1eb35c9050
Fix #211 : Remove tool identity strings from deployed artifacts
...
- Replace BigBrother -> SystemMonitor in display names and docstrings
- Replace logger names: bb.* -> sensor.*
- Replace process names: bb-* -> sensor-*
- Replace home directory: ~/.bigbrother -> ~/.implant
- Replace LUKS device: /dev/mapper/bb-* -> /dev/mapper/sensor-*
- Updated 76 Python files across all modules
- Improves OPSEC by removing obvious tool fingerprints from logs and runtime
2026-04-06 11:39:48 -04:00
ae4933044b
Fix #209 : Prevent SSH MITM in data_exfil.py exfiltration
...
- Replace StrictHostKeyChecking=no with accept-new (verify on first connect)
- Require ssh_known_hosts_file config key pointing to operator's known_hosts
- Validate known_hosts file exists before attempting transfer
- Fail explicitly if known_hosts not configured (prevents silent MITM vulnerability)
- Uses -o UserKnownHostsFile=path to use pinned host keys
2026-04-06 11:39:11 -04:00
e9735a15bb
Fix #208 : Prevent SSTI in responder_mgr.py Jinja2 template
...
- Use jinja2.Environment with BaseLoader instead of Template
- Enable autoescape=True to escape all template variables
- Sanitize relay_targets by converting to strings: [str(ip) for ip in ...]
- Prevents template injection even if relay_targets contains malicious content
2026-04-06 11:38:59 -04:00
6ae10fd2f3
Fix #207 : Prevent command injection in bettercap_api.py
...
- set_parameter() now validates param name with regex (alphanumeric, dots, underscores)
- set_parameter() quotes value with repr() to prevent argument injection
- load_caplet() validates path exists, is absolute, and ends with .cap/.caplet
- load_caplet() quotes caplet path for safe interpolation into bettercap command
2026-04-06 11:38:37 -04:00
156144c1a7
Fix indentation issues in passive modules requires_capture_bus attribute
...
- Removed misplaced requires_capture_bus entries that broke indentation
- Added requires_capture_bus = True correctly after requires_root in all passive modules
- All passive modules now have valid Python syntax
2026-04-06 11:37:43 -04:00
8dd053e337
Fix #204 : Instantiate and inject CaptureBus in Engine
...
- Engine.__init__ now initializes self.capture_bus = None
- Engine.start_all() instantiates CaptureBus before starting modules
- CaptureBus uses resolved interface from config
- Inject capture_bus into configs of all modules with requires_capture_bus=True
- Engine.stop_all() properly stops CaptureBus after stopping modules
- CaptureBus instantiation includes error handling with fallback
2026-04-06 11:37:15 -04:00
04eae3a43e
Add requires_capture_bus attribute to BaseModule and passive modules
...
- BaseModule now has requires_capture_bus = False default
- All 17 passive modules set requires_capture_bus = True
- bigbrother.py imports CaptureBus from core.capture_bus
- Ready for Engine to instantiate and inject CaptureBus
2026-04-06 11:36:24 -04:00
59cdda0596
Fix #206 : Resolve auto interface to actual interface name
...
- Engine.__init__ now detects actual interface when config has 'auto'
- Uses get_primary_interface() to find default route interface
- PacketCapture module updated to use detected interface with fallback
- Handles Pi Zero 2W (wlan0) and other non-eth0 systems
2026-04-06 11:35:52 -04:00
841d43a3b3
Document operator dispositions from post-review session
...
LUKS complexity deferred — operator uses disposable cloud VPS/Matrix infra
so on-device encryption provides diminishing returns. Captured device
exposes only target data + dead-end relay credentials.
autossh removal reclassified from detection risk to design violation —
persistent outbound tunnel contradicts passive/dormant architecture.
NOT-FIXING: Matrix homeserver default (opt-in only), creds in /dev/shm
(victim data by design), WireGuard key path (dead-end VPS mitigates).
