# BigBrother: Total Network Surveillance Platform + Operator Jump Box

> **Version**: 3.1
> **Date**: 2026-03-17
> **Status**: Implementation Blueprint

---

## Table of Contents

1. [Overview](#1-overview)
2. [File Tree](#2-file-tree)
3. [Surveillance Modules](#3-surveillance-modules)
4. [Connectivity](#4-connectivity)
5. [Stealth](#5-stealth)
6. [Pre-installed Tools](#6-pre-installed-tools)
7. [Core Framework](#7-core-framework)
8. [Setup & Bootstrap](#8-setup--bootstrap)
9. [Configuration](#9-configuration)
10. [Hardware Tiers](#10-hardware-tiers)
11. [Implementation Phases](#11-implementation-phases)
12. [OPSEC Notes](#12-opsec-notes)

---

## 1. Overview

BigBrother is a total network surveillance platform and operator jump box designed for authorized red team engagements. It deploys on Raspberry Pi (Zero 2W through Pi 4) or full Debian hosts, operating as an inline transparent bridge or passive tap. Once deployed, its passive surveillance runs 24/7 with zero operator interaction — capturing every packet, logging every DNS query, extracting every credential that crosses the wire, and mapping every relationship on the network.

The platform has two operational modes. **Passive surveillance** runs unsupervised from the moment of deployment, collecting full packet captures, DNS query logs, TLS SNI data, cleartext credentials, Kerberos tickets, host information, traffic patterns, and protocol metadata. **Active surveillance** is operator-enabled when deeper collection is needed — ARP spoofing to become the man-in-the-middle, DNS poisoning, DHCP spoofing, Responder for hash capture, mitmproxy for HTTPS interception. Once the operator enables an active module and configures its targets, it runs unattended.

BigBrother is not an autonomous attack framework. There is no decision engine, no state machine, no automated attack chaining. The operator makes all decisions. When the operator needs to run offensive tools, they SSH into the box and use the pre-installed toolkit directly: nmap, Certipy, Impacket, BloodHound, CrackMapExec, Chisel, Ligolo-ng. These tools are installed by `setup.sh`, not wrapped in Python. The operator runs them, interprets the results, and decides what to do next.

Scope is the operator's responsibility. An optional `scope.yaml` can be loaded to validate active module targets against in-scope ranges, but this is not mandatory — there is no hard scope enforcement or OT lockout mechanism forced on the operator.

---

## 2. File Tree

```
~/tools/bigbrother/
├── bigbrother.py                    # Main CLI + interactive menu (Click + Rich)
├── setup.sh                         # Idempotent Debian bootstrap (packages + tools)
├── requirements.txt                 # Python dependencies
├── .gitignore
│
├── config/
│   ├── bigbrother.yaml              # Non-sensitive defaults only (plaintext FS)
│   ├── modules.yaml                 # Per-module enable/disable + params
│   ├── stealth.yaml                 # OPSEC/stealth profile config
│   ├── hardware_tiers.yaml          # Pi Zero 2W vs Pi 4 vs Debian host limits
│   ├── scope.yaml                   # Optional scope enforcement (IP ranges, domains)
│   └── templates/
│       ├── engagement_default.yaml  # Template for new engagements
│       ├── engagement_minimal.yaml  # Minimal config for Pi Zero 2W
│       └── engagement_full.yaml     # Full config for Pi 4 / Debian host
│
├── core/
│   ├── __init__.py
│   ├── engine.py                    # Module lifecycle manager (load, start, stop, status)
│   ├── capture_bus.py               # Single AF_PACKET capture, demux to per-module queues
│   ├── scheduler.py                 # Task scheduler (cron-like, jitter-aware)
│   ├── bus.py                       # Internal event bus (pub/sub between modules)
│   ├── state.py                     # Persistent state manager (SQLite)
│   ├── resource_monitor.py          # RAM/CPU/disk/thermal watchdog, throttle enforcement
│   └── kill_switch.py               # Manual wipe orchestrator
│
├── modules/
│   ├── __init__.py
│   ├── base.py                      # Abstract base class for all modules
│   │
│   ├── passive/                     # 24/7 unsupervised collection
│   │   ├── __init__.py
│   │   ├── packet_capture.py        # Full PCAP rotation, BPF filters, promiscuous mode
│   │   ├── dns_logger.py            # Per-host DNS query log, every domain resolved
│   │   ├── tls_sni_extractor.py     # HTTPS destinations from ClientHello SNI field
│   │   ├── credential_sniffer.py    # Cleartext FTP/HTTP/SMTP/POP3/IMAP/Telnet/SNMP + NTLM
│   │   ├── kerberos_harvester.py    # AS-REQ/AS-REP/TGS-REQ/TGS-REP from traffic
│   │   ├── host_discovery.py        # ARP table, DHCP sniffing, mDNS, NetBIOS
│   │   ├── os_fingerprint.py        # Passive OS fingerprinting (p0f-style)
│   │   ├── traffic_analyzer.py      # Protocol distribution, flows, bandwidth, beacons, comm graphs
│   │   ├── vlan_discovery.py        # 802.1Q tags, DTP frames, 802.1X detection
│   │   ├── network_mapper.py        # Who talks to whom, protocol, volume — visual graph
│   │   ├── auth_flow_tracker.py     # Map user-to-service authentication, build timelines
│   │   ├── smb_monitor.py           # File share access patterns (users, shares, files)
│   │   ├── voip_capture.py          # SIP metadata, call records, RTP audio (if unencrypted)
│   │   ├── print_interceptor.py     # PCL/PostScript print spool from network print traffic
│   │   ├── wireless_intel.py        # Probe requests, BLE scanning, WPA handshakes, WIDS
│   │   ├── protocol_analyzer.py     # Zeek-style protocol dissection, service ID, cert analysis
│   │   ├── cloud_token_harvester.py # Passive AWS keys, Azure tokens, JWT, OAuth, SAML
│   │   ├── email_sniffer.py         # Capture email content + attachments from cleartext SMTP/IMAP/POP3
│   │   ├── ldap_harvester.py        # LDAP search query/response parsing, AD object inventory
│   │   ├── rdp_monitor.py           # RDP NLA/CredSSP header parsing, session tracking
│   │   ├── quic_analyzer.py         # QUIC Initial packet SNI extraction (UDP/443)
│   │   └── db_interceptor.py        # MSSQL/MySQL/PostgreSQL/Redis/MongoDB protocol parsing
│   │
│   ├── active/                      # Operator-enabled, then runs unattended
│   │   ├── __init__.py
│   │   ├── arp_spoof.py             # ARP cache poisoning, become MITM gateway
│   │   ├── dns_poison.py            # DNS response injection, redirect queries
│   │   ├── dhcp_spoof.py            # Rogue DHCP to set implant as gateway/DNS
│   │   ├── evil_twin.py             # Rogue AP with captive portal
│   │   ├── ipv6_slaac.py            # IPv6 SLAAC spoofing, become IPv6 gateway
│   │   ├── responder_mgr.py         # Manage Responder process (LLMNR/NBT-NS/mDNS poisoning)
│   │   ├── ssl_downgrade.py         # sslstrip for legacy apps (opt-in, HSTS warning)
│   │   ├── http_logger.py           # Log every URL, header, POST body, cookie (requires MITM)
│   │   ├── file_extractor.py        # Carve files from HTTP/SMB/FTP traffic in real-time
│   │   ├── session_hijacker.py      # Capture cookies, session tokens, JWT from intercepted traffic
│   │   ├── js_injector.py           # Inject keyloggers or BeEF hooks into HTTP responses
│   │   ├── mitmproxy_mgr.py         # Full HTTPS interception with generated certs
│   │   ├── ntlm_relay.py            # ntlmrelayx integration, coordinated with Responder
│   │   └── cloud_token_active.py    # Extract tokens from MITM'd HTTPS traffic
│   │
│   ├── connectivity/
│   │   ├── __init__.py
│   │   ├── tailscale.py             # Tailscale lifecycle, auth, health
│   │   ├── wireguard.py             # WireGuard tunnel management
│   │   ├── bridge.py                # Transparent inline bridge (USB eth + onboard)
│   │   ├── wifi_client.py           # WiFi client mode, network selection
│   │   ├── reverse_tunnel.py        # SSH reverse tunnel fallback
│   │   ├── cellular_backup.py       # LTE modem HAT for out-of-band access (optional)
│   │   └── ble_emergency.py         # BLE emergency access channel (optional)
│   │
│   ├── stealth/
│   │   ├── __init__.py
│   │   ├── mac_manager.py           # MAC randomization / cloning
│   │   ├── process_disguise.py      # Process name/cmdline spoofing
│   │   ├── log_suppression.py       # Syslog filtering, audit rule injection
│   │   ├── encrypted_storage.py     # LUKS container management
│   │   ├── tmpfs_manager.py         # tmpfs mounts for sensitive ops
│   │   ├── watchdog.py              # Health monitoring, auto-restart services
│   │   ├── anti_forensics.py        # Timestomp, secure deletion
│   │   ├── traffic_mimicry.py       # 48h baseline + behavioral blending
│   │   ├── ja3_spoofer.py           # JA3/JA3S TLS fingerprint matching
│   │   ├── ids_tester.py            # Test actions against known IDS rulesets
│   │   ├── lkm_rootkit.py           # Optional LKM for process/file/net hiding (compromised host only)
│   │   └── overlayfs_manager.py     # SD card wear protection via overlayfs
│   │
│   └── intel/
│       ├── __init__.py
│       ├── credential_db.py         # SQLite credential store (all captured creds organized)
│       ├── topology_mapper.py       # Network graph construction, Graphviz export
│       ├── report_generator.py      # Engagement summary, timeline, findings
│       ├── net_intel.py             # Beacon detection, communication graphing
│       ├── user_timeline.py         # Per-user activity timeline (DNS + auth + traffic)
│       ├── supply_chain_detect.py   # Passive detection of internal repos, WSUS, CI/CD, registries
│       ├── change_detector.py       # Continuous network state diffing, burn detection
│       ├── security_posture.py      # Map target defenses (EDR, SIEM, honeypots)
│       └── operator_audit.py        # Encrypted operator session/command audit trail
│
├── services/
│   ├── bigbrother-core.service      # Main daemon (disguised name in production)
│   ├── bigbrother-watchdog.service  # Watchdog / auto-recovery
│   ├── bigbrother-capture.service   # Packet capture (passive)
│   ├── bigbrother-passive.service   # All passive surveillance modules
│   ├── bigbrother-bridge.service    # Transparent bridge
│   └── bigbrother-tailscale.timer   # Tailscale health check timer
│
├── templates/
│   ├── captive_portals/
│   │   ├── corporate_login.html     # Corporate WiFi login mimic
│   │   ├── guest_wifi.html          # Guest WiFi terms page
│   │   ├── outlook_login.html       # O365 login clone
│   │   └── vpn_portal.html          # VPN portal clone
│   ├── dns_zones/
│   │   ├── redirect_all.zone        # Wildcard DNS redirect
│   │   └── selective.zone.j2        # Jinja2 template for targeted DNS
│   ├── hostapd/
│   │   ├── open.conf.j2             # Open AP config
│   │   └── wpa2.conf.j2             # WPA2 AP config
│   ├── responder/
│   │   └── Responder.conf.j2        # Responder config template
│   ├── beef/
│   │   └── hook.js.j2               # BeEF hook injection template
│   └── lkm/
│       ├── bb_hide.c                # Kernel module source
│       └── Makefile                 # Build for target kernel version
│
├── utils/
│   ├── __init__.py
│   ├── crypto.py                    # AES-256-GCM encryption, key derivation, wipe
│   ├── networking.py                # Interface enumeration, IP helpers, raw sockets
│   ├── logging.py                   # Encrypted rotating log, memory-only option
│   ├── stealth.py                   # OPSEC helpers (timing jitter, traffic shaping)
│   ├── resource.py                  # Memory/CPU profiling, Pi Zero limits
│   ├── permissions.py               # Capability checks, privilege escalation
│   └── config_loader.py             # YAML config parser with validation + defaults
│
├── data/
│   ├── oui.db                       # MAC OUI database (SQLite, compressed)
│   ├── os_sigs.db                   # Passive OS fingerprint signatures
│   ├── dhcp_fingerprints.db         # DHCP option 55 fingerprints (Fingerbank dataset)
│   ├── ids_rules/                   # Snort/Suricata rule snapshots for self-testing
│   │   ├── emerging-threats.rules
│   │   └── snort-community.rules
│   ├── ja3_fingerprints.db          # Known JA3 hashes for common browsers
│   └── bpf_filters/
│       ├── credentials.bpf          # BPF for credential protocols
│       ├── dns.bpf                  # BPF for DNS traffic
│       ├── discovery.bpf            # BPF for discovery traffic
│       └── full_capture.bpf         # BPF for full capture (minus noise)
│
├── tests/
│   ├── __init__.py
│   ├── test_engine.py               # Module lifecycle tests
│   ├── test_bus.py                   # Event bus tests
│   ├── test_crypto.py               # Encryption/wipe tests
│   ├── test_modules.py              # Module interface compliance tests
│   ├── test_resource.py             # Resource constraint tests
│   └── conftest.py                  # Pytest fixtures
│
├── scripts/
│   ├── setup_bridge.sh              # Bridge interface setup
│   ├── teardown_bridge.sh           # Bridge interface teardown
│   └── build_lkm.sh                # Compile rootkit LKM for target kernel
│
└── storage/                         # Runtime data (gitignored, LUKS-encrypted)
    ├── config/                      # Sensitive config (keys, auth, engagement details)
    ├── pcaps/                       # Rotated packet captures (zstd compressed)
    ├── creds/                       # Extracted credentials
    ├── dns_logs/                    # DNS query logs per host
    ├── sni_logs/                    # TLS SNI destination logs
    ├── emails/                      # Captured email content + attachments
    ├── files/                       # Carved files from traffic
    ├── voip/                        # SIP metadata + RTP audio captures
    ├── print_jobs/                  # Intercepted print spool data
    ├── intel/                       # Analysis outputs, topology graphs
    ├── baseline/                    # Traffic baseline data (48h capture)
    ├── audit/                       # Operator session/command audit trail
    └── logs/                        # Encrypted operation logs
```

