n0mad1k/bigbrother
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Commit Graph

  • 3ea6c40352 Remove transient AI workflow audit artifacts and gitignore future ones main Cobra 2026-07-21 13:10:27 -04:00
  • 3ba8a33b65 housekeeping: add .claude/ to .gitignore Cobra 2026-04-22 15:22:31 -04:00
  • 047635c304 Fix arrival/departure gates dropping LAA MACs; halve ARP scan interval Cobra 2026-04-15 15:25:32 -04:00
  • d8c742cea6 Reduce departure latency from 30min worst-case to 6min Cobra 2026-04-15 14:50:19 -04:00
  • 44c8e87959 Gate arrival/departure alerts to phones and wearables only Cobra 2026-04-15 13:19:05 -04:00
  • 9b2f747775 Add active ARP scanning to bypass AP proxy on WiFi networks Cobra 2026-04-15 12:58:59 -04:00
  • a9d43ce4d3 Suppress BlueZ teardown race on SIGTERM in ble_alerter Cobra 2026-04-15 00:30:32 -04:00
  • f28b11801a Fix MAC normalization in ARP opcode=2 trust gate Cobra 2026-04-15 00:24:59 -04:00
  • d4f95a550c Add BLE GATT Device Name probing and WiFi+BLE arrival correlation Cobra 2026-04-15 00:03:35 -04:00
  • d4f16425f9 Label takes precedence over DHCP hostname in arrival/departure alerts Cobra 2026-04-14 23:50:23 -04:00
  • 3547c22d83 Delay arrival alert 2s so mDNS hostname resolves before alert fires Cobra 2026-04-14 23:37:06 -04:00
  • 0d48b78463 Prefer auto-discovered hostname over device label in alerts Cobra 2026-04-14 23:34:34 -04:00
  • b9a3411345 Extract Bonjour hostname from mDNS and use it in arrival/departure alerts Cobra 2026-04-14 23:23:07 -04:00
  • a77323b1a0 Skip all personal devices from ARP seed, not just labeled ones Cobra 2026-04-14 23:17:13 -04:00
  • a2597f5f3d Prevent labeled devices from being silently seeded; detect opcode=2 ARP for labeled MACs Cobra 2026-04-14 23:06:05 -04:00
  • d3da6ea89c Prevent churn suppression from silencing labeled personal devices Cobra 2026-04-14 22:45:15 -04:00
  • 7154e2b295 Exclude infrastructure MACs from personal device detection via NET_ALERTER_INFRA_MACS Cobra 2026-04-14 22:10:28 -04:00
  • 409752eb2a Remove Tailscale exclusion machinery — root cause was a bad .env label Cobra 2026-04-14 22:06:58 -04:00
  • b73d497010 Fix seed_tailscale_peers to use CurAddr field not Endpoints Cobra 2026-04-14 21:51:52 -04:00
  • 83894bf84d Fix three presence monitoring bugs: Tailscale exclusion, mDNS arrival, ARP personal device arrival Cobra 2026-04-14 21:51:02 -04:00
  • 54b389e767 Prevent watchdog from re-triggering departure on already-departing devices Cobra 2026-04-14 20:40:09 -04:00
  • 7d87f29a47 Fix arrival suppression when device returns during departure debounce Cobra 2026-04-14 19:49:33 -04:00
  • 57cf43eaea Disable active probes — passive-only operation required Cobra 2026-04-14 16:18:12 -04:00
  • 936e33d373 Seed last_seen from ARP cache on startup so watchdog has a baseline Cobra 2026-04-14 16:07:47 -04:00
  • 51fff82867 Ignore ARP replies in last_seen updates to block AP proxy spoofing Cobra 2026-04-14 15:57:56 -04:00
  • 88bc36af61 Fix departure detection for AP ARP-proxy networks (passive-only) Cobra 2026-04-14 15:52:26 -04:00
  • 52fc12b97a Fix false presence: only trigger arrival on NUD_REACHABLE, not STALE/DELAY/PROBE Cobra 2026-04-14 15:38:30 -04:00
  • e92bec1fcd Add Garmin/Fitbit OUIs; consolidate personal device detection into is_personal_device() Cobra 2026-04-14 15:01:49 -04:00
  • 7b039cbefd Use LAA MAC bit to auto-detect phones/wearables for occupancy Cobra 2026-04-14 14:58:53 -04:00
  • df6ecba5e5 Restrict occupancy to personal devices only (phones/wearables) Cobra 2026-04-14 14:56:20 -04:00
  • be852dbcf3 Fix MAC normalization in device_labels lookup; add label support to arrival/departure alerts Cobra 2026-04-14 14:52:41 -04:00
  • ba18b2fba8 Add device labels to occupancy alerts — include who is present Cobra 2026-04-14 14:46:18 -04:00
  • 2fb6e7e8e1 Fire occupancy alert on startup — UNKNOWN→OCCUPIED was silently suppressed Cobra 2026-04-14 14:39:02 -04:00
