6caf1a15ca
Add Phase 1 advanced stealth modules: anti-forensics, traffic mimicry, JA3 spoofing, IDS testing, LKM rootkit, overlayfs manager
...
6 Python modules extending BaseModule + LKM kernel module template:
- anti_forensics.py: timestomping, core dump disable, swap off, journal vacuum, history suppression, bettercap tmpfs home, secure deletion
- traffic_mimicry.py: two-phase baseline/shaping engine matching implant traffic to observed network patterns
- ja3_spoofer.py: TLS fingerprint spoofing with Chrome/Firefox/Edge profiles, iptables NFQUEUE interception, SSL context configuration
- ids_tester.py: on-demand Snort/Suricata rule assessment with risk levels, preflight validation, caplet analysis
- lkm_rootkit.py: kernel module lifecycle (build/load/unload) for process/file/connection hiding on generic Debian hosts
- overlayfs_manager.py: tmpfs-backed overlayfs with tier-aware size budgets for zero SD card write activity
- bb_hide.c: ftrace-based LKM hooking getdents64/tcp4_seq_show/udp4_seq_show with self-hiding from lsmod
- Makefile: standard out-of-tree kernel module build
2026-03-18 08:23:02 -04:00
d883b07e34
Add Phase 1 core stealth modules: MAC manager, process disguise, log suppression, encrypted storage, tmpfs manager, watchdog
...
6 stealth modules implementing the OPSEC layer:
- MacManager: innocuous MAC profiles from DB, DHCP hostname/vendor class spoofing, TCP stack tuning (TTL, window, timestamps)
- ProcessDisguise: rename processes to system service names via prctl, auto-disguise on MODULE_STARTED/TOOL_RESTARTED events
- LogSuppression: rsyslog filters, auditd exclusions, journald rate limits, shell history/utmp/wtmp clearing with clean removal on stop
- EncryptedStorage: LUKS2 container with HKDF network-derived key (CPU serial + C2 component), fallback key, auto-format and subdirectory creation
- TmpfsManager: tier-aware RAM-backed mounts for working dirs and WAL files, power loss = instant evidence destruction
- Watchdog: periodic health checks, auto-restart (max 3), OOM priority assignment by module type, bus event monitoring
2026-03-18 08:21:01 -04:00
f90a686626
Phase 1: setup script and data bootstrapping
...
- setup.sh: Idempotent bootstrap for OPi Zero 3 / RPi Zero 2W / Debian
Platform detection, system packages, Pi optimizations (gpu_mem, swap,
sysctl), directory structure, Python venv, bettercap binary install,
external tools (Responder, NetExec, Chisel, Ligolo, kerbrute, etc),
data database creation, systemd service install, permissions, verification.
Supports --reinstall, --jumpbox, --no-tools, --verify-only flags.
- scripts/build_data.py: Creates 5 SQLite databases
innocuous_macs.db (51 consumer device profiles with OUI/DHCP/TCP fingerprints),
oui.db (50 seed OUIs), os_sigs.db (16 p0f-style signatures),
dhcp_fingerprints.db (19 option-55 fingerprints), ja3_fingerprints.db (13 hashes)
- scripts/build_lkm.sh: LKM rootkit compiler wrapper
- scripts/rotate_pcap.sh: tcpdump post-rotation handler with zstd compression,
optional AES-256-GCM encryption, disk space monitoring, and auto-purge
2026-03-18 08:13:55 -04:00
0a05f009e8
Add Phase 1 core infrastructure: event bus, state manager, engine, capture bus, tool manager, scheduler, resource monitor, kill switch
...
Core framework (8 files in core/) + BaseModule ABC (2 files in modules/):
- bus.py: Multiprocess-safe pub/sub event bus using mp.Queue with background dispatcher thread, 20 canonical event types
- state.py: SQLite persistent state with WAL mode, dedicated writer thread with 500ms coalesce, module status + generic key-value store
- engine.py: Module lifecycle manager with multiprocess model, dependency resolution (topological sort), hardware tier detection (opi_zero3/pi_zero/generic), resource budgeting, scope enforcement, engagement phase gating
- capture_bus.py: Single AF_PACKET socket packet demux with per-module subscriber queues, BPF filter matching, drop-oldest backpressure
- tool_manager.py: Subprocess lifecycle for external tools (bettercap/tcpdump/Responder/mitmproxy/ntlmrelayx) with exponential backoff restart, /proc resource monitoring, process disguise via prctl, health check callbacks, graceful SIGTERM->SIGKILL shutdown
- scheduler.py: Cron-like task scheduler with jitter, thread pool execution, enable/disable/run_now controls
- resource_monitor.py: System + per-process RAM/CPU/disk/thermal monitoring, OOM kill lowest-priority module, thermal shedding at 70C
- kill_switch.py: 7-phase wipe sequence (stop procs, corrective ARP, LUKS destroy, shred keys, zero-fill, clear RAM, reboot), boot flag for interrupted wipe resume, dead man's switch
- modules/base.py: BaseModule ABC with start/stop/status/configure/health_check interface contract
2026-03-18 08:13:11 -04:00
62a1010ab4
Add Phase 1 utility modules: crypto, networking, logging, stealth, resource, permissions, config_loader, bettercap_api
...
