🔒Hanwha Vision Cameras Run Linux Apps With Decrypted Firmware
Your surveillance cameras just got a lot more hackable
TL;DR
Hanwha Vision's video surveillance devices can run Linux apps but have serious security issues. Decrypted firmware reveals hardcoded GitHub tokens and military IP addresses, raising red flags for anyone using these cameras.
Hanwha Vision’s surveillance cameras now support running Linux applications, but the company has exposed major security flaws in their firmware. The decrypted fwimage.tgz file shows a hardcoded GitHub token with admin privileges to hundreds of repositories, likely sent over the wire during admin UI access. This is a big deal for anyone using these devices in sensitive environments like military bases or government facilities where IP addresses were found.
Key Points
Firmware blobs for each camera model are accessible on Hanwha’s website.
The passphrase to decrypt fwimage.tgz is HTW + the camera model number.
Trufflehog found a duplicated GitHub token in 30 files, with admin access.
62% of extracted firmwares contained the same compromised GitHub token.
Token was revoked within 12 hours after being notified about security issues.
Why It Matters
If you're using Hanwha Vision cameras for surveillance, especially in military or government settings, this is a critical issue. The exposed GitHub tokens and IP addresses pose significant risks to data integrity and privacy. Anyone with access to the admin UI could potentially exploit these vulnerabilities.
Frequently Asked Questions
Why does this matter?
If you're using Hanwha Vision cameras for surveillance, especially in military or government settings, this is a critical issue. The exposed GitHub tokens and IP addresses pose significant risks to data integrity and privacy. Anyone with access to the admin UI could potentially exploit these vulnerabilities.
What happened?
Hanwha Vision's video surveillance devices can run Linux apps but have serious security issues. Decrypted firmware reveals hardcoded GitHub tokens and military IP addresses, raising red flags for anyone using these cameras.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.