taskSavannah Administration - Tasks: task #15934, Submission of Drive Badger

 
 

task #15934: Submission of Drive Badger

Submitter:  Tomasz Klim <tomaszklim>
Submitted:  Thu 08 Apr 2021 09:08:18 AM UTC
   
 
Should Start On:  Thu 08 Apr 2021 12:00:00 AM UTC Should be Finished on:  Sun 18 Apr 2021 12:00:00 AM UTC
Category:  Project Approval Priority:  * 5 - Normal
Status:  Cancelled Privacy:  Public
Assigned to:  ineiev Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Fri 06 Aug 2021 10:11:51 AM UTC, comment #6: 

No response; cancelling.

Ineiev <ineiev>
Site Administrator
Thu 24 Jun 2021 08:10:35 AM UTC, comment #5: 


[from sv-register-public@]:

> I checked these links and I believe that proper answers are:
>
> 1. GPL-2.0-or-later
> 2. Standard GNU/Linux userland binaries


Now it isn't certain what those binaries are.

> Are there any remaining problems to solve?


The tarball still have the issue with naming.

Also, some copyrightable files have no valid copyright and license notices.

Ineiev <ineiev>
Site Administrator
Fri 18 Jun 2021 07:30:02 AM UTC, comment #4: 

If there is no further interest, I'll cancel this submission.

Ineiev <ineiev>
Site Administrator
Thu 27 May 2021 12:50:16 PM UTC, comment #3: 

comment #2:

> comment #1:
> > and didn't list all your dependencies.  Please do.
>
> There are 2 types of dependencies:
>
> 1. External binaries:
>
> - https://github.com/Aorimn/dislocker (GPL2; executed only as separate binary, and its functionality is optional, to handle Bitlocker-encrypted NTFS filesystems)

...

Please don't say "Licensed under the GPL2",
https://www.gnu.org/licenses/identify-licenses-clearly.html

> - standard Linux userland binaries (cat, mv, mount etc.)


This wording doesn't comply with our hosting requirements.  Savannah is the forge of the GNU Project, and we require that people give us due credit when hosting their packages here.

> > Will the licensing of the result be compatible with Savannah hosting requirements? (By the way, do you understand well what they are?)
>
> "To be hosted on Savannah, your project must be free software, and it must be kept independent of any nonfree software. (...)"
>
> Yes, it will be compatible.


This is more about dependencies rather than licensing; Savannah has more strict licensing requirements, e.g. the package must be GPL-compatible.

I think I should ask you read our hosting requirements again, carefully.

Ineiev <ineiev>
Site Administrator
Sun 02 May 2021 05:25:07 PM UTC, comment #2: 

comment #1:

> You didn't specify the licensing of your package clearly,


MIT License:
https://github.com/drivebadger/drivebadger/blob/master/LICENSE


> and didn't list all your dependencies.  Please do.


There are 2 types of dependencies:

1. External binaries:

- https://github.com/Aorimn/dislocker (GPL2; executed only as separate binary, and its functionality is optional, to handle Bitlocker-encrypted NTFS filesystems)

- https://github.com/libyal/libfsapfs (LGPL3; executed only as separate binaries, and its functionality is optional, to handle Apple filesystems)

- standard Linux userland binaries (cat, mv, mount etc.)

2. Code-level dependencies:

- python-configparser
http://docs.python.org/3/library/configparser.html
Classifier: License :: OSI Approved :: MIT License


> Will the licensing of the result be compatible with Savannah hosting requirements? (By the way, do you understand well what they are?)


"To be hosted on Savannah, your project must be free software, and it must be kept independent of any nonfree software. (...)"

Yes, it will be compatible.

Tomasz Klim <tomaszklim>
Tue 27 Apr 2021 01:31:27 PM UTC, comment #1: 

You didn't specify the licensing of your package clearly, and didn't list all your dependencies.  Please do.  Will the licensing of the result be compatible with Savannah hosting requirements? (By the way, do you understand well what they are?)

Ineiev <ineiev>
Site Administrator
Thu 08 Apr 2021 09:08:18 AM UTC, original submission:  

A new project has been registered at Savannah
This project account will remain inactive until a site admin approves
or discards the registration.


Registration Administration


While this item will be useful to track the registration process,
approving or discarding the registration must be done using the specific Group Administration page, accessible only to site administrators,
effectively logged as site administrators (superuser):



Registration Details


  • Name: Drive Badger
  • System Name:  drivebadger
  • Type: non-GNU software and documentation
  • License: GNU General Public License v3 or later (MIT License (for Drive Badger itself)


GNU GPL2 (for Kali Linux)

)




Description:

Drive Badger is a software tool for data exfiltration – which means, for copying data from the computer to external USB drive. Unlike many other tools from IT security area, it's not a Proof-of-Concept kind of tool, bringing some groundbreaking techniques. Everything, what Drive Badger does, can be as well run manually, step by step. Instead, what Drive Badger really does, is doing it all better, by putting the maximum focus on:

- speed - all operation is fully automated, and there are over 340 unique exclude rules, which reduce the amount of files to be copied by eliminating low-value files and directories from the list, and thus save typically over 95% of the time, that would be spent by "naive" script
- stealth - all operation is done below the installed operating system, so totally invisible to the installed security software (anti-virus, DLP, SIEM, EDR etc.)
- support for drive encryption - Microsoft BitLocker and Apple FileVault encryption is supported, including automated matching the keys given as flat list, to particular encrypted partitions
- operator safety - there is no way to distinguish between Drive Badger and ordinary Kali Linux Live drive, or to prove the fact of data exfiltration, until someone knows the proper password (and thanks to PBKDF2 algorithm, there is no way to crack it)

So, the real purpose of Drive Badger is to change the economics of covert data exfiltration attacks (make them more affordable), by reducing the overall risk of the operation, and also by lowering the entry threshold for the operator, who no longer needs to have IT background.

Technically means, Drive Badger is a modular framework written in Unix Shell, running on modified Kali Linux Live, from USB drive. What it does, is:

- detect all drives, including encrypted drives and network shares
- mount them
- rsync contents (using over 340 exclude rules to speed up)



Other Software Required:

All binary dependencies are present in standard Debian repositories (Drive Badger doesn't require anything non-free).

The most advanced dependency is Dislocker: https://packages.debian.org/sid/utils/dislocker


Other Comments:

Full documentation available here:
https://github.com/drivebadger/drivebadger/wiki


Tarball URL:

https://github.com/drivebadger/drivebadger/archive/refs/tags/2021.03.01.tar.gz


Tomasz Klim <tomaszklim>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by tomaszklim (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-08-06 ineiev StatusIn Progress Cancelled
        Open/ClosedOpen Closed
    2021-04-27 ineiev StatusNone In Progress
        Assigned toNone ineiev

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code