My security camera shipped a GitHub admin token in its login page

A security researcher discovered a GitHub administrative token embedded in the login page of Hanwha Vision security cameras and reported the exposure to the company, which revoked the credential within 12 hours, the researcher said. The researcher reverse-engineered firmware for Hanwha Vision cameras, decrypting the root filesystem using a hardcoded AES key and initialization vector found in the fwupgrader binary. A scan of the extracted filesystem with TruffleHog revealed a GitHub token duplicated in approximately 30 files that granted administrative privileges to hundreds of repositories in the organization's GitHub account. The token appeared to have been included because the camera's user interface, built with Vite, was configured to write the entirety of the CI job's environment variables into the build artifacts at compile time. The researcher downloaded and analyzed roughly 500 firmware images across the product line and found the same token in only three images. The researcher reported the finding to Hanwha Vision's security contact and received confirmation that the token had been revoked. The exposed environment variables also contained IP addresses assigned to the U.S. Department of Defense, though the significance of that data was not determined.