5694fdc56c
WireGuard as primary C2 — zero traffic when idle, on-demand connect. Tailscale moves to fallback.
2026-03-17 16:03:21 -04:00
b6d9d7a738
Drop Suricata/RITA — Zeek is the offensive analysis tool, IDS is not our job
2026-03-17 15:32:12 -04:00
813e224b03
v4.0: Shadow SOC framing — Zeek/Suricata/RITA offline analysis, innocuous MAC profiles, operator workstation as SOC analysis brain
2026-03-17 15:28:15 -04:00
0a80f8bed8
v4.0 design rewrite: orchestrator architecture, operator workstation, innocuous MACs
...
Major rewrite of BIGBROTHER_DESIGN.md incorporating three architectural changes:
1. Orchestrator model: BigBrother wraps proven tools instead of reimplementing.
- bettercap replaces 5+ custom active modules (ARP/DNS/DHCP/HTTP/SSL)
- tcpdump replaces custom scapy packet capture
- 11 modules deleted (file_extractor, email_sniffer, print_interceptor,
voip_capture, protocol_analyzer, session_hijacker, http_logger,
ssl_downgrade, js_injector, cloud_token_active, report_generator)
- New: bettercap_mgr, tool_manager, tool_output_parser, bettercap_api
- Module count: 67 -> 60
2. Operator workstation section: offline analysis tools and pull scripts
for file carving, email/print reconstruction, GPU hash cracking, and
report generation from PCAPs and SQLite DBs.
3. Innocuous MAC database: curated consumer device profiles (Fire TV,
iPhone, Roku, etc.) with matching DHCP hostname, vendor class, TTL,
and TCP window size for complete device impersonation.
Deleted ARCHITECTURE_RETHINK.md (merged into design doc).
2026-03-17 12:35:47 -04:00
0a62b805f4
v4.0 architecture rethink: orchestrator model over custom reimplementation
...
6-agent security tribe evaluation of replacing 11 custom Python modules
with bettercap/tcpdump/tshark wrappers. Modules categorized as DELETE
(offline processing), WRAPPER (proven tool orchestration), or KEEP
(genuinely lightweight custom code). Revised file tree, resource impact
analysis, risk assessment, and on-device vs offline processing matrix.
2026-03-17 12:27:09 -04:00
0a40103fd5
Full PCAP on all tiers — no headers-only, no tiered retention. 128GB+ with zstd-19 handles it.
2026-03-17 12:09:22 -04:00
4a22eb566f
Rewrite operational workflow with detailed per-module output for dental office scenario
...
Complete rewrite showing exact expected output from every passive and active
module against a realistic small business dental office network. Includes
protocol-level explanations, realistic fake data, honest assessment of what
produces zero, and step-by-step DNS poisoning/ARP spoofing/Responder walkthroughs.
2026-03-17 12:04:04 -04:00
5ad9f41fba
Initial commit: BigBrother design doc and operational workflow
2026-03-17 11:48:47 -04:00
a4edcf6e15
v3.2: Merge security review into design doc as single source of truth
...
Integrate all findings from SECURITY_REVIEW.md inline into module specs:
- OPSEC warnings added to arp_spoof, responder_mgr, evil_twin, mitmproxy, tailscale, ble_emergency
- Accepted limitations noted in tls_sni_extractor (ECH, DoH, TLS 1.3), smb_monitor (SMB3), email_sniffer, credential_sniffer, process_disguise, bridge
- New modules: data_exfil.py (connectivity), wordlists in data/
- Design changes: tiered PCAP retention, ARP crash recovery, 802.1X full bypass, engagement phase gating, schema migration, setup reliability
- Hardware notes: USB power budget, Pi fingerprint mitigations, physical detection, SD write endurance
- Remove SECURITY_REVIEW.md and review_agent5_redteam.json
2026-03-17 11:11:25 -04:00
3041943c21
PCAP max compression: zstd -19 on rotation for storage and transfer efficiency
2026-03-17 11:01:19 -04:00
d3d1deb99c
v3.1: Incorporate security tribe review findings into design doc
...
Add 7 new modules: ldap_harvester, rdp_monitor, quic_analyzer,
db_interceptor (passive), change_detector, security_posture,
operator_audit (intel). Add capture_bus for single AF_PACKET
demux to per-module queues (multiprocess architecture). Fix Pi
Zero memory budget (70MB interpreter, 4 passive modules max).
Move sensitive config inside LUKS with network-derived boot key.
Require 128GB SD card with zstd PCAP compression. Add coercion
tools (Coercer, PetitPotam), proxychains-ng, socat, sshuttle,
pypykatz, ldapdomaindump, smbmap, ROADtools. Add thermal
monitoring, SQLite contention fix (single DB + async writer),
bridge STP/CDP suppression, DHCP fingerprinting, wireless
interface conflict detection, optional scope.yaml, DoH/ECH
awareness, triage CLI command. Update implementation phases
and hardware tier matrix.
2026-03-17 10:57:51 -04:00
7915ef17de
Add consolidated security review from 6-agent tribe analysis
...
91 raw findings from Security, OPSEC, Blue Team, APT, Red Team, and
Infra/Reliability analysts consolidated to 45 actionable items across
7 sections: new modules (9), design changes (10), infra fixes (6),
tool gaps (5), OPSEC warnings (10), and accepted limitations (7).
Key themes: LDAP/RDP monitoring gaps, PCAP storage crisis, data exfil
pipeline needed, ARP/Responder detection risk, Pi Zero memory budget
exceeded, multiprocess architecture required, config files outside LUKS.
2026-03-17 10:28:42 -04:00
f959ef89cd
Rewrite design doc v3.0: surveillance platform + operator jump box
...
Complete rewrite of BIGBROTHER_DESIGN.md with new design philosophy:
- Removed autonomous decision engine, state machine, hard scope enforcement
- Removed lateral movement automation, tool wrappers, attack chain recipes
- Removed push notifications, automated attack chaining, OT lockout
- Added 8 new passive surveillance modules: DNS logger, TLS SNI extractor,
network relationship mapper, auth flow tracker, SMB file access monitor,
VoIP/SIP metadata capture, print job interception, email sniffer
- Added 4 new active modules: HTTP transaction logger, file extractor,
JS/HTML injection, mitmproxy integration
- Added per-user activity timeline intelligence module
- Pre-installed tools section (nmap, Certipy, Impacket, BloodHound,
CrackMapExec, Chisel, Ligolo-ng, etc.) - installed not wrapped
- Simplified to 5 implementation phases from 10
- Operator makes all decisions, no autonomous behavior
2026-03-17 10:04:14 -04:00
45dc317c31
Add consolidated BigBrother design document post-tribe review
...
Comprehensive network implant architecture incorporating findings from
6-agent security review tribe. Key additions: 802.1X NAC bypass,
AD attack suite (Kerberoast/ADCS/coercion), autonomous decision engine,
multi-protocol C2 chain, traffic mimicry, hardware tier enforcement,
mandatory scope enforcement, OT/SCADA passive lockout, 5 attack chain
recipes, detection risk matrix, and reliability safeguards.
2026-03-17 07:39:01 -04:00
n0mad1k