n0mad1k
62a1010ab4
9 files in utils/ providing the shared infrastructure layer: - crypto: AES-256-GCM file encryption, argon2id/PBKDF2 key derivation, HKDF network unlock, LUKS container management - networking: interface detection, MAC/IP helpers, BPF compilation via libpcap ctypes, gratuitous ARP, VLAN creation - logging: encrypted log writer (BBLogger) with rotation, per-module files, stdout suppression for stealth - stealth: process rename via prctl, cmdline spoofing, sysctl helpers, timestomping, core dump disable - resource: hardware tier detection (OPi Zero 3 / Pi Zero / generic) via /proc/device-tree and cpuinfo, resource monitoring - permissions: root/capability checks via capget ctypes, privilege dropping, directory permission enforcement - config_loader: YAML merge hierarchy (hardware_tiers -> bigbrother -> modules -> stealth -> CLI), tier auto-detection, SIGHUP reload - bettercap_api: REST client with per-session random credentials, session/events/command methods
66 lines
3.6 KiB
YAML
66 lines
3.6 KiB
YAML
# BigBrother Hardware Tier Definitions
|
|
# Platform-specific resource limits and capability gates.
|
|
# Platform auto-detected at boot or set in bigbrother.yaml.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Orange Pi Zero 3 (4GB) — Primary Implant
|
|
# Allwinner H618, 4x Cortex-A53 @ 1.5GHz, WiFi 5 + BT 5.0, 1x GbE
|
|
# Dimensions: 50x55mm, ~$29, 0.8W idle / ~3.5W load
|
|
# OS: Armbian Debian 12 Bookworm
|
|
# ---------------------------------------------------------------------------
|
|
opi_zero3:
|
|
max_passive: 16 # All passive modules supported
|
|
max_active: 6 # Concurrent active module limit
|
|
max_ram_mb: 3800 # ~4GB minus OS overhead
|
|
zstd_level: 19 # Max compression (10-15x on PCAPs)
|
|
kdf: "argon2id" # Strong key derivation
|
|
mitmproxy: true # 100-200MB RAM — fits in budget
|
|
lkm: false # No kernel headers on Armbian
|
|
cellular: true # Via 13-pin header USB breakout
|
|
overlayfs_mb: 200 # tmpfs overlay size
|
|
thermal_warning: 55 # Celsius — needs heatsink
|
|
thermal_shed: 70 # Shed active modules at this temp
|
|
wifi_attacks: true # Built-in WiFi 5 supports evil twin
|
|
inline_bridge: true # Via USB Ethernet adapter
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Raspberry Pi Zero 2W — Jumpbox / Beacon
|
|
# BCM2710A1, 4x Cortex-A53 @ 1.0GHz, WiFi 4, no Ethernet (USB adapter)
|
|
# 512MB RAM — lightweight passive sniffing + callback beacon only.
|
|
# No active attack capability. Deploy as decoy/expendable.
|
|
# ---------------------------------------------------------------------------
|
|
pi_zero:
|
|
max_passive: 4 # dns_logger, credential_sniffer, host_discovery, +1
|
|
max_active: 0 # No active modules — jumpbox only
|
|
max_ram_mb: 410 # 512MB minus OS (~110MB)
|
|
zstd_level: 3 # Fast mode (5-8x compression, minimal CPU)
|
|
kdf: "pbkdf2" # argon2id too expensive for 512MB
|
|
mitmproxy: false # Way too much RAM
|
|
lkm: false # No kernel headers
|
|
cellular: false # No USB header
|
|
overlayfs_mb: 30 # Minimal tmpfs overlay
|
|
thermal_warning: 55 # Celsius
|
|
thermal_shed: 70 # Shed modules at this temp
|
|
wifi_attacks: false # WiFi 4 too weak for evil twin
|
|
inline_bridge: false # No Ethernet port
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Generic Debian Host — Full Capability
|
|
# Any x86_64/aarch64 Debian host. No hardware constraints.
|
|
# Supports all modules including LKM rootkit.
|
|
# ---------------------------------------------------------------------------
|
|
generic:
|
|
max_passive: 16 # All passive modules
|
|
max_active: 99 # Effectively unlimited
|
|
max_ram_mb: null # No artificial limit
|
|
zstd_level: 19 # Max compression
|
|
kdf: "argon2id" # Strong key derivation
|
|
mitmproxy: true # Plenty of RAM
|
|
lkm: true # Kernel headers available
|
|
cellular: true # If USB modem attached
|
|
overlayfs_mb: null # Not needed on full host
|
|
thermal_warning: 80 # Server-grade thermal limits
|
|
thermal_shed: 95 # Server-grade thermal limits
|
|
wifi_attacks: true # If wireless adapter present
|
|
inline_bridge: true # Dual NIC supported
|