From 7915ef17de0b47afc8a52f517ee3587bdf464d8c Mon Sep 17 00:00:00 2001 From: n0mad1k Date: Tue, 17 Mar 2026 10:28:42 -0400 Subject: [PATCH] Add consolidated security review from 6-agent tribe analysis 91 raw findings from Security, OPSEC, Blue Team, APT, Red Team, and Infra/Reliability analysts consolidated to 45 actionable items across 7 sections: new modules (9), design changes (10), infra fixes (6), tool gaps (5), OPSEC warnings (10), and accepted limitations (7). Key themes: LDAP/RDP monitoring gaps, PCAP storage crisis, data exfil pipeline needed, ARP/Responder detection risk, Pi Zero memory budget exceeded, multiprocess architecture required, config files outside LUKS. --- SECURITY_REVIEW.md | 305 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 305 insertions(+) create mode 100644 SECURITY_REVIEW.md diff --git a/SECURITY_REVIEW.md b/SECURITY_REVIEW.md new file mode 100644 index 0000000..7a41de5 --- /dev/null +++ b/SECURITY_REVIEW.md @@ -0,0 +1,305 @@ +# BigBrother v3.0 Security Review — Consolidated + +**Date**: 2026-03-17 +**Reviewed by**: Security Tribe (6 agents, 91 raw findings consolidated to 45) +**Scope**: BIGBROTHER_DESIGN.md — full architecture, module design, deployment model, OPSEC posture + +--- + +## New Modules to Add + +### NM-01: LDAP Query Harvester (`ldap_monitor.py`) +- **Priority**: CRITICAL +- **Source**: Agent 1, Agent 4 +- **Description**: The design captures LDAP binds and NTLM auth over LDAP but never parses LDAP search queries/responses. LDAP traffic on ports 389/3268 contains the richest AD intelligence on any network: group memberships, GPO links, OU structure, service account descriptions (often containing passwords), admin group queries, and enumeration patterns that reveal what tools admins use. +- **Recommendation**: Add ldap_monitor.py as a passive module. Parse LDAP SearchRequest/SearchResponse, extract base DN, filter, attributes, and result entries. Feed into topology_mapper and intel reports. This is the single highest-value passive module missing from the design. + +### NM-02: RDP Session Intelligence (`rdp_monitor.py`) +- **Priority**: CRITICAL +- **Source**: Agent 1, Agent 4 +- **Description**: RDP (TCP/3389) is the most-used lateral movement protocol in enterprise Windows environments and is completely absent from the design. Even without decryption, NLA negotiation headers reveal username, domain, client hostname, and keyboard layout. CredSSP carries NTLM/Kerberos that kerberos_harvester may miss if not RDP-aware. Session timing maps admin schedules. +- **Recommendation**: Add passive RDP monitoring for NLA/CredSSP extraction and session timing. Optionally add active rdp_mitm.py (Seth-based) for credential capture when in MITM position. + +### NM-03: QUIC/HTTP3 Traffic Parser +- **Priority**: CRITICAL +- **Source**: Agent 1, Agent 5 +- **Description**: QUIC (UDP/443) now carries 30-40% of web traffic. The tls_sni_extractor only handles TCP-based TLS ClientHello. QUIC Initial packets contain a TLS ClientHello in a completely different framing (CRYPTO frame). Without parsing QUIC, SNI visibility has a massive blind spot for Google, Cloudflare, and Meta traffic. +- **Recommendation**: Add QUIC Initial packet parsing to tls_sni_extractor.py. Decrypt Initial packets using connection ID-derived keys (standard per RFC 9001, not secret). Extract SNI from the embedded ClientHello. + +### NM-04: Data Exfiltration Pipeline (`data_exfil.py`) +- **Priority**: CRITICAL +- **Source**: Agent 1, Agent 4, Agent 5 +- **Description**: All collected data lives only on the implant until the operator SSHes in. No automatic exfiltration means: physical seizure = total loss, SD card corruption = total loss, captured credentials sit unused for hours/days, and multi-day PCAPs overflow before anyone reviews them. +- **Recommendation**: Add data_exfil.py in modules/connectivity/. Priority push: credentials immediately on CREDENTIAL_FOUND