Published · 4d agoBuild2 min read
The GitHub Figure We Cannot Ground, And The 279 Cameras We Can
Nothing supplied supports a 50 percent raw-download error rate or a five-plane GitHub degradation. What the material does support: Slovakia's NBU says 279 traffic cameras carry a Russian backdoor.
Written for builders.See today for builders
What happened
- Slovakia's national security service NBU has issued a security alert against the use of NERO R-ONE high-speed traffic cameras.
- The NBU says the cameras contain a backdoor mechanism that grants shell and network access to the devices via an SMS message received from a list of hardcoded Russian phone numbers.
- According to the NBU, the cameras are a rebranded version of a Russian traffic camera model named CORDON PRO.M, produced by St Petersburg-based Russian firm Semicon.
- The cameras were bought as part of a 30 million euro EU-funded project to rebuild Slovakia's national traffic monitoring system.
- The Slovak Interior Ministry has allegedly bought and was preparing to install 279 cameras on selected roads across Slovakia.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
The figure on the card that sent you here, roughly 50 percent raw repository download errors across five degraded GitHub planes, is not in the material we were given, and we will not reconstruct a status page from memory. The only GitHub document in the file is a help page on connecting an identity provider, which states that SAML single sign-on requires GitHub Enterprise Cloud and that the supported SCIM providers are Entra ID, Okta and OneLogin [13]; it contains no error rates, no timeline and no incident data at all [14].
The number the material does support is 279. Slovakia's Interior Ministry has allegedly bought that many NERO R-ONE high-speed traffic cameras and was preparing to install them on selected roads [5], as part of a 30 million euro EU-funded rebuild of the national traffic monitoring system [4]. That works out to about 107,500 euros of programme budget per camera, though the envelope covers the whole system rebuild rather than unit price [12].
The national security service NBU has now issued an alert against the devices [1]. Its finding is the mechanism that matters: a backdoor granting shell and network access to the camera after an SMS from a list of hardcoded Russian phone numbers [2]. The NBU says the units are a rebranded CORDON PRO.M built by St Petersburg firm Semicon [3]. The Ministry initially denied Russian origin and argued there was no data-theft risk because the cameras would sit on a closed-loop network [6]. An SMS trigger is not on that network. Supporting failures compound it: SecureBoot is disabled, so firmware origin is never enforced [7], the web management portal has multiple vulnerabilities, and live streams are exposed to anyone who knows the broadcasting IP, with no password [8].
The investigation began after opposition accusations and Slovak press reports tying the purchase to a Cyprus shell company with fake certifications [11]. Deployment is paused pending an independent auditor commissioned to confirm the NBU findings [9]. Similar devices are allegedly installed in Croatia and possibly elsewhere in Eastern Europe [10].
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Slovakia's national security service NBU has issued a security alert against the use of NERO R-ONE high-speed traffic cameras.
- [2]
The NBU says the cameras contain a backdoor mechanism that grants shell and network access to the devices via an SMS message received from a list of hardcoded Russian phone numbers.
- [3]
According to the NBU, the cameras are a rebranded version of a Russian traffic camera model named CORDON PRO.M, produced by St Petersburg-based Russian firm Semicon.
- [4]
The cameras were bought as part of a 30 million euro EU-funded project to rebuild Slovakia's national traffic monitoring system.
ReportedView cited source - [5]
The Slovak Interior Ministry has allegedly bought and was preparing to install 279 cameras on selected roads across Slovakia.
ReportedView cited source - [6]
The Ministry initially denied that the cameras were of Russian origin and said there was no danger of data theft because the devices were going to be on a closed loop Ministry network.
ReportedView cited source
Sources & coverage · 2 publishers
The reporting this story was synthesized from, earliest first. Every link goes to the original.
- news.risky.biz4d agoSlovakia finds Russian backdoor in traffic cameras
- docs.github.com4d agoConnecting your identity provider to your organization
Additional citations
- NBU, via Risky Bulletin
- NBU
- NBU technical report