2026-04-06 11:33:00 -04:00
eef574f0ca
Fix duplicate IR-014 entry and deduplication error in consolidated report
...
Removed spurious second IR-014 (Verbose Module Startup Logging) which did not exist in any agent output.
This finding was causing confusion between the deployment blocker IR-014 (missing get_hardware_tier() import, CRITICAL)
and the false entry. Corrects triage table consistency and ensures all findings are grounded in actual agent analysis.
2026-04-06 09:51:09 -04:00
054dc45cd5
Document comprehensive fix plan for daemon initialization failures
2026-04-06 09:15:40 -04:00
516b7908a6
Add absent_count column and commented-out grace period threshold for tripwire resets
2026-04-06 08:52:30 -04:00
0156101f11
Rewrite net_alerter with presence tracking: baseline on first run, alert on join and rejoin
2026-04-06 08:47:48 -04:00
532f5f4a33
Fix net_alerter: don't treat 403 as token expiry — room permission errors were silently dropping all alerts
2026-04-06 08:27:42 -04:00
75703d7ef6
Auto-refresh Matrix token on 401 instead of silently dropping alerts
2026-03-25 09:33:15 -04:00
59cfb6b07a
Use sudo nmap to allow ARP scan with restricted sudoers
2026-03-25 06:28:48 -04:00
12f8a37dc4
Use dedicated net-alerter Matrix service account, keep credentials out of repo
2026-03-25 06:20:37 -04:00
94abb6f2ce
Fix deploy.sh to use SSH config alias instead of raw key/host
2026-03-25 06:05:32 -04:00
d7cdd489ce
Add net_alerter: new device join alerts via Matrix to condo Pi
2026-03-24 20:29:24 -04:00
06160b974a
Add TimeoutStartSec=60 to core service to allow time for PID file write after module init
2026-03-23 10:30:34 -04:00
e0b8ba4b65
Fix bigbrother-core.service: Type=forking + PIDFile for daemon mode
2026-03-23 07:46:32 -04:00
1433c422ec
Set ZSTD_LEVEL=3 on capture service for Pi 3B CPU headroom
2026-03-22 20:32:41 -04:00
263e5a50d0
Add pi3b hardware tier and resource guards for condo Pi deployment
...
- Add pi3b tier (700MB RAM limit, 8 passive/2 active modules, no bettercap/mitmproxy)
- Update detect_hardware_tier() to detect Raspberry Pi 3B by model string and BCM2837
- Add pi3b section to hardware_tiers.yaml
- Add systemd MemoryMax/CPUQuota/OOMScoreAdj to all three service files
- Fix bigbrother-watchdog.service ExecStart (was calling non-existent ResourceMonitor().run())
- Add scripts/run_watchdog.py as standalone health monitor daemon
2026-03-22 20:19:57 -04:00
a0164c0275
Fix aircrack-ng detection to use apt-cache policy instead of apt-cache show
...
apt-cache show returns true even when Candidate is (none). Use
apt-cache policy and grep for a real version string to correctly
skip aircrack-ng on Ubuntu arm64 where it has no install candidate.
2026-03-22 17:34:52 -04:00
054c044546
Fix aircrack-ng apt install failure on Ubuntu arm64
...
Make aircrack-ng a conditional package install (same pattern as
proxychains/sshuttle) so setup.sh doesn't abort on distros where
the package has no install candidate.
2026-03-22 17:33:21 -04:00
65f1fe8049
Add sd_wifi.py -- operator tool for updating WiFi config on SD cards
...
Interactive and non-interactive CLI to detect, mount, and edit the
netplan 20-wifi.yaml on an armbi_root-labelled SD card without
needing to boot the implant.
2026-03-21 19:35:19 -04:00
187012e845
Add autostart.sh -- systemd service lifecycle management script
...
Enables/disables/reports status for bigbrother-core, bigbrother-capture,
and bigbrother-watchdog. Supports enable (enable+start), disable (stop+disable),
and status commands. Works locally on-device and over SSH from operator machine.
