My security camera shipped a GitHub admin token in its login page • Hacker News Board

Re: My security camera shipped a GitHub admin token in its login page

#181

Post by ethin » Sat, Jul 25, 2026, 12:48 AM UTC

bityard wrote: post #167

ethin wrote: post #157

Earlier quoted context omitted.

My ISP won't give me the router credentials because they claim that that would somehow risk their network interconnectivity or something. I have no idea how this makes any sense since a router (shouldn't) give me that level of access, but maybe I'm missing something?

If the router is also the modem, it can have diagnostic stuff that could (I am careful to point out: theoretically) cause them a big support headache in one way or another. Also, I had a DSL modem back in the day with its own terrible NAT built-in. I managed to log in (I may have been given the admin password from a friend who worked at the ISP, allegedly) and once I put it into bridge mode, I was able to acquire mul…

Really? I didn't know ISP-provided modems could even do that, I assumed they were like routers and isolated to the local network and what the ISP gives them access to. I just wish they would give me more than "well it's for security and it's corporate policy" or something, it just seems like some excuse, and their remedy is "buy your own router" (which isn't an option for me, too expensive).

Re: My security camera shipped a GitHub admin token in its login page

#182

Post by jonah » Sat, Jul 25, 2026, 12:53 AM UTC

makefu wrote: post #153

badatnames wrote: post #107

Worthy thread to ask: is there such a thing as a white label IP camera (or similar) with a supported open firmware? Not asking for open source, but something close to plug and play that nonetheless has a way of stripping the rootfs as desired for bespoke use in a manufacturer-supported way. I have looked around before but I only found genuinely dev-oriented kits that weren't even in a shell, and crazy priced. edit: s…

There is also https://thingino.com/ which has a clear set of supported cameras. The installation is straight forward if you choose a cam with SD-Card flashing support. I upgraded two of the Sonoff Slim Gen2 without any issues.

I bought the cheapest PTZ camera they have listed and, as you say the install was easy. The interface is useful and it does what it says on the tin.

Re: My security camera shipped a GitHub admin token in its login page

#183

Post by [deleted] » Sat, Jul 25, 2026, 12:56 AM UTC

oasisbob wrote: post #177

inigyou wrote: post #150

Earlier quoted context omitted.

If they converted to IPv6, they could easily have a globally unique address space. Real globally unique, not probabilistic.

The fact that the network concentrator co uses DoD v4 address space to avoid conflicts implies that their clients are bringing v4 addresses, so IPv6 is utterly irrelevant in this situation.

[deleted]

Re: My security camera shipped a GitHub admin token in its login page

#184

Post by Arrowmaster » Sat, Jul 25, 2026, 1:12 AM UTC

hhh wrote: post #5

grommz wrote: post #4

The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.

I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.

I don't remember which but one of the major US cellular networks was using the DoDs 7.0.0.0/8 internally. It was never an issue since the DoD kept that /8 offline but the IPs would show up in traceroutes. I had to tell many people to ignore it.

Re: My security camera shipped a GitHub admin token in its login page

#185

Post by ece » Sat, Jul 25, 2026, 1:33 AM UTC

badatnames wrote: post #107

Worthy thread to ask: is there such a thing as a white label IP camera (or similar) with a supported open firmware? Not asking for open source, but something close to plug and play that nonetheless has a way of stripping the rootfs as desired for bespoke use in a manufacturer-supported way. I have looked around before but I only found genuinely dev-oriented kits that weren't even in a shell, and crazy priced. edit: s…

Pinecube from pine64.

https://pine64.org/devices/pinecube/

Re: My security camera shipped a GitHub admin token in its login page

#186

Post by ndriscoll » Sat, Jul 25, 2026, 1:38 AM UTC

ssl-3 wrote: post #179

ndriscoll wrote: post #174

Earlier quoted context omitted.

Instead of forwarding a port to a specific machine on the NAT page, you allow incoming traffic on that port to that machine on the firewall page. You'll want to add a stable IP to the host (in addition to the SLAAC rotating privacy IP if it already has one. One interface can have multiple addresses). That's pretty much it, except now you can allow the same port to multiple machines, where previously you could only fo…

That sounds easy, but I think you just inadvertently demonstrated the quagmire that many seem to perceive. Suppose I've got a machine on the LAN and I want to open it up to the world on port 1025 with IPv6. This can't happen with SLAAC? It has to be a new address? Does the ISP pick the prefix for that address? And one can't centrally-manage that address (because people keep saying that DHCPv6 isn't worth stuffing aro…

If it's MAC based SLAAC, it'll be stable, so you could use it. Otherwise you add a stable address. You could use DHCP if you want. If you're using a backup ISP with dynamic DNS, your failover should be the same as ipv4. You can already have ips from both prefixes on the interface. You're also way past clueless home user stage if you have that setup at all, so I can't imagine ipv6 is the stumbling block.

Things would be nicer if NAT66 were used by default for home users though so the question of prefixes would disappear, and it'd perhaps match the "more advanced" home user ipv4 mental model. You'd just use e.g. fd00::2 as your server address.

Re: My security camera shipped a GitHub admin token in its login page

#187

Post by vhiremath4 » Sat, Jul 25, 2026, 1:41 AM UTC

whalesalad wrote: post #9

I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.

What lights did you get? I have Oasis. Love them but same thing would rather control them through a central bot or something.

Re: My security camera shipped a GitHub admin token in its login page

#188

Post by antonvs » Sat, Jul 25, 2026, 1:51 AM UTC

edwinjm wrote: post #154

grommz wrote: post #4

The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.

The DoWD owns such a large chunk of the IP space, it can very easily be a coincidence

That they used a public IP as an internal IP? That’s simply a mistake.

Re: My security camera shipped a GitHub admin token in its login page

#189

Post by BLKNSLVR » Sat, Jul 25, 2026, 2:09 AM UTC

KPGv2 wrote: post #113

grommz wrote: post #4

The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.

> Department of War n.b., it's the Department of Defense, just like the Kennedy Center doesn't have Trump's name attached, and the large body of water by Texas is the Gulf of Mexico.

100% correct

DoW is a nickname if anything. I'm surprised Hegseth hasn't requested 'Secretary' get nick-named to something more masculine sounding.

Re: My security camera shipped a GitHub admin token in its login page

#190

Post by ButlerianJihad » Sat, Jul 25, 2026, 2:27 AM UTC

Back in the mid-1990s, I was working at an ISP and also at a consulting firm. The consulting firm's #1 business at the time was to get businesses connected to the Internet, where these businesses already had significant LAN buildouts.

Now these were the days before IANA had officially assigned those "Private IP Network" numbers. Nobody had any private IPv4 space to work with! So the choices consisted of: make up some numbers and hope they don't conflict, or go ahead and register your IPv4 space and get public netblocks assigned, even if you're just using them privately.

So, needless to say, we encountered some bonkers configurations, and a lot of our job was undoing some really awful configurations in order to make them compliant with actual Internet connectivity, and so that different office LANs would interoperate properly.

We were also big advocates of security, firewalls, and the venerable "DMZ/Bastion" setups from back in the day, so those Private IP Network assignments would've been really useful, along with NAT, but we simply didn't have those tools at our disposal, and our clients were basically registering huge IPv4 blocks that they really didn't need to ever use.