Security Researcher Finds GitHub Admin Token and DoD IP Addresses Baked Into Hanwha Camera Firmware

One Vite Misconfiguration Leaked a Surveillance Company's CI Secrets Into Camera Firmware

A single variable in a Vite build configuration serialized the entire CI environment of Hanwha Vision into the web interface shipped with the company's camera firmware. The bundle included a GitHub token with administrative privileges across hundreds of repositories, duplicated across roughly 30 files, and three IP addresses the researcher identified as assigned to the U.S. Department of Defense 1.

The cause was a build variable set to the full `process.env` object, which writes every environment variable from the CI job into the frontend JavaScript. The leaked data included Kubernetes service configuration, npm build settings, the GitHub token, and infrastructure addresses 1. Any team using a modern frontend bundler can make this mistake. Nothing in the standard build process flags when a CI environment leaks into a shipping artifact, and the leak persists silently until someone goes looking.

Getting to that point required breaking two layers of firmware encryption. The outer layer used a passphrase derived from the camera's model number, a scheme documented in earlier security research on these cameras 1. The inner layer used AES-256-CBC with a key XOR-obfuscated against a static table inside the firmware updater binary and reassembled at runtime 1.

Rather than manually tracing the obfuscation in Ghidra, the researcher pointed Claude Code at the updater binary and returned to a working decryption routine 1. The AES key and IV were hardcoded and identical across the product line, and the researcher published both values 1.

With the root filesystem exposed, the researcher ran TruffleHog, a credential-scanning tool, and immediately surfaced the GitHub token. Checking its permissions revealed administrative access to hundreds of repositories in Hanwha's GitHub organization 1. The researcher speculated that anyone accessing the admin interface of an affected camera may have received the token over the network, but noted they lacked a physical camera to confirm whether the token was actually served or merely stored on disk 1.

To measure the scope, the researcher scraped roughly 500 firmware images from Hanwha's website. About 62 percent were extractable with the same decryption approach. Only three contained the token, and all three carried the same credential 1.

The dumped CI environment also contained infrastructure addresses the researcher identified as assigned to the U.S. Department of Defense: 55.101.212.23, 55.101.212.21, and 55.101.211.213 1. The researcher flagged the significance of these addresses as speculative, noting it was unclear whether they reflected a direct DoD relationship, shared CI infrastructure with Hanwha sister companies including Hanwha Aerospace and Hanwha Defense USA, or the use of DoD-assigned IP ranges for internal services 1.

Hanwha Vision is a video surveillance company founded as Samsung Techwin, a subsidiary of Hanwha Group 1. Former products from the Samsung Techwin era include the K9 Thunder self-propelled artillery, the K10 ammunition resupply vehicle, and the SGR-A1 sentry gun robot 1. A company with that lineage shipping its CI credentials inside publicly downloadable firmware changes the stakes of what is otherwise a configuration error.

The researcher reported the finding through Hanwha's open security reporting channel. Hanwha revoked the token within 12 hours 1. The disclosure process worked. The token was dead within half a day of a single email. But the discovery depended on one person choosing to download 500 firmware images, point an AI assistant at the encryption, and run a credential scanner. The same Vite misconfiguration is reproducible in any project using the build tool. How many other shipped binaries are carrying their CI environments right now, waiting for someone to check?