Leaked GitHub Admin Tokens in Security Camera Firmware

Published: 2026-07-24 | Reading Time: ~6 minutes

I've recently been revisiting the security of surveillance hardware. With AXIS pushing for their cameras to support Linux applications more broadly, these devices are becoming high-value targets in enterprise environments. Consequently, they require the same rigorous vulnerability and credential management as any other server.

During this research, I encountered a company called Hanwha Vision. Upon visiting their site, I discovered they provide accessible firmware blobs for their various models—a goldmine for any security researcher.

🛠️ The Reverse Engineering Process

My initial approach involved using binwalk on the image. I was hoping for a simple rootfs, but instead, I found a tarball containing AI-related assets and a file named fwimage.tgz that appeared to be encrypted.

Layer 1: The Initial Passphrase

I found a previous write-up by Matt Brown that provided the necessary lead. The decryption passphrase follows a specific pattern: HTW + [Model Number]

For example, for the model XNP-9300RW, the passphrase was HTWXNP-9300RW.

Layer 2: The Obfuscated Rootfs

Inside that first tarball was another fwimage.tgz. This one used a different encryption scheme, rendering Matt Brown's method useless. I initially suspected a hardware-bound key, but I found a fwupgrader binary in the outer tarball.

I would have spent days manually poking around in Ghidra if this were 2023, but instead, I utilized Claude Code. While I enjoyed dinner with my partner, the AI analyzed the binary and provided me with the rootfs.

The Decryption Logic

Hanwha implemented obfuscation within the fwupgrader to hide the rootfs decryption process. The AES key is not stored in plaintext; rather, it is XOR'd against a static key table and reassembled during execution.

The mathematical operation can be represented as: $\text{Actual Key} = \text{Obfuscated Key} \oplus \text{Static Table}$

The binary eventually shells out to the openssl CLI. Even the command strings were XOR-obfuscated. The reconstructed command is as follows:

openssl enc -md sha256 -aes-256-cbc -d \
-K KEY -iv IV -in INPUT -out OUTPUT

Hardcoded Credentials (Universal across the model line):

🚩 The "Crown Jewels" Leak

Once I had the rootfs, I ran trufflehog to scan for secrets. The result was immediate: a GitHub token was duplicated across approximately 30 different files.

Upon inspection, this token granted admin privileges to hundreds of repositories within the company's GitHub organization.

How did this happen?

It appears the camera's UI is built using vite. During the build process, one of the variables was configured to capture the entire process.env object, effectively baking the CI/CD environment variables directly into the production files.

Leaked Environment Snippet:

var W = { 
  DATAPORT: 9090, 
  GIT_LFS_SKIP_SMUDGE: 1, 
  npm_command: run-script, 
  KUBERNETES_SERVICE_PORT_HTTPS: 443, 
  GITHUB_NPM_TOKEN: "snip :ghp_…REDACTED…", 
  npm_config_userconfig: "/home/docker/.npmrc", 
  // ... etc
}

If these files are served via the admin UI, any user accessing the interface could potentially intercept this token over the wire.

🇺🇸 The DoD Connection

While digging through the environment variables, I found several IP addresses that are registered to the US Department of Defense (DoD).

• SWARM_MASTER_NFS_ADDRESS: 55.101.212.23
• OTEL_ELASTIC_URL: http://55.101.212.21:5601/
• CIMIP: 55.101.211.213

This is highly unusual. Is it a case of poor network planning (using unused IP space), or is there a deeper tie?

Corporate Context

A quick look at Wikipedia reveals that Hanwha Vision (formerly Samsung Techwin) is a surveillance firm. However, its sister companies are heavily involved in defense:

• Hanwha Aerospace
• Hanwha Defense USA (Manufacturers of the K9 Thunder, K10, and K2 Black Panther)

Speculation: It is possible that the CI infrastructure is centralized at the parent company level. The environment variables for Hanwha Aerospace or Hanwha Defense USA might be leaking into the build environment for the Vision division.

📊 Scope and Disclosure

To determine if this was an isolated incident, I performed the following:

• Scraped the Hanwha website for all available firmware.
• Downloaded $\approx 500$ firmware images.
• Attempted extraction using the discovered method.

Results:

• Extraction Success Rate: 62%
• Token Presence: Only 3 images contained the token.
• Token Consistency: All 3 images contained the exact same token.

I have since sent a concise disclosure email to the company, providing enough detail for them to locate and revoke the compromised token.