diff --git a/BIGBROTHER_DESIGN.md b/BIGBROTHER_DESIGN.md index aed5218..3c6c939 100644 --- a/BIGBROTHER_DESIGN.md +++ b/BIGBROTHER_DESIGN.md @@ -1,8 +1,8 @@ # BigBrother: Total Network Surveillance Platform + Operator Jump Box -> **Version**: 3.1 +> **Version**: 3.2 > **Date**: 2026-03-17 -> **Status**: Implementation Blueprint +> **Status**: Implementation Blueprint (Security Review Integrated) --- @@ -29,6 +29,8 @@ BigBrother is a total network surveillance platform and operator jump box design The platform has two operational modes. **Passive surveillance** runs unsupervised from the moment of deployment, collecting full packet captures, DNS query logs, TLS SNI data, cleartext credentials, Kerberos tickets, host information, traffic patterns, and protocol metadata. **Active surveillance** is operator-enabled when deeper collection is needed — ARP spoofing to become the man-in-the-middle, DNS poisoning, DHCP spoofing, Responder for hash capture, mitmproxy for HTTPS interception. Once the operator enables an active module and configures its targets, it runs unattended. +**Reality check**: Modern corporate networks are 85-95% encrypted. Passive value is primarily metadata — DNS, TLS SNI, Kerberos wire capture, flow analysis. Cleartext credential sniffer and email sniffer yield near-zero on modern networks. Kerberos from wire is the single highest-value passive capability. Active MITM is required for anything beyond metadata. + BigBrother is not an autonomous attack framework. There is no decision engine, no state machine, no automated attack chaining. The operator makes all decisions. When the operator needs to run offensive tools, they SSH into the box and use the pre-installed toolkit directly: nmap, Certipy, Impacket, BloodHound, CrackMapExec, Chisel, Ligolo-ng. These tools are installed by `setup.sh`, not wrapped in Python. The operator runs them, interprets the results, and decides what to do next. Scope is the operator's responsibility. An optional `scope.yaml` can be loaded to validate active module targets against in-scope ranges, but this is not mandatory — there is no hard scope enforcement or OT lockout mechanism forced on the operator. @@ -119,7 +121,8 @@ Scope is the operator's responsibility. An optional `scope.yaml` can be loaded t │ │ ├── wifi_client.py # WiFi client mode, network selection │ │ ├── reverse_tunnel.py # SSH reverse tunnel fallback │ │ ├── cellular_backup.py # LTE modem HAT for out-of-band access (optional) -│ │ └── ble_emergency.py # BLE emergency access channel (optional) +│ │ ├── ble_emergency.py # BLE emergency access channel (optional) +│ │ └── data_exfil.py # Automated data exfiltration pipeline │ │ │ ├── stealth/ │ │ ├── __init__.py @@ -194,6 +197,12 @@ Scope is the operator's responsibility. An optional `scope.yaml` can be loaded t │ │ ├── emerging-threats.rules │ │ └── snort-community.rules │ ├── ja3_fingerprints.db # Known JA3 hashes for common browsers +│ ├── wordlists/ # Pre-bundled for on-device cracking +│ │ ├── rockyou.txt.gz # Classic password list +│ │ ├── top-1m-passwords.txt # SecLists top-1M +│ │ └── rules/ # Hashcat rules +│ │ ├── OneRuleToRuleThemAll.rule +│ │ └── dive.rule │ └── bpf_filters/ │ ├── credentials.bpf # BPF for credential protocols │ ├── dns.bpf # BPF for DNS traffic @@ -255,7 +264,8 @@ Scope is the operator's responsibility. An optional `scope.yaml` can be loaded t - CPU cost: zstd -19 on Pi 4 compresses at ~5-10MB/s (runs as background task after rotation, not inline) - Pi Zero: use zstd -3 (fast mode, still 5-8x compression, minimal CPU) - Snap length configurable: 96 bytes (headers only) for Pi Zero, 65535 (full) for Pi 4+ -- Disk usage monitoring — auto-purge oldest PCAPs when threshold hit +- **Tiered retention**: Headers-only (snap=96) as default on all tiers for bulk traffic. Separate credential-protocol full-capture ring buffer (NTLM, Kerberos, HTTP auth ports only). Full PCAP is operator-opt-in for targeted sessions. A 100Mbps link generates ~45GB/hour at full snap — without tiering, 32GB fills in hours and auto-purge destroys historical data. +- Disk usage monitoring — auto-purge oldest PCAPs when threshold hit (bulk first, credential ring preserved) - PcapNG format support for metadata embedding (interface info, comments, timestamps) **Resources**: RAM 30-80MB (snap length dependent), CPU 5-15% capture + compression spikes on rotation, disk varies @@ -289,7 +299,9 @@ Scope is the operator's responsibility. An optional `scope.yaml` can be loaded t - Extract Server Name Indication field — reveals destination even when encrypted - Correlate with DNS logs for complete web activity picture - Detect certificate pinning, TLS 1.3 encrypted SNI (ESNI/ECH) gaps -- **ECH limitation**: Encrypted Client Hello (Cloudflare, Google, Firefox) returns CDN dummy SNI — no passive mitigation. When in MITM position, blocking DoH forces DNS fallback but ECH requires full TLS interception. +- **ECH limitation**: Encrypted Client Hello (Cloudflare, Google, Firefox) returns CDN dummy SNI — no passive mitigation. ECH requires full TLS interception to defeat. +- **DoH blind spot**: DNS-over-HTTPS to hardcoded resolvers (1.1.1.1, 8.8.8.8) bypasses dns_logger entirely — 30-70% of endpoint DNS may be encrypted. Internal AD DNS to domain controllers remains visible on UDP/53. When in MITM position, block DoH resolver IPs and strip HTTPS DNS records (type 65) to force plaintext fallback. +- **TLS 1.3**: Server certificates encrypted during handshake — passive cert extraction impossible. Rely on SNI (while available) and CT logs. - Log: timestamp, source IP, destination IP:port, SNI hostname, TLS version - QUIC/HTTP3 SNI handled by separate `quic_analyzer.py` module @@ -305,8 +317,10 @@ Scope is the operator's responsibility. An optional `scope.yaml` can be loaded t - **Cleartext**: FTP (USER/PASS), HTTP Basic/Digest, HTTP form POST, SMTP AUTH, POP3 USER/PASS, IMAP LOGIN, Telnet, SNMP community strings, LDAP simple bind - **NTLM**: Extract NTLMv1/v2 challenge-response from SMB, HTTP NTLM, LDAP NTLM, MSSQL NTLM - **Kerberos**: Extract encrypted timestamps from AS-REQ (password spray targets) +- **Realistic yield**: On modern networks (85-95% encrypted), cleartext protocols yield near-zero in passive mode. SMTP is universally STARTTLS. Primary passive value is NTLM/Kerberos from wire. Cleartext sniffer becomes high-value only with active MITM position. - Output: hashcat-compatible format, stored in credential_db - Publishes CREDENTIAL_FOUND events on bus +- Auto-queue captured hashes for CPU-mode john/hashcat in low-priority cgroup; push hashes immediately to operator's cracking rig via data_exfil for GPU cracking **Resources**: RAM 20MB, CPU 3%, disk 5MB **Dependencies**: scapy, impacket (for NTLM/Kerberos parsing) @@ -437,6 +451,7 @@ Scope is the