n0mad1k/bigbrother
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
185 Commits 1 Branch 0 Tags
83894bf84d2eb7190438978afd3d7a8e31ba2e67
T
Clone
Open with VS Code Open with VSCodium Open with Intellij IDEA
Download ZIP Download TAR.GZ Download BUNDLE
Cobra 83894bf84d Fix three presence monitoring bugs: Tailscale exclusion, mDNS arrival, ARP personal device arrival 
Tailscale peers (travel router b6:cc) were kept perpetually REACHABLE in the
kernel ARP cache by OPi's WireGuard keepalives, refreshing last_seen and
blocking departure alerts. seed_tailscale_peers() excludes their MACs.

mDNS was only refreshing the watchdog timer for already-known devices. Apple
devices send mDNS on WiFi join as the primary signal — now calls on_arrival()
so first-seen mDNS triggers ARRIVED alert and occupancy update.

ARP opcode 1 for personal devices never called on_arrival(), so devices that
joined without DHCP (c6:37 My iPhone at 01:25) got no alert. Now fires
on_arrival() for personal devices not yet in known_devices.
2026-04-14 21:51:02 -04:00
config
Strip OPSEC tool identity fingerprints
2026-04-08 22:18:35 -04:00
core
Strip OPSEC tool identity fingerprints
2026-04-08 22:18:35 -04:00
data
Add Phase 1 utility modules: crypto, networking, logging, stealth, resource, permissions, config_loader, bettercap_api
2026-03-18 08:11:25 -04:00
modules
Strip OPSEC tool identity fingerprints
2026-04-08 22:18:35 -04:00
net_alerter
Fix three presence monitoring bugs: Tailscale exclusion, mDNS arrival, ARP personal device arrival
2026-04-14 21:51:02 -04:00
presence
Add bounds checks to netlink and DHCP parsers — prevent exception flood on malformed packets
2026-04-10 15:49:03 -04:00
scripts
Support wpa_supplicant config format on OPi/Armbian targets
2026-04-14 13:14:35 -04:00
services
Fix firstboot service startup: GOPATH env, enable all services, add bettercap passive caplet
2026-04-08 10:51:09 -04:00
storage
Add Phase 1 utility modules: crypto, networking, logging, stealth, resource, permissions, config_loader, bettercap_api
2026-03-18 08:11:25 -04:00
templates
Phase 4: Active modules, templates, and operator scripts
2026-03-18 13:48:11 -04:00
tests
Deploy presence daemon to OPi Zero 3 test implant
2026-04-10 15:49:03 -04:00
utils
Strip OPSEC tool identity fingerprints
2026-04-08 22:18:35 -04:00
.devtrack_context
Add audit artifacts from #671 review pipeline
2026-04-14 13:18:35 -04:00
.gitignore
Encrypt sensitive credential fields before event bus emission (#215)
2026-04-06 11:43:46 -04:00
bigbrother.py
Strip OPSEC tool identity fingerprints
2026-04-08 22:18:35 -04:00
IMPLEMENTATION_PLAN.md
Document comprehensive fix plan for daemon initialization failures
2026-04-06 09:15:40 -04:00
OPERATIONAL_WORKFLOW.md
Update hardware platform to Orange Pi Zero 3 (4GB) as primary implant
2026-03-18 08:04:24 -04:00
operator_setup.sh
Add three dynamic infrastructure auto-suppression mechanisms to net_alerter
2026-04-10 22:57:40 -04:00
requirements.txt
Add Phase 1 utility modules: crypto, networking, logging, stealth, resource, permissions, config_loader, bettercap_api
2026-03-18 08:11:25 -04:00
SECURITY_REVIEW.md
Apply QA corrections to consolidated security review: deconflict APT-001 triage, add deduplication transparency, document exploit chain dependencies
2026-04-10 15:49:03 -04:00
setup.sh
Add NET_ALERTER_INFRA_IPS config to setup.sh .env template and operator_setup.sh prompt
2026-04-10 22:50:56 -04:00
S
Description
Network drop implant — passive SOC + active exploitation. Deploy on any Debian host.
4.3 MiB
Languages
Python 89.2%
Shell 8.5%
HTML 1.1%
C 0.9%
Jinja 0.3%