taskSavannah Administration - Tasks: task #15934, Submission of Drive Badger


task #15934: Submission of Drive Badger

Submitted by:  Tomasz Klim <tomaszklim>
Submitted on:  Thu 08 Apr 2021 09:08:18 AM UTC  
Should Start On:  Thu 08 Apr 2021 12:00:00 AM UTC Should be Finished on:  Sun 18 Apr 2021 12:00:00 AM UTC
Category:  Project Approval Priority:  5 - Normal
Status:  In Progress Privacy:  Public
Percent Complete:  0% Assigned to:  Ineiev <ineiev>
Open/Closed:  Open Effort:  0.00

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Sun 02 May 2021 05:25:07 PM UTC, comment #2: 

comment #1:

> You didn't specify the licensing of your package clearly,

MIT License:

> and didn't list all your dependencies.  Please do.

There are 2 types of dependencies:

1. External binaries:

- https://github.com/Aorimn/dislocker (GPL2; executed only as separate binary, and its functionality is optional, to handle Bitlocker-encrypted NTFS filesystems)

- https://github.com/libyal/libfsapfs (LGPL3; executed only as separate binaries, and its functionality is optional, to handle Apple filesystems)

- standard Linux userland binaries (cat, mv, mount etc.)

2. Code-level dependencies:

- python-configparser
Classifier: License :: OSI Approved :: MIT License

> Will the licensing of the result be compatible with Savannah hosting requirements? (By the way, do you understand well what they are?)

"To be hosted on Savannah, your project must be free software, and it must be kept independent of any nonfree software. (...)"

Yes, it will be compatible.

Tomasz Klim <tomaszklim>
Tue 27 Apr 2021 01:31:27 PM UTC, comment #1: 

You didn't specify the licensing of your package clearly, and didn't list all your dependencies.  Please do.  Will the licensing of the result be compatible with Savannah hosting requirements? (By the way, do you understand well what they are?)

Ineiev <ineiev>
Site AdministratorIn charge of this item.
Thu 08 Apr 2021 09:08:18 AM UTC, original submission:  

A new project has been registered at Savannah
This project account will remain inactive until a site admin approves
or discards the registration.

Registration Administration

While this item will be useful to track the registration process,
approving or discarding the registration must be done using the specific Group Administration page, accessible only to site administrators,
effectively logged as site administrators (superuser):

Registration Details

  • Name: Drive Badger
  • System Name:  drivebadger
  • Type: non-GNU software and documentation
  • License: GNU General Public License v3 or later (MIT License (for Drive Badger itself)

GNU GPL2 (for Kali Linux)



Drive Badger is a software tool for data exfiltration – which means, for copying data from the computer to external USB drive. Unlike many other tools from IT security area, it's not a Proof-of-Concept kind of tool, bringing some groundbreaking techniques. Everything, what Drive Badger does, can be as well run manually, step by step. Instead, what Drive Badger really does, is doing it all better, by putting the maximum focus on:

- speed - all operation is fully automated, and there are over 340 unique exclude rules, which reduce the amount of files to be copied by eliminating low-value files and directories from the list, and thus save typically over 95% of the time, that would be spent by "naive" script
- stealth - all operation is done below the installed operating system, so totally invisible to the installed security software (anti-virus, DLP, SIEM, EDR etc.)
- support for drive encryption - Microsoft BitLocker and Apple FileVault encryption is supported, including automated matching the keys given as flat list, to particular encrypted partitions
- operator safety - there is no way to distinguish between Drive Badger and ordinary Kali Linux Live drive, or to prove the fact of data exfiltration, until someone knows the proper password (and thanks to PBKDF2 algorithm, there is no way to crack it)

So, the real purpose of Drive Badger is to change the economics of covert data exfiltration attacks (make them more affordable), by reducing the overall risk of the operation, and also by lowering the entry threshold for the operator, who no longer needs to have IT background.

Technically means, Drive Badger is a modular framework written in Unix Shell, running on modified Kali Linux Live, from USB drive. What it does, is:

- detect all drives, including encrypted drives and network shares
- mount them
- rsync contents (using over 340 exclude rules to speed up)

Other Software Required:

All binary dependencies are present in standard Debian repositories (Drive Badger doesn't require anything non-free).

The most advanced dependency is Dislocker: https://packages.debian.org/sid/utils/dislocker

Other Comments:

Full documentation available here:

Tarball URL:


Tomasz Klim <tomaszklim>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by tomaszklim (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-04-27 ineiev StatusNone => In Progress
        Assigned toNone => ineiev

    Back to the top

    Powered by Savane 3.6