operator's responsibility. An optional `scope.yaml` can be loaded t - Identify sensitive shares (SYSVOL, NETLOGON, C$, ADMIN$, custom shares) - Log: timestamp, user, source IP, share name, file path, operation - Detect GPP/Group Policy access patterns +- **SMB3 limitation**: Windows Server 2022 and Windows 11 default to SMB 3.1.1 with AES encryption. Negotiate/session setup (capabilities, NTLM) is visible but encrypted payload is opaque. File access monitoring requires active MITM with SMB downgrade. **Resources**: RAM 15MB, CPU 2%, disk 5MB **Dependencies**: scapy, impacket @@ -483,8 +498,9 @@ Scope is the operator's responsibility. An optional `scope.yaml` can be loaded t - Probe request collection — reveals client preferred network history - BLE scanning — identify phones, badges, IoT devices - WPA 4-way handshake passive capture from legitimate connections -- WIDS detection — identify wireless IDS by monitoring for correlation patterns +- WIDS detection — identify wireless IDS by monitoring for correlation patterns (run 2-hour observation before allowing evil_twin) - Publishes HANDSHAKE_CAPTURED events +- **Interface conflict**: Monitor mode on wlan0 and wifi_client managed mode are mutually exclusive on same interface. Requires explicit second USB WiFi adapter for concurrent monitor+client. engine.py detects and prevents conflicting modes. **Resources**: RAM 20MB, CPU 3%, disk 10MB **Dependencies**: scapy, aircrack-ng (for monitor mode), bluez (for BLE) @@ -533,6 +549,7 @@ Scope is the operator's responsibility. An optional `scope.yaml` can be loaded t - Decode MIME multipart, Base64 attachments, quoted-printable - Store: per-email directory with headers, body text, and attachment files - Only captures cleartext — encrypted (STARTTLS, SSL) requires MITM position +- **Realistic yield**: SMTP is universally STARTTLS in 2026. Expect near-zero cleartext email capture on modern networks without active MITM. **Resources**: RAM 20MB, CPU 3%, disk varies (attachment size) **Dependencies**: scapy, email (stdlib) @@ -612,12 +629,15 @@ These modules require explicit operator activation. Once configured and started, **Purpose**: Become the man-in-the-middle by poisoning ARP caches. All target traffic flows through the implant. +> **OPSEC WARNING**: ARP spoofing is the most-detected active technique. DAI on managed switches silently prevents it. EDR agents (CrowdStrike, SentinelOne, Defender ATP) alert on ARP cache anomalies within minutes. ARPwatch and Wazuh agents generate immediate alerts. Even with rate-limiting and jitter, ARP spoof against EDR-protected endpoints is detected. **Prefer Responder + ipv6_slaac as primary credential capture.** Reserve ARP spoof for confirmed legacy segments with no DAI/EDR. Run ids_tester DAI probe before activation. + - Gratuitous ARP replies to targets, impersonating gateway - Gratuitous ARP replies to gateway, impersonating targets - IP forwarding enabled to maintain connectivity - Target list: specific hosts (not full subnet — less noise) - Rate-limited ARP replies with jitter - Restore original ARP entries on stop +- **Crash recovery**: Kernel-level ARP restoration — cron job every 30s checks arp_spoof PID, sends gratuitous ARP corrections if process is dead. Prevents spoofed targets from losing gateway connectivity (1-5 min ARP timeout) on crash. **Resources**: RAM 10MB, CPU 2% **Dependencies**: scapy, iptables @@ -648,7 +668,7 @@ These modules require explicit operator activation. Once configured and started, - Set implant IP as default gateway — all traffic routes through implant - Set implant IP as DNS server — all DNS queries visible - Configurable lease time, subnet mask, DNS settings -- Target specific MACs or respond to all +- Target specific MACs or respond to all (when scope.yaml loaded, only responds to in-scope MACs) **Resources**: RAM 10MB, CPU 1% **Dependencies**: scapy @@ -659,6 +679,8 @@ These modules require explicit operator activation. Once configured and started, **Purpose**: Rogue access point with captive portal for credential harvesting. +> **OPSEC WARNING**: Enterprise WIDS (Cisco, Aruba, Meraki) alerts immediately on any AP advertising a corporate SSID from an unknown BSSID. No evasion is possible — this is structural. Deauth floods are separately detected. 802.11w (protected management frames) prevents deauth entirely. Only viable in environments confirmed to have no WIDS. Run wireless_intel WIDS detection check (2-hour observation) before allowing evil_twin activation. + - hostapd-based AP matching target SSID - Open or WPA2 mode - Captive portal serving credential harvesting pages (corporate login, O365, guest WiFi) @@ -691,6 +713,8 @@ These modules require explicit operator activation. Once configured and started, **Purpose**: Manage the Responder process for LLMNR/NBT-NS/mDNS poisoning and NTLMv2 hash capture. +> **OPSEC WARNING**: Responder poisoning has mature detection coverage. Microsoft Defender for Identity has dedicated LLMNR/NBT-NS poisoning alerts. Suricata ET POLICY rules match poisoning responses. CrowdStrike/SentinelOne alert on NTLM auth to unexpected destinations. Advanced SOCs deploy honeypot LLMNR names. Implement selective targeting: only respond to hostnames never seen in legitimate DNS. Avoid responses during known SOC shift changes. + - Start/stop/monitor Responder subprocess - Configure via Responder.conf.j2 template (enable/disable protocols) - Parse Responder output for captured hashes @@ -788,6 +812,7 @@ These modules require explicit operator activation. Once configured and started, - Manage mitmproxy process in transparent mode - Generate CA cert (operator must install on targets or accept warnings) +- **CA cert IOC**: Override default mitmproxy CA CN (default is "mitmproxy") to match target's existing PKI naming convention. The CA cert is attributable forensic evidence that survives the engagement. Only practical against internal apps with no cert pinning where operator can pre-install CA via GPO. - Full request/response logging for HTTPS traffic - Script hooks for credential extraction, file carving, injection - Provides decrypted traffic to other modules (http_logger, file_extractor, cloud_token_active) @@ -805,7 +830,7 @@ These modules require explicit operator activation. Once configured and started, - Manage ntlmrelayx process (from Impacket) - Relay targets: SMB, LDAP, LDAPS, HTTP, MSSQL, ADCS HTTP enrollment - Coordinate with responder_mgr — Responder captures, ntlmrelayx relays -- Coordinate with operator running coercion tools (PetitPotam, PrinterBug) +- Coordinate with operator running coercion tools (PetitPotam, PrinterBug) — without coercion, ntlm_relay waits passively for organic auth (slow). Coercer + PetitPotam pre-installed for this reason. - ADCS ESC8 relay: relay to HTTP enrollment