---

## 3. Surveillance Modules

### 3.1 Passive Surveillance (24/7, zero noise, unsupervised)

22 passive modules. These start at deployment and run continuously without generating any network traffic. All receive packets via the capture bus (one AF_PACKET socket, demuxed to per-module queues).

---

#### `modules/passive/packet_capture.py` — Full Packet Capture

**Purpose**: Capture all network traffic to encrypted rotating PCAPs for offline analysis.

- Promiscuous mode on bridge or tap interface
- BPF filters: full capture, credentials-only, DNS-only, or custom
- PCAP rotation: size-based (100MB default) or time-based (1h default)
- AES-256-GCM encryption before writing to disk
- Snap length configurable: 96 bytes (headers only) for Pi Zero, 65535 (full) for Pi 4+
- Disk usage monitoring — auto-purge oldest PCAPs when threshold hit

**Resources**: RAM 30-80MB (snap length dependent), CPU 5-15%, disk varies
**Dependencies**: libpcap, scapy

---

#### `modules/passive/dns_logger.py` — DNS Query Logger

**Purpose**: Build per-host browsing history from DNS queries. Every domain every host resolves, timestamped.

- Capture DNS queries and responses (UDP/53, TCP/53)
- Per-source-IP log: timestamp, queried domain, response IPs, query type
- Aggregate into browsing profiles per host
- Detect internal DNS servers, split-horizon configurations
- Flag interesting domains: cloud services, security tools, update servers, webmail
- Flag hosts connecting to known DoH resolvers (1.1.1.1, 8.8.8.8, 9.9.9.9) — indicates DNS blind spot for that host
- When in MITM position: option to block DoH resolver IPs and strip HTTPS DNS records (type 65) to force plaintext DNS
- Batch inserts: buffer 1000 records, flush every 60s (reduces SQLite write contention)

**Resources**: RAM 15MB, CPU 2%, disk 5MB/day typical
**Dependencies**: scapy or dpkt

---

#### `modules/passive/tls_sni_extractor.py` — TLS SNI Extractor

**Purpose**: Log every HTTPS destination without decryption, from the ClientHello SNI field.

- Parse TLS ClientHello from TCP/443 (and other TLS ports)
- Extract Server Name Indication field — reveals destination even when encrypted
- Correlate with DNS logs for complete web activity picture
- Detect certificate pinning, TLS 1.3 encrypted SNI (ESNI/ECH) gaps
- **ECH limitation**: Encrypted Client Hello (Cloudflare, Google, Firefox) returns CDN dummy SNI — no passive mitigation. When in MITM position, blocking DoH forces DNS fallback but ECH requires full TLS interception.
- Log: timestamp, source IP, destination IP:port, SNI hostname, TLS version
- QUIC/HTTP3 SNI handled by separate `quic_analyzer.py` module

**Resources**: RAM 10MB, CPU 2%, disk 3MB/day typical
**Dependencies**: scapy or dpkt

---

#### `modules/passive/credential_sniffer.py` — Credential Sniffer

**Purpose**: Extract credentials from cleartext protocols and NTLM/Kerberos authentication.

- **Cleartext**: FTP (USER/PASS), HTTP Basic/Digest, HTTP form POST, SMTP AUTH, POP3 USER/PASS, IMAP LOGIN, Telnet, SNMP community strings, LDAP simple bind
- **NTLM**: Extract NTLMv1/v2 challenge-response from SMB, HTTP NTLM, LDAP NTLM, MSSQL NTLM
- **Kerberos**: Extract encrypted timestamps from AS-REQ (password spray targets)
- Output: hashcat-compatible format, stored in credential_db
- Publishes CREDENTIAL_FOUND events on bus

**Resources**: RAM 20MB, CPU 3%, disk 5MB
**Dependencies**: scapy, impacket (for NTLM/Kerberos parsing)

---

#### `modules/passive/kerberos_harvester.py` — Kerberos Ticket Harvester

**Purpose**: Extract Kerberos tickets from network traffic for offline cracking.

- **AS-REQ**: Extract encrypted timestamps (hashcat mode 7500)
- **AS-REP**: Extract hashes for accounts without pre-auth (hashcat mode 18200) — AS-REP roasting from the wire
- **TGS-REQ**: Log SPN requests — reveals what services users access
- **TGS-REP**: Extract service ticket hashes (hashcat mode 13100) — Kerberoasting from the wire
- Identify domain controllers, realm names, user principal names
- Feed all hashes into credential_db

**Resources**: RAM 15MB, CPU 3%, disk 10MB
**Dependencies**: scapy, impacket

---

#### `modules/passive/host_discovery.py` — Host Discovery

**Purpose**: Build complete host inventory from passive network observation.

- ARP table monitoring (new MACs)
- DHCP request/ACK sniffing (hostname, vendor class, requested IP)
- DHCP option 55 (Parameter Request List) parsing for device fingerprinting via `data/dhcp_fingerprints.db` (Fingerbank dataset)
- mDNS/Bonjour service announcements
- NetBIOS name queries and responses
- SSDP/UPnP discovery traffic
- NBNS and LLMNR queries (hostname resolution attempts)
- Correlate: IP + MAC + hostname + vendor (OUI) + OS guess + DHCP fingerprint

