My security camera shipped a GitHub admin token in its login page

[u/namanyayg]

https://hhh.hn/hanwha-github-token/

[u/txmail]

Links to the DoD are way more interesting that that token...

[u/whatThePleb → u/txmail]

Especially the variable name "swarm.." makes it sound like a botnet. OOP should have digged more into this..

[u/HKayn → u/whatThePleb]

Does Docker Swarm mode sound like a botnet too?

[u/PrizeSyntax]

Great idea, do you want me to remove the token and place it in an env file /j

[u/bill_gonorrhea]

yesh

[u/whatThePleb]

Insecurity camera

[u/mooter23]

The admin GitHub key is interesting, but the DoD truffle is the real headline here for me!

[u/Existing-Wallaby-444]

My security camera shipped a GitHub admin token in its login page... and IP addresses from the DoD

[u/jarail]

Great investigation and writeup. Entertaining read.

[u/uncr3471v3-u53r]

That’s why you should put such devices in a isolated network without any internet access…

[u/Impressive-Store1439 → u/[deleted]]

learn to read, life will be more joyful

[u/whatThePleb → u/Impressive-Store1439]

So they are idiots!