A Hanwha security camera shipped with a hardcoded GitHub administrative token visible in its login page source code, potentially granting unauthorized access to the company's repositories.
A security researcher discovered that Hanwha's security camera firmware contained a GitHub admin token embedded in the login page HTML. The token was exposed in plain text within the client-side code, creating a significant security vulnerability.
The exposure granted full administrative access to associated GitHub repositories, allowing anyone with knowledge of the token to view, modify, or delete code and configurations. This type of credential leakage represents a critical risk for supply chain security, as compromised repositories could enable attackers to inject malicious code into future firmware releases.
Discovery and Response
The researcher responsibly disclosed the vulnerability through GitHub's security advisory process. The incident highlights a common but dangerous practice: embedding API tokens and credentials directly in firmware or application code rather than using secure authentication methods.
Handling secrets properly requires using environment variables, secure vaults, or API key management systems that keep credentials separate from source code. Hard-coded tokens create persistent vulnerabilities since they cannot be easily rotated without rebuilding and redistributing firmware.
Broader Implications
This discovery underscores risks in IoT device supply chains. Security cameras and similar network-connected devices often receive less scrutiny during development than consumer-facing applications, yet they can serve as entry points for network compromise.
The incident also demonstrates the importance of code review practices and security scanning in firmware development. Automated tools can flag credential patterns before code ships to production.
Hanwha has not publicly commented on the timeline for patching affected devices or the scope of potentially compromised repositories. Users of affected camera models may face extended exposure periods while firmware updates roll out.
This case joins a growing list of IoT device vulnerabilities involving exposed credentials, reinforcing the need for stronger security practices throughout hardware manufacturers' development and distribution processes.
Slopsquatting, phantom domains, and HalluSquatting exploit identical vulnerabilities in AI coding agents. Security researchers warn that these attacks leverage late-binding patterns where AI systems trust non-existent packages and repositories.
Chick-fil-A confirmed a credential stuffing attack compromised over 13,000 customer accounts between June 17-19. The breach targeted the restaurant chain's website and mobile app.
Moonshot AI's Kimi K3 scored 32 percent on offensive cyber benchmarks versus 76 percent for leading U.S. models, according to tests by the British AI Security Institute and U.S. Center for AI Standards and Innovation. The model's safeguards also failed to prevent exploit development.
An Illinois man received a 76-month prison sentence Tuesday for hacking over 750 women's Snapchat accounts and stealing intimate photos without consent.