events via Tailscale. Nightly rsync of intel artifacts during off-hours. Pull-model for bulk PCAPs on operator demand. Store only a rolling window locally. + +### NM-05: Change Detection / Alerting System +- **Priority**: CRITICAL +- **Source**: Agent 4 +- **Description**: The design captures network state continuously but never diffs it. Over multi-week deployments, the critical question is: what changed? New host (new employee? IR team?), new service on DC (security tool deployment?), admin accessing unusual shares. Without change detection, the operator flies blind between check-ins and may miss burn indicators. +- **Recommendation**: Add a change_detector module that diffs topology/host/service state every hour. Flag new hosts, new services, disappeared hosts, unusual auth patterns. Push critical changes (potential IR activity, new security tools) immediately to operator. + +### NM-06: Security Posture / EDR Detection Module +- **Priority**: CRITICAL +- **Source**: Agent 4 +- **Description**: The design has IDS self-testing (checking your own actions against Snort rules) but nothing that maps the target's security posture. Before any active module activates, the operator needs to know: which EDR is on endpoints, which SIEM is deployed, are there honeypots/honeytokens, is there a SOC monitoring this segment. +- **Recommendation**: Add security_posture.py that passively identifies: EDR update traffic (CrowdStrike, SentinelOne, Defender ATP beacon patterns), SIEM log collectors (Wazuh, Splunk forwarder traffic), WIDS/WIPS probe patterns, honeypot signatures, and NAC infrastructure. Map to a risk score that gates active module activation. + +### NM-07: Credential Cracking Pipeline +- **Priority**: HIGH +- **Source**: Agent 4, Agent 5 +- **Description**: The design captures NTLMv2, Kerberos TGS/AS-REP, and HTTP digest hashes but has no cracking pipeline. On Pi 4, hashcat CPU mode runs ~50K H/s for NTLMv2 — enough to crack weak passwords from rockyou in hours. Every hour a hash sits uncracked is lost access opportunity. No wordlists are pre-staged. +- **Recommendation**: Pre-bundle rockyou.txt.gz and OneRuleToRuleThemAll in /opt/tools/wordlists/. Auto-queue captured hashes for CPU-mode john/hashcat with a low-priority cgroup. Push hashes immediately to operator's cracking rig via data_exfil for GPU cracking. + +### NM-08: Triage Command (`bigbrother.py triage`) +- **Priority**: HIGH +- **Source**: Agent 5 +- **Description**: After 24-48 hours unsupervised, the operator needs a single "what changed since I last checked" view. The current CLI has status (health), creds (dump), and intel (report) but no delta view. The event bus already generates timestamped events for all discoveries. +- **Recommendation**: Add `bigbrother.py triage [--since Nh]` that queries all event types since the given time: new credentials, new hosts, anomalies, module errors, storage status. One-screen prioritized delta report. + +### NM-09: Operator Audit Trail +- **Priority**: MEDIUM +- **Source**: Agent 1 +- **Description**: No record of what the operator does when SSHed in. Manual tool execution (nmap, certipy, impacket) is untracked. For authorized engagements, this audit trail is essential for deconfliction, timeline accuracy, and evidence integrity. +- **Recommendation**: Add operator_audit.py that logs SSH sessions, shell commands (via PROMPT_COMMAND), and CLI invocations to a separate audit log inside the LUKS container. + +--- + +## Design Changes Required + +### DC-01: Tiered PCAP Storage Strategy +- **Priority**: CRITICAL +- **Source**: Agent 1, Agent 5, Agent 6 +- **Description**: A 100Mbps link generates ~45GB/hour at full snap. Even at 96-byte snap, a busy link fills 32GB in hours. The current 100MB rotation + 80% disk purge means the operator returns to find all historical PCAPs deleted. No smart retention differentiates high-value from bulk traffic. +- **Recommendation**: