Security Camera Firmware Exposed GitHub Admin Token and DoD IP Addresses
My security camera shipped a GitHub admin token in its login page
While investigating Hanwha Vision security camera firmware, I discovered a hardcoded GitHub admin token embedded in the login page source. This token granted access to hundreds of repositories due to a build error that leaked the entire CI environment. The firmware also contained unexpected IP addresses assigned to the US Department of Defense, raising questions about the company's internal infrastructure. I reported the issue, and Hanwha revoked the credentials within twelve hours.
I never thought I would be accidentally finding keys to the kingdom of the manufacturer on the ground later in my career; my life is kinda weird sometimes.
- badatnames
Worthy thread to ask: is there such a thing as a white label IP camera (or similar) with a supported open firmware? Not asking for open source, but something close to plug and play that nonetheless has a way of stripping the rootfs as desired for bespoke use in a manufacturer-supported way.
I have looked around before but I only found genuinely dev-oriented kits that weren't even in a shell, and crazy priced.
edit: seems there are some options now (or I missed them before), e.g. https://www.goodcam.io/#for-independent-developers
- grommz
The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.
- dev_l1x_be
Not surprised, many of these vendors are doing crazy things, insane defaults, broken security, hardcoded values. Security is not a priority, I get that, but at the very least some baseline check would be nice (no hardcoded credentials for starting)
- tehlike
A rule of thumb, put your cameras on a separate VLAN and never give that vlan internet access.
Least you can do.
- RyJones
When I cared, I found out that a lot of OBD-II dongles shipped with the same MAC, which gave you access to everything on a bunch of websites.
You can curse the storm, but the wind will come.
- pak9rabid
Perhaps they should just drop the 'security' from the name and simply call it a camera.
- sodapopcan
This blog's misuse of the external link icon irks me.
- IshKebab
LLMs have truly killed obfuscation. It only worked previously by making things extremely tedious but AI doesn't care about that.