My security camera shipped a GitHub admin token in its login page
1–10 of 265 posts
Re: My security camera shipped a GitHub admin token in its login page
#2When I cared, I found out that a lot of OBD-II dongles shipped with the same MAC, which gave you access to everything on a bunch of websites.
You can curse the storm, but the wind will come.
Re: My security camera shipped a GitHub admin token in its login page
#3When I cared, I found out that a lot of OBD-II dongles shipped with the same MAC, which gave you access to everything on a bunch of websites. You can curse the storm, but the wind will come.
how did "same MAC" lead to "access to everything"?
Was the website's security based on MAC, which presumably is supplied by the client? If so, I guess.. typical IoT.
Re: My security camera shipped a GitHub admin token in its login page
#4The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.
Re: My security camera shipped a GitHub admin token in its login page
#5The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.
I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.
Re: My security camera shipped a GitHub admin token in its login page
#6The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.
I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.
there's a couple subnets I (ab)use in the DOD IP space for my home network knowing they'd never put them on the open internet. it's also fun to throw logging for a loop if someone digs.
22.0.0.0/8 - it's basically free real estate!
Re: My security camera shipped a GitHub admin token in its login page
#7When I cared, I found out that a lot of OBD-II dongles shipped with the same MAC, which gave you access to everything on a bunch of websites. You can curse the storm, but the wind will come.
how did "same MAC" lead to "access to everything"? Was the website's security based on MAC, which presumably is supplied by the client? If so, I guess.. typical IoT.
buy any dongle that sells for under $100 on amazon. they all have the same mac, and come with 'bespoke' apps to let you do things to your car. those apps are all thin wrappers on code widely shared; they use the MAC of the dongle as the keystone for ID.
Short story: buy one cheap dongle on Amazon, dump the MAC (00:11:22:AA:BB:CC IIRC; it's been 15 years since I cared) and you have auth to all of the apps everywhere.
Reminder: the Bluetooth logo comes, mostly, from self-certification.
Re: My security camera shipped a GitHub admin token in its login page
#8Earlier quoted context omitted.
I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.
there's a couple subnets I (ab)use in the DOD IP space for my home network knowing they'd never put them on the open internet. it's also fun to throw logging for a loop if someone digs. 22.0.0.0/8 - it's basically free real estate!
I have seen ISP doing CGNAT on DOD IP space.
Re: My security camera shipped a GitHub admin token in its login page
#9I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.
Re: My security camera shipped a GitHub admin token in its login page
#10The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.
I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.
This will trip up most SOC workflows in funny ways, and I like it.
IPs having a global distinction between public/private is a convention, but local routing can widely differ.
Same with the "China Cyberattacks" - the guys sitting on top of my outgoing fiber can simulate any IP address they want to me.