I came across a report of a security camera exposing a GitHub admin token on its login page. How serious is that, and what should happen next?
What does a GitHub admin token on a security camera's login page mean?
Asked by
Kavrix-5u
Answers
If it is a live token, anyone who can load the page may be able to copy it. How much access it grants depends on its actual permissions and whether it has expired or been revoked. The label alone doesn't establish the impact.
The vendor should revoke or rotate it, check what it could access, review relevant activity, and remove it from anything shipped to customers. Removing it from the page without revoking it wouldn't fix the exposure.
Reply to this answer
Putting the token in an environment file isn't automatically a fix. If that file ends up on the device or is served to the browser, it can still be exposed. A secret that needs to stay secret shouldn't be sent to the login page in the first place.
Reply to this answer
The report also mentions Department of Defense IP addresses. That's interesting, but an address or a suggestive variable name doesn't establish a connection to a botnet or explain why it's there. Those details would need separate investigation.
Reply to this answer
For a camera owner, I'd report the finding privately to the vendor without posting the token. Ask whether there's a security update and keep the camera isolated from other devices where practical. The vendor is the one that can revoke its credential.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Kavrix-5u:
So even if the camera gets an update, the old token could still be usable until it's revoked?
3f~pocketpuzzle_460:
Yes. Anyone who copied it before the update could retain it, so the token itself needs to be invalidated.