search

KasperskyLab / TinyCheck

TinyCheck allows you to easily capture network communications from a smartphone or any device which can be associated to a Wi-Fi access point in order to quickly analyze them. This can be used to check if any suspect or malicious communication is outgoing from a smartphone, by using heuristics or specific Indicators of Compromise (IoCs). In order to make it working, you need a computer with a Debian-like operating system and two Wi-Fi interfaces. The best choice is to use a Raspberry Pi (2+) a Wi-Fi dongle and a small touch screen. This tiny configuration (for less than $50) allows you to tap any Wi-Fi device, anywhere.
Apache License 2.0
3.06k stars 224 forks source link

IOCs detection issue ? #116

Open loromire opened 1 year ago

loromire commented 1 year ago

Hi, I installed TinyCheck and try it on a phone where I installed a stalkware. Tinycheck didnt find any IOC after 20 minutes of capture. So my question, when TinyCheck is installed, is there a list of IOCs in it ? Or do I hvae to manually put IOCs list or something like that ? Thanks for responding guys ! Btw this soft has great potential thx Felix !

Malpaga commented 1 year ago

Hi, I am facing the same problem after analyzing 20 minutes of capture from a purposefully compromised phone. An SQLite database is included with TinyCheck, you can find it in the parent directory for the app (/usr/share/TinyCheck/tinycheck.sqlite3). Apparently it already has around 4,2k IOC entries, mostly domain names. After verification, the domain name of the server reached by the tested stalkerware was found in the sqlite ioc database. Analysis still failed however and no problem was found within the tested device.

I will search a bit more and keep you informed if I find anything !

enricoDec commented 1 year ago

As @Malpaga mentioned, TinyCheck comes with a default list of IOC, which can be manually extended. In the Wiki you can see how to add new IOC. I would recommend testing if TinyChecks analysis is working by manually starting it (described how-to in the Wiki here). In the past I had it failing and not reporting it in the frontend, but by manually starting it in the command line you can check if errors are thrown (in my case Zeek was not installed).

EvgenyAblesov commented 11 months ago

Hello everyone in this thread!

loromire, please provide more information about device you running on?

If you experiencing some troubles with 32-bit version on RPi4, please refer to https://forums.raspberrypi.com/viewtopic.php?t=351727

Long story short: RPi4 + 32-bit OS --> add "arm_64bit=0" line with no quotes to the end of your /boot/config.txt