2026-07-25 / Signal #1
Hanwha security camera ships GitHub admin token in firmware/login page
“Your security camera just handed you admin access to its manufacturer's entire GitHub empire.”
9.0Weirdness
Why It Matters
Physical surveillance hardware (IoT camera you install at home) literally embeds and exposes its maker's dev secrets; intersects supply-chain slop, watcher/watched inversion, and a company with sentry gun/military history. Concrete artifact + weird real-world behavior.
Evidence
Detailed reverse-engineering post on hhh.hn (July 24, decrypted firmware via binwalk/Ghidra/trufflehog; token in ~30 files granting admin to hundreds of Hanwha repos; only 3/500 firmwares affected; quick revocation; DoD IPs and military ties noted). HN top story.
Signal Read
Needs scoring pass
Source Trail
Daily scan: 2026-07-25