TinyCheck

TinyCheck allows you to easily capture network communications from a smartphone or any device which can be associated to a Wi-Fi access point in order to quickly analyze them. This can be used to check if any suspect or malicious communication is outgoing from a smartphone, by using heuristics or specific Indicators of Compromise (IoCs). In order to make it working, you need a computer with a Debian-like operating system and two Wi-Fi interfaces. The best choice is to use a Raspberry Pi (2+) a Wi-Fi dongle and a small touch screen. This tiny configuration (for less than $50) allows you to tap any Wi-Fi device, anywhere.

APACHE-2.0 License

Stars
3.1K
TinyCheck - New version of TinyCheck with MISP implementation! Latest Release

Published by felixaime over 3 years ago

Hello everyone, a new release of TinyCheck 🎉 is coming (v0.7-test)!

This release mainly adds the support of MISP (https://www.misp-project.org) to grab IOCs from your own instances 🚀. We would like to thank @JulAkx for his PR request regarding this integration and his work on it 🙏 !

Regarding the user interface, we've enhanced the frontend ergonomics and the report views to add few technical indicators related to the network capture such as the capture SHA1 hash for legal forensic/IT security experts 🤓. Moreover, few bugs seen in the backend interface have been fixed. These fixes add better ergonomics 🛠️.

Under the wood, few things has been updated too. The default internet check is now 1.1.1.1 as we had issues with a partner entity regarding the example.com domain name. We dynamically assign a specific channel to the WiFi AP, which depends of the channel of the already connected interface in order to prevent jamming between the two interfaces. We added the capture automatic removing in order to ensure a better privacy 🕵️‍♀️, new detections rules (HTTP Host header) and debugged few stuff 🔎.

For the next release, we are plan to add the possibility to check arbitrary pcaps from a USB key and integrate OpenCTI support (https://www.opencti.io). More and more people and entities are sending some feedbacks about their use of TinyCheck to so don't hesitate to send yours at tinycheck(at)kaspersky(dot)com ✉️ - this will help us to improve it 💪.

TinyCheck - Improvements

Published by felixaime over 3 years ago

  • Added domain detection in certificates ;
  • Correcting certificate SHA1 detection issue ;
  • Adding npm audit during the update process ;
TinyCheck - New updates

Published by felixaime over 3 years ago

  • Added new translations (Russian, Italian, Portuguese, German- Thanks Christina from Kaspersky)
  • Installation script improvements (New checks)
  • JWT improvements (thanks @bl4ckh0l3z)
  • Npm installation timeout setted for low bandwidth (thanks @openfacto/@hpiedcoq)
  • Other minor bugfixes.