mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 09:14:33 +00:00
CyberMind-FR
6399a6c3ee
## 4 changes bundled ### 1. URGENT iOS 'commencer a surfer' fix The button linked to https://duckduckgo.com directly. iOS captive sheet intercepted the navigation and did nothing visible. User stuck on the success page. Fix : href -> http://captive.apple.com/hotspot-detect.html + target=_blank + JS fallback to DDG after 500ms. iOS sees the captive probe succeed, closes the captive sheet, user lands in Safari with full connectivity. ### 2. Generative rule engine (common/secubox_core/rule_engine.py) Replaces the static whitelist.py with a 3-layer decision engine : Layer 1 : STATIC whitelist-baseline.yaml + operator override Layer 2 : GENERATIVE Python predicates that auto-trust by criteria : - *.gouv.fr / service-public.fr -> trust - *.ameli.fr / cnam.fr / cpam.fr / etc. -> trust - hosts with ≥3 cert-pinning failures observed -> trust-warn (auto-learned) - high-reputation ASN (Cloudflare/Akamai/Google /Amazon/Apple/OVH) -> trust-warn Layer 3 : DEFAULT inspect (fall through) record_pinning_failure(host) called by mitm addons on TLS handshake fail -> persisted to /var/lib/secubox/toolbox/learned-rules.json -> next evaluate() returns trust-warn for that host. ### 3. Dynamic sensitivity profiles 🟢 low : block only confirmed malware (threat-intel match). DGA ≥ 90, beacon never. No false positives. 🟡 medium : balanced default. DGA ≥ 70, beacon ≥ 75. 🟠 high : strict. DGA ≥ 50, beacon ≥ 50, low-rep ASN block. 🔴 paranoid : default-deny — block anything not whitelisted. should_block(threat_intel_matches, dga_score, beaconing_score, asn_rep, is_whitelisted) returns (decision, reason). Used by scoring + (Phase 4) active blocking. Profile selectable via /etc/secubox/toolbox/rule-engine.yaml : sensitivity: low | medium | high | paranoid static_rules: [...] # operator extends baseline ### 4. Whitelist baseline expansion (47 -> 108 patterns) + Banking FR neobanks : Boursorama Banque, Hello Bank, BforBank, N26, Wise, Monzo, ING, Trade Republic + crypto (Binance, Kraken, Coinbase) + Streaming : Netflix, Disney+, Spotify, Deezer, Canal+, France.tv, Arte, YouTube + CDN, Twitch, Amazon Video + Education FR : Pronote, Ecole Directe, ENT universitaire, CNED + Health FR : Maiia, Livi + Workplace SaaS : Office365, SharePoint, Slack, Zoom, Teams, Salesforce, Atlassian, Notion, Dropbox, Box, Adobe + Gaming : Steam, Epic, EA, Battle.net, PlayStation, Xbox Live, Nintendo, Discord + DoH resolvers : Cloudflare, Google, NextDNS ## Backward compat whitelist.py kept as a thin shim — match() / is_whitelisted() delegate to rule_engine. local_store.py + inject_banner.py continue to work. ## Verified gk2 (2026-06-05) stats : static_rules=108, generative_rules=4, sensitivity=medium evaluate('impots.gouv.fr') -> trust (gov-fr generative) should_block(threat_intel_matches=1) -> True should_block(dga_score=80) -> True (≥ 70) should_block(is_whitelisted=True) -> False
42 lines
1.2 KiB
Plaintext
42 lines
1.2 KiB
Plaintext
Source: secubox-toolbox
|
|
Section: net
|
|
Priority: optional
|
|
Maintainer: Gerald KERMA <devel@cybermind.fr>
|
|
Build-Depends: debhelper-compat (= 13), dh-python, python3-all
|
|
Standards-Version: 4.6.2
|
|
Homepage: https://cybermind.fr/secubox
|
|
Rules-Requires-Root: no
|
|
|
|
Package: secubox-toolbox
|
|
Architecture: all
|
|
Depends: ${misc:Depends}, ${python3:Depends},
|
|
secubox-core (>= 1.0),
|
|
python3 (>= 3.11),
|
|
python3-fastapi | python3-pip,
|
|
python3-uvicorn | python3-pip,
|
|
python3-jinja2,
|
|
python3-pydantic,
|
|
python3-httpx,
|
|
python3-qrcode,
|
|
python3-fpdf2 | python3-pip,
|
|
nftables,
|
|
iproute2,
|
|
hostapd,
|
|
dnsmasq,
|
|
mitmproxy,
|
|
openssl,
|
|
adduser,
|
|
fonts-dejavu-core,
|
|
fonts-symbola,
|
|
fonts-noto-color-emoji,
|
|
python3-yaml,
|
|
python3-geoip2 | geoipupdate
|
|
Description: SecuBox-DEB ToolBoX — Gondwana Cabine Numérique (captive AP + MITM analyzer)
|
|
Phase 1 du parent #474 (ToolBoX Pipeline). Productionize le PoC captive
|
|
portal en package dédié : splash + consent R2 + CA distribution iOS
|
|
(mobileconfig) + nftables TPROXY → mitmproxy transparent +
|
|
addons (cookies/dpi/avatar/ja4/soc-relay) → modules SecuBox existants.
|
|
.
|
|
Conforme CSPN (R2 opt-in explicite, MAC hashing avec sel rotatif daily,
|
|
retention 24h défaut). Cible : borne publique cabine téléphonique numérique.
|