Security Camera Firm Exposes GitHub Admin Token in Firmware
Hanwha Vision cameras found to contain a GitHub admin token in their firmware.
1Critical Security Flaw in Cameras
A GitHub admin token with access to hundreds of repositories was found in Hanwha Vision security camera firmware. The token could have been sent to anyone accessing the admin interface, posing a severe security risk.
2Firmware Analysis
Researchers analyzed Hanwha camera firmware using binwalk and Ghidra. Encrypted rootfs files were decrypted using an XOR-obfuscated AES key. The key and IV were hardcoded in the firmware, leading to the vulnerability.
3CI Environment Variables Issue
The token was exposed because the build process wrote all process.env variables to files. This leaked sensitive CI environment data, including the GitHub token, into 30 different files in the firmware.
4US Department of Defense Connection
Firmware contained IP addresses assigned to the US DoD. Hanwha has ties to defense industries, but it's unclear why these IPs were in the firmware. Shared CI environments with defense-related sister companies might be the cause.
5Token Prevalence
The researcher downloaded and analyzed all Hanwha firmware. Out of 500 firmwares, 62% were decrypted, and only three contained the same GitHub token. Why the token wasn't in others remains a mystery.
6Security Alert and Implications
This incident highlights the critical security risks in IoT device firmware. Leaking sensitive data into firmware can have severe consequences. Hanwha must take immediate action to address this vulnerability.