Default to headers-only BPF (snap=96) on all tiers, not just Pi Zero. Add a credential-protocol full-capture ring buffer (NTLM, Kerberos, HTTP auth ports only). Full PCAP is operator-opt-in for targeted sessions. Nightly rsync of filtered PCAPs to operator infrastructure. + +### DC-02: Multiprocess Architecture with Capture Bus +- **Priority**: CRITICAL +- **Source**: Agent 6 +- **Description**: 18+ passive modules competing for the same promiscuous socket causes packet duplication, race conditions, and increased memory. A single scapy crash in any module kills the entire process (thread-per-module in one Python process). +- **Recommendation**: Implement a capture_bus.py: one privileged AF_PACKET capture process, packets dispatched to per-module queues via shared memory or named pipes. Each module runs as a separate process. A crash in credential_sniffer doesn't take down dns_logger. + +### DC-03: Pi Zero 2W Memory Budget Correction +- **Priority**: CRITICAL +- **Source**: Agent 6 +- **Description**: The design shows 350MB used out of 512MB with ~50MB headroom. Real-world Python 3 with scapy+impacket+cryptography+rich runs 60-80MB for the interpreter alone (not the stated 25MB). Actual headroom is negative — OOM killer will fire within hours. +- **Recommendation**: Reduce Pi Zero passive modules to 4 core: packet_capture (96B snap), dns_logger, credential_sniffer, host_discovery. Disable tls_sni_extractor, os_fingerprint, traffic_analyzer on Pi Zero. Move them to Pi 4 tier only. + +### DC-04: LUKS Boot-Unlock and Config Protection +- **Priority**: CRITICAL +- **Source**: Agent 1, Agent 2 +- **Description**: Two problems: (1) LUKS passphrase stored nowhere — operator forgets = data loss on multi-week engagement. (2) Config files (bigbrother.yaml, modules.yaml) sit outside LUKS and contain Tailscale auth key, WireGuard private key, engagement name, and client name. LUKS kill switch destroys the container but these plaintext configs survive on the SD card. +- **Recommendation**: Move ALL config files containing operator/client identifiers inside the LUKS container. For boot unlock: derive a key from network-fetchable component (C2 server) + device-specific component (CPU serial), so the device auto-unlocks only when it has C2 connectivity. + +### DC-05: SQLite Write Contention Fix +- **Priority**: HIGH +- **Source**: Agent 6 +- **Description**: SQLite WAL mode serializes writes. With 18 modules publishing events, credential findings, DNS records, and host discoveries concurrently, write contention causes 1-5 second delays and potential SQLITE_BUSY data loss. Multiple database files multiply the problem. +- **Recommendation**: Single SQLite database with schema-separated tables. Batch event writes through a dedicated writer thread with a 500ms coalesce window. Move WAL files to tmpfs with periodic checkpoint to SD card (accept up to 30 minutes data loss on power failure). + +### DC-06: Bridge Link-Loss Failsafe +- **Priority**: HIGH +- **Source**: Agent 1, Agent 5 +- **Description**: If the bridge crashes, OOM-kills, or USB ethernet disconnects (vibration, power glitch), the connected host loses all network connectivity. IT investigates the port immediately. The design mentions "fall back to passive tap" but the host is still down. +- **Recommendation**: Implement a dead-man timer: a lightweight C watchdog (not Python) that checks bridge forwarding every 5 seconds. If bridge is down for >10 seconds, configure the interfaces for direct passthrough (bypass the bridge, become a transparent cable). Hardware bypass relays are ideal if budget allows. + +### DC-07: ARP Spoof Crash Recovery +- **Priority**: HIGH +- **Source**: Agent 1, Agent 2, Agent 3, Agent 5 +- **Description**: If the implant crashes while ARP spoofing, all spoofed targets lose gateway connectivity until ARP cache timeout (1-5 minutes). Modern EDR (CrowdStrike, SentinelOne, Defender ATP) already alerts