Hanwha security cameras shipped a GitHub admin token in firmware

A security researcher reverse-engineered firmware images from Hanwha Vision (formerly Samsung Techwin) security cameras and decrypted their protected rootfs. Using an AI-assisted disassembly workflow, they extracted the hardcoded AES key and IV hidden inside the fwupgrader binary and published the model-wide decryption keys.

A scan of the resulting filesystem found the same GitHub token duplicated across roughly 30 files, with admin access to hundreds of repositories in Hanwha's GitHub organization. The root cause traced back to the camera UI's Vite build process, which baked the entire CI job's process.env into client-side code — leaking not just the token but other sensitive environment variables, including IP addresses registered to the US Department of Defense.

The researcher collected firmware for roughly 500 camera models, successfully decrypted most, and found the same token embedded in three of them. Hanwha was notified and revoked the token within 12 hours. The incident underscores how IoT device makers continue to make basic mistakes in CI/CD pipeline security and secret management.