Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My security camera shipped a GitHub admin token in its login page

hhh.hn

Post reply on HN
Print view View original

31–40 of 265 posts

Re: My security camera shipped a GitHub admin token in its login page

#31

Post by Matuzy »

inigyou wrote: post #23
ErroneousBosh wrote: post #15

Earlier quoted context omitted.

I recently troubleshot an installation for someone where at some point in the past they'd picked 1.1.1.0/24 as their address range because "all that 192 stuff was silly and too complicated". You know, I'm not sure I can explain how I feel about this properly without waving the shotgun around.

Yet another thing ipv6 solves. Yeah you can do the officially supported fdXX:XXXX:XXXX:... but you can also just pick something like 1::1 and it's unlikely to conflict with the current global range. If you're gonna do that, though, it's better if you use fd00:... or one of the other assigned ranges so it's still in the standard range. OSes use this as a heuristic for source address selection.

> Yet another thing ipv6 solves. ... it's unlikely to conflict with the current global range

I'm not familiar with IPv6's details, could you elaborate on this? To me, this reads like you're saying that IPv6 solves the problem by having low adoption rates rather than an actual function of the protocol.

Re: My security camera shipped a GitHub admin token in its login page

#32

Post by dev_l1x_be »

Not surprised, many of these vendors are doing crazy things, insane defaults, broken security, hardcoded values. Security is not a priority, I get that, but at the very least some baseline check would be nice (no hardcoded credentials for starting)

Re: My security camera shipped a GitHub admin token in its login page

#33

Post by xoa »

walrus01 wrote: post #13
kotaKat wrote: post #6

Earlier quoted context omitted.

there's a couple subnets I (ab)use in the DOD IP space for my home network knowing they'd never put them on the open internet. it's also fun to throw logging for a loop if someone digs. 22.0.0.0/8 - it's basically free real estate!

the entirety of 10/8 and 172.16/12 and 192.168/16 wasn't large enough for your house?

>the entirety of 10/8 and 172.16/12 and 192.168/16 wasn't large enough for your house?

Just to chime in agreeing with sibling comments, the issue is when it's not about just your house and you're deep into self-hosted stuff with a lot of different properties and businesses other people's houses all sharing resources. Without a lot of coordination and consideration, which in practice doesn't really happen easily given the adhoc nature such things tend to organically develop out of, and all the random stuff that wants specific addresses at least for setup, it actually gets pretty easy to run into collisions. Allocations typically are definitely inefficient in many respects but also made sense in the context they were first done and of course can be a certain amount of effort to change.

In an ideal world I sorta feel like "IPv6" should have been more along the lines of :, everyone gets a prefix or set of prefixes that they actually own and are consistent worldwide, or at least only change when geographic location changes, and then can just have the entire 32-bit IPv4 space for LAN however they want. Then you only have to care about prefix between LANs and it could all be extremely automated, internally you only need to use something that looks like IPv4 with the network hardware transparently able to handle prefixes for WAN. Backwards compatibility story would be a lot more straight forward too. Oh well.

@kotaKat: that's a great idea and I don't know why I forgot I played with that like 15 years ago. Really handy as a backup space that almost certainly won't collide with any commercial hardware at least.

Re: My security camera shipped a GitHub admin token in its login page

#35

Post by iso1631 »

kowbell wrote: post #30
inigyou wrote: post #23

Earlier quoted context omitted.

Yet another thing ipv6 solves. Yeah you can do the officially supported fdXX:XXXX:XXXX:... but you can also just pick something like 1::1 and it's unlikely to conflict with the current global range. If you're gonna do that, though, it's better if you use fd00:... or one of the other assigned ranges so it's still in the standard range. OSes use this as a heuristic for source address selection.

"all that 192 stuff was silly and too complicated... but this fd00: stuff is easy peasy!"

192.168.0.0/24 -> fd00:0::/64

192.168.1.0/24 -> fd00:1::/64

192.168.2.0/24 -> fd00:2::/64

192.168.240.0/24 -> fd00:240::/64

It's not a great idea, but its no harder.

No need to mess around with setting up DHCP, remembering if your router is top or bottom of the subnet, and if you want 500 devices on a single subnet that's no problem.

Now if you still need ipv4 then yes, ipv6 is stupid as you have double the pain for none of the gain, but if you are ip6 only then its far easier.

Re: My security camera shipped a GitHub admin token in its login page

#36

Post by vitally3643 »

Matuzy wrote: post #31
inigyou wrote: post #23

Earlier quoted context omitted.

Yet another thing ipv6 solves. Yeah you can do the officially supported fdXX:XXXX:XXXX:... but you can also just pick something like 1::1 and it's unlikely to conflict with the current global range. If you're gonna do that, though, it's better if you use fd00:... or one of the other assigned ranges so it's still in the standard range. OSes use this as a heuristic for source address selection.

> Yet another thing ipv6 solves. ... it's unlikely to conflict with the current global range I'm not familiar with IPv6's details, could you elaborate on this? To me, this reads like you're saying that IPv6 solves the problem by having low adoption rates rather than an actual function of the protocol.

The argument is that IPv6 addresses are UUIDs and any random block is unlikely to collide with any other random address.

It's not about low adoption, it's that there are unimaginably many IPv6 addresses.

...which is a major reason for why it has low adoption

Re: My security camera shipped a GitHub admin token in its login page

#38

Post by phh »

llm_nerd wrote: post #21
IshKebab wrote: post #17

LLMs have truly killed obfuscation. It only worked previously by making things extremely tedious but AI doesn't care about that.

And it's worth considering that obfuscation only ever worked against casuals for whom tedious was a bridge too far. Nation state actors and criminal hacker groups, on the other hand, consider the tedious entirely worth it.

Yes, obfuscation was always a matter of cost: how much money do you need to break the protection? LLM just decreased that amount by a lot.

(Yes ok, RSA4096 is technically a matter of cost, you just need an infinite amount of money)

Re: My security camera shipped a GitHub admin token in its login page

#40

Post by dev_l1x_be »

whalesalad wrote: post #9

I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.

In many cases it is bad to publish this info because they might come after you. There used to be a company who shielded the “researcher” from the legal consequences, can’t remember the name though.
Post reply on HN