9 files in utils/ providing the shared infrastructure layer:
- crypto: AES-256-GCM file encryption, argon2id/PBKDF2 key derivation, HKDF network unlock, LUKS container management
- networking: interface detection, MAC/IP helpers, BPF compilation via libpcap ctypes, gratuitous ARP, VLAN creation
- logging: encrypted log writer (BBLogger) with rotation, per-module files, stdout suppression for stealth
- stealth: process rename via prctl, cmdline spoofing, sysctl helpers, timestomping, core dump disable
- resource: hardware tier detection (OPi Zero 3 / Pi Zero / generic) via /proc/device-tree and cpuinfo, resource monitoring
- permissions: root/capability checks via capget ctypes, privilege dropping, directory permission enforcement
- config_loader: YAML merge hierarchy (hardware_tiers -> bigbrother -> modules -> stealth -> CLI), tier auto-detection, SIGHUP reload
- bettercap_api: REST client with per-session random credentials, session/events/command methods
2026-03-18 08:11:25 -04:00
63e317176d
Update hardware platform to Orange Pi Zero 3 (4GB) as primary implant
...
Replaces RPi 4 as main implant with OPi Zero 3 — 50x55mm footprint,
WiFi 5 + BT 5.0 built-in, 4GB RAM, $29. RPi Zero 2W retained as
jumpbox/beacon role. Updated all hardware tier tables, memory budgets,
OPSEC notes, and operational workflow.
2026-03-18 08:04:24 -04:00
5694fdc56c
WireGuard as primary C2 — zero traffic when idle, on-demand connect. Tailscale moves to fallback.
2026-03-17 16:03:21 -04:00
b6d9d7a738
Drop Suricata/RITA — Zeek is the offensive analysis tool, IDS is not our job
2026-03-17 15:32:12 -04:00
813e224b03
v4.0: Shadow SOC framing — Zeek/Suricata/RITA offline analysis, innocuous MAC profiles, operator workstation as SOC analysis brain
2026-03-17 15:28:15 -04:00
0a80f8bed8
v4.0 design rewrite: orchestrator architecture, operator workstation, innocuous MACs
...
Major rewrite of BIGBROTHER_DESIGN.md incorporating three architectural changes:
1. Orchestrator model: BigBrother wraps proven tools instead of reimplementing.
- bettercap replaces 5+ custom active modules (ARP/DNS/DHCP/HTTP/SSL)
- tcpdump replaces custom scapy packet capture
- 11 modules deleted (file_extractor, email_sniffer, print_interceptor,
voip_capture, protocol_analyzer, session_hijacker, http_logger,
ssl_downgrade, js_injector, cloud_token_active, report_generator)
- New: bettercap_mgr, tool_manager, tool_output_parser, bettercap_api
- Module count: 67 -> 60
2. Operator workstation section: offline analysis tools and pull scripts
for file carving, email/print reconstruction, GPU hash cracking, and
report generation from PCAPs and SQLite DBs.
3. Innocuous MAC database: curated consumer device profiles (Fire TV,
iPhone, Roku, etc.) with matching DHCP hostname, vendor class, TTL,
and TCP window size for complete device impersonation.
Deleted ARCHITECTURE_RETHINK.md (merged into design doc).
2026-03-17 12:35:47 -04:00
0a62b805f4
v4.0 architecture rethink: orchestrator model over custom reimplementation
...
6-agent security tribe evaluation of replacing 11 custom Python modules
with bettercap/tcpdump/tshark wrappers. Modules categorized as DELETE
(offline processing), WRAPPER (proven tool orchestration), or KEEP
(genuinely lightweight custom code). Revised file tree, resource impact
analysis, risk assessment, and on-device vs offline processing matrix.
2026-03-17 12:27:09 -04:00
0a40103fd5
Full PCAP on all tiers — no headers-only, no tiered retention. 128GB+ with zstd-19 handles it.
2026-03-17 12:09:22 -04:00
4a22eb566f
Rewrite operational workflow with detailed per-module output for dental office scenario
...