**Resources**: RAM 15MB, CPU 2%, disk 5MB
**Dependencies**: scapy, data/oui.db, data/dhcp_fingerprints.db

---

#### `modules/passive/os_fingerprint.py` — Passive OS Fingerprinting

**Purpose**: Identify operating systems without sending any probes. p0f-style.

- TCP SYN/SYN-ACK analysis: window size, TTL, DF flag, MSS, window scaling, SACK, timestamps
- HTTP User-Agent header extraction
- DHCP vendor class identifier
- SMB dialect negotiation
- SSH version strings
- Confidence scoring per host, multiple evidence sources

**Resources**: RAM 10MB, CPU 2%, disk 2MB
**Dependencies**: scapy, data/os_sigs.db

---

#### `modules/passive/traffic_analyzer.py` — Traffic Analyzer

**Purpose**: Protocol distribution, flow analysis, bandwidth monitoring, beacon detection.

- Protocol breakdown: percentage by packet count and bytes
- Flow tracking: 5-tuple flows, duration, bytes transferred
- Top talkers: hosts by volume, connections, protocol diversity
- Beacon detection: regular-interval communications that suggest C2, heartbeats, or update checks
- Bandwidth profiling: hourly/daily patterns, anomaly detection
- Communication graphs: source-destination pairs with protocol and volume edges

**Resources**: RAM 25-60MB (flow table size), CPU 5%, disk 10MB
**Dependencies**: scapy

---

#### `modules/passive/vlan_discovery.py` — VLAN Discovery

**Purpose**: Map VLAN topology from passive observation.

- 802.1Q tag detection — identify VLANs in use
- DTP frame capture — detect trunk negotiation
- 802.1X/EAPOL frame detection — identify NAC-protected ports
- CDP/LLDP frame parsing — switch names, port IDs, VLAN assignments
- STP BPDU parsing — switch topology, root bridge identification

**Resources**: RAM 10MB, CPU 1%, disk 2MB
**Dependencies**: scapy

---

#### `modules/passive/network_mapper.py` — Network Relationship Mapper

**Purpose**: Build a comprehensive map of who talks to whom, how much, and over what protocols. Visual graph output.

- Track all communication pairs with protocol and volume metadata
- Identify servers (many inbound connections) vs clients (many outbound)
- Detect admin workstations (SSH/RDP to many hosts)
- Map printer relationships, file server access patterns
- Graphviz DOT output for topology visualization
- Periodic snapshots for change detection

**Resources**: RAM 20MB, CPU 3%, disk 5MB
**Dependencies**: scapy, graphviz (for rendering)

---

#### `modules/passive/auth_flow_tracker.py` — Authentication Flow Tracker

**Purpose**: Map who authenticates to what services and when, building per-user activity timelines.

- Track Kerberos TGT requests (AS-REQ) — user login events
- Track Kerberos service ticket requests (TGS-REQ) — service access
- Track NTLM authentication across protocols (SMB, HTTP, LDAP, MSSQL)
- Track SSH connection establishment
- Track LDAP binds
- Build per-user timeline: login time, services accessed, duration patterns
- Identify service accounts (authenticate to many hosts, regular intervals)

**Resources**: RAM 15MB, CPU 2%, disk 5MB
**Dependencies**: scapy, impacket

---

#### `modules/passive/smb_monitor.py` — SMB File Access Monitor

**Purpose**: Track file share access patterns — which users access which shares and files.

- Parse SMB2/3 tree connect requests — which shares are accessed
- Parse SMB2/3 create requests — which files are opened
- Track read/write operations per user per share
- Identify sensitive shares (SYSVOL, NETLOGON, C$, ADMIN$, custom shares)
- Log: timestamp, user, source IP, share name, file path, operation
- Detect GPP/Group Policy access patterns

**Resources**: RAM 15MB, CPU 2%, disk 5MB
**Dependencies**: scapy, impacket

---

#### `modules/passive/voip_capture.py` — VoIP/SIP Metadata Capture

**Purpose**: Capture call records, participants, duration. Optionally capture RTP audio if unencrypted.

- Parse SIP INVITE/BYE/CANCEL — call setup and teardown
- Extract: caller, callee, call-ID, codec, duration
- Track RTP streams associated with SIP sessions
- If RTP is unencrypted: capture audio to WAV files
- If SRTP: log metadata only (cannot decrypt)
- Detect VoIP infrastructure (PBX, SBC, trunks)

**Resources**: RAM 20MB + audio storage, CPU 3%, disk varies (audio intensive)
**Dependencies**: scapy, wave (stdlib)

---

#### `modules/passive/print_interceptor.py` — Print Job Interceptor

**Purpose**: Capture print spool data from network print traffic.

- Capture RAW print data (TCP/9100 — JetDirect/AppSocket)
- Capture LPD print data (TCP/515)
- Capture IPP print data (TCP/631)
- Extract PCL and PostScript content
- Convert to PDF where possible (Ghostscript)
- Log: timestamp, source IP, printer IP, job size, content preview

**Resources**: RAM 15MB, CPU 2%, disk varies (print job size)
**Dependencies**: scapy, ghostscript (optional, for PDF conversion)

---

#### `modules/passive/wireless_intel.py` — Wireless Intelligence

**Purpose**: Probe request collection, BLE scanning, WPA handshake capture, WIDS detection.

- Monitor mode on WiFi interface (requires capable adapter)
- Probe request collection — reveals client preferred network history
- BLE scanning — identify phones, badges, IoT devices
- WPA 4-way handshake passive capture from legitimate connections
- WIDS detection — identify wireless IDS by monitoring for correlation patterns
- Publishes HANDSHAKE_CAPTURED events

**Resources**: RAM 20MB, CPU 3%, disk 10MB
**Dependencies**: scapy, aircrack-ng (for monitor mode), bluez (for BLE)

---

#### `modules/passive/protocol_analyzer.py` — Protocol Deep Analyzer

**Purpose**: Zeek-style protocol dissection, service identification, certificate analysis.

- Protocol identification beyond port numbers (payload heuristics)
- Service banner extraction: version strings, server headers
- TLS certificate analysis: SANs, issuers, expiry, chain validation
- OT protocol detection: Modbus (502), DNP3 (20000), OPC UA (4840), S7comm, BACnet, EtherNet/IP
- HTTP/2 and QUIC identification
- Anomaly flagging: unusual protocols, new services, version changes

**Resources**: RAM 40MB, CPU 5%, disk 20MB
**Dependencies**: scapy, dpkt

---

#### `modules/passive/cloud_token_harvester.py` — Cloud Token Harvester (Passive)

**Purpose**: Passively extract cloud credentials and tokens from observed traffic.

- AWS: Access keys (AKIA*), secret keys, session tokens in HTTP headers/bodies
- Azure: Bearer tokens, refresh tokens in HTTP Authorization headers
- GCP: OAuth tokens, service account key patterns
- Generic: JWT tokens (decode header + claims), SAML assertions, OAuth authorization codes
- Only from cleartext protocols or already-decrypted MITM traffic
- Feed into credential_db with cloud provider context

**Resources**: RAM 15MB, CPU 2%, disk 5MB
**Dependencies**: scapy, pyjwt (for JWT decoding)

---

#### `modules/passive/email_sniffer.py` — Email Sniffer

**Purpose**: Capture email content and attachments from unencrypted SMTP/IMAP/POP3.

- Parse SMTP (TCP/25, 587) conversations — extract sender, recipients, subject, body, attachments
- Parse IMAP (TCP/143) FETCH responses — extract email content
- Parse POP3 (TCP/110) RETR responses — extract email content
- Decode MIME multipart, Base64 attachments, quoted-printable
- Store: per-email directory with headers, body text, and attachment files
- Only captures cleartext — encrypted (STARTTLS, SSL) requires MITM position

**Resources**: RAM 20MB, CPU 3%, disk varies (attachment size)
**Dependencies**: scapy, email (stdlib)

---

#### `modules/passive/ldap_harvester.py` — LDAP Query Harvester

**Purpose**: Parse LDAP search queries and responses to build a passive AD object inventory.

- Parse LDAP SearchRequest/SearchResponse on ports 389 (LDAP) and 3268 (Global Catalog)
- Extract: base DN, search filter, requested attributes, result entries
- Build inventory: users, groups, computers, GPOs, SPNs, delegation attributes
- Detect LAPS password reads (ms-Mcs-AdmPwd attribute requests)
- Identify enumeration patterns that reveal admin tools (BloodHound, ADFind, PowerView queries)
- Feed extracted objects into topology_mapper and credential_db (service account descriptions often contain passwords)

**Resources**: RAM 20MB, CPU 3%, disk 10MB
**Dependencies**: scapy, impacket (for LDAP parsing)

---

#### `modules/passive/rdp_monitor.py` — RDP Session Monitor

**Purpose**: Extract intelligence from RDP connection negotiation without decryption.

- Parse RDP NLA (Network Level Authentication) negotiation headers on TCP/3389
- Extract: username, domain, client hostname, keyboard layout, client build number
- Parse CredSSP to capture NTLM/Kerberos auth (feed to kerberos_harvester and credential_sniffer)
- Track admin-to-server session patterns: who RDPs where and when
- Identify jump boxes (hosts receiving many RDP sessions) and admin workstations (hosts initiating many)

**Resources**: RAM 15MB, CPU 2%, disk 5MB
**Dependencies**: scapy, impacket

---

#### `modules/passive/quic_analyzer.py` — QUIC/HTTP3 SNI Extractor

**Purpose**: Extract TLS SNI from QUIC Initial packets on UDP/443, covering the 30-40% of web traffic invisible to TCP-based TLS extraction.

