My security camera shipped a GitHub admin token in its login page

51•hhh•2h ago

Comments

RyJones•1h ago

When I cared, I found out that a lot of OBD-II dongles shipped with the same MAC, which gave you access to everything on a bunch of websites.

You can curse the storm, but the wind will come.

netsharc•58m ago

how did "same MAC" lead to "access to everything"?

Was the website's security based on MAC, which presumably is supplied by the client? If so, I guess.. typical IoT.

RyJones•39m ago

buy any dongle that sells for under $100 on amazon. they all have the same mac, and come with 'bespoke' apps to let you do things to your car. those apps are all thin wrappers on code widely shared; they use the MAC of the dongle as the keystone for ID.

Short story: buy one cheap dongle on Amazon, dump the MAC (00:11:22:AA:BB:CC IIRC; it's been 15 years since I cared) and you have auth to all of the apps everywhere.

Reminder: the Bluetooth logo comes, mostly, from self-certification.

andreareina•7m ago

Amazing! I have the same MAC address on my luggage!

grommz•53m ago

The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.

hhh•48m ago

I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.

kotaKat•43m ago

there's a couple subnets I (ab)use in the DOD IP space for my home network knowing they'd never put them on the open internet. it's also fun to throw logging for a loop if someone digs.

22.0.0.0/8 - it's basically free real estate!

cryptonym•21m ago

I have seen ISP doing CGNAT on DOD IP space.

walrus01•6m ago

the entirety of 10/8 and 172.16/12 and 192.168/16 wasn't large enough for your house?

bflesch•16m ago

This will trip up most SOC workflows in funny ways, and I like it.

IPs having a global distinction between public/private is a convention, but local routing can widely differ.

Same with the "China Cyberattacks" - the guys sitting on top of my outgoing fiber can simulate any IP address they want to me.

whalesalad•16m ago

I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.

Ecsta•5m ago

There's a lot of public keys that don't give you any special access, unless the dev is really bad.

Anyone who cares about security will be using App Attest or the Google store equivalent.

that_guy_iain•8m ago

I bet someone returned that security camera.

My security camera shipped a GitHub admin token in its login page

Flux 3 X Mimic: The Next Generation of Video-Action Models

It's getting harder to focus every day

Flux 3

India's first privately-developed rocket reaches orbit on dramatic debut launch

IRGC Claims It Destroyed Amazon's Bahrain Data Center

The IBM PC, Part 1: Arrival

Kaizen #4: Overhauled Homelab

Buz – A fork of Bun using modern Zig, with sub-1s incremental builds

Patreon laying off 20% of staff

Nothing works and everyone is euphoric

Programming language file extensions that match ISO 3166-1 alpha-2 country code

Claude Cookbook

Em dashes are fucking amazing

Why is programming so captivating, yet so agonizing?

Game of Trees – Git-based version control from OpenBSD folks

Computational chemistry, Locally? My rant on SSH

Show HN: Echo – Fable-level results at 1/3 the cost using open-weight models

Oracle fires 21,000 employees to fund AI spending

How Do We Stop Vibe Coding?

Tangleflow: Converts GitHub Actions workflows to tangled workflows and back

The story behind APC-2

The Book Prize Index

I Tried Building a Real App with AI. It Took a Year

Writing by hand is good for your brain

AMD's Instinct MI455X: Aiming for the Sun

Hetzner is working on LLM Inference

The day Steve Jobs dissed me in a keynote (2010)

Startup founders urge U.S. government not to shut off Chinese open weight AI

I regret migrating to Codeberg

My security camera shipped a GitHub admin token in its login page

Comments

My security camera shipped a GitHub admin token in its login page

Flux 3 X Mimic: The Next Generation of Video-Action Models

It's getting harder to focus every day

Flux 3

India's first privately-developed rocket reaches orbit on dramatic debut launch

IRGC Claims It Destroyed Amazon's Bahrain Data Center

The IBM PC, Part 1: Arrival

Kaizen #4: Overhauled Homelab

Buz – A fork of Bun using modern Zig, with sub-1s incremental builds

Patreon laying off 20% of staff

Nothing works and everyone is euphoric

Programming language file extensions that match ISO 3166-1 alpha-2 country code

Claude Cookbook

Em dashes are fucking amazing

Why is programming so captivating, yet so agonizing?

Game of Trees – Git-based version control from OpenBSD folks

Computational chemistry, Locally? My rant on SSH

Show HN: Echo – Fable-level results at 1/3 the cost using open-weight models

Oracle fires 21,000 employees to fund AI spending

How Do We Stop Vibe Coding?

Tangleflow: Converts GitHub Actions workflows to tangled workflows and back

The story behind APC-2

The Book Prize Index

I Tried Building a Real App with AI. It Took a Year

Writing by hand is good for your brain

AMD's Instinct MI455X: Aiming for the Sun

Hetzner is working on LLM Inference

The day Steve Jobs dissed me in a keynote (2010)

Startup founders urge U.S. government not to shut off Chinese open weight AI

I regret migrating to Codeberg