  • a3df9ed958 Any enrolled non-infrastructure device marks location as occupied Cobra 2026-04-14 14:25:32 -04:00
  • c01064c12e Enroll on first contact — 1 source is better than none Cobra 2026-04-14 14:21:52 -04:00
  • b50fc4238b Implement mDNS as standalone enrollment signal and active probes on device discovery Cobra 2026-04-14 14:12:36 -04:00
  • f73ef29c1e net_alerter: Add Strategy 0 MAC deduplication and fix Strategy 3 overwrite bug Cobra 2026-04-14 13:39:37 -04:00
  • 6a5d1f0670 Exit cleanly when no BT adapter found instead of crash-looping Cobra 2026-04-14 13:29:29 -04:00
  • 0a8d6a2019 Add audit artifacts from #671 review pipeline Cobra 2026-04-14 13:18:35 -04:00
  • cfa2d9e0e7 Support wpa_supplicant config format on OPi/Armbian targets Cobra 2026-04-14 13:14:35 -04:00
  • b67127677f Fix P1/P2 audit findings from #671 review Cobra 2026-04-14 12:46:44 -04:00
  • 5077e30c66 Add multi-source device identity store and zero-config enrollment (#671) Cobra 2026-04-14 12:38:32 -04:00
  • e49ca1ace5 Add tests for iOS departure detection features Cobra 2026-04-13 20:30:49 -04:00
  • 3f4e79dd68 Add iOS departure detection via passive ARP/mDNS capture and watchdog Cobra 2026-04-13 20:27:00 -04:00
  • 979ebe8441 fix _check_churn self-deadlock — remove redundant known_lock nesting Cobra 2026-04-13 17:07:25 -04:00
  • 13900f9045 Remove Matrix credentials from global memory — load at call time Cobra 2026-04-13 04:00:56 -04:00
  • c87967f2c4 Fix timer.cancel() deadlock and add MAC format validation Cobra 2026-04-12 08:41:04 -04:00
  • 0b468ee548 Fix P1 bugs in occupancy tracking: lock ordering deadlock, MAC normalization, and race condition Cobra 2026-04-12 07:57:37 -04:00
  • f690370402 Implement occupancy tracking with personal device detection and deadlock fix Cobra 2026-04-12 07:26:57 -04:00
  • 92c85f4e43 Apply Delta Reviewer QA corrections to net_alerter security review Cobra 2026-04-10 23:34:42 -04:00
  • f243e1e049 Append Delta Reviewer QA report to consolidated security findings Cobra 2026-04-10 23:28:24 -04:00
  • 1af00e7da9 Consolidate 6-agent security review into unified report Cobra 2026-04-10 23:23:44 -04:00
  • d1e89bddf5 Add three dynamic infrastructure auto-suppression mechanisms to net_alerter Cobra 2026-04-10 22:57:40 -04:00
  • 98ee896916 Add NET_ALERTER_INFRA_IPS config to setup.sh .env template and operator_setup.sh prompt Cobra 2026-04-10 22:50:56 -04:00
  • 39ae11f3d1 Add flap state cleanup to test_net_alerter for test isolation Cobra 2026-04-10 22:46:07 -04:00
  • 91a84b9d6f Add interface flap detection and env var for infrastructure IPs in net_alerter Cobra 2026-04-10 22:45:15 -04:00
  • 06c84e1800 Deploy presence daemon to OPi Zero 3 test implant Cobra 2026-04-10 15:48:56 -04:00
  • 2169c868c3 Add bounds checks to netlink and DHCP parsers — prevent exception flood on malformed packets Cobra 2026-04-10 15:05:19 -04:00
  • fd1eeeda47 Fix P1 blockers: configurable port, connection leak, race condition, DB path + WAL Cobra 2026-04-10 15:02:26 -04:00
  • 09b81deb45 Add presence daemon user documentation and architecture guide Cobra 2026-04-10 14:55:13 -04:00
  • fd014b2a38 Add passive presence daemon — multi-signal WiFi/ARP/DHCP/BLE with exponential decay Cobra 2026-04-10 14:54:50 -04:00
  • 722a632cee Revert "Add presence DB schema; fix BLE passive scan mode (bleak #1440)" Cobra 2026-04-10 14:26:27 -04:00
  • 3ddb854685 Revert "Add Phase 1 WiFi presence daemon — mDNS + ARP fusion with exponential decay and presence anchor" Cobra 2026-04-10 14:26:27 -04:00
  • f7460b0416 Add Phase 1 WiFi presence daemon — mDNS + ARP fusion with exponential decay and presence anchor Cobra 2026-04-10 14:22:55 -04:00
  • 0994385f7c Add presence DB schema; fix BLE passive scan mode (bleak #1440) Cobra 2026-04-10 14:21:50 -04:00
  • 982e0c526c Apply QA corrections to consolidated security review: deconflict APT-001 triage, add deduplication transparency, document exploit chain dependencies Cobra 2026-04-10 10:10:52 -04:00