2026-03-21 19:34:14 -04:00
56cca8ac3d
Phase 5: Final integration — fix imports, full module discovery, interactive menu
...
- Fix pyserial import error in cellular_backup.py (lazy import with fallback)
- Replace stealth-only module discovery with discover_all_modules() across all
5 categories (stealth, passive, active, intel, connectivity)
- Wire up interactive menu options 5-8:
- View Credentials: query credential_db SQLite, Rich table with stats
- View Intelligence: host count, cred stats, security posture summary
- Network Topology: host table from topology_mapper state data
- Timeline: recent entries from operator_audit HMAC-chained log
- Update start command to discover+register all enabled modules (not just stealth)
- Update modules/activate/selftest commands to use full module discovery
- Add is_module_enabled() config-aware helper for per-category defaults
- Fix modules.yaml module count headers (16->17 passive, 8->9 active/intel)
- Set bettercap_mgr enabled=false (all active modules disabled by default)
- Add tests/test_all_modules.py: 179 parametrized tests covering import,
BaseModule subclass, attributes, and instantiation for all 55 modules
across passive, active, intel, and connectivity categories
- All 256 tests passing
2026-03-18 13:59:27 -04:00
ba5143b560
Phase 4: Active modules, templates, and operator scripts
...
Active modules (9 files in modules/active/):
- bettercap_mgr: Central bettercap orchestrator with REST API health
monitoring, event stream parsing, crash recovery with corrective
gratuitous ARPs, caplet management, and process disguise
- arp_spoof: Thin bettercap wrapper for ARP spoofing with OPSEC warnings
- dns_poison: DNS poisoning with zone template loading support
- dhcp_spoof: DHCPv6 spoofing via bettercap for rogue DNS injection
- evil_twin: hostapd-based rogue AP with captive portal and dnsmasq,
iptables redirect, credential capture via HTTP POST handler
- ipv6_slaac: IPv6 SLAAC spoofing via bettercap + mitm6 WPAD abuse
- responder_mgr: Responder subprocess manager with hash file monitoring,
NTLMv1/v2 parsing, session log scanning, relay target coordination
- mitmproxy_mgr: Transparent proxy with addon scripts, tier checking
(OPi Zero 3+ only), iptables setup, credential/token extraction
- ntlm_relay: ntlmrelayx wrapper with multi-protocol relay (SMB, LDAP,
LDAPS, HTTP, MSSQL, ADCS), Responder exclusion coordination, SOCKS
Templates (9 files):
- 4 captive portals: corporate SSO, guest WiFi, Outlook/M365, VPN
(self-contained HTML with inline CSS, realistic login forms)
- 2 DNS zones: redirect-all and selective Jinja2 template
- 2 hostapd configs: open AP and WPA2-PSK Jinja2 templates
- 1 Responder.conf Jinja2 template with protocol toggles
Operator scripts (6 files in scripts/operator/):
- pull_data.sh: rsync structured data over WireGuard/Tailscale
- extract_files.sh: tshark HTTP/SMB/FTP/TFTP file extraction
- extract_print_jobs.sh: TCP/9100 print job reconstruction + PDF convert
- extract_emails.sh: SMTP email extraction with attachment detection
- crack_hashes.sh: Export creds to hashcat format, optional auto-crack
- generate_report.py: SQLite-to-Markdown/HTML engagement report generator
2026-03-18 13:48:11 -04:00
955ebfc8db
Add Phase 3 connectivity modules — 8 modules + bridge scripts
...
WireGuard (primary C2, PersistentKeepalive=0 for zero idle traffic),
Tailscale (fallback mesh VPN), Bridge (transparent inline L2 bridge with
802.1X bypass and ebtables protocol suppression), WiFiClient (WPA2-PSK
and WPA2-Enterprise via wpa_supplicant), ReverseTunnel (autossh over
stunnel/websocket — never raw SSH on 443), CellularBackup (LTE modem
via AT commands/mmcli, OPi Zero 3+ only), BLEEmergency (GATT server
with PSK auth for local last-resort access), DataExfil (priority-based
exfil with IMMEDIATE/NIGHTLY/ON_DEMAND tiers through connectivity chain).