on ARP anomalies within minutes even when spoofing is working correctly. +- **Recommendation**: Implement kernel-level ARP restoration (cron job every 30s checks arp_spoof PID, sends gratuitous ARP corrections if dead). Document that ARP spoof against EDR-protected endpoints will trigger alerts — recommend Responder+ipv6_slaac as primary credential capture instead. + +### DC-08: 802.1X Full Bypass Implementation +- **Priority**: HIGH +- **Source**: Agent 5 +- **Description**: 802.1X enforcement is present in ~40% of enterprise environments. EAPOL passthrough alone is insufficient — switch may detect topology change, MAB lists may reject, re-auth timers cause delayed failure. The full silentbridge technique (bidirectional MAC clone) is needed but underspecified. +- **Recommendation**: Document and implement the full silentbridge/marvin attack: clone victim MAC on external interface, pass all EAP frames bidirectionally, implant's own traffic uses cloned MAC. Document WiFi-only fallback when wired 802.1X blocks deployment. + +### DC-09: Scope Enforcement Layer (Optional) +- **Priority**: HIGH +- **Source**: Agent 1 +- **Description**: "Scope is the operator's responsibility" is a valid philosophy but creates risk on multi-day engagements with unattended active modules. ARP spoofing an entire subnet or DHCP spoofing all requests can hit out-of-scope hosts. +- **Recommendation**: Add optional scope.yaml with in-scope IP ranges/hostnames/domains. When loaded, active modules validate targets before acting. ARP spoof validates each target, DHCP spoof only responds to in-scope MACs. + +### DC-10: Engagement Phase Separation +- **Priority**: HIGH +- **Source**: Agent 3 +- **Description**: The highest-confidence SOC detection is temporal correlation: new device appears + active attacks begin within hours = obvious implant. Passive phase should run for minimum 1-2 weeks before any active module activates, letting the device age into the network baseline. +- **Recommendation**: Add an explicit engagement_phase config: PASSIVE_ONLY for first N days (configurable), then ACTIVE_ALLOWED. Active modules refuse to start during passive-only phase. Document this as core OPSEC doctrine. + +--- + +## Infrastructure / Reliability Fixes + +### IR-01: Thermal Monitoring and Throttle Response +- **Priority**: HIGH +- **Source**: Agent 5, Agent 6 +- **Description**: Pi Zero 2W throttles at 60C, hits 55-65C in enclosed deployments under sustained capture load. Pi 4 in server rooms can also thermal throttle. No temperature monitoring exists in the design. +- **Recommendation**: Read /sys/class/thermal/thermal_zone0/temp every 30s in resource_monitor. Emit RESOURCE_WARNING at 55C. At 65C, shed non-essential modules. Document minimum airflow requirements and consider thermal pad adhesion to enclosure. + +### IR-02: SD Card Write Endurance +- **Priority**: HIGH +- **Source**: Agent 6 +- **Description**: LUKS-encrypted writes to SD card for every PCAP rotation, SQLite WAL commit, and DNS log flush will wear the flash. Industrial endurance cards (30K P/E cycles) at continuous write degrade within weeks. I/O stalls of 10-30 seconds observed under sustained LUKS writes cause module crashes. +- **Recommendation**: Use tmpfs for SQLite WAL files. Buffer PCAP writes through tmpfs with async flush. Set WAL checkpoint interval to 30 minutes. Accept up to 30 minutes of data loss on power failure as acceptable trade-off for SD longevity. + +### IR-03: Setup Script Reliability +- **Priority**: HIGH +- **Source**: Agent 6 +- **Description**: setup.sh installs 30+ packages and 8 tools from GitHub without version pinning. On ARM Debian bookworm: masscan requires manual build, GitHub API rate limits fail pip/git installs, tool versions may break compatibility. Idempotency claims fail (git clone errors if directory exists). +- **Recommendation**: Pre-bundle all tool binaries in a companion tarball with SHA256 