- Parse QUIC Initial packets (RFC 9000) from UDP/443 traffic
- Decrypt Initial packet payload using connection ID-derived keys (standard per RFC 9001, not secret)
- Extract CRYPTO frames containing TLS ClientHello
- Parse SNI from embedded ClientHello — same format as TCP TLS
- Feed results into tls_sni_extractor's log format for unified SNI visibility

**Resources**: RAM 10MB, CPU 2%, disk 3MB/day
**Dependencies**: scapy

---

#### `modules/passive/db_interceptor.py` — Database Protocol Interceptor

**Purpose**: Parse database wire protocols to extract login sequences, queries, and credential-containing statements.

- **MSSQL TDS** (TCP/1433): login packets (username, hostname, app name), SQL batch queries
- **MySQL** (TCP/3306): handshake (server version, auth plugin), login, query packets
- **PostgreSQL** (TCP/5432): startup (user, database), simple/extended query protocol
- **Redis** (TCP/6379): AUTH commands, key operations (detect credential storage patterns)
- **MongoDB** (TCP/27017): OP_MSG/OP_QUERY for auth, find, and aggregate operations
- Flag credential-containing queries (`INSERT INTO users`, `SET password`, connection strings)
- Extract result metadata (row counts, column names) without storing full result sets

**Resources**: RAM 25MB, CPU 3%, disk 10MB
**Dependencies**: scapy, impacket

---

### 3.2 Active Surveillance (operator-enabled, then runs unattended)

These modules require explicit operator activation. Once configured and started, they run without further interaction.

---

#### `modules/active/arp_spoof.py` — ARP Spoofing

**Purpose**: Become the man-in-the-middle by poisoning ARP caches. All target traffic flows through the implant.

- Gratuitous ARP replies to targets, impersonating gateway
- Gratuitous ARP replies to gateway, impersonating targets
- IP forwarding enabled to maintain connectivity
- Target list: specific hosts (not full subnet — less noise)
- Rate-limited ARP replies with jitter
- Restore original ARP entries on stop

**Resources**: RAM 10MB, CPU 2%
**Dependencies**: scapy, iptables

---

#### `modules/active/dns_poison.py` — DNS Poisoning

**Purpose**: Redirect DNS queries to capture credentials or redirect users to cloned sites.

- DNS response injection — race legitimate DNS server
- Selective targeting: specific domains only, forward everything else
- Redirect to captive portal (credential capture)
- Redirect to cloned services (phishing)
- Wildcard mode (redirect all) or targeted mode (redirect specific domains)
- Jinja2 zone templates for flexible configuration

**Resources**: RAM 10MB, CPU 2%
**Dependencies**: scapy, dnslib

---

#### `modules/active/dhcp_spoof.py` — DHCP Spoofing

**Purpose**: Rogue DHCP server to set implant as gateway and/or DNS server for new clients.

- Respond to DHCP DISCOVER before legitimate server (race condition)
- Set implant IP as default gateway — all traffic routes through implant
- Set implant IP as DNS server — all DNS queries visible
- Configurable lease time, subnet mask, DNS settings
- Target specific MACs or respond to all

**Resources**: RAM 10MB, CPU 1%
**Dependencies**: scapy

---

#### `modules/active/evil_twin.py` — Evil Twin AP

**Purpose**: Rogue access point with captive portal for credential harvesting.

- hostapd-based AP matching target SSID
- Open or WPA2 mode
- Captive portal serving credential harvesting pages (corporate login, O365, guest WiFi)
- Optional deauth of target AP to force client migration
- Captured credentials fed to credential_db
- Channel selection to minimize interference

**Resources**: RAM 30MB, CPU 5%
**Dependencies**: hostapd, dnsmasq, iptables, USB WiFi adapter

---

#### `modules/active/ipv6_slaac.py` — IPv6 SLAAC Spoofing

**Purpose**: Become IPv6 default gateway via Router Advertisements. Bypasses IPv4-only defenses like DAI.

- Send Router Advertisement messages with implant as default gateway
- Targets automatically configure IPv6 address and route through implant
- DNS via Router Advertisement — set implant as IPv6 DNS
- Most networks have no IPv6 RA Guard deployed
- Combine with DNS poisoning for credential capture
- Works alongside mitm6 (pre-installed tool)

**Resources**: RAM 10MB, CPU 2%
**Dependencies**: scapy

---

#### `modules/active/responder_mgr.py` — Responder Manager

**Purpose**: Manage the Responder process for LLMNR/NBT-NS/mDNS poisoning and NTLMv2 hash capture.

- Start/stop/monitor Responder subprocess
- Configure via Responder.conf.j2 template (enable/disable protocols)
- Parse Responder output for captured hashes
- Feed hashes into credential_db automatically
- Coordinate with ntlm_relay for relay attacks
- This manages Responder — operator can also run Responder directly

**Resources**: RAM 30MB (Responder process), CPU 3%
**Dependencies**: Responder (installed by setup.sh)

---

#### `modules/active/ssl_downgrade.py` — SSL Downgrade

**Purpose**: sslstrip for legacy applications. Opt-in only.

- Disabled by default — requires explicit enable in modules.yaml
- Warning on activation about HSTS rendering this mostly ineffective
- Strip HTTPS redirects from HTTP responses
- Only useful against legacy internal apps without HSTS
- For modern HTTPS interception, use mitmproxy_mgr instead

**Resources**: RAM 15MB, CPU 2%
**Dependencies**: iptables, scapy

---

#### `modules/active/http_logger.py` — HTTP Transaction Logger

**Purpose**: When in MITM position, log every HTTP transaction: URL, headers, POST body, cookies.

- Requires active MITM (arp_spoof, dhcp_spoof, or ipv6_slaac running)
- Log full URL including query parameters
- Log request and response headers
- Log POST/PUT body content (form data, JSON, XML)
- Extract and log cookies (session tokens, auth cookies)
- Configurable: log all or filter by content-type/URL pattern

**Resources**: RAM 20MB, CPU 3%, disk varies
**Dependencies**: scapy or mitmproxy

---

#### `modules/active/file_extractor.py` — File Extractor

**Purpose**: Carve files from HTTP/SMB/FTP traffic in real-time.

- Requires MITM position for HTTPS content
- HTTP: reconstruct files from chunked/gzip responses
- SMB: extract files from SMB2/3 read responses
- FTP: capture files from data connections
- Detect file type by magic bytes, store with metadata
- Filter: all files or specific types (documents, executables, archives)

**Resources**: RAM 40MB, CPU 5%, disk varies heavily
**Dependencies**: scapy, python-magic

---

#### `modules/active/session_hijacker.py` — Session Hijacker

**Purpose**: Capture cookies, session tokens, and JWT from intercepted traffic.

- Requires MITM position
- Extract Set-Cookie and Cookie headers from HTTP
- Extract Authorization headers (Bearer tokens, Basic auth)
- Extract JWT tokens from headers, URL parameters, POST bodies
- Parse JWT claims (expiry, scope, user info)
- Store in credential_db with service context and expiry

**Resources**: RAM 15MB, CPU 2%, disk 5MB
**Dependencies**: scapy, pyjwt

---

#### `modules/active/js_injector.py` — JavaScript/HTML Injection

**Purpose**: Inject keyloggers or BeEF hooks into HTTP responses when in MITM position.

- Requires MITM position (HTTP only — HTTPS needs mitmproxy_mgr)
- Inject `<script>` tag into HTML responses before `</body>`
- Payloads: keylogger (POST keystrokes to implant), BeEF hook, custom JS
- Selective injection by target IP, domain, or URL pattern
- BeEF hook template included
- Captured keystrokes stored in credential_db

**Resources**: RAM 15MB, CPU 2%
**Dependencies**: scapy or mitmproxy

---

#### `modules/active/mitmproxy_mgr.py` — mitmproxy Integration

**Purpose**: Full HTTPS interception with on-the-fly generated certificates. Operator activates knowing this causes certificate warnings.

- Manage mitmproxy process in transparent mode
- Generate CA cert (operator must install on targets or accept warnings)
- Full request/response logging for HTTPS traffic
- Script hooks for credential extraction, file carving, injection
- Provides decrypted traffic to other modules (http_logger, file_extractor, cloud_token_active)
- Not available on Pi Zero 2W (RAM constraint)

**Resources**: RAM 100-200MB, CPU 10-20%
**Dependencies**: mitmproxy (installed by setup.sh), iptables

---

#### `modules/active/ntlm_relay.py` — NTLM Relay

**Purpose**: ntlmrelayx integration for relaying captured NTLM authentication.

- Manage ntlmrelayx process (from Impacket)
- Relay targets: SMB, LDAP, LDAPS, HTTP, MSSQL, ADCS HTTP enrollment
- Coordinate with responder_mgr — Responder captures, ntlmrelayx relays
- Coordinate with operator running coercion tools (PetitPotam, PrinterBug)
- ADCS ESC8 relay: relay to HTTP enrollment endpoint for certificate issuance
- LDAP relay: add users, modify ACLs, add replication rights for DCSync
- Output: relay results, captured credentials, obtained certificates

**Resources**: RAM 40MB (ntlmrelayx process), CPU 5%
**Dependencies**: impacket (installed by setup.sh)

---

#### `modules/active/cloud_token_active.py` — Cloud Token Harvester (Active)

**Purpose**: Extract cloud tokens from MITM'd HTTPS traffic. Enhanced version of passive harvester.

- Requires mitmproxy_mgr running (decrypted HTTPS)
- AWS: STS AssumeRole responses, console session tokens
- Azure: MSAL/ADAL token responses, Graph API tokens
- GCP: OAuth token responses, metadata server responses
- Generic: All JWT tokens, SAML assertions in decrypted HTTPS
- Enrichment: decode tokens, extract scopes, check expiry

