Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My security camera shipped a GitHub admin token in its login page

hhh.hn

Post reply on HN
Print view View original

61–70 of 265 posts

Re: My security camera shipped a GitHub admin token in its login page

#61

Post by daneel_w »

folkrav wrote: post #51
dev_l1x_be wrote: post #32

Not surprised, many of these vendors are doing crazy things, insane defaults, broken security, hardcoded values. Security is not a priority, I get that, but at the very least some baseline check would be nice (no hardcoded credentials for starting)

There’s some irony to security not being a priority for security cameras. Different kind of security I know, but still.

There's also some irony in people happily ignoring that so many of these products live-stream the inside view of their homes and offices to some foreign corporate cloud - and in the case of suspiciously many Chinese security cameras, a state-backed corporation's cloud. Because, wow, it really is convenient.

Re: My security camera shipped a GitHub admin token in its login page

#62

Post by inisirex »

whalesalad wrote: post #9

I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.

[flagged]

Re: My security camera shipped a GitHub admin token in its login page

#64

Post by avgDev »

fragmede wrote: post #52
whalesalad wrote: post #9

I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.

Have you actually tried to do anything with them though? The keys are in there, but may not grant you any real extra access beyond what your user is actually allowed to do via the app.

It is still pretty nice, you don't have to install yet another app to do something. People did this with Mazda app as it allowed them to start the car without subscription. They 'fixed' it.

Re: My security camera shipped a GitHub admin token in its login page

#65

Post by walrus01 »

kingleopold wrote: post #37
grommz wrote: post #4

The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.

Note to self: never buy any Korean hardware or software product. /S

Note to self, never buy any hardware product, move to a yurt in the woods, start an alpaca ranch, write a manifesto

Re: My security camera shipped a GitHub admin token in its login page

#66

Post by anonymars »

hhh wrote: post #5
grommz wrote: post #4

The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.

I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.

Interesting -- seems like the side effect would be to basically prevent use by the DoD but not really anyone else. Bonus points if they sell a "government" version for higher cost

Re: My security camera shipped a GitHub admin token in its login page

#67

Post by tehlike »

whalesalad wrote: post #9

I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.

Another rule of thumb - i know it's not always the best since some products are really nice aesthetically - is to buy only local smart stuff, for example, zigbee/zwave.

Re: My security camera shipped a GitHub admin token in its login page

#68

Post by tehlike »

inigyou wrote: post #27
whalesalad wrote: post #9

I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.

Everything can be controlled without a proprietary app. Hope you reverse engineer the protocol and publish how to do it.

Or claude/codex can.

Re: My security camera shipped a GitHub admin token in its login page

#69

Post by CodesInChaos »

aizk wrote: post #46

Department of War IP address? I feel this should be making headlines!

Abusing IP ranges which were assigned to an organization but aren't actually used on the public Internet as private addresses is pretty common. Sure, it's bad practice, but not a big deal.

Re: My security camera shipped a GitHub admin token in its login page

#70

Post by petepete »

tehlike wrote: post #67
whalesalad wrote: post #9

I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.

Another rule of thumb - i know it's not always the best since some products are really nice aesthetically - is to buy only local smart stuff, for example, zigbee/zwave.

I live by this rule*. Being able to pick up stuff from IKEA that's well supported, well designed and really affordable is a huge advantage.

*almost, I have two things that need an app. My Vaillant boiler and my Yale alarm system. Both apps are terrible, but I have a 10 year warranty on the boiler and my alarm is up to scratch from a home insurance point of view.**

Post reply on HN