My security camera shipped a GitHub admin token in its login page

Worthy thread to ask: is there such a thing as a white label IP camera (or similar) with a supported open firmware? Not asking for open source, but something close to plug and play that nonetheless has a way of stripping the rootfs as desired for bespoke use in a manufacturer-supported way.

I have looked around before but I only found genuinely dev-oriented kits that weren't even in a shell, and crazy priced.

edit: seems there are some options now (or I missed them before), e.g. https://www.goodcam.io/#for-independent-developers

The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.

Not surprised, many of these vendors are doing crazy things, insane defaults, broken security, hardcoded values. Security is not a priority, I get that, but at the very least some baseline check would be nice (no hardcoded credentials for starting)

A rule of thumb, put your cameras on a separate VLAN and never give that vlan internet access.

Least you can do.

When I cared, I found out that a lot of OBD-II dongles shipped with the same MAC, which gave you access to everything on a bunch of websites.

You can curse the storm, but the wind will come.

Perhaps they should just drop the 'security' from the name and simply call it a camera.

This blog's misuse of the external link icon irks me.

LLMs have truly killed obfuscation. It only worked previously by making things extremely tedious but AI doesn't care about that.