checksums. Pin all pip versions. Add guard conditions for every non-idempotent operation. Add --reinstall flag for force-refresh. + +### IR-04: Wireless Interface Conflict Detection +- **Priority**: MEDIUM +- **Source**: Agent 6 +- **Description**: wireless_intel requires monitor mode on wlan0; wifi_client requires managed mode on the same interface. On Pi Zero 2W with one onboard WiFi, these modules are mutually exclusive but the design doesn't detect the conflict. +- **Recommendation**: Add interface conflict detection to engine.py. Before starting a module, check if the interface is in a conflicting mode. Require explicit second USB WiFi adapter for concurrent monitor+client. + +### IR-05: USB Power Budget Documentation +- **Priority**: MEDIUM +- **Source**: Agent 6 +- **Description**: Pi Zero 2W + USB Ethernet + USB WiFi draws 1.9-4.7W total. USB 2.0 hubs provide only 2.5W per port. Underpowered deployments cause USB resets, disconnecting the bridge ethernet adapter mid-operation. +- **Recommendation**: Document minimum 5V/3A dedicated supply. Add power source check in selftest. Warn if running from USB hub or laptop port. + +### IR-06: Schema Migration Path +- **Priority**: LOW +- **Source**: Agent 6 +- **Description**: No database schema versioning. A mid-engagement BigBrother update with schema changes corrupts the credential database and loses all collected data. +- **Recommendation**: Add schema_version integer in metadata table. Compare on startup, run migration scripts if needed. Use ALTER TABLE ADD COLUMN for backwards-compatible changes. + +--- + +## Pre-installed Tool Gaps + +### TG-01: Coercion Tools (PetitPotam, Coercer, SpoolSample) +- **Priority**: CRITICAL +- **Source**: Agent 1, Agent 5 +- **Description**: ntlm_relay waits passively for organic authentication without coercion tools. PetitPotam (MS-EFSRPC), PrinterBug/SpoolSample, and DFSCoerce force machine account authentication to the implant for relay attacks. Without them, the NTLM relay to ADCS ESC8 chain (the engagement-ender) requires luck. +- **Recommendation**: Install Coercer (pip, wraps all methods) and PetitPotam.py (standalone) unconditionally in setup.sh. + +### TG-02: Wordlists and Rule Files +- **Priority**: HIGH +- **Source**: Agent 5 +- **Description**: No wordlists pre-staged. Operator can't download them on target network. CPU-mode hashcat/john needs good wordlists to crack NTLMv2 from Responder within the engagement window. +- **Recommendation**: Pre-bundle rockyou.txt.gz, SecLists top-1M passwords, and OneRuleToRuleThemAll + dive rule files in /opt/tools/wordlists/. + +### TG-03: ldapdomaindump / LDAPDomainDump +- **Priority**: HIGH +- **Source**: Agent 5 +- **Description**: Fast AD enumeration without BloodHound collection cycles. Critical for quick domain recon after first credential capture. +- **Recommendation**: Add to setup.sh pip install. + +### TG-04: smbmap +- **Priority**: MEDIUM +- **Source**: Agent 5 +- **Description**: Quick share enumeration, more reliable than NetExec for single-target share listings. +- **Recommendation**: Add to setup.sh pip install. + +### TG-05: ROADtools (Azure/Entra Recon) +- **Priority**: MEDIUM +- **Source**: Agent 5 +- **Description**: Azure/Entra recon for cloud-hybrid environments. Virtually every enterprise target in 2026 has O365/Azure AD. +- **Recommendation**: Add roadtools to setup.sh pip install for Pi 4 and Debian host tiers. + +--- + +## OPSEC Warnings + +These are detection risks operators MUST understand before deployment. + +### OW-01: ARP Spoofing Is the Most-Detected Active Technique +- **Priority**: CRITICAL +- **Source**: Agent 2, Agent 3, Agent 5 +- **Description**: DAI on managed switches silently prevents it. EDR agents (CrowdStrike, SentinelOne, Defender ATP) alert on ARP cache anomalies within minutes. ARPwatch and Wazuh agents generate immediate alerts. Even with rate-limiting and jitter, ARP spoof against