Complete rewrite showing exact expected output from every passive and active
module against a realistic small business dental office network. Includes
protocol-level explanations, realistic fake data, honest assessment of what
produces zero, and step-by-step DNS poisoning/ARP spoofing/Responder walkthroughs.
2026-03-17 12:04:04 -04:00
5ad9f41fba
Initial commit: BigBrother design doc and operational workflow
2026-03-17 11:48:47 -04:00
a4edcf6e15
v3.2: Merge security review into design doc as single source of truth
...
Integrate all findings from SECURITY_REVIEW.md inline into module specs:
- OPSEC warnings added to arp_spoof, responder_mgr, evil_twin, mitmproxy, tailscale, ble_emergency
- Accepted limitations noted in tls_sni_extractor (ECH, DoH, TLS 1.3), smb_monitor (SMB3), email_sniffer, credential_sniffer, process_disguise, bridge
- New modules: data_exfil.py (connectivity), wordlists in data/
- Design changes: tiered PCAP retention, ARP crash recovery, 802.1X full bypass, engagement phase gating, schema migration, setup reliability
- Hardware notes: USB power budget, Pi fingerprint mitigations, physical detection, SD write endurance
- Remove SECURITY_REVIEW.md and review_agent5_redteam.json
2026-03-17 11:11:25 -04:00
3041943c21
PCAP max compression: zstd -19 on rotation for storage and transfer efficiency
2026-03-17 11:01:19 -04:00
d3d1deb99c
v3.1: Incorporate security tribe review findings into design doc
...
Add 7 new modules: ldap_harvester, rdp_monitor, quic_analyzer,
db_interceptor (passive), change_detector, security_posture,
operator_audit (intel). Add capture_bus for single AF_PACKET
demux to per-module queues (multiprocess architecture). Fix Pi
Zero memory budget (70MB interpreter, 4 passive modules max).
Move sensitive config inside LUKS with network-derived boot key.
Require 128GB SD card with zstd PCAP compression. Add coercion
tools (Coercer, PetitPotam), proxychains-ng, socat, sshuttle,
pypykatz, ldapdomaindump, smbmap, ROADtools. Add thermal
monitoring, SQLite contention fix (single DB + async writer),
bridge STP/CDP suppression, DHCP fingerprinting, wireless
interface conflict detection, optional scope.yaml, DoH/ECH
awareness, triage CLI command. Update implementation phases
and hardware tier matrix.
2026-03-17 10:57:51 -04:00
7915ef17de
Add consolidated security review from 6-agent tribe analysis
...
91 raw findings from Security, OPSEC, Blue Team, APT, Red Team, and
Infra/Reliability analysts consolidated to 45 actionable items across
7 sections: new modules (9), design changes (10), infra fixes (6),
tool gaps (5), OPSEC warnings (10), and accepted limitations (7).
Key themes: LDAP/RDP monitoring gaps, PCAP storage crisis, data exfil
pipeline needed, ARP/Responder detection risk, Pi Zero memory budget
exceeded, multiprocess architecture required, config files outside LUKS.
2026-03-17 10:28:42 -04:00
f959ef89cd
Rewrite design doc v3.0: surveillance platform + operator jump box
...
Complete rewrite of BIGBROTHER_DESIGN.md with new design philosophy:
- Removed autonomous decision engine, state machine, hard scope enforcement
- Removed lateral movement automation, tool wrappers, attack chain recipes
- Removed push notifications, automated attack chaining, OT lockout
- Added 8 new passive surveillance modules: DNS logger, TLS SNI extractor,
network relationship mapper, auth flow tracker, SMB file access monitor,
VoIP/SIP metadata capture, print job interception, email sniffer
- Added 4 new active modules: HTTP transaction logger, file extractor,
JS/HTML injection, mitmproxy integration
- Added per-user activity timeline intelligence module
- Pre-installed tools section (nmap, Certipy, Impacket, BloodHound,
CrackMapExec, Chisel, Ligolo-ng, etc.) - installed not wrapped
- Simplified to 5 implementation phases from 10
- Operator makes all decisions, no autonomous behavior
2026-03-17 10:04:14 -04:00
45dc317c31
Add consolidated BigBrother design document post-tribe review
...
Comprehensive network implant architecture incorporating findings from
6-agent security review tribe. Key additions: 802.1X NAC bypass,
AD attack suite (Kerberoast/ADCS/coercion), autonomous decision engine,
multi-protocol C2 chain, traffic mimicry, hardware tier enforcement,
mandatory scope enforcement, OT/SCADA passive lockout, 5 attack chain
recipes, detection risk matrix, and reliability safeguards.
2026-03-17 07:39:01 -04:00
n0mad1k