Skip to content

OffCode Web Remote Control 0.8

Choose a tag to compare

View all tags
@EmptyCode0x86 EmptyCode0x86 released this 05 Jul 13:54
WebRemoteControl08
bba46d9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

HOW TO USE: https://github.com/EmptyCode0x86/Web-Remote-Control-System/blob/main/README.md

CHANGELOG:

05/07/2026
VER: 0.8

  • Security: Agent encryption & identity (v2) — Server Manager now generates a unique AES-256 key, AgentKeyId, and AGENT_CONNECT_TOKEN (256-bit random hex) for each new stub. All three are embedded in the stub trailer/.env and registered in BackEnd/AgentKeys.json (hot-reloaded via AgentKeyStore, no BackEnd restart). Per-agent keys limit blast radius: leaking one stub no longer decrypts every agent's traffic (the shared AES_MASTER_KEY_HEX remains BackEnd↔FrontEnd dashboard only). Connect token closes identity spoofing on the anonymous ConnectAsDevice hub method: the BackEnd validates the token with constant-time hex comparison before registration; new agents call ConnectAsDevice directly over TLS. Validation activates per registry entry (legacy rows without connectToken still work until updated). The encrypted ReceiveEncryptedFromAgent → ConnectAsDevice bypass is restricted when AgentSecurity:RequireConnectToken is true (false in dev, true in appsettings.Production.json). Production: rebuild all agent stubs after upgrading the BackEnd, then enable RequireConnectToken=true. Use HTTPS/WSS so the connect token is not visible on the wire. LoadTester supports direct token-based registration.
  • Fixed: FrontEnd Hardcoded Dev Fallback Key Removed — The FrontEnd's encryption service previously fell back to a hardcoded AES key when ASPNETCORE_ENVIRONMENT=Development and AES_MASTER_KEY_HEX was unset. It now fails fast and refuses to start without a valid key, matching the BackEnd and RemoteAgent behavior exactly.
Assets 3
Loading