This week, it was discovered that certain security cameras manufactured by Hanwha contain a GitHub admin token within their firmware, accessible from the login page. This revelation highlights a significant security oversight in the deployment of these devices.
The cameras in question are capable of running Linux applications and are increasingly being deployed in enterprise environments. The firmware, available for download from Hanwha's site, was found to contain an encrypted tarball with a separate AI component and additional firmware images. Upon further inspection using tools like binwalk and Ghidra, it was revealed that the encryption scheme involved an AES key obfuscated in the binary, which could be reconstructed to access the root filesystem.
The critical finding was the presence of a GitHub token with admin privileges, duplicated in approximately 30 files within the firmware. This token provided access to hundreds of repositories within the associated GitHub organization. The token was inadvertently included due to an issue where the camera's UI build process recorded the entire environment variables, including sensitive CI job data, into the files.
These cameras are targeted at enterprise users who require robust security and surveillance systems. The cameras' ability to run Linux applications makes them attractive for custom deployments in various security-sensitive environments.
Work implications: This vulnerability could impact IT security teams and DevOps professionals, highlighting the need for rigorous security audits of firmware and software environments in enterprise deployments.
Originally reported by hhh.hn