**Resources**: RAM 15MB, CPU 2%, disk 5MB
**Dependencies**: mitmproxy, pyjwt

---

### 3.3 Intelligence & Analysis

---

#### `modules/intel/credential_db.py` — Credential Database

**Purpose**: Central SQLite store for all captured credentials, organized and deduplicated.

- Schema: source_module, timestamp, source_ip, target_ip, target_service, username, domain, credential_type (cleartext/ntlmv1/ntlmv2/kerberos_tgs/kerberos_asrep/jwt/cookie/cloud_token), credential_value, hashcat_mode, cracked_value, notes
- Deduplication on (target_service, username, credential_type, credential_value)
- Export: hashcat format (by mode), CSV, JSON
- Query interface: by host, user, service, type, time range
- Statistics: credential count by type, crack rate

**Resources**: RAM 10MB, CPU 1%, disk varies
**Dependencies**: sqlite3 (stdlib)

---

#### `modules/intel/topology_mapper.py` — Network Topology Mapper

**Purpose**: Generate network topology diagrams from collected data.

- Aggregate data from host_discovery, network_mapper, vlan_discovery
- Generate Graphviz DOT files for network diagrams
- Node types: workstation, server, printer, router, switch, AP, unknown
- Edge types: colored by protocol (SMB=blue, SSH=green, HTTP=orange, etc.)
- VLAN boundaries, subnet groupings
- Export: DOT, SVG, PNG

**Resources**: RAM 15MB, CPU 2%, disk 5MB
**Dependencies**: graphviz

---

#### `modules/intel/report_generator.py` — Engagement Report Generator

**Purpose**: Generate engagement summary with timeline, findings, and topology.

- Engagement timeline: chronological event log with timestamps
- Credential report: all captured credentials, sources, crack status
- Topology diagram: auto-generated network map
- Host inventory: all discovered hosts with OS, services, notes
- Traffic statistics: protocol distribution, top talkers, bandwidth
- Export: Markdown and HTML

**Resources**: RAM 15MB, CPU 2%, disk 5MB
**Dependencies**: jinja2

---

#### `modules/intel/net_intel.py` — Network Intelligence

**Purpose**: Beacon detection, communication graphing, existing C2/malware detection.

- Beacon detection: identify regular-interval communications (C2 beacons, heartbeats, update checks)
- Communication graphing: trust relationships, admin access patterns
- Anomaly baseline: what is normal traffic so implant can blend in
- Service dependency mapping: identify critical services
- Detect existing compromises on the network (other attackers' C2)

**Resources**: RAM 20MB, CPU 3%, disk 5MB
**Dependencies**: numpy (optional, for statistical analysis)

---

#### `modules/intel/user_timeline.py` — Per-User Activity Timeline

**Purpose**: Build detailed per-user activity timelines from DNS, auth, traffic, and SMB data.

- Aggregate from: dns_logger, auth_flow_tracker, smb_monitor, credential_sniffer
- Per-user view: login times, services accessed, files opened, websites visited, email activity
- Identify: work hours, break patterns, admin activity windows
- Identify: service accounts (24/7 activity, many hosts)
- Export: per-user JSON timeline, summary report

**Resources**: RAM 15MB, CPU 2%, disk 5MB
**Dependencies**: sqlite3 (stdlib)

---

#### `modules/intel/supply_chain_detect.py` — Supply Chain Detection

**Purpose**: Passively detect internal infrastructure that represents supply chain attack surfaces.

- Internal package repos: PyPI mirrors, npm registries, Maven, NuGet
- WSUS servers (Windows Update)
- Internal CA servers
- Configuration management: Puppet, Chef, Ansible, SCCM endpoints
- Container registries: Docker, Harbor
- CI/CD systems: Jenkins, GitLab, TeamCity
- Output: list of supply chain targets for operator awareness
- Detection only — no exploitation, no interaction

**Resources**: RAM 10MB, CPU 1%, disk 2MB
**Dependencies**: scapy

---

#### `modules/intel/change_detector.py` — Network Change Detection

**Purpose**: Continuously diff network state against baseline. Early warning system for IR activity and burn detection.

- After baseline period, snapshot network state hourly: hosts, services, connection patterns
- Alert on: new hosts appearing, new services on existing hosts, hosts disappearing
- Alert on: security tool traffic (connections to known EDR/SIEM update domains)
- Alert on: scan activity targeting the implant's segment (port sweeps, ARP scans)
- Alert on: unusual auth patterns (new admin accounts, bulk password changes)
- Publishes CHANGE_DETECTED events on bus with severity (INFO/WARN/CRITICAL)
- Critical changes (potential IR activity, new security tools) logged for operator triage

**Resources**: RAM 15MB, CPU 2%, disk 5MB
**Dependencies**: sqlite3 (stdlib)

---

#### `modules/intel/security_posture.py` — Security Posture Mapper

**Purpose**: Passively map the target's defensive infrastructure. Know what you're up against before going active.

- Detect EDR update traffic: CrowdStrike (ts01-b.cloudsink.net), SentinelOne, Carbon Black, Defender ATP
- Detect SIEM log forwarding: syslog to collectors, Splunk HEC (TCP/8088), Wazuh agent traffic
- Detect vulnerability scanners: Nessus, Qualys, Rapid7 scan patterns
- Detect honeypots: Thinkst Canary traffic patterns, HoneyComb, T-Pot signatures
- Detect network taps: SPAN port indicators, packet broker traffic (Gigamon, Keysight)
- Detect NAC infrastructure: 802.1X RADIUS, Forescout, ISE traffic patterns
- Output: defense inventory with confidence scores, gates active module risk assessment

**Resources**: RAM 10MB, CPU 2%, disk 5MB
**Dependencies**: scapy

---

#### `modules/intel/operator_audit.py` — Operator Audit Trail

**Purpose**: Log operator SSH sessions and commands to encrypted storage for engagement reporting and legal protection.

- Hook via PROMPT_COMMAND to capture shell commands when operator SSHes in
- Log: timestamp, SSH session ID, username, command, working directory
- Log BigBrother CLI invocations with arguments
- All audit data written to LUKS-encrypted `storage/audit/` — never to system logs
- Tamper-evident: append-only log with HMAC chain
- Export: timeline format for engagement reports and deconfliction

**Resources**: RAM 5MB, CPU 0.5%, disk varies
**Dependencies**: sqlite3 (stdlib)

---

## 4. Connectivity

### `modules/connectivity/tailscale.py` — Tailscale (Primary)

**Purpose**: Primary operator access via Tailscale mesh VPN.

- Install and authenticate Tailscale on deployment
- Pre-auth key with engagement-specific ACL tags
- Hostname matches device disguise (e.g., "iot-sensor-03")
- Health monitoring: check Tailscale state, re-auth if needed
- Operator SSHes over Tailscale to use pre-installed tools
- Looks like HTTPS to Derp relay servers on the network

**Resources**: RAM 30MB, CPU 2%
**Dependencies**: tailscale (installed by setup.sh)

---

### `modules/connectivity/wireguard.py` — WireGuard (Fallback)

**Purpose**: Fallback VPN if Tailscale is blocked or unavailable.

- WireGuard tunnel to operator's endpoint
- Pre-configured keys, minimal handshake
- UDP-based, single port, encrypted
- Automatic keepalive for NAT traversal
- Lower overhead than Tailscale

**Resources**: RAM 5MB, CPU 1%
**Dependencies**: wireguard-tools

---

### `modules/connectivity/bridge.py` — Transparent Inline Bridge

**Purpose**: Insert implant inline between target host and switch. Invisible at L2/L3.

- Bridge two Ethernet interfaces (USB eth + onboard)
- No IP address on bridge interfaces — invisible on network
- EAP/EAPOL passthrough for 802.1X environments
- All traffic passes through — available for passive capture
- Clone victim MAC for implant's own traffic
- Disable STP on bridge, suppress BPDU frame emission via ebtables
- Filter CDP/LLDP emission from bridge interfaces (receive only, never transmit)
- Failsafe: lightweight C watchdog checks bridge forwarding every 5s, direct passthrough if down >10s

**Resources**: RAM 10MB, CPU 2%
**Dependencies**: bridge-utils, ebtables, scripts/setup_bridge.sh

---

### `modules/connectivity/wifi_client.py` — WiFi Client Mode

**Purpose**: Connect to target WiFi network for access.

- wpa_supplicant managed connection
- Support for WPA2-PSK, WPA2-Enterprise (PEAP/EAP-TLS)
- Network selection from config
- Signal strength monitoring
- Roaming support

**Resources**: RAM 10MB, CPU 1%
**Dependencies**: wpa_supplicant, wireless-tools

---

### `modules/connectivity/reverse_tunnel.py` — Reverse SSH Tunnel

**Purpose**: Fallback access when VPN is blocked. SSH out to operator-controlled server.

- autossh for persistent reverse tunnel
- Operator connects: ssh -J jumphost -p tunnel_port implant
- Dynamic port forwarding (SOCKS proxy) option
- Multiple tunnel endpoints for redundancy
- SSH-over-WebSocket or SSH tunneled inside TLS (stunnel/ncat --ssl) — never raw SSH on 443 (DPI detects SSH banner on non-SSH ports)

**Resources**: RAM 15MB, CPU 1%
**Dependencies**: autossh, openssh-client, stunnel4 or ncat

---

### `modules/connectivity/cellular_backup.py` — Cellular Backup (Optional)

**Purpose**: Out-of-band access via LTE modem when target network blocks all tunneling.

- LTE modem HAT support (SIM7600, EC25)
- AT command interface, PPP connection
- Completely independent of target network
- Power-hungry (~2W continuous) — Pi 4 only
- Requires pre-provisioned SIM card

