Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My security camera shipped a GitHub admin token in its login page

hhh.hn

Post reply on HN
Print view View original

41–50 of 265 posts

Re: My security camera shipped a GitHub admin token in its login page

#41

Post by freeone3000 »

bflesch wrote: post #10
hhh wrote: post #5

Earlier quoted context omitted.

I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.

This will trip up most SOC workflows in funny ways, and I like it. IPs having a global distinction between public/private is a convention, but local routing can widely differ. Same with the "China Cyberattacks" - the guys sitting on top of my outgoing fiber can simulate any IP address they want to me.

It’s only a convention in the sense that the IANA is a convention: https://www.iana.org/assignments/iana-ipv4-special-registry/...

192.0.0.0/24, 10/8, 172.16/12, and various other subslices of 192/8 are reserved for local use and are not publicly routable.

Re: My security camera shipped a GitHub admin token in its login page

#42

Post by tclancy »

andreareina wrote: post #12
RyJones wrote: post #7

Earlier quoted context omitted.

buy any dongle that sells for under $100 on amazon. they all have the same mac, and come with 'bespoke' apps to let you do things to your car. those apps are all thin wrappers on code widely shared; they use the MAC of the dongle as the keystone for ID. Short story: buy one cheap dongle on Amazon, dump the MAC (00:11:22:AA:BB:CC IIRC; it's been 15 years since I cared) and you have auth to all of the apps everywhere.…

Amazing! I have the same MAC address on my luggage!

Remind me to rotate my GitHub tokens.

Re: My security camera shipped a GitHub admin token in its login page

#43

Post by tclancy »

JTbane wrote: post #29
Ecsta wrote: post #14

Earlier quoted context omitted.

There's a lot of public keys that don't give you any special access, unless the dev is really bad. Anyone who cares about security will be using App Attest or the Google store equivalent.

>Anyone who cares about security I have something hilarious to tell you about IoT apps

A Venn diagram like a 6th grade boy's graffiti of boobs.

Re: My security camera shipped a GitHub admin token in its login page

#44

Post by lardosaurusrex »

grommz wrote: post #4

The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.

just buy stuff you can put your own firmware/os on because it's either just the worst security in the world (aka anything not from china) or, well... china.

and while i currently don't hate china as much as i do US rn (because canadian; sorry) i can also say -- due to being an aforementioned leaflandian -- that due to very personal experience i have zero faith in anything from china that has the ability to connect to any type of network :')

And so yeah at this point if I can't at the very least get a whatever-wrt firmware (preferably a proper linux distro nowadays; not to say the *-wrt firmwares aren't a real OS but, y'know) on the device i just avoid them entirely since, well... it's all i can do at this point because even if there were baked in hardware-based backdoors i as an individual can't do much more than that.

Re: My security camera shipped a GitHub admin token in its login page

#47

Post by jabart »

ErroneousBosh wrote: post #15
hhh wrote: post #5

Earlier quoted context omitted.

I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.

I recently troubleshot an installation for someone where at some point in the past they'd picked 1.1.1.0/24 as their address range because "all that 192 stuff was silly and too complicated". You know, I'm not sure I can explain how I feel about this properly without waving the shotgun around.

Didn't AT&T do that and Cloudflare made them change it when they aquired that space?

Re: My security camera shipped a GitHub admin token in its login page

#48

Post by snoman »

dev_l1x_be wrote: post #32

Not surprised, many of these vendors are doing crazy things, insane defaults, broken security, hardcoded values. Security is not a priority, I get that, but at the very least some baseline check would be nice (no hardcoded credentials for starting)

As they say: in IoT the S stands for security.

Re: My security camera shipped a GitHub admin token in its login page

#49

Post by accrual »

hhh wrote: post #5
grommz wrote: post #4

The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.

I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.

I also know of a company who does this. The reason in their case is they act as a network concentrator, bridging hundreds of client IP spaces, so this helps them avoid conflicts with their own space without having to NAT constantly. There is still a lot of NAT for the more common ranges.

Re: My security camera shipped a GitHub admin token in its login page

#50

Post by fragmede »

dev_l1x_be wrote: post #40
whalesalad wrote: post #9

I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.

In many cases it is bad to publish this info because they might come after you. There used to be a company who shielded the “researcher” from the legal consequences, can’t remember the name though.

@stake or L0pht?
Post reply on HN