Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using Hinge as a Command and Control Server

mattwie.se

Post reply on HN
Print view View original

61–70 of 71 posts

Re: Using Hinge as a Command and Control Server

#61

Post by monerozcash »

kachapopopow wrote: post #59
monerozcash wrote: post #58

Earlier quoted context omitted.

There are much lighter alternatives though, why would you want to bother with cryptocurrencies when you could just use DHT? I mean, even just shipping a Tor client embedded in your malware seems like a much better idea. >just rely on explorers to query your own wallet This kind of defeats the point, you get exactly 0 censorship resistance like this.

enlighten me how a non trivially generated address that is only known by malware can be implemented in every single blockchain explorer? you would have to extract the keys from the malware, you would then have to implement the logic and announce it - then rely on blockchain exploreres actually using that data to block addresses in real time.

I'm not 100% sure I understand what you're saying, but I guess you're asking how this could be censored?

> you would have to extract the keys from the malware

Yeah? That happens all the time. If you're designing mechanisms like this, it's presumably specifically against adversaries which are doing exactly that.

> you would then have to implement the logic and announce it - then rely on blockchain exploreres actually using that data to block addresses in real time.

Someone would only have to do this once and all your bots would be gone.

Usually the whole point of these mechanisms is C&C resilience, and usually that only matters for really big botnets which face co-ordinated attacks.

Any good C&C system for a bigger botnet would seek to eliminate all meaningful external points of failure for C&C. Using a block explorer, or HN comments, does not achieve that.

Re: Using Hinge as a Command and Control Server

#62

Post by monerozcash »

kachapopopow wrote: post #60
sneak wrote: post #55

Earlier quoted context omitted.

Yes, and can easily be blocked if they are commonly used for c&c, like many other sites are (such as gists and pastebins) for the same reason.

if you add non trivial address generation there simply isn't a good way to block it except for hope and prayers. nobody really wants to play wack-a-mole on blocking addresses for c2 servers and then there will always be websites which straight up do not care.

I mean, at that point, why wouldn't you just rely on a DGA? At least then you wouldn't be flooding block explorer sites with millions or potentially tens of millions of requests per day for your C&C traffic.

Essentially the exact approach you propose has been attempted in far cleverer ways, it did not work very well.

Re: Using Hinge as a Command and Control Server

#63

Post by kachapopopow »

monerozcash wrote: post #61
kachapopopow wrote: post #59

Earlier quoted context omitted.

enlighten me how a non trivially generated address that is only known by malware can be implemented in every single blockchain explorer? you would have to extract the keys from the malware, you would then have to implement the logic and announce it - then rely on blockchain exploreres actually using that data to block addresses in real time.

I'm not 100% sure I understand what you're saying, but I guess you're asking how this could be censored? > you would have to extract the keys from the malware Yeah? That happens all the time. If you're designing mechanisms like this, it's presumably specifically against adversaries which are doing exactly that. > you would then have to implement the logic and announce it - then rely on blockchain exploreres actually…

that's why you have large lists, fallbacks and rolling updates to said fallbacks. it isolates you as the c2 owner to the c2 malware. once you have that you can just query from any kind of server and publish it anywhere else, you can have it act as an indirect proxy, not the primary contact point - it's a globally available database for a low low cost of transaction fees.

but explorers are the easiest since there's so many of them and so many of them that do not give two shits about blacklisting addresses.

Re: Using Hinge as a Command and Control Server

#64

Post by jhbafgshjk »

kachapopopow wrote: post #63
monerozcash wrote: post #61

Earlier quoted context omitted.

I'm not 100% sure I understand what you're saying, but I guess you're asking how this could be censored? > you would have to extract the keys from the malware Yeah? That happens all the time. If you're designing mechanisms like this, it's presumably specifically against adversaries which are doing exactly that. > you would then have to implement the logic and announce it - then rely on blockchain exploreres actually…

that's why you have large lists, fallbacks and rolling updates to said fallbacks. it isolates you as the c2 owner to the c2 malware. once you have that you can just query from any kind of server and publish it anywhere else, you can have it act as an indirect proxy, not the primary contact point - it's a globally available database for a low low cost of transaction fees. but explorers are the easiest since there's so…

[dead]

Re: Using Hinge as a Command and Control Server

#65

Post by JasonADrury »

kachapopopow wrote: post #63
monerozcash wrote: post #61

Earlier quoted context omitted.

I'm not 100% sure I understand what you're saying, but I guess you're asking how this could be censored? > you would have to extract the keys from the malware Yeah? That happens all the time. If you're designing mechanisms like this, it's presumably specifically against adversaries which are doing exactly that. > you would then have to implement the logic and announce it - then rely on blockchain exploreres actually…

that's why you have large lists, fallbacks and rolling updates to said fallbacks. it isolates you as the c2 owner to the c2 malware. once you have that you can just query from any kind of server and publish it anywhere else, you can have it act as an indirect proxy, not the primary contact point - it's a globally available database for a low low cost of transaction fees. but explorers are the easiest since there's so…

And what do you gain from all this extra complexity designed to compensate for fundamentally unreliable c&c channels?

