-
Notifications
You must be signed in to change notification settings - Fork 1
Installing
Before you start installing anything, you need to choose the best hardware platform for your particular needs - this choice determines both possible operating systems, and installation method:
- Raspberry Pi and Raspbian (currently renamed to Raspberry Pi OS) or Ubuntu for Raspberry Pi - download OS image, write it to MicroSD memory card, mount the first partition and create empty file named "ssh" (without any extension)
- NanoPi (NEO2 and NEO3) - download Ubuntu FriendlyElec image, write it to MicroSD memory card, and it's ready for work
- ordinary desktop computer or laptop - Debian, Ubuntu, Kali Linux or other Debian clone with systemd version 229 or newer (released 2016+) - download chosen image, write it to CD/DVD or pen drive, and run the standard installer
- Macbook (including M1 CPU) - Kali Linux (see below)
Choosing Raspberry Pi platform, you have to choose between Raspbian and Ubuntu. Differences:
- Raspbian (32-bit only) - it's a clone of Debian, heavily modified for Raspberry Pi, with lots of additional tools, preconfigured to work in graphical mode
- Raspberry Pi OS (64-bit Raspbian) - rather stay away from this version (as for December 2021) because of many small problems waiting to be fixed
- Ubuntu 20.04 for Raspberry Pi - available in both 32-bit and 64-bit versions, only for Raspberry Pi 4 - its potential advantage is better compatibility with standard Ubuntu Server, and newer software versions (comparing to Debian/Raspbian)
If your chosen hardware has 3 GB RAM or less, we advise that you choose 32-bit version (if you have 32-bit and 64-bit version to choose). Also, if you choosed specialized hardware like Raspberry Pi, it is better to use a specialized distribution (eg. Raspbian), with dedicated kernel version and additional userland tools, than generic Ubuntu for ARM.
If you choose Kali Linux, you have 2 options:
-
Download install image for your chosen hardware architecture, and install it as primary OS on your computer.
-
Download live image and do everything just like in stage 2 of Drive Badger installation:
- write it to USB drive
- create the third, encrypted persistent partition on that drive
- each time boot the computer from this drive in Live USB Encrypted Persistence mode
The second option gives you additional capabilities: Kali Linux works exactly the same as it would be installed on your computer, allowing also to encrypt the target partition (which is not possible on Raspberry Pi). On the other hand, booting Kali Linux in this mode (even without encryption) requires having a screen and keyboard, to manually choose 4th or 5th option at each boot. So this mode is suitable mainly for laptops.
Boot into your new Linux, make sure that you have working Internet connection, open the terminal, execute sudo su -
to become root, and execute:
apt update
apt install git
git clone https://github.com/drivebadger/drivebadger /opt/drivebadger
git clone https://github.com/drivebadger/compat /opt/drivebadger/external/compat
git clone https://github.com/drivebadger/ext-veracrypt /opt/drivebadger/external/ext-veracrypt
git clone https://github.com/drivebadger/ignore-known /opt/drivebadger/config/ignore-known
The above set of 4 repositories is a bare minimum - enough to run the exfiltration process, but not enough to achieve optimal performance, handle encrypted drives or network shares. Now you need to clone all chosen configuration repositories and hooks into respectively /opt/drivebadger/config
and /opt/drivebadger/hooks
directories:
- this includes also your own (or 3rd party) repositories outside github.com/drivebadger namespace
- you can also use Github private repositories, see how to install them
- you can also use SVN repositories
- you can also manually create subdirectories there
Mobile Badger supports 4 most important drive encryption methods: Apple FileVault, Bitlocker, LUKS and VeraCrypt. Of course, decryption is possible only when you obtained and installed encryption keys (either assigned to drives, or not).
For security reasons, in most cases you should keep your encryption keys in a private repository. See how to install private repositories.
While Mobile Badger's main functionality is data exfiltration, it is also able to make changes to the copied filesystem: create files or directories, write data into them, rename, delete etc. This feature is called filesystem injection and is done by "injectors". See injectors-playground repository for example scripts.
After you create your own injector repositories, you need to clone them into /opt/drivebadger/injectors
directory.
Make sure that you cloned everything that you want to use. Then open the terminal, execute sudo su -
to become root, and execute:
cd /opt/drivebadger/setup/mobile && ./install.sh
This will "arm" your computer by enabling custom systemd
rules that intercept events of plugging in USB devices.
You can find the example install script here - just remember, that it's an example, not a complete script.
© Copyright 2020-2022 by Tomasz Klim Payload.pl