**Resources**: RAM 15MB, CPU 2%, power 2W
**Dependencies**: ppp, usb-modeswitch, LTE modem HAT

---

### `modules/connectivity/ble_emergency.py` — BLE Emergency Access (Optional)

**Purpose**: Local emergency access via Bluetooth Low Energy when all network access is down.

- BLE GATT server, ~10m range
- PSK-based challenge-response authentication
- Commands: status, kill, reboot
- Always-on, minimal power (~0.1W)
- Use case: operator physically near implant, network C2 down

**Resources**: RAM 5MB, CPU 0.5%
**Dependencies**: bluez

---

## 5. Stealth

### `modules/stealth/mac_manager.py` — MAC Randomization/Cloning

- Change from Raspberry Pi OUI (B8:27:EB, DC:A6:32, E4:5F:01) to common vendor
- Clone a specific MAC observed on network
- Persist MAC across reboots
- Different MAC per interface if needed

---

### `modules/stealth/process_disguise.py` — Process Disguise

- Rename all BigBrother processes to match legitimate system services
- Spoof /proc/self/cmdline, /proc/self/comm
- Systemd service descriptions use innocuous names
- `ps aux` shows nothing suspicious

---

### `modules/stealth/log_suppression.py` — Log Suppression

- rsyslog filter rules to drop implant-related entries
- auditd rule exclusions for implant paths/PIDs
- journald rate-limit increase to prevent buffer overflow logging
- Clear: bash history (HISTFILE unset), utmp/wtmp/btmp entries

---

### `modules/stealth/encrypted_storage.py` — LUKS Encrypted Storage

- LUKS container for all sensitive data (pcaps, creds, logs, sensitive config)
- Boot-unlock via network-derived key: fetch value from C2 server, combine with device CPU serial via HKDF
- If C2 unreachable on boot: collect to tmpfs until operator reconnects, then flush to LUKS
- ALL config with sensitive data (WG keys, Tailscale auth, engagement name) stored inside LUKS at `storage/config/`
- Only `config/bigbrother.yaml` with non-sensitive defaults remains on plaintext filesystem
- LUKS header destruction = instant data unrecoverability (config, creds, pcaps — everything)
- If physically seized without C2 access + device serial: encrypted data is unrecoverable

---

### `modules/stealth/tmpfs_manager.py` — tmpfs for Sensitive Operations

- Mount tmpfs for active operation working directories
- Power loss = instant evidence destruction (RAM is volatile)
- Configurable size per mount point
- Used by active modules for temporary data

---

### `modules/stealth/watchdog.py` — Watchdog

- Monitor all BigBrother services
- Auto-restart crashed modules (max 3 restarts before disable)
- Health check: process alive, resource usage normal, connectivity up
- OOM priority: core=-500, passive=100, active=200 (active killed first)
- systemd Restart=on-failure integration

---

### `modules/stealth/anti_forensics.py` — Anti-Forensics

- Timestomp all created files to match OS install date
- Secure deletion (shred) for removed files
- No core dumps (ulimit -c 0)
- No swap (or encrypted swap only)
- Clear filesystem journal entries related to implant

---

### `modules/stealth/traffic_mimicry.py` — Traffic Mimicry

- **Phase 1** (48h baseline): Capture normal traffic patterns — protocols, volumes, timing, destinations. Build statistical model.
- **Phase 2** (behavioral blending): Shape implant traffic to match baseline. Exfil timed to match normal upload patterns. C2 beacon intervals matched to existing periodic traffic. DNS query rate matched to normal resolution rate.

---

### `modules/stealth/ja3_spoofer.py` — JA3 Fingerprint Spoofing

- Modify TLS ClientHello to match known browser JA3 hashes
- Database of current Chrome, Firefox, Edge JA3 fingerprints
- Applied to all outbound HTTPS (C2, data transfer)
- Prevents JA3-based detection of non-browser TLS clients

---

### `modules/stealth/ids_tester.py` — IDS Self-Testing

- Load Snort/Suricata rule snapshots from data/ids_rules/
- Before going active, check planned actions against known signatures
- Rate detection risk per proposed action
- Rule snapshots bundled at deploy time

---

### `modules/stealth/lkm_rootkit.py` — LKM Rootkit (Optional)

- Loadable kernel module for compromised host deployment (not Pi)
- Hides: processes from /proc, files from readdir, network connections from /proc/net/tcp|udp, module from lsmod
- Compiled for target kernel (scripts/build_lkm.sh)
- Requires matching kernel headers
- Operator explicitly loads — never auto-loaded

---

### `modules/stealth/overlayfs_manager.py` — overlayfs SD Card Protection

- Root filesystem as overlayfs (read-only base + tmpfs overlay)
- All writes go to RAM — SD card sees zero write activity
- Forensics: writes vanish on reboot (only LUKS container persists)
- Configured at boot via initramfs hook
- All hardware tiers (Pi Zero gets smaller overlay)

---

## 6. Pre-installed Tools

These are installed by `setup.sh`. The operator runs them directly via SSH. BigBrother does not wrap them in Python.

| Tool | Purpose |
|---|---|
| **nmap** | Port scanning, service detection, NSE scripts |
| **masscan** | High-speed port scanning |
| **Certipy** | AD Certificate Services enumeration and attacks |
| **Impacket** | secretsdump, ntlmrelayx, smbexec, wmiexec, psexec, GetUserSPNs, GetNPUsers, smbclient, mssqlclient, dcomexec, atexec, getTGT, getST, etc. |
| **BloodHound.py** | AD data collection (Python ingestor) |
| **Responder** | LLMNR/NBT-NS/mDNS poisoning (also managed by BB for unattended mode) |
| **CrackMapExec / NetExec** | Network authentication testing, enumeration, command execution |
| **Coercer** | All coercion methods (PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce) |
| **PetitPotam.py** | Standalone MS-EFSRPC coercion (backup for Coercer) |
| **Chisel** | TCP/UDP tunneling over HTTP, SOCKS proxy |
| **Ligolo-ng** | Tunneling/pivoting (agent on target, proxy on implant) |
| **proxychains-ng** | Proxy chain routing for tool traffic |
| **socat** | Multipurpose relay (TCP/UDP/Unix sockets) |
| **sshuttle** | Transparent SSH-based VPN/pivot |
| **mitm6** | IPv6 MITM with WPAD abuse |
| **Bettercap** | Network attack and monitoring (ARP, DNS, WiFi, BLE) |
| **tcpdump** | Packet capture CLI |
| **tshark** | Wireshark CLI — protocol analysis, PCAP processing |
| **mitmproxy** | HTTPS interception proxy (also managed by BB module) |
| **iodine** | DNS tunnel |
| **autossh** | Persistent SSH tunnels |
| **aircrack-ng** | WiFi capture and cracking suite |
| **hashcat** | Password/hash cracking (if GPU available on Debian host) |
| **evil-winrm** | WinRM shell with upload/download |
| **enum4linux-ng** | SMB/NetBIOS enumeration |
| **kerbrute** | Kerberos brute-force / user enumeration |
| **pypykatz** | Mimikatz in Python (LSASS, DPAPI, registry) |
| **ldapdomaindump** | Fast AD enumeration after first credential |
| **smbmap** | SMB share enumeration and access |
| **ROADtools** | Azure/Entra ID recon (Pi 4 and Debian host only) |

---

## 7. Core Framework

### `bigbrother.py` — Main CLI + Interactive Menu

Single entry point. Click CLI for scripting, Rich TUI for interactive operator use.

```
Click Commands:
    start       — Start passive surveillance (all passive modules)
    stop        — Stop all modules gracefully
    status      — Show module status, resource usage, connectivity
    activate    — Activate a specific active module
    deactivate  — Deactivate a specific active module
    kill        — Execute kill switch (manual wipe)
    creds       — Query credential database
    intel       — Generate intelligence report
    triage      — Delta view since last check-in (new creds, hosts, anomalies, errors)
    timeline    — Show per-user activity timeline
    topology    — Generate network topology map
    baseline    — Run 48h traffic baseline capture
    config      — View/edit current configuration
    selftest    — Run pre-flight self-test

Interactive Menu (Rich-based):
    [S] Status Dashboard    — Module status, resource gauges, connectivity
    [P] Passive Modules     — Start/stop/configure each
    [A] Active Modules      — Activate/configure/deactivate each
    [C] Credentials         — Browse/search/export captured creds
    [I] Intelligence        — Topology, traffic, timelines, reports
    [N] Network             — Interface status, bridge, connectivity
    [W] Wireless            — Probe reqs, BLE scan, WPA capture
    [K] Kill Switch         — Confirmation + wipe
    [Q] Quit
```

### `core/engine.py` — Module Lifecycle Manager

- **Multiprocess model**: each module runs as a separate process — one crash does not kill capture or other modules
- Discover, load, start, stop, and monitor all modules via process supervision
- Dependency resolution: modules declare dependencies, engine starts in order
- Resource budgeting: check remaining RAM/CPU before starting module
- Hardware tier enforcement: Pi Zero 2W gets hard module limits (4 passive max)
- Interface conflict detection: prevents two modules from claiming the same interface in incompatible modes (e.g., monitor mode vs managed mode on wlan0)
- Graceful degradation: if module fails, others continue
- Optional scope enforcement: when `config/scope.yaml` is loaded, active modules validate targets against in-scope IP ranges/hostnames/domains before acting

### `core/capture_bus.py` — Packet Capture Bus

Single privileged AF_PACKET socket captures all traffic, demultiplexes to per-module queues by protocol/port. Reduces kernel socket overhead from N modules to 1.

