My security camera shipped a GitHub admin token in its login page

100

hhhh about 3 hours ago 32 commentsRead Article on hhh.hn

⚡ Community Insights

Discussion Sentiment

78% Positive

Analyzed from 704 words in the discussion.

Discussion (32 Comments)Read Original on HackerNews

dev_l1x_be•1 minute ago

Not surprised, many of these vendors are doing crazy things, insane defaults, broken security, hardcoded values. Security is not a priority, I get that, but at the very least some baseline check would be nice (no hardcoded credentials for starting)

grommz•about 1 hour ago

The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.

hhh•about 1 hour ago

I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.

ErroneousBosh•29 minutes ago

I recently troubleshot an installation for someone where at some point in the past they'd picked 1.1.1.0/24 as their address range because "all that 192 stuff was silly and too complicated".

You know, I'm not sure I can explain how I feel about this properly without waving the shotgun around.

cyanydeez•8 minutes ago

Sounds like someones on the path to sovereign citizenship. I can't wait for our cyber-sovereign citizenships who deny various IP ranges coming from the government's domain naming system.

inigyou•12 minutes ago

Yet another thing ipv6 solves. Yeah you can do the officially supported fdXX:XXXX:XXXX:... but you can also just pick something like 1::1 and it's unlikely to conflict with the current global range.

If you're gonna do that, though, it's better if you use fd00:... or one of the other assigned ranges so it's still in the standard range. OSes use this as a heuristic for source address selection.

bflesch•40 minutes ago

This will trip up most SOC workflows in funny ways, and I like it.

IPs having a global distinction between public/private is a convention, but local routing can widely differ.

Same with the "China Cyberattacks" - the guys sitting on top of my outgoing fiber can simulate any IP address they want to me.

kotaKat•about 1 hour ago

there's a couple subnets I (ab)use in the DOD IP space for my home network knowing they'd never put them on the open internet. it's also fun to throw logging for a loop if someone digs.

22.0.0.0/8 - it's basically free real estate!

walrus01•30 minutes ago

the entirety of 10/8 and 172.16/12 and 192.168/16 wasn't large enough for your house?

cryptonym•about 1 hour ago

I have seen ISP doing CGNAT on DOD IP space.

walrus01•18 minutes ago

> Note to self: never buy a Korean security product.

The Canadian Navy very recently made a major choice and agreed with you

https://www.google.com/search?client=firefox-b-d&q=hanwha+oc...

RyJones•about 2 hours ago

When I cared, I found out that a lot of OBD-II dongles shipped with the same MAC, which gave you access to everything on a bunch of websites.

You can curse the storm, but the wind will come.

netsharc•about 1 hour ago

how did "same MAC" lead to "access to everything"?

Was the website's security based on MAC, which presumably is supplied by the client? If so, I guess.. typical IoT.

RyJones•about 1 hour ago

buy any dongle that sells for under $100 on amazon. they all have the same mac, and come with 'bespoke' apps to let you do things to your car. those apps are all thin wrappers on code widely shared; they use the MAC of the dongle as the keystone for ID.

Short story: buy one cheap dongle on Amazon, dump the MAC (00:11:22:AA:BB:CC IIRC; it's been 15 years since I cared) and you have auth to all of the apps everywhere.

Reminder: the Bluetooth logo comes, mostly, from self-certification.

andreareina•31 minutes ago

Amazing! I have the same MAC address on my luggage!

londons_explore•22 minutes ago

I bought 3 from 3 different vendors and they all have totally different Mac addresses.

Internally they're all Bluetooth to serial chips, and another pic16xxxx chip which does serial to canbus.

I guess the Bluetooth serial chips probably have programmable Mac addresses, but equally they normally ship with a globally default one unless you flash a different one onto it.

inigyou•10 minutes ago

Why do the apps need auth?

IshKebab•23 minutes ago

LLMs have truly killed obfuscation. It only worked previously by making things extremely tedious but AI doesn't care about that.

llm_nerd•19 minutes ago

And it's worth considering that obfuscation only ever worked against casuals for whom tedious was a bridge too far. Nation state actors and criminal hacker groups, on the other hand, consider the tedious entirely worth it.

walrus01•11 minutes ago

> consider the tedious entirely worth it.

Entirely without LLMs, I'm imagining an office of North Korean compsci graduates doing astonishingly tedious tasks, for whom an office job on a basic Linux computer and slightly better diet and nice apartment put them in the top 1-2% of living standard in the country.

inigyou•10 minutes ago

Pirates checked Denuvo, once considered the king of DRM.

whalesalad•40 minutes ago

I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.

Ecsta•29 minutes ago

There's a lot of public keys that don't give you any special access, unless the dev is really bad.

Anyone who cares about security will be using App Attest or the Google store equivalent.

JTbane•7 minutes ago

>Anyone who cares about security

I have something hilarious to tell you about IoT apps

inigyou•9 minutes ago

Everything can be controlled without a proprietary app. Hope you reverse engineer the protocol and publish how to do it.

that_guy_iain•32 minutes ago

I bet someone returned that security camera.