Security camera firmware shipped with GitHub admin token
Hanwha cameras' firmware leak exposes token with access to hundreds of repos
1Firmware surprise
A security researcher analyzing Hanwha camera firmware discovered a GitHub admin token in the admin interface. The token provided full access to hundreds of repositories, leaked through accidental inclusion of CI environment variables in the firmware build process.
2Encryption cracked
The researcher first tried Matt Brown's decryption method but found Hanwha had updated their scheme. Using Ghidra and Claude AI, they extracted XOR-obfuscated AES keys and IV from the fwupgrader binary, gaining access to the root filesystem.
3Token prevalence
Trufflehog scans revealed the token duplicated in 30 files. The camera's UI, built with Vite, was writing the entire process.env to firmware during build, exposing all CI environment variables including the privileged GitHub token.
4DoD connections
The firmware contained IP addresses belonging to the US Department of Defense. Hanwha Vision's defense industry history (K9 Thunder, SGR-A1 robot) and ties to Hanwha Defense USA may explain these, though the exact connection remains unclear.
5Company-wide risk
Analysis of 500 firmwares revealed 62 were extractable, with 3 containing the same token. This suggests a systemic CI leak at Hanwha. The token may have been exposed to anyone accessing the camera admin interface.
6Critical security lesson
This incident highlights IoT manufacturers' firmware security and credential management weaknesses. Uncontrolled CI/CD environment variable usage and security gaps in defense-linked companies create critical vulnerabilities needing immediate attention.
Original article: Hacker News — Güvenlik kamerası firmware'inde GitHub admin token bulundu