Developed by: bad-antics Development Team & antX
Copyright Β© 2026
Both Hive-Mind (master) and Spawn (client) applications have been hardened with enterprise-grade security features to protect your home network.
- 256-bit Shared Secret Key - All Spawn clients must provide the correct authentication key
- Automatic Key Generation - Hive-Mind generates a cryptographically secure random key on first run
- Secure Key Storage - Keys stored in
%APPDATA%\HiveMind\security.keywith hidden/read-only attributes
- Military-Grade Encryption - All network communication encrypted with AES-256
- Unique Keys Per Installation - Each Hive-Mind installation has unique encryption keys
- Encrypted Messages - Commands and responses fully encrypted in transit
- Connection Throttling - Maximum 1 connection every 2 seconds per IP address
- Prevents Spam - Blocks rapid-fire connection attempts
- Automatic Cleanup - Old connection records automatically purged
- Failed Attempt Tracking - Monitors authentication failures per IP
- Automatic Lockout - 5 failed attempts = 15 minute lockout
- IP-Based Blocking - Attackers automatically blocked
- XSS Protection - Dangerous characters escaped
- Length Limits - Input capped at 1000 characters
- Injection Prevention - SQL/Command injection attacks blocked
- Windows DPAPI - Credentials encrypted at rest on Windows
- File Permissions - chmod 600 on Linux/macOS (owner read/write only)
- Secure Delete - Credentials can be safely removed
- Port 49152 - Dynamic/private port range (less targeted)
- Local Network Only - Not exposed to internet by default
- Connection Validation - Every message validated and authenticated
-
First Launch
- Run as Administrator:
Start-Process "dotnet" -ArgumentList "run" -Verb RunAs - Watch the boot sequence - you'll see security initialization
- Security keys automatically generated and saved
- Run as Administrator:
-
Getting the Authentication Key
- Click
[SHOW AUTH KEY]button - Key is displayed in terminal and copied to clipboard
- KEEP THIS KEY SECURE - anyone with this key can connect
- Click
-
Starting the Command Server
- Click
[START SERVER]to listen on port 49152 - DEFCON level changes to 3 (heightened readiness)
- Server now accepts authenticated Spawn connections
- Click
-
Security Best Practices
- Only give the auth key to trusted machines
- Don't share the key publicly or over unsecured channels
- Regenerate keys if compromised (manually delete
security.key)
-
First Setup
- Run Spawn on remote machine
- When prompted, enter the authentication key from Hive-Mind
- Choose whether to save credentials (recommended)
-
Saved Credentials
- Credentials encrypted and stored locally
- Windows: Protected with DPAPI (user-level encryption)
- Linux/macOS: File permissions 600 (owner only)
-
Automatic Check-In
- Spawn checks in every 5 seconds
- Each check-in is authenticated and encrypted
- Failed authentication stops the client
-
Security Indicators
- β Green checkmark = Successful authentication
- β Red X = Authentication failed
- Yellow warning = Connection issue
- AES-256-CBC - Industry standard symmetric encryption
- 256-bit Keys - Maximum security strength
- Unique IV - Prevents pattern analysis
- Spawn creates message:
AUTH|<token>|<command> - Spawn encrypts entire message with AES-256
- Hive-Mind receives encrypted message
- Hive-Mind decrypts and validates token
- Hive-Mind checks rate limits and lockouts
- If valid, Hive-Mind processes command and sends encrypted response
- Sliding Window: 2-second minimum between connections from same IP
- Lockout Duration: 15 minutes after 5 failed authentication attempts
- Automatic Cleanup: Old records purged every connection check
- Hive-Mind Keys:
%APPDATA%\HiveMind\security.key - Spawn Credentials (Windows):
%APPDATA%\Spawn\credentials.dat - Spawn Credentials (Linux/macOS):
~/.config/Spawn/credentials.dat
- This system is designed for local network use only
- Do NOT port forward port 49152 on your router
- Do NOT expose Hive-Mind to the public internet
If you need internet exposure, add:
- TLS/SSL - Transport layer encryption (HTTPS equivalent)
- Certificate Pinning - Prevent man-in-the-middle attacks
- IP Whitelisting - Only allow specific IPs to connect
- VPN - Use VPN instead of direct internet exposure
- Protect machines with Hive-Mind installed (they have the master keys)
- Use full-disk encryption on all machines
- Strong passwords on all accounts
If you believe your keys have been compromised:
- Stop Hive-Mind
- Delete
%APPDATA%\HiveMind\security.key - Restart Hive-Mind - New keys will be generated
- Get new auth key and distribute to all Spawn clients
- Update all Spawn clients with new credentials
> AUTHENTICATION FAILED - ACCESS DENIED- Someone tried wrong key- Multiple rapid connection attempts - Possible attack
- Connections from unexpected IPs - Investigate
β Authentication failed- Check if auth key is correct- Repeated connection failures - Hive-Mind may be down or keys changed
- Verify you copied the correct auth key from Hive-Mind
- Click
[SHOW AUTH KEY]in Hive-Mind to see current key - Delete Spawn credentials and re-enter key
- Check if IP is locked out (wait 15 minutes)
- Verify Spawn has correct authentication key
- Check Hive-Mind terminal for specific error messages
- Verify Hive-Mind server is running
- Check firewall isn't blocking port 49152
- Verify IP address and port number are correct
v1.0 HARDENED (2026-01-01)
- Added AES-256 encryption for all network communication
- Implemented 256-bit authentication system
- Added rate limiting and brute force protection
- Input sanitization and validation
- Secure credential storage with DPAPI/file permissions
- Changed default port to 49152 (dynamic/private range)
- Security status displayed in boot sequence
- [SHOW AUTH KEY] button for easy key distribution
Developed by: bad-antics Development Team & antX
Copyright: Β© 2026 All Rights Reserved
This software is provided "as is" without warranty of any kind. Use at your own risk.
| Feature | Details |
|---|---|
| Encryption | AES-256-CBC |
| Authentication | 256-bit shared secret |
| Port | 49152 (dynamic/private range) |
| Rate Limit | 1 connection per 2 seconds per IP |
| Lockout | 5 failed attempts = 15 min ban |
| Storage | DPAPI (Windows) / chmod 600 (Unix) |
KEEP YOUR AUTHENTICATION KEY SECURE!