ddb4c5d0a8
Expand p0f OS fingerprint signatures from 16 to 102 entries
...
Comprehensive p0f-style TCP SYN signatures covering Linux (kernel 2.0-6.x,
Android, Chrome OS, Alpine, containers), Windows (2000 through 11/Server
2022, XP, Embedded), macOS (Tiger through Sonoma), iOS/iPadOS/tvOS/watchOS,
BSDs (Free/Open/Net/DragonFly), Solaris/illumos, network devices (Cisco
IOS/NX-OS/IOS-XE, Juniper, MikroTik, Ubiquiti, pfSense, OPNsense,
Fortinet, Palo Alto, Aruba, F5, HP ProCurve, Arista), printers (HP,
Brother, Epson, Canon, Xerox, Ricoh, Kyocera, Lexmark, Zebra), embedded/
IoT (lwIP, uIP, VxWorks, QNX, Zephyr, ESP-IDF, FreeRTOS, Contiki-NG,
Windows IoT), gaming consoles, and virtualization guests.
DevTrack: bigbrother #419
2026-04-10 07:06:50 -04:00
05a3f7553b
Expand MAC profiles from 55 to 132 innocuous device profiles
...
Added profiles for: more streaming devices (Shield TV, Roku 4K),
additional smart TVs (Hisense, Insignia, Philips, Toshiba), more smart
speakers (Sonos Era, HomePod, Bose, Echo Pop/Studio), extensive IoT
devices (Arlo, Eufy, Chamberlain, Lutron, Lifx, Roborock, SmartThings,
August, Honeywell), more printers (Kyocera, Lexmark, Ricoh, Xerox),
additional gaming (Xbox Series S, Switch OLED, Steam Deck), more phones
(Pixel, OnePlus, Xiaomi), wearables (Apple Watch, Fitbit, Garmin,
Galaxy Watch), network gear (Linksys, ASUS, eero), and NAS devices
(Synology, QNAP). New device_type categories: wearable, network, nas.
DevTrack: bigbrother #417
2026-04-10 07:05:25 -04:00
2cb408af4f
Expand JA3 fingerprint database from 4 to 501 profiles
...
New seed_ja3.py generates comprehensive JA3 TLS fingerprint profiles
covering Chrome/Chromium (100-124 x 4 platforms), Firefox (100-125 x 3),
Edge, Safari (macOS + iOS), Opera, Brave, Tor Browser, Vivaldi, ChromeOS,
TLS libraries (OpenSSL, BoringSSL, GnuTLS, NSS, Go, Java, .NET, Node.js,
mbedTLS, wolfSSL, rustls), common tools (curl, wget, Python, httpx),
mobile clients (Samsung Internet, Android WebView, iOS WKWebView),
VPN clients (AnyConnect, GlobalProtect, OpenVPN, WARP), Electron apps,
and IoT/embedded devices (ESP32, AWS IoT, smart home).
JA3 hashes are computed correctly from TLS ClientHello parameters using
the standard MD5(version,ciphers,extensions,curves,formats) formula.
DevTrack: bigbrother #416
2026-04-10 07:02:56 -04:00
7070f6548c
Add reimage bootstrap: deploy.sh, setup_wifi.sh, fix setup.sh enable/reinstall, idempotent DB inserts
2026-04-07 13:20:15 -04:00
0f754cfb7f
Fix DB table/column mismatch and stale PID noise on startup
...
build_data.py created 'profiles' but mac_manager queries 'mac_profiles'.
Columns category/model renamed to device_type/device_name. device_type
values aligned with _CATEGORY_MAP in mac_manager (streaming, smart_tv,
phone, tablet, smart_speaker, iot, printer, gaming).
ja3_fingerprints.db table renamed from 'fingerprints' to 'ja3_profiles'
and expanded with all columns ja3_spoofer queries (name, description,
cipher_suites, extensions, elliptic_curves, ec_point_formats as JSON).
StateManager.reset_module_status() clears stale 'running' entries on
startup so watchdog doesn't flag old-session PIDs as dead modules.
Engine.start_all() calls reset before launch and does a 3s post-startup
liveness check, logging any modules that crashed immediately after fork.
2026-04-07 13:05:31 -04:00
1eb35c9050
Fix #211 : Remove tool identity strings from deployed artifacts
...
- Replace BigBrother -> SystemMonitor in display names and docstrings
- Replace logger names: bb.* -> sensor.*
- Replace process names: bb-* -> sensor-*
- Replace home directory: ~/.bigbrother -> ~/.implant
- Replace LUKS device: /dev/mapper/bb-* -> /dev/mapper/sensor-*
- Updated 76 Python files across all modules
- Improves OPSEC by removing obvious tool fingerprints from logs and runtime
2026-04-06 11:39:48 -04:00
f90a686626
Phase 1: setup script and data bootstrapping
...
- setup.sh: Idempotent bootstrap for OPi Zero 3 / RPi Zero 2W / Debian
Platform detection, system packages, Pi optimizations (gpu_mem, swap,
sysctl), directory structure, Python venv, bettercap binary install,
external tools (Responder, NetExec, Chisel, Ligolo, kerbrute, etc),
data database creation, systemd service install, permissions, verification.
Supports --reinstall, --jumpbox, --no-tools, --verify-only flags.
- scripts/build_data.py: Creates 5 SQLite databases
innocuous_macs.db (51 consumer device profiles with OUI/DHCP/TCP fingerprints),
oui.db (50 seed OUIs), os_sigs.db (16 p0f-style signatures),
dhcp_fingerprints.db (19 option-55 fingerprints), ja3_fingerprints.db (13 hashes)
- scripts/build_lkm.sh: LKM rootkit compiler wrapper
- scripts/rotate_pcap.sh: tcpdump post-rotation handler with zstd compression,
optional AES-256-GCM encryption, disk space monitoring, and auto-purge
2026-03-18 08:13:55 -04:00
n0mad1k