I would report this using the responsible disclosure program of the manufacturer.
Ask HN: Do I publish code that affects millions of wireless security cameras?
101–109 of 109 posts
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#102I'm not sure law authorize you to publish the code even if you have warned the manufacturer and waited a number of days. The warning could also be taken for blackmail. You'll face serious problems as this is proprietary technology and so you'll violate their copyright.They also can consider your action as intrusive. Further more, if your exploit is used by others for criminal damages, you'll sure be taken for responsible. So :
1. search for a bug bounty programm linked to the company, 2. if no programm found, contact the manufacturer in an anonymous way (there are examples of people accused end sued of trespassing by companies when they were acting in good faith, 3. if no news from them, leave it to others or contact a lawyer in order to insist if you think what you have found can really be harmful.
But never (never) publish the code without having been able to negotiate with the firm and obtain authorization.
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#103Earlier quoted context omitted.
> "Morality is either objective or completely arbitrary" is a false dichotomy > some reasonable foundational beliefs such as "I generally want people to have it good and not suffer" > But the belief that it's generally good when people don't suffer is obviously subjective, even if widespread. Why is generally not wanting to hurt people a "reasonable foundational belief?" It's definitely not universal in humanity righ…
This is a discussion that started with notifying people of a possible webcam bug and ended with Russian war crimes. I think we can declare the thread spent.
Does Godwin's law need to be updated to mention Russia from now on?
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#104An my opinion, do not share the constant moral delemiah already exists daily for one humanbeingand,and also as we all know all of us love living in the fishbowl, and it's your find so
That permits you to do whatever you wish with it as long as honesty,Intgrety, and ethics are all involved I also see what we do as a kinda with skills as such the responsibility, that tags along shall have the same. Skill set only aimed in another direction,
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#105I chose to read the prior comments posted, wish I had not done so.
The answer to your question has zero to do with ethics, morals, etc.
We live quite literally within a surveillance state that becomes more sophisticated and invasive by the day. FANG profit models, undisclosed deals between govt/SV and the omnipresence of video cameras have effectually made the 4th Amendment mute.
You have 3 choices and each of them is absolutely fine and at your discretion: 1. Treat your work as a "bug bounty" and contact each manufacturer for compensation. 2. Choose educate ecosystem via github post. 3. Keep quiet and use for exact purpose you intended.
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#106> given an IP of the camera So this is an internal tool, not something you can gain access to remote cameras behind NAT firewalls? I think a lot of people are assuming this is a WAN attack. Sounds genuinely useful, especially if it can be worked into PVR software to integrate with more hardware.
OP didn’t specify if it worked on IPv6. There each device is theoretically reachable from the www.
Theoretically yes, in practice no. IPV6 devices are reachable, however many routers by default configure firewalls to block incoming traffic.
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#107I personally would set up an anonymous account and email the manufacturer, asking them about bug bounty without revealing anything. Say something like that you are a security researcher and wondering if they have a bug bounty program for security of their webcams.
If they are willing to pay you, set up a proof of concept to demonstrate that the exploit works (ask them to give you an ip of a publicly accessible cam under their control and send them the image capture), and then ask to be paid out in BTC. Do everything behind the VPN of course. Remember, the company can simply sue you without any reason for some bullshit "unauthorized computer use" on a whim by someone who doesn't understand technology, so remaining anonymous is essential.
If they don't have a bug bounty, disclose it to them first, and give them a timeline to fix the exploit with guidance on how to do so, after which you can publicly disclose it, with instructions on how to mitigate (probably set up firewall rules im guessing), along with publishing all of the communication chain between you.
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#108Earlier quoted context omitted.
NAT wont stop an unsecured IP camera from happily streaming content out of your network. Always deploy (and properly configure) an actual firewall to control ingress and egress of packets on your network.
Or secure your network with just NAT if you want. I really don't care.
Yeah, NAT is fairly secure in the sense that it blocks incoming connections... you're kind of a security nut if you lock down all ports. Anyone outgoing will just stream over 80 or 443 anyways, port based firewalls are pretty antiquated. You can't really lock down port 80 and still have a functional network unless you whitelist every device you connect.
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#109Earlier quoted context omitted.
Or secure your network with just NAT if you want. I really don't care.
Yeah, NAT is fairly secure in the sense that it blocks incoming connections... you're kind of a security nut if you lock down all ports. Anyone outgoing will just stream over 80 or 443 anyways, port based firewalls are pretty antiquated. You can't really lock down port 80 and still have a functional network unless you whitelist every device you connect.
But you can lock down that egress for your cameras. Why does your camera need to establish any outbound stream at all? Might want to keep an eye on that...