Security Camera Ships GitHub Admin Token in Login Page

A security researcher found a GitHub admin token embedded in a Hanwha security camera's login page. The token granted full access to the company's GitHub repositories, potentially exposing internal source code, build pipelines, and sensitive configuration files. The firmware also included a list of US Department of War IP addresses and other hardcoded credentials. The token has since been revoked, but the incident highlights systemic IoT security failures.

The Hanwha Security Camera Leak

The researcher discovered the token by inspecting the HTML source of the camera's login page. It belonged to a user with admin privileges. This wasn't a one-off mistake. The firmware appears to have been reused from a high-security military contract without cleaning up sensitive data. The embedded IP addresses confirm that Hanwha's development process lacks basic secret management.

Why It's Trending on Hacker News

The Hacker News thread shows a mix of exasperation and dark humor. One commenter noted:

"The US Department of War IP addresses baked into the firmware is the bigger story here."

Another reflected on the broader IoT landscape:

"Not surprised, many of these vendors are doing crazy things, insane defaults, broken security, hardcoded values. Security is not a priority."

Practical advice emerged quickly:

"A rule of thumb, put your cameras on a separate VLAN and never give that VLAN internet access. Least you can do."

This sentiment underscores a tired but necessary truth: you can't trust the devices you plug into your network.

IoT Security Lessons from the Hanwha Leak

Embedded devices have a long history of shipping with hardcoded credentials, backdoors, and now GitHub tokens. The root cause is a "ship first, secure later" culture that prioritizes time-to-market over security hygiene. For Hanwha, the token is a symptom of poor secret management in CI/CD pipelines. A token granting admin access should never be bundled in a frontend asset.

But the IP addresses are more concerning. They suggest firmware crafted for a specific high-security customer was repurposed for mass market without sanitization. This is a supply chain security failure. If a vendor can't manage a simple list of IPs, what else lurks in the firmware? Backdoors? Unpatched vulnerabilities?

The HN comments are right: you can't fix bad firmware, but you can contain it. VLAN isolation is the bare minimum. Treat IoT devices as hostile endpoints from the factory.

Practical Steps for Builders: Hardening Your IoT Network

If you're an engineer or IT admin, here's how to protect yourself:

1. Network segmentation: Put IoT devices on a separate VLAN with strict firewall rules. Never allow them to initiate outbound connections except to a dedicated management server. Use network access control (NAC) to enforce policies. For a primer, see Cisco's VLAN guide.
2. Monitor traffic: Use tools like Zeek or Wireshark to look for anomalies. Hardcoded IPs might try to phone home; block them at the firewall level.
3. Vendor assessment: Before purchasing, ask vendors about their secure development practices. Do they use secret scanning? Are firmware images signed? Can you independently audit updates?
4. Token scanning: If you're a vendor, integrate secret scanners like truffleHog or git-secrets into your CI pipeline. Never commit tokens to repositories, and never embed them in client-facing code. GitHub's secret scanning can also help.

For developers, treat every token as a potential leak. Use short-lived credentials, rotate them frequently, and apply least-privilege principles.

Here's a simple example of a Git pre-commit hook that prevents accidental token commits:

#!/bin/sh

# Prevent accidental commit of secrets (simplified)

if git diff --cached | grep -E '(GH|github)_[A-Za-z0-9_-]{35,40}'; then
  echo "ERROR: Found a potential GitHub token. Remove it before committing."
  exit 1
fi

Combine this with automated scanning in your CI pipeline.

Final Verdict: Treat Every IoT Device as Hostile

If you use IoT devices—especially security cameras, door locks, or industrial sensors—you need to care. This story is a wake-up call that even reputable vendors can ship dangerously flawed firmware. If you're building IoT products, this is a mandatory case study in what not to do. If you're a consumer, isolation is your best defense: put that camera on a separate VLAN and block its internet access. Otherwise, you're trusting firmware written by someone who accidentally included a GitHub admin token in a login page.