n0mad1k
62a1010ab4
9 files in utils/ providing the shared infrastructure layer: - crypto: AES-256-GCM file encryption, argon2id/PBKDF2 key derivation, HKDF network unlock, LUKS container management - networking: interface detection, MAC/IP helpers, BPF compilation via libpcap ctypes, gratuitous ARP, VLAN creation - logging: encrypted log writer (BBLogger) with rotation, per-module files, stdout suppression for stealth - stealth: process rename via prctl, cmdline spoofing, sysctl helpers, timestomping, core dump disable - resource: hardware tier detection (OPi Zero 3 / Pi Zero / generic) via /proc/device-tree and cpuinfo, resource monitoring - permissions: root/capability checks via capget ctypes, privilege dropping, directory permission enforcement - config_loader: YAML merge hierarchy (hardware_tiers -> bigbrother -> modules -> stealth -> CLI), tier auto-detection, SIGHUP reload - bettercap_api: REST client with per-session random credentials, session/events/command methods
54 lines
2.7 KiB
YAML
54 lines
2.7 KiB
YAML
# BigBrother Stealth / OPSEC Profile
|
|
# Process disguise, log suppression, anti-forensics, traffic mimicry.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Process Name Disguise
|
|
# All managed processes renamed to innocuous system service names.
|
|
# /proc/PID/exe still points to real binary (unavoidable without LKM).
|
|
# ---------------------------------------------------------------------------
|
|
process_names:
|
|
python3: "systemd-thermald"
|
|
bettercap: "networkd-dispatcher"
|
|
tcpdump: "systemd-netlogd"
|
|
responder: "systemd-resolved"
|
|
mitmproxy: "systemd-networkd"
|
|
ntlmrelayx: "systemd-logind"
|
|
hostapd: "wpa_supplicant"
|
|
dnsmasq: "systemd-resolved"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Log Suppression
|
|
# Minimize forensic artifacts in system logs.
|
|
# ---------------------------------------------------------------------------
|
|
log_suppression:
|
|
rsyslog_filter: true # Drop log entries matching our processes/paths
|
|
auditd_exclusion: true # Exclude our PIDs/paths from audit rules
|
|
journald_rate_limit: true # Rate-limit journal entries from our services
|
|
bash_history: false # Disable bash history for root/.bashrc
|
|
utmp_wtmp: false # Suppress login records (utmp/wtmp/btmp)
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Anti-Forensics
|
|
# Minimize on-disk evidence.
|
|
# ---------------------------------------------------------------------------
|
|
anti_forensics:
|
|
timestomp: true # Match all file timestamps to reference file
|
|
timestomp_reference: "/etc/os-release" # Use OS install date as reference
|
|
core_dumps: false # Disable core dumps (ulimit -c 0)
|
|
swap: false # Disable swap entirely (swapoff -a)
|
|
secure_delete: true # Overwrite before unlink for sensitive files
|
|
bettercap_home_tmpfs: true # Set $HOME to tmpfs (no ~/.bettercap/ artifacts)
|
|
bettercap_no_history: true # --no-history flag for bettercap
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Traffic Mimicry
|
|
# Shape implant traffic to match observed network baseline.
|
|
# ---------------------------------------------------------------------------
|
|
traffic_mimicry:
|
|
enabled: true
|
|
baseline_hours: 48 # Duration of traffic baseline collection
|
|
shape_exfil: true # Time and size exfil to match upload patterns
|
|
match_protocols: true # Use same protocols as observed traffic
|
|
match_timing: true # Match time-of-day activity patterns
|
|
jitter_pct: 15 # Random jitter on all timed operations
|