endpoint for certificate issuance - LDAP relay: add users, modify ACLs, add replication rights for DCSync - Output: relay results, captured credentials, obtained certificates @@ -986,6 +1011,8 @@ These modules require explicit operator activation. Once configured and started, **Purpose**: Primary operator access via Tailscale mesh VPN. +> **OPSEC WARNING**: Tailscale connects to login.tailscale.com and known DERP relay IPs. Corporate proxy logs, Zeek, or NGFW will flag connections to Tailscale infrastructure from a device that has never used it. The IP ranges and hostnames are publicly documented. If target network has no existing Tailscale traffic (check during baseline), prefer WireGuard to a self-hosted endpoint or reverse SSH over stunnel. Traffic mimicry cannot fix a fundamentally new destination. + - Install and authenticate Tailscale on deployment - Pre-auth key with engagement-specific ACL tags - Hostname matches device disguise (e.g., "iot-sensor-03") @@ -1019,12 +1046,13 @@ These modules require explicit operator activation. Once configured and started, - Bridge two Ethernet interfaces (USB eth + onboard) - No IP address on bridge interfaces — invisible on network -- EAP/EAPOL passthrough for 802.1X environments +- **802.1X bypass** (silentbridge technique): Clone victim MAC on external interface, pass all EAP frames bidirectionally, implant's own traffic uses cloned MAC. EAPOL passthrough alone is insufficient — switch may detect topology change, MAB lists may reject, re-auth timers cause delayed failure. WiFi-only fallback when wired 802.1X blocks deployment. - All traffic passes through — available for passive capture - Clone victim MAC for implant's own traffic - Disable STP on bridge, suppress BPDU frame emission via ebtables - Filter CDP/LLDP emission from bridge interfaces (receive only, never transmit) - Failsafe: lightweight C watchdog checks bridge forwarding every 5s, direct passthrough if down >10s +- **Bridge failure = network outage**: Inline bridge is a single point of failure. Hardware bypass relays mitigate but don't eliminate risk. Bridge failure will be noticed; watchdog minimizes outage to <15 seconds. **Resources**: RAM 10MB, CPU 2% **Dependencies**: bridge-utils, ebtables, scripts/setup_bridge.sh @@ -1080,10 +1108,12 @@ These modules require explicit operator activation. Once configured and started, **Purpose**: Local emergency access via Bluetooth Low Energy when all network access is down. +> **OPSEC WARNING**: BLE advertisements are detectable by any device within 30m scanning on channels 37/38/39. Disable BLE by default. Enable only on-demand (dead man's switch or SMS trigger over cellular). Use random rotating BLE address and non-standard service UUIDs. + - BLE GATT server, ~10m range - PSK-based challenge-response authentication - Commands: status, kill, reboot -- Always-on, minimal power (~0.1W) +- Disabled by default — enable only when needed - Use case: operator physically near implant, network C2 down **Resources**: RAM 5MB, CPU 0.5% @@ -1091,6 +1121,22 @@ These modules require explicit operator activation. Once configured and started, --- +### `modules/connectivity/data_exfil.py` — Automated Data Exfiltration + +**Purpose**: Push collected data to operator infrastructure automatically. Without this, physical seizure = total loss, SD card corruption = total loss, credentials sit unused for hours/days. + +- **Priority push**: Credentials immediately on CREDENTIAL_FOUND events via active C2 channel (Tailscale/WG) +- **Nightly sync**: Intel artifacts (topology, timelines, posture map) during off-hours +- **On-demand pull**: Bulk PCAPs transferred when operator requests +- **Rolling window**: Keep only recent data locally after successful exfil — reduces seizure exposure +- Respects traffic_mimicry baseline — exfil timed to match normal upload patterns +- Falls back through connectivity chain (Tailscale > WG > reverse SSH > cellular) + +**Resources**: RAM 15MB, CPU 2% (spikes during transfer) +**Dependencies**: rsync, active C2 channel + +--- + ## 5. Stealth ### `modules/stealth/mac_manager.py` — MAC Randomization/Cloning @@ -1108,6 +1154,7 @@ These modules require explicit operator activation. Once configured and started, - Spoof /proc/self/cmdline, /proc/self/comm - Systemd service descriptions use innocuous names - `ps aux` shows nothing suspicious +- **Limitation**: Defeats `ps aux` but NOT: /proc/PID/exe (shows real Python binary), strace/ptrace by EDR, systemd-analyze, high CPU/RAM usage inspection. Primary protection must be physical inaccessibility (Pi in cable run) or LKM rootkit (compromised host), not process disguise alone. --- @@ -1290,6 +1337,7 @@ Interactive Menu (Rich-based): - Interface conflict detection: prevents two modules from claiming the same interface in incompatible modes (e.g., monitor mode vs managed mode on wlan0) - Graceful degradation: if module fails, others continue - Optional scope enforcement: when `config/scope.yaml` is loaded, active modules validate targets against in-scope IP ranges/hostnames/domains before acting +- **Engagement phase gating**: Configurable `engagement_phase` — PASSIVE_ONLY for first N days (default: 7), then ACTIVE_ALLOWED. Active modules refuse to start during passive-only phase. New device + active attacks within hours is the highest-confidence SOC detection via temporal SIEM correlation. ### `core/capture_bus.py` — Packet Capture Bus @@ -1317,7 +1365,7 @@ CHANGE_DETECTED THERMAL_WARNING SCOPE_VIOLATION ### `core/state.py` — Persistent State -Single SQLite database with schema-separated tables (not multiple DB files). WAL mode with dedicated async writer thread — all modules submit writes to a queue, writer batches with 500ms coalesce window. PRAGMA synchronous=NORMAL, busy_timeout=30s. WAL files on tmpfs with periodic checkpoint to SD card (accept up to 30 minutes data loss on power failure for SD longevity). Stores module states, discovered hosts, running configuration. Survives reboots. +Single SQLite database with schema-separated tables (not multiple DB files). WAL mode with dedicated async writer thread — all modules submit writes to a queue, writer batches with 500ms coalesce window. PRAGMA synchronous=NORMAL, busy_timeout=30s. WAL files on tmpfs with periodic checkpoint to SD card (accept up to 30 minutes data loss on power failure for SD longevity). Stores module states, discovered hosts, running configuration. Survives reboots. Schema versioning via metadata table — compare on startup, run migration scripts if needed. Use ALTER TABLE ADD COLUMN for backwards-compatible changes to avoid mid-engagement data loss. ### `core/scheduler.py` — Task Scheduler @@ -1381,16 +1429,31 @@ pypykatz (pipx), ldapdomaindump (pipx), smbmap (pipx), ROADtools (pipx, Pi 4+ only) ``` +**Wordlists (to `/opt/tools/wordlists/`):** + +``` +rockyou.txt.gz, SecLists top-1M passwords, +OneRuleToRuleThemAll.rule, dive.rule +``` + **System packages (additional):** ``` -proxychains-ng socat sshuttle +proxychains-ng socat sshuttle stunnel4 ``` **Kernel config:** IP forwarding (v4+v6), no send_redirects. **Pi optimizations:** gpu_mem=16, disable bluetooth/avahi, no swap. +**Setup reliability**: +- Pre-bundle all tool binaries in a companion tarball with SHA256 checksums (masscan requires manual build on ARM) +- Pin all pip versions in requirements.txt +- Guard conditions for every non-idempotent operation (git clone errors if directory exists) +- `--reinstall` flag for force-refresh +- DHCP vendor class set to match cloned MAC's vendor (e.g., "MSFT 5.0") before first network contact +- Hostname set before first DHCP request + **Directories:** `storage/{config,pcaps,creds,dns_logs,sni_logs,emails,files,voip,print_jobs,intel,baseline,audit,logs}` with mode 700. ### Systemd Services @@ -1475,6 +1538,11 @@ operating_hours: baseline: duration_hours: 48 auto_start: true + +engagement_phase: + mode: "passive_only" # passive_only | active_allowed + passive_days: 7 # Days before active modules are permitted + auto_transition: true # Auto-transition to active_allowed after N days ``` ### `storage/config/` — Sensitive Config (Inside LUKS) @@ -1570,7 +1638,13 @@ When enabled: ARP spoof validates each target IP, DHCP spoof only responds to in ## 10. Hardware Tiers -**Minimum SD card**: 128GB (high-endurance industrial). With zstd -19 compression (10-15x on PCAPs), 128GB provides ~1.2TB effective PCAP storage. Compressed PCAPs also transfer 10-15x faster when operator pulls data over C2 channel. +**Minimum SD card**: 128GB (high-endurance industrial). With zstd -19 compression (10-15x on PCAPs), 128GB provides ~1.2TB effective PCAP storage. Compressed PCAPs also transfer 10-15x faster when operator pulls data over C2 channel. SD card write endurance: use tmpfs for SQLite WAL files, buffer PCAP writes through tmpfs with async flush. Accept up to 30 minutes data loss on power failure for SD longevity. + +**Power requirements**: Minimum 5V/3A dedicated supply. Pi Zero 2W + USB Ethernet + USB WiFi draws 1.9-4.7W. USB 2.0 hubs provide only 2.5W per port — underpowered deployments cause USB resets, disconnecting bridge ethernet mid-operation. Consider PoE splitter for power (blends with existing cable plant). selftest checks power source and warns if running from USB hub. + +**Pi hardware fingerprint**: Even with MAC randomization, Pi is fingerprinted through DHCP Option 60 (vendor class "dhcpcd-..."), hostname patterns, TCP stack (nmap OS fingerprint), and TTL values. NAC platforms and Forescout specifically profile device types. setup.sh sets DHCP vendor class to match cloned MAC's vendor and tunes TCP stack parameters in anti_forensics to match target OS profile. + +**Physical detection**: Extra ethernet cable/USB adapter in a cable run, continuous power draw, thermal signature in confined spaces, LED activity — all detectable by facilities staff. Disable all LEDs. Use purpose-built enclosure matching physical environment. MAC spoofing must happen in pre-init before first frame. | Capability | Pi Zero 2W (512MB) | Pi 4 (4GB) | Debian Host | |---|:---:|:---:|:---:| @@ -1628,8 +1702,8 @@ Files: - utils/ (all 7 utility modules) - config/ (bigbrother.yaml, modules.yaml, stealth.yaml, hardware_tiers.yaml, scope.yaml) - services/ (all systemd units) -- setup.sh (core packages, tool installation incl. Coercer, proxychains-ng, etc.) -- data/dhcp_fingerprints.db +- setup.sh (core packages, tool installation incl. Coercer, proxychains-ng, wordlists, stunnel4) +- data/dhcp_fingerprints.db, data/wordlists/ - tests/ (engine, bus, crypto, resource) Validation: Module lifecycle works (multiprocess). Capture bus demuxes packets. @@ -1663,18 +1737,19 @@ Zero IDS alerts. ### Phase 3: Connectivity + Baseline (Weeks 6-7) -All connectivity modules. Bridge hardening (STP/CDP suppression, watchdog failsafe). Traffic baseline capture. Reliable operator access. +All connectivity modules including data exfil pipeline. Bridge hardening (STP/CDP suppression, watchdog failsafe). Traffic baseline capture. Reliable operator access. ``` Files: -- modules/connectivity/ (all 7 modules) +- modules/connectivity/ (all 8 modules incl. data_exfil) - modules/stealth/traffic_mimicry.py (baseline capture phase) - scripts/setup_bridge.sh, teardown_bridge.sh Validation: Failover chain works: Tailscale > WireGuard > SSH > Cellular. Bridge transparent with STP/BPDU/CDP/LLDP suppression. C watchdog failsafe triggers passthrough in <15s. WiFi client connected. 48h baseline captured. -BLE emergency access functional. +BLE emergency access functional. Data exfil pipeline pushes creds on capture, +nightly intel sync. Engagement phase gating enforced. ``` ### Phase 4: Active Surveillance (Weeks 8-9) @@ -1707,7 +1782,10 @@ Tasks: - SQLite contention test (22 modules writing concurrently) - LUKS network-derived unlock test (C2 reachable and unreachable scenarios) - Rich TUI interactive menu polish (triage command) -- setup.sh validation on clean OS images (all new tools install correctly) +- setup.sh validation on clean OS images (all tools install, wordlists present, stunnel4 available) +- setup.sh idempotency test (run twice, no errors) +- USB power budget verification per tier +- Schema migration test (upgrade mid-engagement without data loss) - Crypto implementation review - LKM rootkit compile and test on target kernels - IDS tester validation against current rulesets @@ -1732,7 +1810,7 @@ Tasks: ### During Operation -9. **48-hour baseline** — Capture before any active module. Investment in stealth. +9. **Passive-only phase** — Enforce 1-2 week passive-only phase minimum. New device + active attacks within hours is the highest-confidence SIEM correlation for implant detection. Let the device age into the network baseline. 10. **Working hours** — Active modules during business hours only. After-hours activity is anomalous. 11. **Traffic blending** — Use traffic_mimicry to shape implant traffic to baseline. 12. **JA3** — All outbound HTTPS uses ja3_spoofer. @@ -1764,8 +1842,9 @@ Tasks: ### Network Footprint 31. **Bridge mode** — No IP, no MAC on network. Physical inspection only detection. -32. **Tailscale** — Looks like HTTPS to Derp servers. -33. **WireGuard** — Encrypted UDP on single port. Looks like noise. -34. **Reverse SSH** — Must be SSH-over-WebSocket or SSH tunneled inside TLS (stunnel/ncat --ssl). Never raw SSH on 443 — DPI detects SSH banner. +32. **Tailscale** — Looks like HTTPS to Derp servers. But Tailscale destinations are publicly documented — check during baseline whether target network already has Tailscale traffic before using. +33. **WireGuard** — Encrypted UDP on single port to self-hosted endpoint. Preferred when Tailscale would be a new destination. +34. **Reverse SSH** — Must be SSH-over-WebSocket or SSH tunneled inside TLS (stunnel/ncat --ssl). Never raw SSH on 443 — DPI detects SSH banner (`content:"SSH-"; port 443`). 