A Hanwha security camera shipped with a hardcoded GitHub administrative token visible in its login page source code, potentially granting unauthorized access to the company's repositories.
A security researcher discovered that Hanwha's security camera firmware contained a GitHub admin token embedded in the login page HTML. The token was exposed in plain text within the client-side code, creating a significant security vulnerability.
The exposure granted full administrative access to associated GitHub repositories, allowing anyone with knowledge of the token to view, modify, or delete code and configurations. This type of credential leakage represents a critical risk for supply chain security, as compromised repositories could enable attackers to inject malicious code into future firmware releases.
Discovery and Response
The researcher responsibly disclosed the vulnerability through GitHub's security advisory process. The incident highlights a common but dangerous practice: embedding API tokens and credentials directly in firmware or application code rather than using secure authentication methods.
Handling secrets properly requires using environment variables, secure vaults, or API key management systems that keep credentials separate from source code. Hard-coded tokens create persistent vulnerabilities since they cannot be easily rotated without rebuilding and redistributing firmware.
Broader Implications
This discovery underscores risks in IoT device supply chains. Security cameras and similar network-connected devices often receive less scrutiny during development than consumer-facing applications, yet they can serve as entry points for network compromise.
The incident also demonstrates the importance of code review practices and security scanning in firmware development. Automated tools can flag credential patterns before code ships to production.
Hanwha has not publicly commented on the timeline for patching affected devices or the scope of potentially compromised repositories. Users of affected camera models may face extended exposure periods while firmware updates roll out.
This case joins a growing list of IoT device vulnerabilities involving exposed credentials, reinforcing the need for stronger security practices throughout hardware manufacturers' development and distribution processes.
Berlin's government is intensively reviewing 5.79TB of state data released by ransomware group Rhysida after refusing to pay a ransom demand. The leaked files reportedly contain sensitive information on national defense and threat response plans.
Cybercriminals are exploiting thousands of compromised small-business websites to distribute ClickFix malware payloads stored in smart contracts on the BNB Smart Chain, amplifying the reach of a known threat.
Quad9 provides an open DNS recursive service that prioritizes user privacy and security at no cost. The service blocks malware and phishing domains while maintaining minimal data collection.
A government website running Ruby on Rails was exploited within hours of a critical vulnerability patch becoming public. The rapid attack demonstrates how quickly threat actors weaponize disclosed security flaws.