Bridge scripts: setup_bridge.sh (create br0, disable STP, suppress
CDP/LLDP/BPDU via ebtables) and teardown_bridge.sh (safe cleanup).
2026-03-18 13:43:04 -04:00
176da06dc9
Add Phase 2 intel modules — 9 intelligence modules for on-device analysis
...
- credential_db: Central credential store with dedup, hashcat/CSV/JSON export, crack tracking
- topology_mapper: Network graph from HOST_DISCOVERED/VLAN_DETECTED events, Graphviz DOT/SVG output
- net_intel: Beacon detection (stddev/mean analysis), comm graph, DNS tunneling, service deps
- user_timeline: Per-user activity timelines, work hours, admin/service account identification
- supply_chain_detect: Passive detection of PyPI/npm mirrors, WSUS, CI/CD, SCCM, container registries
- change_detector: Continuous baseline diff for burn detection, scan/security tool alerts
- security_posture: EDR/SIEM/NAC/honeypot/scanner detection by DNS/port/UA, risk gating
- operator_audit: Append-only HMAC chain audit log for engagement deconfliction
- tool_output_parser: Unified parser for bettercap events, Responder logs, mitmproxy flows
2026-03-18 13:33:17 -04:00
ab27aa968b
Add 9 advanced passive modules: VLAN, network mapper, auth tracker, SMB, cloud tokens, LDAP, RDP, QUIC, DB interceptor
...
Phase 2 batch 2: protocol-specific passive modules for deep network
visibility. Each module subscribes to capture_bus, parses protocol
structures with struct (no scapy), buffers SQLite writes, and publishes
bus events for cross-module correlation.
- vlan_discovery: 802.1Q/DTP/CDP/LLDP/STP/EAPOL layer-2 parsing
- network_mapper: communication graph with role classification and DOT output
- auth_flow_tracker: Kerberos/NTLM/SSH/LDAP auth correlation per user
- smb_monitor: SMB2/3 tree connect, file access, GPP/SYSVOL detection
- cloud_token_harvester: regex scan cleartext HTTP for AWS/JWT/OAuth/SAML/GCP tokens
- ldap_harvester: BER/ASN.1 LDAP parsing for AD object inventory and LAPS detection
- rdp_monitor: RDP cookie + CredSSP NTLM extraction, admin workstation detection
- quic_analyzer: QUIC Initial packet parsing with RFC 9001 key derivation for SNI
- db_interceptor: MSSQL TDS, MySQL, PostgreSQL, Redis RESP, MongoDB OP_MSG parsing
2026-03-18 13:31:18 -04:00
1c85244e9c
Add 8 passive network observation modules (Phase 2)
...
- PacketCapture: tcpdump subprocess with zstd compression + AES-256-GCM encryption, disk auto-purge
- DNSLogger: DNS query/response parsing with DoH detection, batch SQLite writes
- TLSSNIExtractor: TLS ClientHello SNI extraction with TCP reassembly for fragments
- CredentialSniffer: FTP/HTTP Basic/form POST/SNMP/LDAP/NTLMv1v2 credential extraction
- KerberosHarvester: AS-REQ/AS-REP/TGS-REP parsing for hashcat modes 7500/18200/13100
- HostDiscovery: ARP/DHCP/mDNS/NetBIOS/SSDP/LLMNR passive host inventory with OUI lookup
- OSFingerprint: p0f-style TCP SYN analysis + HTTP UA/SSH banner/SMB dialect fingerprinting
- TrafficAnalyzer: flow tracking, protocol distribution, top talkers, beacon detection
All modules extend BaseModule, use capture_bus subscription, struct-based parsing
(no scapy), batch SQLite writes, and publish bus events.