35. **Cellular** — Completely out-of-band. Bypasses target network entirely. 36. **DNS tunneling** — Low rate, randomized, multiple domains. +37. **Data exfil** — Automated credential push, nightly intel sync. Timed to match baseline upload patterns via traffic_mimicry. diff --git a/SECURITY_REVIEW.md b/SECURITY_REVIEW.md deleted file mode 100644 index 7a41de5..0000000 --- a/SECURITY_REVIEW.md +++ /dev/null @@ -1,305 +0,0 @@ -# BigBrother v3.0 Security Review — Consolidated - -**Date**: 2026-03-17 -**Reviewed by**: Security Tribe (6 agents, 91 raw findings consolidated to 45) -**Scope**: BIGBROTHER_DESIGN.md — full architecture, module design, deployment model, OPSEC posture - ---- - -## New Modules to Add - -### NM-01: LDAP Query Harvester (`ldap_monitor.py`) -- **Priority**: CRITICAL -- **Source**: Agent 1, Agent 4 -- **Description**: The design captures LDAP binds and NTLM auth over LDAP but never parses LDAP search queries/responses. LDAP traffic on ports 389/3268 contains the richest AD intelligence on any network: group memberships, GPO links, OU structure, service account descriptions (often containing passwords), admin group queries, and enumeration patterns that reveal what tools admins use. -- **Recommendation**: Add ldap_monitor.py as a passive module. Parse LDAP SearchRequest/SearchResponse, extract base DN, filter, attributes, and result entries. Feed into topology_mapper and intel reports. This is the single highest-value passive module missing from the design. - -### NM-02: RDP Session Intelligence (`rdp_monitor.py`) -- **Priority**: CRITICAL -- **Source**: Agent 1, Agent 4 -- **Description**: RDP (TCP/3389) is the most-used lateral movement protocol in enterprise Windows environments and is completely absent from the design. Even without decryption, NLA negotiation headers reveal username, domain, client hostname, and keyboard layout. CredSSP carries NTLM/Kerberos that kerberos_harvester may miss if not RDP-aware. Session timing maps admin schedules. -- **Recommendation**: Add passive RDP monitoring for NLA/CredSSP extraction and session timing. Optionally add active rdp_mitm.py (Seth-based) for credential capture when in MITM position. - -### NM-03: QUIC/HTTP3 Traffic Parser -- **Priority**: CRITICAL -- **Source**: Agent 1, Agent 5 -- **Description**: QUIC (UDP/443) now carries 30-40% of web traffic. The tls_sni_extractor only handles TCP-based TLS ClientHello. QUIC Initial packets contain a TLS ClientHello in a completely different framing (CRYPTO frame). Without parsing QUIC, SNI visibility has a massive blind spot for Google, Cloudflare, and Meta traffic. -- **Recommendation**: Add QUIC Initial packet parsing to tls_sni_extractor.py. Decrypt Initial packets using connection ID-derived keys (standard per RFC 9001, not secret). Extract SNI from the embedded ClientHello. - -### NM-04: Data Exfiltration Pipeline (`data_exfil.py`) -- **Priority**: CRITICAL -- **Source**: Agent 1, Agent 4, Agent 5 -- **Description**: All collected data lives only on the implant until the operator SSHes in. No automatic exfiltration means: physical seizure = total loss, SD card corruption = total loss, captured credentials sit unused for hours/days, and multi-day PCAPs overflow before anyone reviews them. -- **Recommendation**: Add data_exfil.py in modules/connectivity/. Priority push: credentials immediately on CREDENTIAL_FOUND events via Tailscale. Nightly rsync of intel artifacts during off-hours. Pull-model for bulk PCAPs on operator demand. Store only a rolling window locally. - -### NM-05: Change Detection / Alerting System -- **Priority**: CRITICAL -- **Source**: Agent 4 -- **Description**: The design captures network state continuously but never diffs it. Over multi-week deployments, the critical question is: what changed? New host (new employee? IR team?), new service on DC (security tool deployment?), admin accessing unusual shares. Without change detection, the operator flies blind between check-ins and may miss burn indicators. -- **Recommendation**: Add a change_detector module that diffs topology/host/service state every hour. Flag new hosts, new services, disappeared hosts, unusual auth patterns. Push critical changes (potential IR activity, new security tools) immediately to operator. - -### NM-06: Security Posture / EDR Detection Module -- **Priority**: CRITICAL -- **Source**: Agent 4 -- **Description**: The design has IDS self-testing (checking your own actions against Snort rules) but nothing that maps the target's security posture. Before any active module activates, the operator needs to know: which EDR is on endpoints, which SIEM is deployed, are there honeypots/honeytokens, is there a SOC monitoring this segment. -- **Recommendation**: Add security_posture.py that passively identifies: EDR update traffic (CrowdStrike, SentinelOne, Defender ATP beacon patterns), SIEM log collectors (Wazuh, Splunk forwarder traffic), WIDS/WIPS probe patterns, honeypot signatures, and NAC infrastructure. Map to a risk score that gates active module activation. - -### NM-07: Credential Cracking Pipeline -- **Priority**: HIGH -- **Source**: Agent 4, Agent 5 -- **Description**: The design captures NTLMv2, Kerberos TGS/AS-REP, and HTTP digest hashes but has no cracking pipeline. On Pi 4, hashcat CPU mode runs ~50K H/s for NTLMv2 — enough to crack weak passwords from rockyou in hours. Every hour a hash sits uncracked is lost access opportunity. No wordlists are pre-staged. -- **Recommendation**: Pre-bundle rockyou.txt.gz and OneRuleToRuleThemAll in /opt/tools/wordlists/. Auto-queue captured hashes for CPU-mode john/hashcat with a low-priority cgroup. Push hashes immediately to operator's cracking rig via data_exfil for GPU cracking. - -### NM-08: Triage Command (`bigbrother.py triage`) -- **Priority**: HIGH -- **Source**: Agent 5 -- **Description**: After 24-48 hours unsupervised, the operator needs a single "what changed since I last checked" view. The current CLI has status (health), creds (dump), and intel (report) but no delta view. The event bus already generates timestamped events for all discoveries. -- **Recommendation**: Add `bigbrother.py triage [--since Nh]` that queries all event types since the given time: new credentials, new hosts, anomalies, module errors, storage status. One-screen prioritized delta report. - -### NM-09: Operator Audit Trail -- **Priority**: MEDIUM -- **Source**: Agent 1 -- **Description**: No record of what the operator does when SSHed in. Manual tool execution (nmap, certipy, impacket) is