I think the Hinge being referred to is a dating app? I have no idea. https://hinge.co/
[flagged]
Using Hinge as a Command and Control Server
11–20 of 71 posts
Re: Using Hinge as a Command and Control Server
#12speaking of command and control servers, the best one you can get at the moment is to just to use crypto currencies, plenty of available nodes to auto discover or just rely on explorers to query your own wallet, deposit address can encode quite a bit of information since it's a pretty long address and definitely has enough bytes to encode commands
Many networks block non-http/s traffic.
Re: Using Hinge as a Command and Control Server
#13Um, use an app that requires you submit to video facial recognition to make an account?
So that you can then use that account, which is tied to your biometrics, for lawbreaking?
Wut?
Re: Using Hinge as a Command and Control Server
#14speaking of command and control servers, the best one you can get at the moment is to just to use crypto currencies, plenty of available nodes to auto discover or just rely on explorers to query your own wallet, deposit address can encode quite a bit of information since it's a pretty long address and definitely has enough bytes to encode commands
Many networks block non-http/s traffic.
Block explorer websites expose blockchains over http/s.
Re: Using Hinge as a Command and Control Server
#15Um, use an app that requires you submit to video facial recognition to make an account? So that you can then use that account, which is tied to your biometrics, for lawbreaking? Wut?
In 2025/2026 it’s not hard to generate fake videos that bypass these security gates.
Re: Using Hinge as a Command and Control Server
#16Um, use an app that requires you submit to video facial recognition to make an account? So that you can then use that account, which is tied to your biometrics, for lawbreaking? Wut?
In 2025/2026 it’s not hard to generate fake videos that bypass these security gates.
They don't let you upload facefusion videos. The video has to come from the front-facing camera on a phone.
There is an extremely profitable company (whose data hoard keeps geting hacked but why should they care?) built around this:
https://www.au10tix.com/
Re: Using Hinge as a Command and Control Server
#17speaking of command and control servers, the best one you can get at the moment is to just to use crypto currencies, plenty of available nodes to auto discover or just rely on explorers to query your own wallet, deposit address can encode quite a bit of information since it's a pretty long address and definitely has enough bytes to encode commands
I want to thank you and the other user (hobofan) for pointing out the use of crypto currencies as C2s. I do bioinformatics for a living, not infosec, so that's another fun little rabbit hole for me to go on...
Re: Using Hinge as a Command and Control Server
#18I'm not really into malware, so I was just wondering: - Isn't this really non-viable in practice? The "few headers" that were shown include an Authorization header, that would presumable rotate every ~24 hours and would have to rotate for all the malware clients as well. - Are centralized Command and Control Severs still a thing in the malware space? I would have assumed that this function mainly migrated onto one of…
Regarding your first point, extraction of the headers could be trivially automated. Also, using Hinge's CDN (which I think is CloudFlare and/or AWS) is more viable imo, as you don't need to provide headers to GET the files. If that also applies to user-uploaded videos then I do think there's some meat on this bone. But as the other user who replied to you pointed out, this was mostly for nerdy delight.
Also thanks for bringing up the blockchain C2 use, that's cool and news to me.
Re: Using Hinge as a Command and Control Server
#19Um, use an app that requires you submit to video facial recognition to make an account? So that you can then use that account, which is tied to your biometrics, for lawbreaking? Wut?
You don't have to do that? I touched upon it in the first section of the post. All you need is a valid phone number, which you can use throwaway trial SIM cards for.
Re: Using Hinge as a Command and Control Server
#20Um, use an app that requires you submit to video facial recognition to make an account? So that you can then use that account, which is tied to your biometrics, for lawbreaking? Wut?
You don't have to do that? I touched upon it in the first section of the post. All you need is a valid phone number, which you can use throwaway trial SIM cards for.
> Our first hurdle is the account creation setup
Account creation requires biometric face-scan.