Cobra 5077e30c66 Add multi-source device identity store and zero-config enrollment (#671)
Track devices across MAC rotations using BLE Handoff sequence numbers
and DHCP Option 55 fingerprinting. Auto-enroll personal devices when
seen on 2+ independent signal types. Handle iOS MAC rotation silently.
Confidence-based departure only fires for enrolled devices.

Changes:
- New device_store dict for stable device identity tracking (keyed by
  handoff seq anchor or DHCP fingerprint hash)
- _dhcp_fingerprint_hash() computes stable DHCP Option 55 fingerprint
- _create_identity_record() initializes device records
- _on_device_enrolled() triggers silent enrollment when signal_count >= 2
- _correlate_or_create_identity() finds or creates identities via BLE seq
  or DHCP fingerprint, handles MAC rotation detection
- _ingest_signal() ingests signals from multiple sources (BLE, DHCP, ARP,
  mDNS) and triggers enrollment when criteria met
- ble_sniffer() thread for Apple Continuity Protocol parsing (HCI socket +
  hcidump fallback); graceful failure on missing hardware
- Modified parse_frame() to extract DHCP Option 55 and ingest signals for
  ARP, mDNS, DHCP packets
- Updated main() to start BLE sniffer thread and log device_store stats
2026-04-14 12:38:32 -04:00
S
Description
Network drop implant — passive SOC + active exploitation. Deploy on any Debian host.
4.3 MiB
Languages
Python 89.2%
Shell 8.5%
HTML 1.1%
C 0.9%
Jinja 0.3%