# Security camera firmware shipped with GitHub admin token Hanwha cameras' firmware leak exposes token with access to hundreds of repos - **Source:** [Hacker News](https://news.ycombinator.com) - **Published:** 2026-07-24 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/c8af65ec-534c-44f8-b737-4ad055521e4f ## Firmware surprise A security researcher analyzing Hanwha camera firmware discovered a GitHub admin token in the admin interface. The token provided full access to hundreds of repositories, leaked through accidental inclusion of CI environment variables in the firmware build process. ## Encryption cracked The researcher first tried Matt Brown's decryption method but found Hanwha had updated their scheme. Using Ghidra and Claude AI, they extracted XOR-obfuscated AES keys and IV from the fwupgrader binary, gaining access to the root filesystem. ## Token prevalence Trufflehog scans revealed the token duplicated in 30 files. The camera's UI, built with Vite, was writing the entire process.env to firmware during build, exposing all CI environment variables including the privileged GitHub token. ## DoD connections The firmware contained IP addresses belonging to the US Department of Defense. Hanwha Vision's defense industry history (K9 Thunder, SGR-A1 robot) and ties to Hanwha Defense USA may explain these, though the exact connection remains unclear. ## Company-wide risk Analysis of 500 firmwares revealed 62 were extractable, with 3 containing the same token. This suggests a systemic CI leak at Hanwha. The token may have been exposed to anyone accessing the camera admin interface. ## Critical security lesson This incident highlights IoT manufacturers' firmware security and credential management weaknesses. Uncontrolled CI/CD environment variable usage and security gaps in defense-linked companies create critical vulnerabilities needing immediate attention. ## Sources covering this story - https://hhh.hn/hanwha-github-token/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._