protected endpoints is detected. +- **Action**: Use Responder+ipv6_slaac as primary credential capture. Reserve ARP spoof for confirmed legacy segments with no DAI/EDR. Add DAI probe to ids_tester before activation. + +### OW-02: Responder Poisoning Has Mature Detection Coverage +- **Priority**: CRITICAL +- **Source**: Agent 2, Agent 3, Agent 5 +- **Description**: Microsoft Defender for Identity has dedicated LLMNR/NBT-NS poisoning alerts. Suricata ET POLICY rules match poisoning responses. CrowdStrike/SentinelOne alert on NTLM auth to unexpected destinations. Honeypot LLMNR names are deployed by advanced SOCs. +- **Action**: Implement selective targeting: only respond to hostnames never seen in legitimate DNS. Add MDI-aware timing (avoid responses during known SOC shift changes). Document as high-risk active module. + +### OW-03: Evil Twin / Rogue AP — Instant WIDS Detection +- **Priority**: CRITICAL +- **Source**: Agent 2, Agent 3 +- **Description**: Enterprise WIDS (Cisco, Aruba, Meraki) alerts immediately on any AP advertising a corporate SSID from an unknown BSSID. This is structural — no evasion is possible. Deauth floods are separately detected. 802.11w (protected management frames) prevents deauth entirely. +- **Action**: Evil twin is only viable in environments confirmed to have no WIDS. Add WIDS detection check (2-hour observation) to wireless_intel before allowing evil_twin activation. + +### OW-04: Tailscale Control Plane Is Fingerprinted +- **Priority**: HIGH +- **Source**: Agent 2, Agent 3 +- **Description**: Tailscale connects to login.tailscale.com and known DERP relay IPs. Corporate proxy logs, Zeek, or NGFW will flag connections to Tailscale infrastructure from a device that has never used it before. The IP ranges and hostnames are publicly documented. +- **Action**: If target network has no existing Tailscale traffic (check during baseline), prefer WireGuard to a self-hosted endpoint or reverse SSH over stunnel. Traffic_mimicry cannot fix a fundamentally new destination. + +### OW-05: SSH on Port 443 Is Protocol Mismatch +- **Priority**: HIGH +- **Source**: Agent 2 +- **Description**: Reverse SSH tunnel on TCP/443 responds with SSH banner instead of TLS ServerHello. Any stateful NGFW or IDS running DPI immediately flags this. Suricata rule: `content:"SSH-"; port 443`. +- **Action**: Default to SSH-over-WebSocket or SSH tunneled inside TLS (stunnel/ncat --ssl) so TCP/443 carries a real TLS handshake. Never raw SSH on 443. + +### OW-06: Raspberry Pi Hardware Fingerprint +- **Priority**: HIGH +- **Source**: Agent 2 +- **Description**: Even with MAC randomization, Pi is fingerprinted through DHCP Option 60 (vendor class "dhcpcd-..."), hostname patterns, TCP stack (nmap OS fingerprint), and TTL values. NAC platforms and Forescout specifically profile device types. +- **Action**: setup.sh must set DHCP vendor class to match the cloned MAC's vendor (e.g., "MSFT 5.0"). Hostname set before first DHCP request. TCP stack tuning in anti_forensics to match target OS profile. + +### OW-07: mitmproxy CA Certificate Is a Persistent IOC +- **Priority**: HIGH +- **Source**: Agent 2, Agent 3 +- **Description**: The default mitmproxy CA has CN "mitmproxy". Even with custom CN, the CA certificate installed on endpoints or visible in browser certificate errors is attributable forensic evidence that survives the engagement. +- **Action**: Override CA CN to match target's existing PKI naming convention. Document that mitmproxy is only practical against internal apps with no cert pinning where operator can pre-install CA via GPO. + +### OW-08: Physical Detection Vectors +- **Priority**: HIGH +- **Source**: Agent 2 +- **Description**: Extra ethernet cable/USB adapter in a cable run, continuous 0.5-3W power draw on a USB port, thermal signature in confined spaces, and LED activity are all detectable by facilities staff, IT, or security-aware employees. +- **Action**: Use