- One capture process with CAP_NET_RAW opens promiscuous socket on bridge/tap interface
- Modules subscribe to packet queues by BPF filter expression (e.g., "tcp port 389" for ldap_harvester)
- Packets dispatched to per-module multiprocessing queues via shared memory
- Module crash does not affect capture process or other modules
- Queue backpressure: if a module falls behind, oldest packets dropped from its queue (not others)
- Stats: per-module packet count, queue depth, drop count

### `core/bus.py` — Internal Event Bus

Pub/sub between modules. Event types:

```
CREDENTIAL_FOUND    HOST_DISCOVERED     PCAP_ROTATED
MODULE_STARTED      MODULE_STOPPED      MODULE_ERROR
RESOURCE_WARNING    RESOURCE_CRITICAL   KILL_SWITCH
CONNECTIVITY_CHANGED  VLAN_DETECTED     HANDSHAKE_CAPTURED
TICKET_HARVESTED    CLOUD_TOKEN_FOUND   BEACON_DETECTED
CHANGE_DETECTED     THERMAL_WARNING     SCOPE_VIOLATION
```

### `core/state.py` — Persistent State

Single SQLite database with schema-separated tables (not multiple DB files). WAL mode with dedicated async writer thread — all modules submit writes to a queue, writer batches with 500ms coalesce window. PRAGMA synchronous=NORMAL, busy_timeout=30s. WAL files on tmpfs with periodic checkpoint to SD card (accept up to 30 minutes data loss on power failure for SD longevity). Stores module states, discovered hosts, running configuration. Survives reboots.

### `core/scheduler.py` — Task Scheduler

Cron-like scheduler with jitter support. Used for: PCAP rotation, periodic health checks, baseline captures, data pruning.

### `core/resource_monitor.py` — Resource Monitor

Tracks per-module RAM/CPU/disk. Enforces hardware tier limits. Kills lowest-priority module on OOM. Alerts on disk space threshold. Reads `/sys/class/thermal/thermal_zone0/temp` every 30s — publishes THERMAL_WARNING at 55C, sheds non-essential modules at 70C (Pi Zero throttles at 60C, Pi 4 at 80C).

### `core/kill_switch.py` — Kill Switch

Manual wipe tool. Operator triggers via CLI command, remote SSH, BLE, or dead man's switch (configurable).

```
Wipe sequence:
    1. Stop all modules
    2. Destroy LUKS header (milliseconds — data instantly unrecoverable)
    3. Shred encryption keys
    4. Shred credential database
    5. dd zero-fill data partition (belt and suspenders)
    6. Clear RAM (smemcap or /proc/sys/vm/drop_caches)
    7. Reboot

If interrupted: boot flag triggers auto-complete on next boot.
```

---

## 8. Setup & Bootstrap

### `setup.sh` — Idempotent Bootstrap

Detects platform (Pi Zero 2W / Pi 4 / generic Debian) and installs accordingly.

**System packages:**

```
python3 python3-venv python3-dev build-essential libssl-dev libffi-dev
libpcap-dev libnetfilter-queue-dev bridge-utils ebtables iptables nftables
iproute2 net-tools tcpdump tshark nmap masscan dnsutils hostapd dnsmasq
wireless-tools wpasupplicant aircrack-ng wireguard-tools cryptsetup
curl wget git jq tmux screen autossh bluez libbluetooth-dev
ppp usb-modeswitch ghostscript iodine bettercap
```

**Python venv (`.venv/`):**

```
click rich pyyaml cryptography scapy netfilterqueue impacket certipy-ad
bloodhound dnslib requests dpkt pyjwt python-magic numpy graphviz jinja2
mitmproxy (Pi 4+ only)
```

**Tools from GitHub/pipx (to `/opt/tools/`):**

```
Responder (git clone), CrackMapExec/NetExec (pipx), Chisel (binary),
Ligolo-ng (binary), mitm6 (pipx), evil-winrm, enum4linux-ng (pipx),
kerbrute (binary), Coercer (pipx), PetitPotam.py (git clone),
pypykatz (pipx), ldapdomaindump (pipx), smbmap (pipx),
ROADtools (pipx, Pi 4+ only)
```

**System packages (additional):**

```
proxychains-ng socat sshuttle
```

**Kernel config:** IP forwarding (v4+v6), no send_redirects.

**Pi optimizations:** gpu_mem=16, disable bluetooth/avahi, no swap.

**Directories:** `storage/{config,pcaps,creds,dns_logs,sni_logs,emails,files,voip,print_jobs,intel,baseline,audit,logs}` with mode 700.

### Systemd Services

All service descriptions use innocuous names.

| Service File | Visible Description | Actual Function |
|---|---|---|
| `bigbrother-core.service` | System Thermal Management Daemon | Main daemon |
| `bigbrother-watchdog.service` | System Health Monitor | Watchdog |
| `bigbrother-capture.service` | Network Interface Statistics Collector | Packet capture |
| `bigbrother-passive.service` | Network Device Monitor | All passive surveillance |
| `bigbrother-bridge.service` | Network Bridge Service | Transparent bridge |
| `bigbrother-tailscale.timer` | VPN Health Check Timer | Tailscale health |

Resource limits via systemd:
- Core: MemoryMax=400M, CPUQuota=70%
- Watchdog: MemoryMax=50M, CPUQuota=5%
- Capture: MemoryMax=100M, CPUQuota=20%
- Passive: MemoryMax=200M, CPUQuota=30%

---

## 9. Configuration

### `config/bigbrother.yaml` — Master Config (Plaintext FS)

Contains ONLY non-sensitive defaults. All keys, auth tokens, and engagement-identifying data live in `storage/config/` inside the LUKS container.

```yaml
device:
  platform: "auto"              # auto | pi_zero | pi4 | generic
  hostname: "iot-sensor-03"
  install_path: "/opt/.cache/bb"

network:
  primary_interface: "auto"
  bridge:
    enabled: false
    internal: "eth0"
    external: "eth1"
  wifi:
    interface: "wlan0"
  cellular:
    enabled: false
    modem_device: "/dev/ttyUSB0"
    apn: "internet"

connectivity:
  primary: "tailscale"
  failover_chain:
    - tailscale
    - wireguard
    - reverse_tunnel
    - cellular_backup

security:
  encryption_key_derive: "argon2id"  # argon2id | pbkdf2 (Pi Zero)
  dead_man_switch:
    enabled: false
    interval_hours: 24
    action: "wipe"

capture:
  pcap_rotation_mb: 100
  pcap_rotation_hours: 1
  pcap_compression: "zstd"      # zstd compression on rotation (local CPU, zero network signature)
  snap_length: "auto"           # auto (by hardware tier) | 96 | 65535
  bpf_filter: "full_capture"    # full_capture | credentials | dns | custom
  custom_bpf: ""
  disk_max_pct: 85              # Purge oldest PCAPs above this (128GB+ gives headroom)

operating_hours:
  enabled: false
  timezone: "America/New_York"
  active_start: "08:00"
  active_end: "18:00"
  weekend_active: false

baseline:
  duration_hours: 48
  auto_start: true
```

### `storage/config/` — Sensitive Config (Inside LUKS)

Created at deployment, populated before first network connection. Destroyed with LUKS header.

```yaml
# storage/config/engagement.yaml
engagement:
  name: "op-example"
  client: ""

# storage/config/connectivity.yaml
tailscale:
  auth_key: "tskey-..."
  hostname: "iot-sensor-03"
wireguard:
  private_key: ""
  peer_public_key: ""
  endpoint: ""
  allowed_ips: "10.100.0.0/24"
reverse_tunnel:
  server: ""
  port: 443
  key_path: ""
wifi:
  client_ssid: ""
  client_passphrase: ""
kill_passphrase_hash: ""
```

### `config/modules.yaml` — Module Configuration

All passive modules default to `enabled: true, autostart: true` (except `wireless_intel` which requires a monitor mode adapter). All active modules default to `enabled: false` and require operator activation.

Key active module parameters:

```yaml
active:
  arp_spoof:
    targets: []                 # Operator specifies target IPs
    gateway: "auto"
  dns_poison:
    domains: {}                 # domain: redirect_ip
    mode: "selective"           # selective | wildcard
  dhcp_spoof:
    pool_start: ""
    pool_end: ""
  evil_twin:
    ssid: ""
    channel: 6
    portal: "corporate_login"   # Template from templates/captive_portals/
  responder_mgr:
    protocols: {llmnr: true, nbtns: true, mdns: true}
  ssl_downgrade:
    explicit_enable: false      # Double opt-in required
  http_logger:
    log_bodies: true
    max_body_size_kb: 1024
  file_extractor:
    file_types: ["all"]         # all | document | executable | archive | image
  js_injector:
    payload: "keylogger"        # keylogger | beef | custom
    target_domains: []
  ntlm_relay:
    targets: []
    attack: "smb"               # smb | ldap | ldaps | http | adcs
```

### `config/scope.yaml` — Optional Scope Enforcement

Not mandatory. When loaded, active modules validate targets before acting. Operator's choice to use it.

```yaml
# scope.yaml — optional, loaded via `bigbrother.py config --scope scope.yaml`
enabled: false
networks:
  - 10.10.0.0/16
  - 10.0.0.0/24
hosts:
  - dc01.corp.local
  - 10.10.1.50
domains:
  - corp.local
  - subsidiary.local
exclude:
  - 10.10.99.0/24              # OT segment — do not touch
```

When enabled: ARP spoof validates each target IP, DHCP spoof only responds to in-scope MACs, dns_poison only redirects in-scope domains. Passive modules are never scope-restricted — they observe everything.