untracked. For authorized engagements, this audit trail is essential for deconfliction, timeline accuracy, and evidence integrity. -- **Recommendation**: Add operator_audit.py that logs SSH sessions, shell commands (via PROMPT_COMMAND), and CLI invocations to a separate audit log inside the LUKS container. - ---- - -## Design Changes Required - -### DC-01: Tiered PCAP Storage Strategy -- **Priority**: CRITICAL -- **Source**: Agent 1, Agent 5, Agent 6 -- **Description**: A 100Mbps link generates ~45GB/hour at full snap. Even at 96-byte snap, a busy link fills 32GB in hours. The current 100MB rotation + 80% disk purge means the operator returns to find all historical PCAPs deleted. No smart retention differentiates high-value from bulk traffic. -- **Recommendation**: Default to headers-only BPF (snap=96) on all tiers, not just Pi Zero. Add a credential-protocol full-capture ring buffer (NTLM, Kerberos, HTTP auth ports only). Full PCAP is operator-opt-in for targeted sessions. Nightly rsync of filtered PCAPs to operator infrastructure. - -### DC-02: Multiprocess Architecture with Capture Bus -- **Priority**: CRITICAL -- **Source**: Agent 6 -- **Description**: 18+ passive modules competing for the same promiscuous socket causes packet duplication, race conditions, and increased memory. A single scapy crash in any module kills the entire process (thread-per-module in one Python process). -- **Recommendation**: Implement a capture_bus.py: one privileged AF_PACKET capture process, packets dispatched to per-module queues via shared memory or named pipes. Each module runs as a separate process. A crash in credential_sniffer doesn't take down dns_logger. - -### DC-03: Pi Zero 2W Memory Budget Correction -- **Priority**: CRITICAL -- **Source**: Agent 6 -- **Description**: The design shows 350MB used out of 512MB with ~50MB headroom. Real-world Python 3 with scapy+impacket+cryptography+rich runs 60-80MB for the interpreter alone (not the stated 25MB). Actual headroom is negative — OOM killer will fire within hours. -- **Recommendation**: Reduce Pi Zero passive modules to 4 core: packet_capture (96B snap), dns_logger, credential_sniffer, host_discovery. Disable tls_sni_extractor, os_fingerprint, traffic_analyzer on Pi Zero. Move them to Pi 4 tier only. - -### DC-04: LUKS Boot-Unlock and Config Protection -- **Priority**: CRITICAL -- **Source**: Agent 1, Agent 2 -- **Description**: Two problems: (1) LUKS passphrase stored nowhere — operator forgets = data loss on multi-week engagement. (2) Config files (bigbrother.yaml, modules.yaml) sit outside LUKS and contain Tailscale auth key, WireGuard private key, engagement name, and client name. LUKS kill switch destroys the container but these plaintext configs survive on the SD card. -- **Recommendation**: Move ALL config files containing operator/client identifiers inside the LUKS container. For boot unlock: derive a key from network-fetchable component (C2 server) + device-specific component (CPU serial), so the device auto-unlocks only when it has C2 connectivity. - -### DC-05: SQLite Write Contention Fix -- **Priority**: HIGH -- **Source**: Agent 6 -- **Description**: SQLite WAL mode serializes writes. With 18 modules publishing events, credential findings, DNS records, and host discoveries concurrently, write contention causes 1-5 second delays and potential SQLITE_BUSY data loss. Multiple database files multiply the problem. -- **Recommendation**: Single SQLite database with schema-separated tables. Batch event writes through a dedicated writer thread with a 500ms coalesce window. Move WAL files to tmpfs with periodic checkpoint to SD card (accept up to 30 minutes data loss on power failure). - -### DC-06: Bridge Link-Loss Failsafe -- **Priority**: HIGH -- **Source**: Agent 1, Agent 5 -- **Description**: If the bridge crashes, OOM-kills, or USB ethernet disconnects (vibration, power glitch), the connected host loses all network connectivity. IT investigates the port immediately. The design mentions "fall back to passive tap" but the host is still down. -- **Recommendation**: Implement a dead-man timer: a lightweight C watchdog (not Python) that checks bridge forwarding every 5 seconds. If bridge is down for >10 seconds, configure the interfaces for direct passthrough (bypass the bridge, become a transparent cable). Hardware bypass relays are ideal if budget allows. - -### DC-07: ARP Spoof Crash Recovery -- **Priority**: HIGH -- **Source**: Agent 1, Agent 2, Agent 3, Agent 5 -- **Description**: If the implant crashes while ARP spoofing, all spoofed targets lose gateway connectivity until ARP cache timeout (1-5 minutes). Modern EDR (CrowdStrike, SentinelOne, Defender ATP) already alerts on ARP anomalies within minutes even when spoofing is working correctly. -- **Recommendation**: Implement kernel-level ARP restoration (cron job every 30s checks arp_spoof PID, sends gratuitous ARP corrections if dead). Document that ARP spoof against EDR-protected endpoints will trigger alerts — recommend Responder+ipv6_slaac as primary credential capture instead. - -### DC-08: 802.1X Full Bypass Implementation -- **Priority**: HIGH -- **Source**: Agent 5 -- **Description**: 802.1X enforcement is present in ~40% of enterprise environments. EAPOL passthrough alone is insufficient — switch may detect topology change, MAB lists may reject, re-auth timers cause delayed failure. The full silentbridge technique (bidirectional MAC clone) is needed but underspecified. -- **Recommendation**: Document and implement the full silentbridge/marvin attack: clone victim MAC on external interface, pass all EAP frames bidirectionally, implant's own traffic uses cloned MAC. Document WiFi-only fallback when wired 802.1X blocks deployment. - -### DC-09: Scope Enforcement Layer (Optional) -- **Priority**: HIGH -- **Source**: Agent 1 -- **Description**: "Scope is the operator's responsibility" is a valid philosophy but creates risk on multi-day engagements with unattended active modules. ARP spoofing an entire subnet or DHCP spoofing all requests can hit out-of-scope hosts. -- **Recommendation**: Add optional scope.yaml with in-scope IP ranges/hostnames/domains. When loaded, active modules validate targets before acting. ARP spoof validates each target, DHCP spoof only responds to in-scope MACs. - -### DC-10: Engagement Phase Separation -- **Priority**: HIGH -- **Source**: Agent 3 -- **Description**: The highest-confidence SOC detection is temporal correlation: new device appears + active attacks begin within hours = obvious implant. Passive phase should run for minimum 1-2 weeks before any active module activates, letting the device age into the network baseline. -- **Recommendation**: Add an explicit engagement_phase config: PASSIVE_ONLY for first N days (configurable), then