This is an extension for Drive Badger. It provides exclude.list file, containing a list of exclusions compatible with popular rsync program.
The purpose of these exclusions is to decrease the amount of data to be exfiltrated by Drive Badger, and thus to speed up the attack, by eliminating files and directories, that are not valuable in any way to the attacker:
- multimedia files (avi/mkv/rmvb movies, mp3/flac music - except for game content)
- image files containing encrypted filesystems
- Mozilla Firefox/Thunderbird caches
- Windows memory dumps
- Windows search telemetry
Clone this repository as /opt/drivebadger/config/exclude-user directory on your Drive Badger persistent partition.
Q: Why avi/mkv/rmvb movies are excluded from exfiltration, while 3gp/flv/mp4/webm/wmv not?
A: Movies with 3gp/flv/mp4/webm/wmv extensions are often user-generated content (by photo cameras, phones etc.), while avi/mkv/rmvb files
are considered "external movies" (eg. downloaded commercial movies) - usually very big, and not valuable at the same time. You can change this behavior:
- by forking this repository and cloning your fork instead of the original one
- by making a local change directly on Drive Badger USB device