Three bugs causing all modules to exit within seconds of startup:
1. _module_runner had no keep-alive loop after calling module.start().
All modules use a thread-spawning pattern where start() returns
immediately, so the subprocess exited and killed all daemon threads.
Added while module._running: sleep(1) loop to block until stop().
2. Engine injected capture_bus under key 'capture_bus' but 9 modules
(auth_flow_tracker, cloud_token_harvester, ldap_harvester, network_mapper,
rdp_monitor, quic_analyzer, smb_monitor, db_interceptor, vlan_discovery)
look for '_capture_bus'. Inject both keys so all modules get it.
3. mac_manager crashes on startup when innocuous_macs.db exists but has
no mac_profiles table (DB not yet seeded). Added OperationalError
handler to fall back to random OUI instead of crashing.
- Add secure_wipe_file() to utils/crypto.py for file overwrites + deletion
- Add secure_wipe parameter to StateManager.stop() method
- Wipes all SQLite WAL files (.db, .db-wal, .db-shm) with 3 passes
- Normal exit now calls state.stop(secure_wipe=True) to clear state database
- Falls back to regular delete if secure wipe fails
- Prevents state.db from persisting on disk after shutdown
- Add encrypt_credential_dict() and decrypt_credential_field() to utils/crypto.py
- Create utils/credential_encryption.py with encryption/decryption helpers
- Add get_credential_encryption_key() to retrieve key from Infisical at runtime
- Add emit_credential_found() wrapper for modules to use instead of direct bus.emit()
- Update all 15 modules emitting CREDENTIAL_FOUND to use encrypted wrapper
- Update 4 modules consuming CREDENTIAL_FOUND to decrypt payload before processing
- Sensitive fields (username, password, hash, token, etc.) encrypted with AES-256-GCM
- Falls back to plaintext if encryption key unavailable or encryption fails
- Move crash_callback execution outside of self._lock
- Callback is called after releasing the monitor lock
- Re-acquire lock only for restart decision logic
- Prevents deadlock if callback tries to acquire same lock
- Maintains thread safety for restart and process state updates
- Replace StrictHostKeyChecking=no with accept-new (verify on first connect)
- Require ssh_known_hosts_file config key pointing to operator's known_hosts
- Validate known_hosts file exists before attempting transfer
- Fail explicitly if known_hosts not configured (prevents silent MITM vulnerability)
- Uses -o UserKnownHostsFile=path to use pinned host keys
- Use jinja2.Environment with BaseLoader instead of Template
- Enable autoescape=True to escape all template variables
- Sanitize relay_targets by converting to strings: [str(ip) for ip in ...]
- Prevents template injection even if relay_targets contains malicious content
- set_parameter() now validates param name with regex (alphanumeric, dots, underscores)
- set_parameter() quotes value with repr() to prevent argument injection
- load_caplet() validates path exists, is absolute, and ends with .cap/.caplet
- load_caplet() quotes caplet path for safe interpolation into bettercap command
- Removed misplaced requires_capture_bus entries that broke indentation
- Added requires_capture_bus = True correctly after requires_root in all passive modules
- All passive modules now have valid Python syntax
- Engine.__init__ now initializes self.capture_bus = None
- Engine.start_all() instantiates CaptureBus before starting modules
- CaptureBus uses resolved interface from config
- Inject capture_bus into configs of all modules with requires_capture_bus=True
- Engine.stop_all() properly stops CaptureBus after stopping modules
- CaptureBus instantiation includes error handling with fallback
- BaseModule now has requires_capture_bus = False default
- All 17 passive modules set requires_capture_bus = True
- bigbrother.py imports CaptureBus from core.capture_bus
- Ready for Engine to instantiate and inject CaptureBus
- Engine.__init__ now detects actual interface when config has 'auto'
- Uses get_primary_interface() to find default route interface
- PacketCapture module updated to use detected interface with fallback
- Handles Pi Zero 2W (wlan0) and other non-eth0 systems
Removed spurious second IR-014 (Verbose Module Startup Logging) which did not exist in any agent output.
This finding was causing confusion between the deployment blocker IR-014 (missing get_hardware_tier() import, CRITICAL)
and the false entry. Corrects triage table consistency and ensures all findings are grounded in actual agent analysis.
- Add pi3b tier (700MB RAM limit, 8 passive/2 active modules, no bettercap/mitmproxy)
- Update detect_hardware_tier() to detect Raspberry Pi 3B by model string and BCM2837
- Add pi3b section to hardware_tiers.yaml
- Add systemd MemoryMax/CPUQuota/OOMScoreAdj to all three service files
- Fix bigbrother-watchdog.service ExecStart (was calling non-existent ResourceMonitor().run())
- Add scripts/run_watchdog.py as standalone health monitor daemon
apt-cache show returns true even when Candidate is (none). Use
apt-cache policy and grep for a real version string to correctly
skip aircrack-ng on Ubuntu arm64 where it has no install candidate.
Make aircrack-ng a conditional package install (same pattern as
proxychains/sshuttle) so setup.sh doesn't abort on distros where
the package has no install candidate.
Interactive and non-interactive CLI to detect, mount, and edit the
netplan 20-wifi.yaml on an armbi_root-labelled SD card without
needing to boot the implant.
Enables/disables/reports status for bigbrother-core, bigbrother-capture,
and bigbrother-watchdog. Supports enable (enable+start), disable (stop+disable),
and status commands. Works locally on-device and over SSH from operator machine.
WireGuard (primary C2, PersistentKeepalive=0 for zero idle traffic),
Tailscale (fallback mesh VPN), Bridge (transparent inline L2 bridge with
802.1X bypass and ebtables protocol suppression), WiFiClient (WPA2-PSK
and WPA2-Enterprise via wpa_supplicant), ReverseTunnel (autossh over
stunnel/websocket — never raw SSH on 443), CellularBackup (LTE modem
via AT commands/mmcli, OPi Zero 3+ only), BLEEmergency (GATT server
with PSK auth for local last-resort access), DataExfil (priority-based
exfil with IMMEDIATE/NIGHTLY/ON_DEMAND tiers through connectivity chain).
Bridge scripts: setup_bridge.sh (create br0, disable STP, suppress
CDP/LLDP/BPDU via ebtables) and teardown_bridge.sh (safe cleanup).
6 stealth modules implementing the OPSEC layer:
- MacManager: innocuous MAC profiles from DB, DHCP hostname/vendor class spoofing, TCP stack tuning (TTL, window, timestamps)
- ProcessDisguise: rename processes to system service names via prctl, auto-disguise on MODULE_STARTED/TOOL_RESTARTED events
- LogSuppression: rsyslog filters, auditd exclusions, journald rate limits, shell history/utmp/wtmp clearing with clean removal on stop
- EncryptedStorage: LUKS2 container with HKDF network-derived key (CPU serial + C2 component), fallback key, auto-format and subdirectory creation
- TmpfsManager: tier-aware RAM-backed mounts for working dirs and WAL files, power loss = instant evidence destruction
- Watchdog: periodic health checks, auto-restart (max 3), OOM priority assignment by module type, bus event monitoring
Cobra