This commit is contained in:
Félix Aime 2021-01-08 11:49:42 +01:00
commit 2ea8ef49e8
2 changed files with 11 additions and 13 deletions

View File

@ -6,7 +6,7 @@ TinyCheck allows you to easily capture network communications from a smartphone
![Architecture](/assets/network-home.png)
In order to make it working, you need a computer with a Raspberry Pi OS (or other Debian-like operating system - without warranty of working) and two Wi-Fi interfaces. The best choice is to use a [Raspberry Pi (3+)](https://www.raspberrypi.org) with a Wi-Fi dongle and a small touch screen. This tiny configuration (for less than \$50) allows you to tap any Wi-Fi device, anywhere.
In order to make it working, you need a computer with a Raspberry Pi OS (or other Debian-like operating system - without warranty of working) and two Wi-Fi interfaces. The best choice is to use a [Raspberry Pi (3+)](https://www.raspberrypi.org) with a Wi-Fi dongle accepting AP mode and a small touch screen. This tiny configuration (for less than \$50) allows you to tap any Wi-Fi device, anywhere.
*If you have any question about the projet. Want to contribute or just send your feedbacks, don't hesitate to contact us at tinycheck[@]kaspersky[.]com.*
@ -39,7 +39,7 @@ TinyCheck can be used in several ways by individuals and entities:
6. **Analyze the capture** <br/>
Analyze the captured communication, enjoy (or not).
7. **Save the capture** <br/>
Save the capture on an USB key or by direct download.
Save the capture and the PDF report on an USB key or by direct download.
### Architecture
@ -98,7 +98,7 @@ The backend allows you to edit the configuration of TinyCheck, add extended IOCs
- Certificates sha1
- Nameservers
- FreeDNS
- Fancy TLDs
- Fancy TLDs (eg. xyz, .top etc.)
### Meet the analysis engine
@ -121,7 +121,7 @@ On the [Suricata](https://suricata-ids.org/) part, the network capture is analys
- Device name exfiltred in clear-text;
- Access point SSID exfiltred in clear-text;
### Watchers?
### Watchers concept
In order to keep IOCs and whitelist updated constantly, TinyCheck integrates something called "watchers". It is a very simple service with few lines of Python which grabs new formated IOCs or whitelist elements from public URLs. As of today, TinyCheck integrates two urls, one for the whitelist and one for the IOCs (The formated files are present in the assets folder).
@ -138,18 +138,16 @@ Yes, if the demand is felt by NGOs (contact us!). Is it possible to develop this
### Possible updates for next releases
- Centralized server for IOC/whitelist management (aka. Remote Analysis).
- Implement Ethernet use.
- PDF reports.
- Possibility to add watchers from the backend interface.
- Encryption of ZIPed reports.
- Better frontend GUI/JS (use of websockets / better animations).
- Implement Ethernet / Non internet use.
- More OpSec (TOR integration, Local IP randomization etc.)
- 3d template for kiosks ?
- Possibility to add watchers from the backend interface.
- Centralized server for IOC/whitelist management (aka. Remote Analysis).
- Better frontend GUI/JS (use of websockets / better animations).
- Encryption of ZIPed reports.
### Contact
If you have any question about the projet. Want to contribute or just send your feedbacks, don't hesitate to contact us at tinycheck[@]kaspersky[.]com.
If you have any question about the projet. Want to contribute or just send your feedbacks/success stories, don't hesitate to contact us at tinycheck[@]kaspersky[.]com.
### Special thanks

File diff suppressed because one or more lines are too long