  • c04ec0b9ea Add comprehensive test suites for 7 bigbrother modules n0mad1k 2026-04-10 07:38:28 -04:00
  • 0b5c7f3907 Add responder_mgr NTLM hash capture validation tests n0mad1k 2026-04-10 07:37:22 -04:00
  • 7a3b8e40d9 Add ntlm_relay wrapper and ADCS relay validation tests n0mad1k 2026-04-10 07:36:16 -04:00
  • edfa067f68 Add ids_tester IDS evasion self-test validation tests n0mad1k 2026-04-10 07:34:49 -04:00
  • 4ca9d3cdf1 Add validation tests for packet_capture, credential_db, and ja3_spoofer n0mad1k 2026-04-10 07:29:08 -04:00
  • 027eaa39b2 Expand p0f OS fingerprint signatures from 16 to 102 entries n0mad1k 2026-04-10 07:06:50 -04:00
  • 45c4d4a57b Expand MAC profiles from 55 to 132 innocuous device profiles n0mad1k 2026-04-10 07:05:25 -04:00
  • 0d92b97682 Expand JA3 fingerprint database from 4 to 501 profiles n0mad1k 2026-04-10 07:02:56 -04:00
  • fa0e2491cf Fix ble_alerter: MAC name filter, Matrix 429 backoff, active scanner Cobra 2026-04-10 06:44:13 -04:00
  • c0b91e9b0b Switch BLE scanner to active mode — bleak 0.20 passive requires or_patterns on BlueZ Cobra 2026-04-10 06:37:30 -04:00
  • 85e53fed68 Fix test_too_short test (abc/abd are hex characters) Cobra 2026-04-10 06:33:38 -04:00
  • 40eb8cf621 Restore execute permission on operator_setup.sh Cobra 2026-04-10 06:32:31 -04:00
  • 47e45453a7 Add BLE alerter configuration to operator_setup.sh (mode, devices, timeout, Matrix creds) Cobra 2026-04-10 06:32:29 -04:00
  • 7ef6fc7c3f Update deploy-daemon.sh to deploy both net_alerter and ble_alerter Cobra 2026-04-10 06:31:55 -04:00
  • 485b124c11 Add unit tests for BLE alerter (mocked bleak, async scenarios) Cobra 2026-04-10 06:31:41 -04:00
  • a40e86be10 Add systemd unit for BLE alerter (after bluetooth.target) Cobra 2026-04-10 06:31:39 -04:00
  • 77b0cd6512 Add BLE alerter daemon (passive scan, named-device tracking, Matrix alerts) Cobra 2026-04-10 06:31:38 -04:00
  • 71cd3332d2 Fix ARRIVED spam — mark departing instead of popping from known_devices Cobra 2026-04-09 14:34:46 -04:00
  • b66380f25d Fix on_arrival() to always cancel departure timer on device re-arrival Cobra 2026-04-09 13:28:34 -04:00
  • 0e178e34d4 Deploy OUI database as part of net_alerter daemon installation Cobra 2026-04-09 13:05:34 -04:00
  • 4ffe29d4d3 Add SQLite OUI database lookup to net_alerter Cobra 2026-04-09 13:05:18 -04:00
  • a3c9353d3a Add false positive suppression to net_alerter — fix for #467 Cobra 2026-04-09 09:44:37 -04:00
  • 82228d79b3 Append QA review findings to consolidated security report Cobra 2026-04-09 08:31:26 -04:00
  • 87e7587136 Append 4 operator Q&A sections with detailed exploitation scenarios and OPSEC analysis Cobra 2026-04-09 08:25:52 -04:00
  • d4354074c8 Make net_alerter alerts readable — fix hostname dedup and inline OUI lookup Cobra 2026-04-08 22:40:35 -04:00
  • 4d2e46e478 Update module count assertions to reflect reverse_tunnel removal Cobra 2026-04-08 22:26:06 -04:00
  • ffd384f64b Strip OPSEC tool identity fingerprints Cobra 2026-04-08 22:18:35 -04:00
  • b34aab7986 Add net_alerter README with quick start guide Cobra 2026-04-08 21:56:28 -04:00
  • 424b4f4552 Add Orange Pi Zero 3 specific deployment guide Cobra 2026-04-08 21:56:03 -04:00
  • a54acf32b8 Add net_alerter daemon deployment documentation Cobra 2026-04-08 21:55:39 -04:00
  • 52872794ee Add deployment script for net_alerter daemon Cobra 2026-04-08 21:55:18 -04:00
  • 431571dd82 Rebuild net_alerter as persistent daemon — DHCP sniffer + Netlink RTM_NEWNEIGH/DELNEIGH; removes 5-min cron, zero active probing Cobra 2026-04-08 21:55:02 -04:00
  • 402c4e849b Replace nmap ARP scan with passive /proc/net/arp read — no active probing (#449) Cobra 2026-04-08 21:01:12 -04:00
  • 57d70feb20 Add missing detect_interface_with_retry function to fix engine startup Cobra 2026-04-08 20:59:35 -04:00