ACTIVE_ALLOWED. Active modules refuse to start during passive-only phase. Document this as core OPSEC doctrine. - ---- - -## Infrastructure / Reliability Fixes - -### IR-01: Thermal Monitoring and Throttle Response -- **Priority**: HIGH -- **Source**: Agent 5, Agent 6 -- **Description**: Pi Zero 2W throttles at 60C, hits 55-65C in enclosed deployments under sustained capture load. Pi 4 in server rooms can also thermal throttle. No temperature monitoring exists in the design. -- **Recommendation**: Read /sys/class/thermal/thermal_zone0/temp every 30s in resource_monitor. Emit RESOURCE_WARNING at 55C. At 65C, shed non-essential modules. Document minimum airflow requirements and consider thermal pad adhesion to enclosure. - -### IR-02: SD Card Write Endurance -- **Priority**: HIGH -- **Source**: Agent 6 -- **Description**: LUKS-encrypted writes to SD card for every PCAP rotation, SQLite WAL commit, and DNS log flush will wear the flash. Industrial endurance cards (30K P/E cycles) at continuous write degrade within weeks. I/O stalls of 10-30 seconds observed under sustained LUKS writes cause module crashes. -- **Recommendation**: Use tmpfs for SQLite WAL files. Buffer PCAP writes through tmpfs with async flush. Set WAL checkpoint interval to 30 minutes. Accept up to 30 minutes of data loss on power failure as acceptable trade-off for SD longevity. - -### IR-03: Setup Script Reliability -- **Priority**: HIGH -- **Source**: Agent 6 -- **Description**: setup.sh installs 30+ packages and 8 tools from GitHub without version pinning. On ARM Debian bookworm: masscan requires manual build, GitHub API rate limits fail pip/git installs, tool versions may break compatibility. Idempotency claims fail (git clone errors if directory exists). -- **Recommendation**: Pre-bundle all tool binaries in a companion tarball with SHA256 checksums. Pin all pip versions. Add guard conditions for every non-idempotent operation. Add --reinstall flag for force-refresh. - -### IR-04: Wireless Interface Conflict Detection -- **Priority**: MEDIUM -- **Source**: Agent 6 -- **Description**: wireless_intel requires monitor mode on wlan0; wifi_client requires managed mode on the same interface. On Pi Zero 2W with one onboard WiFi, these modules are mutually exclusive but the design doesn't detect the conflict. -- **Recommendation**: Add interface conflict detection to engine.py. Before starting a module, check if the interface is in a conflicting mode. Require explicit second USB WiFi adapter for concurrent monitor+client. - -### IR-05: USB Power Budget Documentation -- **Priority**: MEDIUM -- **Source**: Agent 6 -- **Description**: Pi Zero 2W + USB Ethernet + USB WiFi draws 1.9-4.7W total. USB 2.0 hubs provide only 2.5W per port. Underpowered deployments cause USB resets, disconnecting the bridge ethernet adapter mid-operation. -- **Recommendation**: Document minimum 5V/3A dedicated supply. Add power source check in selftest. Warn if running from USB hub or laptop port. - -### IR-06: Schema Migration Path -- **Priority**: LOW -- **Source**: Agent 6 -- **Description**: No database schema versioning. A mid-engagement BigBrother update with schema changes corrupts the credential database and loses all collected data. -- **Recommendation**: Add schema_version integer in metadata table. Compare on startup, run migration scripts if needed. Use ALTER TABLE ADD COLUMN for backwards-compatible changes. - ---- - -## Pre-installed Tool Gaps - -### TG-01: Coercion Tools (PetitPotam, Coercer, SpoolSample) -- **Priority**: CRITICAL -- **Source**: Agent 1, Agent 5 -- **Description**: ntlm_relay waits passively for organic authentication without coercion tools. PetitPotam (MS-EFSRPC), PrinterBug/SpoolSample, and DFSCoerce force machine account authentication to the implant for relay attacks. Without them, the NTLM relay to ADCS ESC8 chain (the engagement-ender) requires luck. -- **Recommendation**: Install Coercer (pip, wraps all methods) and PetitPotam.py (standalone) unconditionally in setup.sh. - -### TG-02: Wordlists and Rule Files -- **Priority**: HIGH -- **Source**: Agent 5 -- **Description**: No wordlists pre-staged. Operator can't download them on target network. CPU-mode hashcat/john needs good wordlists to crack NTLMv2 from Responder within the engagement window. -- **Recommendation**: Pre-bundle rockyou.txt.gz, SecLists top-1M passwords, and OneRuleToRuleThemAll + dive rule files in /opt/tools/wordlists/. - -### TG-03: ldapdomaindump / LDAPDomainDump -- **Priority**: HIGH -- **Source**: Agent 5 -- **Description**: Fast AD enumeration without BloodHound collection cycles. Critical for quick domain recon after first credential capture. -- **Recommendation**: Add to setup.sh pip install. - -### TG-04: smbmap -- **Priority**: MEDIUM -- **Source**: Agent 5 -- **Description**: Quick share enumeration, more reliable than NetExec for single-target share listings. -- **Recommendation**: Add to setup.sh pip install. - -### TG-05: ROADtools (Azure/Entra Recon) -- **Priority**: MEDIUM -- **Source**: Agent 5 -- **Description**: Azure/Entra recon for cloud-hybrid environments. Virtually every enterprise target in 2026 has O365/Azure AD. -- **Recommendation**: Add roadtools to setup.sh pip install for Pi 4 and Debian host tiers. - ---- - -## OPSEC Warnings - -These are detection risks operators MUST understand before deployment. - -### OW-01: ARP Spoofing Is the Most-Detected Active Technique -- **Priority**: CRITICAL -- **Source**: Agent 2, Agent 3, Agent 5 -- **Description**: DAI on managed switches silently prevents it. EDR agents (CrowdStrike, SentinelOne, Defender ATP) alert on ARP cache anomalies within minutes. ARPwatch and Wazuh agents generate immediate alerts. Even with rate-limiting and jitter, ARP spoof against protected endpoints is detected. -- **Action**: Use Responder+ipv6_slaac as primary credential capture. Reserve ARP spoof for confirmed legacy segments with no DAI/EDR. Add DAI probe to ids_tester before activation. - -### OW-02: Responder Poisoning Has Mature Detection Coverage -- **Priority**: CRITICAL -- **Source**: Agent 2, Agent 3, Agent 5 -- **Description**: Microsoft Defender for Identity has dedicated LLMNR/NBT-NS poisoning alerts. Suricata ET POLICY rules match poisoning responses. CrowdStrike/SentinelOne alert on NTLM auth to unexpected destinations. Honeypot LLMNR names are deployed by advanced SOCs. -- **Action**: Implement selective targeting: only respond to hostnames never seen in legitimate DNS. Add MDI-aware timing (avoid responses during known SOC shift changes). Document as high-risk active module. - -### OW-03: Evil Twin / Rogue AP — Instant WIDS Detection -- **Priority**: CRITICAL -- **Source**: Agent 2, Agent 3 -- **Description**: Enterprise WIDS (Cisco, Aruba, Meraki) alerts immediately on any AP advertising a corporate SSID from an unknown BSSID. This is structural — no evasion is possible. Deauth floods are separately detected. 