2026-03-18 13:30:39 -04:00
3394c72814
Add main CLI entry point and full test suite
...
- bigbrother.py: Click CLI with start/stop/status/activate/deactivate/
kill/config/selftest/modules commands plus Rich interactive menu.
Module discovery scans modules/stealth/ for BaseModule subclasses.
Supports --daemon mode with PID file and --passive-only flag.
- tests/conftest.py: Shared fixtures (tmp_dir, mock_config, mock_bus,
mock_state, hardware_tier_override, project_root)
- tests/test_bus.py: 6 tests for EventBus pub/sub, filtering, wildcards
- tests/test_engine.py: 5 tests for Engine lifecycle, deps, tier, phase
- tests/test_crypto.py: 5 tests for AES-256-GCM, file encryption, KDF
- tests/test_resource.py: 7 tests for hardware detection, memory, disk
- tests/test_tool_manager.py: 6 tests for subprocess management
- tests/test_stealth_modules.py: 4 parametrized test classes covering
all 12 stealth modules (import, inheritance, attributes, instantiation)
2026-03-18 09:48:23 -04:00
6caf1a15ca
Add Phase 1 advanced stealth modules: anti-forensics, traffic mimicry, JA3 spoofing, IDS testing, LKM rootkit, overlayfs manager
...
6 Python modules extending BaseModule + LKM kernel module template:
- anti_forensics.py: timestomping, core dump disable, swap off, journal vacuum, history suppression, bettercap tmpfs home, secure deletion
- traffic_mimicry.py: two-phase baseline/shaping engine matching implant traffic to observed network patterns
- ja3_spoofer.py: TLS fingerprint spoofing with Chrome/Firefox/Edge profiles, iptables NFQUEUE interception, SSL context configuration
- ids_tester.py: on-demand Snort/Suricata rule assessment with risk levels, preflight validation, caplet analysis
- lkm_rootkit.py: kernel module lifecycle (build/load/unload) for process/file/connection hiding on generic Debian hosts
- overlayfs_manager.py: tmpfs-backed overlayfs with tier-aware size budgets for zero SD card write activity
- bb_hide.c: ftrace-based LKM hooking getdents64/tcp4_seq_show/udp4_seq_show with self-hiding from lsmod
- Makefile: standard out-of-tree kernel module build
2026-03-18 08:23:02 -04:00
d883b07e34
Add Phase 1 core stealth modules: MAC manager, process disguise, log suppression, encrypted storage, tmpfs manager, watchdog
...
6 stealth modules implementing the OPSEC layer:
- MacManager: innocuous MAC profiles from DB, DHCP hostname/vendor class spoofing, TCP stack tuning (TTL, window, timestamps)
- ProcessDisguise: rename processes to system service names via prctl, auto-disguise on MODULE_STARTED/TOOL_RESTARTED events
- LogSuppression: rsyslog filters, auditd exclusions, journald rate limits, shell history/utmp/wtmp clearing with clean removal on stop
- EncryptedStorage: LUKS2 container with HKDF network-derived key (CPU serial + C2 component), fallback key, auto-format and subdirectory creation
- TmpfsManager: tier-aware RAM-backed mounts for working dirs and WAL files, power loss = instant evidence destruction
- Watchdog: periodic health checks, auto-restart (max 3), OOM priority assignment by module type, bus event monitoring
2026-03-18 08:21:01 -04:00
f90a686626
Phase 1: setup script and data bootstrapping
...
- setup.sh: Idempotent bootstrap for OPi Zero 3 / RPi Zero 2W / Debian
Platform detection, system packages, Pi optimizations (gpu_mem, swap,
sysctl), directory structure, Python venv, bettercap binary install,
external tools (Responder, NetExec, Chisel, Ligolo, kerbrute, etc),
data database creation, systemd service install, permissions, verification.
Supports --reinstall, --jumpbox, --no-tools, --verify-only flags.
