Zero Breach is a local, read-only scanner that searches a computer's own leftover records for published indicators of the AdFection/Candiru spyware campaign, for authorized triage and defensive research.
| Tool | interplains/zero-breach — local, read-only Python scanner for indicators of the AdFection/Candiru spyware campaign |
| Category | defensive forensics and IOC scanning |
| Primary Use | Scanning browser histories, cookies, caches, file hashes, autostart registrations and DNS resolver data on Windows, macOS and Linux for published indicators |
| Safe Use | Documentary and educational analysis for authorized incident responders, helpline triage and at-risk users checking their own devices; the tool changes no settings and makes no network requests |
| Telemetry Note | Fully passive footprint: no intentional network requests, no administrator rights, read-only queries; some antivirus products may flag it because reading browser databases resembles infostealer behaviour |
interplains/zero-breach occupies an unusual and genuinely defensive niche in the security tooling landscape: it is a scanner built not to attack anything, but to help a potentially targeted person find traces of nation-state-grade commercial spyware on their own machine. Written in Python 3.8–3.12 and tested across Windows, macOS and Linux in continuous integration, it checks a device's own residual records — browser history, cookies, caches, connection records, file fingerprints, auto-start registrations, known malware file paths and the DNS resolver cache — against published indicators from the AdFection campaign. The repository carries Apache-2.0 licensing, 373 stars, and topics including forensics, incident-response, ioc, misp, spyware, stix and threat-intelligence, signalling clearly where it sits in the ecosystem.
The background, as documented in the README, is the Citizen Lab's October 2026 *Exposing AdFection* report on the ad-tech firm Discover-Tech and its Controlium platform, which allegedly abused real-time ad bidding to fingerprint and infect devices at render time, delivering Candiru spyware without any click. At least 45 devices at Al Jazeera were reportedly targeted across 2024–2025. The indicator set baked into zero-breach is drawn from that reporting plus Recorded Future's independent infrastructure tracking (CTA-2025-0805). For an authorized professional, that provenance matters: every finding the tool produces traces back to a named public source rather than to an opaque proprietary feed.
Architecturally, the project makes a deliberate minimalism claim that shapes everything about it. Default checks are standard-library-only: no administrator rights, no added packages, no intentional network requests, no indicator lookups against online services. The single-file distribution is a plain-text zero-breach.py you can read line by line, which is exactly the property you want in a tool aimed at people who already suspect they are being surveilled. Redirected paths and Windows remote drives are skipped, online certificate verification is disabled, and locked browser database snapshots are handled as temporary copies with cleanup attempted and any failure reported alongside the retained location — details that reveal a careful, forensic-hygiene mindset in the design.
Invocation is straightforward and non-weaponized by construction: python -X utf8 zero-breach.py for a full scan, --quick to skip file fingerprinting, and --json report.json to write a structured report. Exit codes are documented precisely: 0 for nothing found, 2 for an indicator match, 1 for setup failure such as a bad indicator file. The underlying source entry point is scan/adint-scan.py, and the single file is deterministically built from the repository via build/build.py, so the matching release tag rebuilds a byte-identical artifact — a reproducible-build guarantee that lets you sidestep trusting the download entirely.
Browser coverage is broad within the two major families. On the Chromium side it handles Chrome, Edge, Brave, Vivaldi and Chromium itself, checking %LOCALAPPDATA%\<vendor>\User Data on Windows, ~/Library/Application Support/<vendor> on macOS and ~/.config/<vendor> plus snap and Flatpak locations on Linux. Firefox profiles and cache directories are also scanned. Notably absent are Opera, Arc and similar Chromium derivatives, and the README is explicit that unsupported browsers and custom profile locations simply are not checked — honesty about coverage gaps that recurs throughout the project's documentation.
That honesty is the tool's most distinctive characteristic. The README repeats, almost as a mantra, that a clean result is not a clean bill of health: spyware of this grade is engineered to defeat precisely this kind of check, most evidence expires within weeks, and Windows does not record DNS history unless someone enabled logging — which the scanner itself checks for and reports. Rather than overselling certainty, zero-breach explicitly frames its mission as narrowing uncertainty, and directs users with credible targeting concerns toward expert helplines such as the Access Now Digital Security Helpline and the Amnesty International Security Lab instead of self-service conclusions.
The evidence-grading system is where the real analytical sophistication lives. Findings are ranked strongest-first across six tiers: on-disk for file fingerprint matches (with an important sub-distinction — a match against a legitimate signed driver this actor abuses, flagged as a vuln-driver lead rather than proof of infection), persistence for auto-start registrations, contacted for actual connection records, dns-record for resolver-cache appearances where a lookup may even have failed, configured for local name-to-address mappings, and referenced for names merely appearing in saved content such as an article about the campaign itself. That last case is the kind of false positive that routinely trips up naive IOC scanners, and zero-breach handles it by design rather than by caveat.
The optional pattern mode extends capability without compromising the baseline. Installed via a hash-pinned requirements-patterns.txt pulling in a pinned YARA-X engine and activated with --patterns, it adds two published Candiru file rules limited to files under roughly 1 MB. --pattern-path ABSOLUTE_PATH can scope the extra check to specific local files or folders, and without it the mode first examines up to 128 safe local files named by per-user Windows COM registrations — the campaign's documented persistence mechanism — before its usual file roots. Pattern matches are explicitly labelled leads for investigation, not proof of active infection.
Release engineering shows unusual care for a small project. v0.1.8 corrects a version-reporting defect from v0.1.7 and refuses network paths passed to --iocs/--json in the single-file build. Downloads are protected by detached GPG signatures with a published verification page, per-release SHA-256 checksums verifiable via Get-FileHash or shasum -a 256, and the deterministic rebuild path already mentioned. The README even anticipates antivirus friction: some products flag any script reading browser databases as infostealer behaviour, and the authors respond with a precise technical defence — the tool's SQL queries read cookie host names and timestamps only, never cookie values, and never decrypt credentials.
Operational telemetry considerations are worth spelling out for defenders. The scanner is read-only and offline, makes no intentional network connections, and defangs all domain and IP matches in its output (example[.]com) so that forwarding a report to a help organisation cannot cause a mail gateway to touch the indicator. On Windows, the DNS-history check reads up to the newest 50,000 retained events and marks the history as partial if older records remain. From a detection standpoint, the footprint an observer sees is local file reads on browser databases and, at worst, a temporary snapshot copy — behaviour that belongs in your allow-review queue precisely because infostealers imitate it.
In an authorized workflow, zero-breach slots in as a first-stage triage instrument: fast, transparent, non-invasive, and honest about its own limits. It is not a replacement for full forensic acquisition, and its documentation says so repeatedly, including the warning that multiple weak matches do not automatically combine into strong evidence. What it offers is a defensible, source-attributed, reproducible check that a helpline volunteer, an incident responder, or a concerned journalist can run in minutes, with an output that explicitly separates what was found from what could not be checked — a standard of epistemic discipline that far more security tools should imitate.
interplains/zero-breach.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.