802.11w (protected management frames) prevents deauth entirely. -- **Action**: Evil twin is only viable in environments confirmed to have no WIDS. Add WIDS detection check (2-hour observation) to wireless_intel before allowing evil_twin activation. - -### OW-04: Tailscale Control Plane Is Fingerprinted -- **Priority**: HIGH -- **Source**: Agent 2, Agent 3 -- **Description**: Tailscale connects to login.tailscale.com and known DERP relay IPs. Corporate proxy logs, Zeek, or NGFW will flag connections to Tailscale infrastructure from a device that has never used it before. The IP ranges and hostnames are publicly documented. -- **Action**: If target network has no existing Tailscale traffic (check during baseline), prefer WireGuard to a self-hosted endpoint or reverse SSH over stunnel. Traffic_mimicry cannot fix a fundamentally new destination. - -### OW-05: SSH on Port 443 Is Protocol Mismatch -- **Priority**: HIGH -- **Source**: Agent 2 -- **Description**: Reverse SSH tunnel on TCP/443 responds with SSH banner instead of TLS ServerHello. Any stateful NGFW or IDS running DPI immediately flags this. Suricata rule: `content:"SSH-"; port 443`. -- **Action**: Default to SSH-over-WebSocket or SSH tunneled inside TLS (stunnel/ncat --ssl) so TCP/443 carries a real TLS handshake. Never raw SSH on 443. - -### OW-06: Raspberry Pi Hardware Fingerprint -- **Priority**: HIGH -- **Source**: Agent 2 -- **Description**: Even with MAC randomization, Pi is fingerprinted through DHCP Option 60 (vendor class "dhcpcd-..."), hostname patterns, TCP stack (nmap OS fingerprint), and TTL values. NAC platforms and Forescout specifically profile device types. -- **Action**: setup.sh must set DHCP vendor class to match the cloned MAC's vendor (e.g., "MSFT 5.0"). Hostname set before first DHCP request. TCP stack tuning in anti_forensics to match target OS profile. - -### OW-07: mitmproxy CA Certificate Is a Persistent IOC -- **Priority**: HIGH -- **Source**: Agent 2, Agent 3 -- **Description**: The default mitmproxy CA has CN "mitmproxy". Even with custom CN, the CA certificate installed on endpoints or visible in browser certificate errors is attributable forensic evidence that survives the engagement. -- **Action**: Override CA CN to match target's existing PKI naming convention. Document that mitmproxy is only practical against internal apps with no cert pinning where operator can pre-install CA via GPO. - -### OW-08: Physical Detection Vectors -- **Priority**: HIGH -- **Source**: Agent 2 -- **Description**: Extra ethernet cable/USB adapter in a cable run, continuous 0.5-3W power draw on a USB port, thermal signature in confined spaces, and LED activity are all detectable by facilities staff, IT, or security-aware employees. -- **Action**: Use purpose-built enclosure matching physical environment. Disable all LEDs. MAC spoofing in pre-init before first frame. Consider PoE splitter for power (blends with existing cable plant). - -### OW-09: SIEM Temporal Correlation Risk -- **Priority**: HIGH -- **Source**: Agent 3 -- **Description**: The highest-confidence SOC detection: new device appears on network + active attacks begin within hours = obvious implant. New MAC → ARP anomalies → NTLM relay → domain compromise is a clear attack chain in SIEM correlation. -- **Action**: Enforce passive-only phase of 1-2 weeks minimum before activating any active module. Let the device age into the network baseline before going active. - -### OW-10: BLE Emergency Access Is Discoverable -- **Priority**: MEDIUM -- **Source**: Agent 2 -- **Description**: ble_emergency.py runs an always-on BLE GATT server. BLE advertisements are detectable by any device within 30m scanning on channels 37/38/39. -- **Action**: Disable BLE by default. Enable only on-demand (dead man's switch or SMS trigger over cellular). Use random rotating BLE address and service UUIDs. - ---- - -## Accepted Limitations - -These are inherent constraints that cannot be fully mitigated. - -### AL-01: Encrypted Traffic Dominance (~85-95%) -- **Source**: Agent 1, Agent 5 -- Modern corporate networks are 85-95% encrypted. Cleartext credential sniffer, email sniffer, and HTTP logger yield near-zero in passive mode. SMB3 encryption is default on Server 2022. SMTP is universally STARTTLS. Accept that passive value is primarily metadata: DNS, TLS SNI, Kerberos wire capture, and flow analysis. Kerberos from wire is the single highest-value passive capability. - -### AL-02: Encrypted Client Hello (ECH) -- **Source**: Agent 1, Agent 5 -- ECH (deployed by Cloudflare, Google, Firefox) encrypts the real SNI. Passive SNI extraction returns the CDN's dummy value. No passive mitigation exists. In active mode, blocking DoH endpoints forces DNS fallback, but ECH cannot be defeated without full TLS interception. - -### AL-03: DNS-over-HTTPS Blindspot -- **Source**: Agent 1, Agent 5 -- DoH to hardcoded resolvers (1.1.1.1, 8.8.8.8) bypasses dns_logger entirely. 30-70% of endpoint DNS queries may be encrypted. Internal AD DNS queries to domain controllers remain visible on UDP/53. The gap is external destination visibility, not internal AD reconnaissance. - -### AL-04: TLS 1.3 Certificate Visibility -- **Source**: Agent 1 -- TLS 1.3 encrypts server certificates during handshake. Passive certificate extraction is impossible. Rely on SNI (while available) and Certificate Transparency logs for cert intelligence. - -### AL-05: SMB3 Encryption -- **Source**: Agent 1 -- Windows Server 2022 and Windows 11 default to SMB 3.1.1 with AES encryption. SMB monitoring captures negotiate/session setup (revealing capabilities and NTLM) but encrypted payload is opaque. File access monitoring requires active MITM position with SMB downgrade. - -### AL-06: Process Disguise vs Forensic Analysis -- **Source**: Agent 2, Agent 3, Agent 5 -- Process name spoofing defeats `ps aux` but not: /proc/PID/exe (shows real Python binary), strace/ptrace by EDR, systemd-analyze, high CPU/RAM usage inspection. Primary protection must be physical inaccessibility (Pi in cable run) or LKM rootkit (compromised host), not process disguise alone. - -### AL-07: Bridge Physical Failure = Network Outage -- **Source**: Agent 1, Agent 5 -- An inline bridge is a single point of failure. Hardware bypass relays mitigate but don't eliminate risk. Accept that bridge failure will be noticed. The dead-man watchdog (DC-06) minimizes outage duration to <15 seconds. - ---- - -*91 raw findings from 6 agents consolidated to 45 actionable items. 9 duplicates merged across agents. 6 severity adjustments applied (Agent 2/3 OPSEC findings rated at face value as they represent real detection risk; Agent 5 field experience ratings preserved).*