- scripts/build_data.py: Creates 5 SQLite databases
innocuous_macs.db (51 consumer device profiles with OUI/DHCP/TCP fingerprints),
oui.db (50 seed OUIs), os_sigs.db (16 p0f-style signatures),
dhcp_fingerprints.db (19 option-55 fingerprints), ja3_fingerprints.db (13 hashes)
- scripts/build_lkm.sh: LKM rootkit compiler wrapper
- scripts/rotate_pcap.sh: tcpdump post-rotation handler with zstd compression,
optional AES-256-GCM encryption, disk space monitoring, and auto-purge
2026-03-18 08:13:55 -04:00
0a05f009e8
Add Phase 1 core infrastructure: event bus, state manager, engine, capture bus, tool manager, scheduler, resource monitor, kill switch
...
Core framework (8 files in core/) + BaseModule ABC (2 files in modules/):
- bus.py: Multiprocess-safe pub/sub event bus using mp.Queue with background dispatcher thread, 20 canonical event types
- state.py: SQLite persistent state with WAL mode, dedicated writer thread with 500ms coalesce, module status + generic key-value store
- engine.py: Module lifecycle manager with multiprocess model, dependency resolution (topological sort), hardware tier detection (opi_zero3/pi_zero/generic), resource budgeting, scope enforcement, engagement phase gating
- capture_bus.py: Single AF_PACKET socket packet demux with per-module subscriber queues, BPF filter matching, drop-oldest backpressure
- tool_manager.py: Subprocess lifecycle for external tools (bettercap/tcpdump/Responder/mitmproxy/ntlmrelayx) with exponential backoff restart, /proc resource monitoring, process disguise via prctl, health check callbacks, graceful SIGTERM->SIGKILL shutdown
- scheduler.py: Cron-like task scheduler with jitter, thread pool execution, enable/disable/run_now controls
- resource_monitor.py: System + per-process RAM/CPU/disk/thermal monitoring, OOM kill lowest-priority module, thermal shedding at 70C
- kill_switch.py: 7-phase wipe sequence (stop procs, corrective ARP, LUKS destroy, shred keys, zero-fill, clear RAM, reboot), boot flag for interrupted wipe resume, dead man's switch
- modules/base.py: BaseModule ABC with start/stop/status/configure/health_check interface contract
2026-03-18 08:13:11 -04:00
62a1010ab4
Add Phase 1 utility modules: crypto, networking, logging, stealth, resource, permissions, config_loader, bettercap_api
...
9 files in utils/ providing the shared infrastructure layer:
- crypto: AES-256-GCM file encryption, argon2id/PBKDF2 key derivation, HKDF network unlock, LUKS container management
- networking: interface detection, MAC/IP helpers, BPF compilation via libpcap ctypes, gratuitous ARP, VLAN creation
- logging: encrypted log writer (BBLogger) with rotation, per-module files, stdout suppression for stealth
- stealth: process rename via prctl, cmdline spoofing, sysctl helpers, timestomping, core dump disable
- resource: hardware tier detection (OPi Zero 3 / Pi Zero / generic) via /proc/device-tree and cpuinfo, resource monitoring
- permissions: root/capability checks via capget ctypes, privilege dropping, directory permission enforcement
- config_loader: YAML merge hierarchy (hardware_tiers -> bigbrother -> modules -> stealth -> CLI), tier auto-detection, SIGHUP reload
- bettercap_api: REST client with per-session random credentials, session/events/command methods
2026-03-18 08:11:25 -04:00
63e317176d
Update hardware platform to Orange Pi Zero 3 (4GB) as primary implant
...
Replaces RPi 4 as main implant with OPi Zero 3 — 50x55mm footprint,
WiFi 5 + BT 5.0 built-in, 4GB RAM, $29. RPi Zero 2W retained as
jumpbox/beacon role. Updated all hardware tier tables, memory budgets,
OPSEC notes, and operational workflow.
2026-03-18 08:04:24 -04:00
5694fdc56c
WireGuard as primary C2 — zero traffic when idle, on-demand connect. Tailscale moves to fallback.
