snooping), Synology NAS "DiskStation" (10.0.1.10), 2x HP LaserJet (10.0.1.20-21), 3x Hikvision IP cameras (10.0.1.30-32), Nest thermostat, Sonos speaker, 8 Windows workstations, 3 MacBooks, WiFi WPA2-PSK "MolarMagic2023!"
> **Critical apps**: Dentrix practice management on workstation (10.0.1.102) connecting to SQL Server on 10.0.1.5, QuickBooks on 10.0.1.6
> **Hardware**: Raspberry Pi 4 (4GB), 128GB industrial SD card, USB Ethernet adapter
> **Deployment**: Inline bridge between front desk wall jack and workstation
> **Hardware**: Orange Pi Zero 3 (4GB), 128GB industrial SD card
> **Deployment**: Connected to open port on office switch (single NIC — inline bridge requires USB Ethernet adapter)
---