purpose-built enclosure matching physical environment. Disable all LEDs. MAC spoofing in pre-init before first frame. Consider PoE splitter for power (blends with existing cable plant). + +### OW-09: SIEM Temporal Correlation Risk +- **Priority**: HIGH +- **Source**: Agent 3 +- **Description**: The highest-confidence SOC detection: new device appears on network + active attacks begin within hours = obvious implant. New MAC → ARP anomalies → NTLM relay → domain compromise is a clear attack chain in SIEM correlation. +- **Action**: Enforce passive-only phase of 1-2 weeks minimum before activating any active module. Let the device age into the network baseline before going active. + +### OW-10: BLE Emergency Access Is Discoverable +- **Priority**: MEDIUM +- **Source**: Agent 2 +- **Description**: ble_emergency.py runs an always-on BLE GATT server. BLE advertisements are detectable by any device within 30m scanning on channels 37/38/39. +- **Action**: Disable BLE by default. Enable only on-demand (dead man's switch or SMS trigger over cellular). Use random rotating BLE address and service UUIDs. + +--- + +## Accepted Limitations + +These are inherent constraints that cannot be fully mitigated. + +### AL-01: Encrypted Traffic Dominance (~85-95%) +- **Source**: Agent 1, Agent 5 +- Modern corporate networks are 85-95% encrypted. Cleartext credential sniffer, email sniffer, and HTTP logger yield near-zero in passive mode. SMB3 encryption is default on Server 2022. SMTP is universally STARTTLS. Accept that passive value is primarily metadata: DNS, TLS SNI, Kerberos wire capture, and flow analysis. Kerberos from wire is the single highest-value passive capability. + +### AL-02: Encrypted Client Hello (ECH) +- **Source**: Agent 1, Agent 5 +- ECH (deployed by Cloudflare, Google, Firefox) encrypts the real SNI. Passive SNI extraction returns the CDN's dummy value. No passive mitigation exists. In active mode, blocking DoH endpoints forces DNS fallback, but ECH cannot be defeated without full TLS interception. + +### AL-03: DNS-over-HTTPS Blindspot +- **Source**: Agent 1, Agent 5 +- DoH to hardcoded resolvers (1.1.1.1, 8.8.8.8) bypasses dns_logger entirely. 30-70% of endpoint DNS queries may be encrypted. Internal AD DNS queries to domain controllers remain visible on UDP/53. The gap is external destination visibility, not internal AD reconnaissance. + +### AL-04: TLS 1.3 Certificate Visibility +- **Source**: Agent 1 +- TLS 1.3 encrypts server certificates during handshake. Passive certificate extraction is impossible. Rely on SNI (while available) and Certificate Transparency logs for cert intelligence. + +### AL-05: SMB3 Encryption +- **Source**: Agent 1 +- Windows Server 2022 and Windows 11 default to SMB 3.1.1 with AES encryption. SMB monitoring captures negotiate/session setup (revealing capabilities and NTLM) but encrypted payload is opaque. File access monitoring requires active MITM position with SMB downgrade. + +### AL-06: Process Disguise vs Forensic Analysis +- **Source**: Agent 2, Agent 3, Agent 5 +- Process name spoofing defeats `ps aux` but not: /proc/PID/exe (shows real Python binary), strace/ptrace by EDR, systemd-analyze, high CPU/RAM usage inspection. Primary protection must be physical inaccessibility (Pi in cable run) or LKM rootkit (compromised host), not process disguise alone. + +### AL-07: Bridge Physical Failure = Network Outage +- **Source**: Agent 1, Agent 5 +- An inline bridge is a single point of failure. Hardware bypass relays mitigate but don't eliminate risk. Accept that bridge failure will be noticed. The dead-man watchdog (DC-06) minimizes outage duration to <15 seconds. + +--- + +*91 raw findings from 6 agents consolidated to 45 actionable items. 9 duplicates merged across agents. 6 severity adjustments applied (Agent 2/3 OPSEC findings rated at face value as they represent real detection risk; Agent 5 field experience ratings preserved).*