2026-03-17 16:03:21 -04:00
b6d9d7a738
Drop Suricata/RITA — Zeek is the offensive analysis tool, IDS is not our job
2026-03-17 15:32:12 -04:00
813e224b03
v4.0: Shadow SOC framing — Zeek/Suricata/RITA offline analysis, innocuous MAC profiles, operator workstation as SOC analysis brain
2026-03-17 15:28:15 -04:00
0a80f8bed8
v4.0 design rewrite: orchestrator architecture, operator workstation, innocuous MACs
...
Major rewrite of BIGBROTHER_DESIGN.md incorporating three architectural changes:
1. Orchestrator model: BigBrother wraps proven tools instead of reimplementing.
- bettercap replaces 5+ custom active modules (ARP/DNS/DHCP/HTTP/SSL)
- tcpdump replaces custom scapy packet capture
- 11 modules deleted (file_extractor, email_sniffer, print_interceptor,
voip_capture, protocol_analyzer, session_hijacker, http_logger,
ssl_downgrade, js_injector, cloud_token_active, report_generator)
- New: bettercap_mgr, tool_manager, tool_output_parser, bettercap_api
- Module count: 67 -> 60
2. Operator workstation section: offline analysis tools and pull scripts
for file carving, email/print reconstruction, GPU hash cracking, and
report generation from PCAPs and SQLite DBs.
3. Innocuous MAC database: curated consumer device profiles (Fire TV,
iPhone, Roku, etc.) with matching DHCP hostname, vendor class, TTL,
and TCP window size for complete device impersonation.
Deleted ARCHITECTURE_RETHINK.md (merged into design doc).
2026-03-17 12:35:47 -04:00
0a62b805f4
v4.0 architecture rethink: orchestrator model over custom reimplementation
...
6-agent security tribe evaluation of replacing 11 custom Python modules
with bettercap/tcpdump/tshark wrappers. Modules categorized as DELETE
(offline processing), WRAPPER (proven tool orchestration), or KEEP
(genuinely lightweight custom code). Revised file tree, resource impact
analysis, risk assessment, and on-device vs offline processing matrix.
2026-03-17 12:27:09 -04:00
0a40103fd5
Full PCAP on all tiers — no headers-only, no tiered retention. 128GB+ with zstd-19 handles it.
2026-03-17 12:09:22 -04:00
4a22eb566f
Rewrite operational workflow with detailed per-module output for dental office scenario
...
Complete rewrite showing exact expected output from every passive and active
module against a realistic small business dental office network. Includes
protocol-level explanations, realistic fake data, honest assessment of what
produces zero, and step-by-step DNS poisoning/ARP spoofing/Responder walkthroughs.
2026-03-17 12:04:04 -04:00
5ad9f41fba
Initial commit: BigBrother design doc and operational workflow
2026-03-17 11:48:47 -04:00
a4edcf6e15
v3.2: Merge security review into design doc as single source of truth
...
Integrate all findings from SECURITY_REVIEW.md inline into module specs:
- OPSEC warnings added to arp_spoof, responder_mgr, evil_twin, mitmproxy, tailscale, ble_emergency
- Accepted limitations noted in tls_sni_extractor (ECH, DoH, TLS 1.3), smb_monitor (SMB3), email_sniffer, credential_sniffer, process_disguise, bridge
- New modules: data_exfil.py (connectivity), wordlists in data/
- Design changes: tiered PCAP retention, ARP crash recovery, 802.1X full bypass, engagement phase gating, schema migration, setup reliability
- Hardware notes: USB power budget, Pi fingerprint mitigations, physical detection, SD write endurance
- Remove SECURITY_REVIEW.md and review_agent5_redteam.json
2026-03-17 11:11:25 -04:00
3041943c21
PCAP max compression: zstd -19 on rotation for storage and transfer efficiency
2026-03-17 11:01:19 -04:00
Cobra