Hanwha Vision Security Camera Firmware Leak: GitHub Admin Token and DoD IP Addresses

Hanwha Vision Security Camera Firmware Leak: GitHub Admin Token and DoD IP Addresses

Executive Summary

A security researcher discovered that Hanwha Vision security camera firmware contained a hardcoded GitHub admin token with access to hundreds of repositories. The leak was caused by a build-time configuration error where the entire CI environment (process.env) was written into the camera's UI files. Additionally, the firmware contained IP addresses assigned to the US Department of Defense (DoD), raising questions about the manufacturer's internal infrastructure or corporate ties.

The Vulnerability: Build-Time Environment Leak

Hanwha Vision accidentally shipped a GitHub admin token embedded in approximately 30 files within the camera's firmware. The root cause was the use of the Vite build tool, where a variable was configured to set the entirety of process.env at build time. This resulted in the entire CI job's environment—including sensitive credentials—being baked directly into the production files.

Example of the leaked environment variables:

var W = {
  DATAPORT: "9090",
  GIT_LFS_SKIP_SMUDGE: "1",
  npm_command: "run-script",
  KUBERNETES_SERVICE_PORT_HTTPS: "443",
  GITHUB_NPM_TOKEN: "<snip>:ghp_…REDACTED…",
  npm_config_userconfig: "/home/docker/.npmrc",
  // etc
}

Firmware Decryption and Analysis

Accessing the root filesystem required bypassing multiple layers of encryption and obfuscation. The researcher used a combination of traditional reverse engineering and AI-assisted analysis:

  1. Initial Decryption: The outer layer used a passphrase based on the model number (e.g., HTW + model number).
  2. RootFS Extraction: A second, more complex fwimage.tgz was encrypted. The researcher used Ghidra and Claude Code to analyze the fwupgrader binary.
  3. Obfuscation Bypass: The fwupgrader binary used XOR-obfuscated keys and command fragments to hide the decryption process. The researcher reconstructed the following OpenSSL command used for decryption:
openssl enc -md sha256 -aes-256-cbc -d -K <KEY> -iv <IV> -in <INPUT> -out <OUTPUT>

Hardcoded Decryption Keys:

  • KEY: dfa049bb922e63e2decc764af5628068e5b7a2662e479a615b14643e567579b0
  • IV: 53f926801b81454a4f889c9a390db6e6

Unexpected Findings: US Department of Defense IPs

Beyond the GitHub token, the researcher found environment variables containing IP addresses assigned to the US Department of Defense:

This finding is particularly notable given Hanwha Vision's corporate structure. Hanwha Vision (formerly Samsung Techwin) is a subsidiary of Hanwha Group, which includes Hanwha Aerospace and Hanwha Defense USA, companies that manufacture military hardware such as the K9 Thunder self-propelled artillery.

Response and Remediation

After the researcher reported the findings to Hanwha, the company responded within 12 hours and revoked the leaked GitHub token.

Community Insights and Security Recommendations

Industry experts and users in the discussion highlighted several critical takeaways regarding IoT security:

  • AI and Obfuscation: The use of LLMs (like Claude Code) has significantly lowered the barrier for reverse engineering, making traditional obfuscation less effective.
  • Network Isolation: Security professionals recommend placing IP cameras on a separate VLAN with no internet access to prevent potential leaks or unauthorized remote access.
  • Credential Management: The repetition of this error across different vendors underscores a systemic failure in CI/CD pipelines to scrub sensitive environment variables before they reach production firmware.

Sources