---

## 10. Hardware Tiers

**Minimum SD card**: 128GB (high-endurance industrial). Provides ample PCAP storage with zstd compression on rotation.

| Capability | Pi Zero 2W (512MB) | Pi 4 (4GB) | Debian Host |
|---|:---:|:---:|:---:|
| **Max passive modules** | 4 | All 22 | All 22 |
| **Max active modules** | 1 | 6 | Unlimited |
| **Snap length** | 96 bytes | 65535 | 65535 |
| **Flow table max** | 5,000 | 50,000 | 100,000 |
| **PCAP compression** | zstd | zstd | zstd |
| **Key derivation** | pbkdf2 | argon2id | argon2id |
| **mitmproxy** | No | Yes | Yes |
| **file_extractor** | No | Yes | Yes |
| **voip audio capture** | No (metadata only) | Yes | Yes |
| **LKM rootkit** | No | No | Yes |
| **Cellular modem** | No (power) | Yes | Yes |
| **BLE** | Yes | Yes | Adapter needed |
| **overlayfs** | Yes (30MB) | Yes (200MB) | N/A |
| **ROADtools** | No | Yes | Yes |

### Pi Zero 2W Memory Budget (Passive Mode)

Python 3 + scapy + impacket + cryptography runs 60-80MB for the interpreter, not 25MB. Budget corrected accordingly. Only 4 passive modules on Pi Zero.

| Component | RAM (MB) |
|---|---|
| OS + kernel | ~110 |
| Python interpreter + libs | ~70 |
| Core framework + capture_bus | ~20 |
| packet_capture (96B snap) | ~30 |
| dns_logger | ~15 |
| credential_sniffer | ~20 |
| host_discovery | ~15 |
| stealth modules | ~20 |
| encrypted_storage | ~10 |
| overlayfs overhead | ~30 |
| connectivity | ~25 |
| **TOTAL** | **~365** |
| **Headroom** | **~35** |

Active module on Pi Zero takes from headroom. Only one active module at a time. Modules like tls_sni_extractor, os_fingerprint, traffic_analyzer, and the new passive modules (ldap_harvester, rdp_monitor, quic_analyzer, db_interceptor) require Pi 4 or Debian host.

---

## 11. Implementation Phases

### Phase 1: Foundation + Stealth (Weeks 1-2)

Core infrastructure, multiprocess module lifecycle, capture bus, stealth layer. OPSEC before any network activity.

```
Files:
- bigbrother.py (CLI skeleton, Click groups, basic menu, triage command)
- core/ (engine, capture_bus, bus, state, scheduler, resource_monitor, kill_switch)
- modules/base.py
- modules/stealth/ (all 12 modules)
- utils/ (all 7 utility modules)
- config/ (bigbrother.yaml, modules.yaml, stealth.yaml, hardware_tiers.yaml, scope.yaml)
- services/ (all systemd units)
- setup.sh (core packages, tool installation incl. Coercer, proxychains-ng, etc.)
- data/dhcp_fingerprints.db
- tests/ (engine, bus, crypto, resource)

Validation: Module lifecycle works (multiprocess). Capture bus demuxes packets.
Encrypted storage with LUKS network-derived unlock. Sensitive config inside LUKS.
Process disguised. Kill switch wipes all data. Watchdog restarts crashed module.
Overlayfs on Pi. Hardware tier detection accurate. Thermal monitoring active.
SQLite single-DB with async writer. Interface conflict detection works.
```

### Phase 2: Passive Surveillance (Weeks 3-5)

All 22 passive modules. Zero network noise. 24/7 unsupervised collection.

```
Files:
- modules/passive/ (all 22 modules incl. ldap_harvester, rdp_monitor,
  quic_analyzer, db_interceptor)
- modules/intel/ (credential_db, topology_mapper, user_timeline,
  change_detector, security_posture, operator_audit)
- data/ (oui.db, os_sigs.db, dhcp_fingerprints.db, bpf_filters/)

Validation: All hosts discovered (with DHCP fingerprinting). Credentials
captured from test services. DNS queries logged per host (DoH hosts flagged).
TLS SNI extracted (TCP + QUIC). LDAP queries parsed, AD objects inventoried.
RDP sessions tracked. Database queries intercepted. Kerberos tickets harvested.
Email captured from cleartext SMTP. SMB file access logged. VoIP metadata
captured. Print jobs intercepted. Network map generated. Change detection
operational. Security posture mapped. Operator audit trail logging.
Zero IDS alerts.
```

### Phase 3: Connectivity + Baseline (Weeks 6-7)

All connectivity modules. Bridge hardening (STP/CDP suppression, watchdog failsafe). Traffic baseline capture. Reliable operator access.

```
Files:
- modules/connectivity/ (all 7 modules)
- modules/stealth/traffic_mimicry.py (baseline capture phase)
- scripts/setup_bridge.sh, teardown_bridge.sh

Validation: Failover chain works: Tailscale > WireGuard > SSH > Cellular.
Bridge transparent with STP/BPDU/CDP/LLDP suppression. C watchdog failsafe
triggers passthrough in <15s. WiFi client connected. 48h baseline captured.
BLE emergency access functional.
```

### Phase 4: Active Surveillance (Weeks 8-9)

All 14 active modules. MITM capabilities. Credential harvesting at scale. Scope enforcement integration.

```
Files:
- modules/active/ (all 14 modules)
- modules/intel/ (report_generator, net_intel, supply_chain_detect)
- templates/ (captive_portals, dns_zones, hostapd, responder, beef)

Validation: ARP spoof + HTTP logging chain works (scope-validated when enabled).
DNS poisoning redirects. DHCP spoof respects scope. Evil twin captures credentials.
Responder captures NTLMv2 hashes. ntlmrelayx relays to ADCS (Coercer integration
tested). mitmproxy decrypts HTTPS. File extraction from traffic. JS injection
into HTTP. Session tokens captured. DoH blocking forces plaintext DNS when in MITM.
```

### Phase 5: Polish + Hardening (Weeks 10-12)

Integration testing, Pi Zero optimization (4-module limit), soak testing, TUI polish.

```
Tasks:
- Full integration test on Pi Zero 2W (4 passive modules), Pi 4 (all 22), Debian
- 72-hour soak test (memory leaks, disk usage, thermal, stability)
- Pi Zero performance optimization pass (verify 365MB budget, thermal under 55C)
- Capture bus stress test (packet throughput, queue backpressure)
- SQLite contention test (22 modules writing concurrently)
- LUKS network-derived unlock test (C2 reachable and unreachable scenarios)
- Rich TUI interactive menu polish (triage command)
- setup.sh validation on clean OS images (all new tools install correctly)
- Crypto implementation review
- LKM rootkit compile and test on target kernels
- IDS tester validation against current rulesets
- zstd PCAP compression verification on 128GB storage
- Error handling audit
```

---

## 12. OPSEC Notes

### Pre-Deployment

1. **Sanitize hardware** — Remove all identifying labels. Generic enclosure.
2. **MAC address** — Change from Pi OUI to common vendor (Dell, HP, Intel) BEFORE connecting.
3. **Hostname** — Generic IoT name. Never "kali", "attack", "pentest".
4. **SSH keys** — Fresh per engagement. Neutral key comment.
5. **Tailscale** — Per-engagement auth key. Hostname matches device disguise.
6. **SD card** — 128GB minimum, high-endurance industrial card. Enable overlayfs.
7. **Pre-bundle everything** — All tools, databases, signatures installed before deployment. Zero package installs on target network.
8. **Test kill switch** — Verify wipe works before deploying in the field.

### During Operation

9. **48-hour baseline** — Capture before any active module. Investment in stealth.
10. **Working hours** — Active modules during business hours only. After-hours activity is anomalous.
11. **Traffic blending** — Use traffic_mimicry to shape implant traffic to baseline.
12. **JA3** — All outbound HTTPS uses ja3_spoofer.
13. **Rate limiting** — All active modules use jitter. No fixed intervals.
14. **Selective targeting** — ARP spoof specific hosts, not entire subnets.
15. **IDS self-test** — Run ids_tester before new active module activation.
16. **C2 rotation** — Use failover chain. Rotate primary channel periodically.

### Host Forensics

17. **Process names** — All processes match legitimate system services.
18. **File paths** — Installed in `/opt/.cache/bb/` — looks like system cache.
19. **Log suppression** — rsyslog filters, auditd exclusions, no bash history.
20. **Encrypted storage** — LUKS for all sensitive data. Physical seizure without key = nothing.
21. **tmpfs** — Active operations in RAM. Power loss = instant destruction.
22. **overlayfs** — SD card sees zero write activity except LUKS container.
23. **Timestamps** — All created files timestomped to match OS install date.

### Kill Switch

24. **Manual only** — Operator's decision to wipe.
25. **CLI command** — `bigbrother.py kill` with passphrase confirmation.
26. **Remote** — Via SSH over any connectivity channel.
27. **BLE** — Emergency kill via Bluetooth if physically near.
28. **Dead man's switch** — Optional: operator configures interval, auto-wipes if no check-in.
29. **Speed** — LUKS header destruction in milliseconds. Data instantly unrecoverable.
30. **Resilient** — If interrupted, boot flag auto-completes wipe on next boot.

### Network Footprint

31. **Bridge mode** — No IP, no MAC on network. Physical inspection only detection.
32. **Tailscale** — Looks like HTTPS to Derp servers.
33. **WireGuard** — Encrypted UDP on single port. Looks like noise.
34. **Reverse SSH** — Must be SSH-over-WebSocket or SSH tunneled inside TLS (stunnel/ncat --ssl). Never raw SSH on 443 — DPI detects SSH banner.
35. **Cellular** — Completely out-of-band. Bypasses target network entirely.
36. **DNS tunneling** — Low rate, randomized, multiple domains.