My security camera shipped a GitHub admin token in its login page

一句话概要

i dissected some firmware for a Hanwha Wisenet XNP-9300RW and found that it had github admin tokens in it, also miltech is weird

原文开头节选

i have been thinking a bit more about security cameras again, because of AXIS starting to push more for every one of their cameras to be able to easily run linux applications on them , they’re far more serious targets in an enterprise environment and need to be managed as such for vulnerabilities and credential management etc. someone brought up to me a company that sounded new to me, Hanwha (Vision.) I took a look at the site, and found that they had accessible firmware blobs for each model of camera, which is always a treat.

i took the image and threw it at binwalk hoping it was just a rootfs or something, but inside there was a separate tarball with some AI stuff for the camera and a fwimage.tgz that binwalk was flagging as encrypted.

I was googling around and saw that Matt Brown has a writeup on these cameras that got me through . basically the passphrase is HTW + the model number so HTWXNP-9300RW worked.

seems like they do some more stuff now, because inside of that tarball was another fwimage.tgz that was encrypted but it wasn’t the same scheme, so we can’t just re-use the same …

(以上为原文节选,完整内容见下方”原文来源”)

这条动态今日登上 Hacker News 首页(455 赞 / 162 评论,来源 hhh.hn)。技术雷达每日自动聚合 AI 工程、后端架构、DevOps 方向的前沿动态;相关工程落地可浏览下方的相关服务与延伸阅读,或直接与我们团队交流。