You could've just used DHT, or even bundled Tor.

Re: Using Hinge as a Command and Control Server

#66

Post by kachapopopow »

JasonADrury wrote: post #65
kachapopopow wrote: post #63

Earlier quoted context omitted.

that's why you have large lists, fallbacks and rolling updates to said fallbacks. it isolates you as the c2 owner to the c2 malware. once you have that you can just query from any kind of server and publish it anywhere else, you can have it act as an indirect proxy, not the primary contact point - it's a globally available database for a low low cost of transaction fees. but explorers are the easiest since there's so…

And what do you gain from all this extra complexity designed to compensate for fundamentally unreliable c&c channels? You could've just used DHT, or even bundled Tor.

because a c2 mechanism isn't that useful when you can't even send the packets out to the internet to use it when t1's get off their ass and actually do something useful.

Re: Using Hinge as a Command and Control Server

#67

Post by kachapopopow »

monerozcash wrote: post #62
kachapopopow wrote: post #60

Earlier quoted context omitted.

if you add non trivial address generation there simply isn't a good way to block it except for hope and prayers. nobody really wants to play wack-a-mole on blocking addresses for c2 servers and then there will always be websites which straight up do not care.

I mean, at that point, why wouldn't you just rely on a DGA? At least then you wouldn't be flooding block explorer sites with millions or potentially tens of millions of requests per day for your C&C traffic. Essentially the exact approach you propose has been attempted in far cleverer ways, it did not work very well.

well you wouldn't really want to use it for botnets that large, modern botnets run off similar systems internet runs off - edge endpoints and crypto currency is just a nice distributed database to rely upon to synchronize everything

Re: Using Hinge as a Command and Control Server

#68

Post by JasonADrury »

kachapopopow wrote: post #66
JasonADrury wrote: post #65

Earlier quoted context omitted.

And what do you gain from all this extra complexity designed to compensate for fundamentally unreliable c&c channels? You could've just used DHT, or even bundled Tor.

because a c2 mechanism isn't that useful when you can't even send the packets out to the internet to use it when t1's get off their ass and actually do something useful.

>because a c2 mechanism isn't that useful when you can't even send the packets out to the internet to use it when t1's get off their ass and actually do something useful.

There are lots of ways to disguise p2p traffic to make it indistinguishable from common, legitimate software.

Re: Using Hinge as a Command and Control Server

#69

Post by JasonADrury »

kachapopopow wrote: post #67
monerozcash wrote: post #62

Earlier quoted context omitted.

I mean, at that point, why wouldn't you just rely on a DGA? At least then you wouldn't be flooding block explorer sites with millions or potentially tens of millions of requests per day for your C&C traffic. Essentially the exact approach you propose has been attempted in far cleverer ways, it did not work very well.

well you wouldn't really want to use it for botnets that large, modern botnets run off similar systems internet runs off - edge endpoints and crypto currency is just a nice distributed database to rely upon to synchronize everything

I don't think you'd want to go through the trouble for smaller botnets though. It's really only the very big ones that face co-ordinated takedown efforts.

For a very small botnet that doesn't attract attention, you could really use any social media site for C&C if your goal was to avoid network-level detection.

For a slightly bigger botnet that might get abuse reports, you could just get a bunch of domains on different ccTLDs from various bulletproof registrars. There are some huge botnets doing this without much trouble.

It's really only the really big botnets where you want to worry about things like P2P C&Cs for censorship resistance, they're the ones that will face co-ordinated efforts to shut them don.

I feel like the block explorers aren't a really good solution, for small botnets there are less conspicuous options. Here's a (real) botnet C&C that uses Steam, and has been doing so for a long time https://steamcommunity.com/profiles/76561199621451974 It's a rather silly implementation though, not sure why the developer decided to do it this way.

It's also worth noting that most botnets aren't targeting networks where they'd really have to worry about network-level detection, so in almost all cases using your own domain names is by far the easiest and most reliable option.

I'd also guess the most common malware these days is of the often short-lived "stealer" type, where the operator doesn't necessarily really care about keeping their bots alive as the malware just immediately grabs all the interesting data from your computer and uploads it.

Re: Using Hinge as a Command and Control Server

#70

Post by Aurornis »

octoberfranklin wrote: post #16
Aurornis wrote: post #15

Earlier quoted context omitted.

In 2025/2026 it’s not hard to generate fake videos that bypass these security gates.

They don't let you upload facefusion videos. The video has to come from the front-facing camera on a phone. There is an extremely profitable company (whose data hoard keeps geting hacked but why should they care?) built around this: https://www.au10tix.com/ Most apps use device attestation (derived from secure boot) to make sure the video stream is really coming from a front-facing camera on a physical device. If Hin…

I know, but you need to think like someone trying to get around the limitation with the lowest effort possible.

They don't feed it a video clip. They hold the camera in front of a screen playing the video. Use a low-end phone with a blurry camera to increase your chances.

Post reply on HN