Ask HN: Do I publish code that affects millions of wireless security cameras?

#1

Post by 00702 » Wed, Oct 12, 2022, 3:57 PM UTC

In a quest to have full local access to my wireless security cameras without the cloud I've figured out how to access the video and audio streams of any camera of a certain manufacturer (whose name I'm withholding) without any modification to the stock firmware.

I currently have a program that, given an IP of the camera, will connect to it, authenticate itself, and get the realtime video/audio stream. This isn't just intercepting an ongoing stream, it will actually start a new stream of its own.

Is this something that I just keep and use in my home setup as I originally intended or do I put the code on GitHub for the masses? What are the general considerations for something like this?

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#2

Post by dingosity » Wed, Oct 12, 2022, 4:01 PM UTC

Google "ethical disclosure."

The standard in the security research community is you inform the manufacturer and give them an opportunity to patch the flaw. Then you wait some number of days (some people say 30, other say "depends on the details of the vulnerability"). Then you publish the code along with enough text to explain the vulnerability to a reasonably technical audience.

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#3

Post by propheadbay » Wed, Oct 12, 2022, 4:02 PM UTC

The responsible thing to do is, of course, to notify the manufacturer of the vulnerability and give them some time to fix it before publishing.

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#4

Post by chunk_waffle » Wed, Oct 12, 2022, 4:10 PM UTC

dingosity wrote: post #2

Google "ethical disclosure." The standard in the security research community is you inform the manufacturer and give them an opportunity to patch the flaw. Then you wait some number of days (some people say 30, other say "depends on the details of the vulnerability"). Then you publish the code along with enough text to explain the vulnerability to a reasonably technical audience.

You might also want to check if the company has a bug bounty program. Unlikely but worth looking...

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#5

Post by pacerier » Wed, Oct 12, 2022, 4:25 PM UTC

re "name", Minor player? Of which country?

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#6

Post by LinuxBender » Wed, Oct 12, 2022, 4:29 PM UTC

chunk_waffle wrote: post #4

dingosity wrote: post #2

Google "ethical disclosure." The standard in the security research community is you inform the manufacturer and give them an opportunity to patch the flaw. Then you wait some number of days (some people say 30, other say "depends on the details of the vulnerability"). Then you publish the code along with enough text to explain the vulnerability to a reasonably technical audience.

You might also want to check if the company has a bug bounty program. Unlikely but worth looking...

Adding to this, when publicly disclosing after the grace period it may be safer to let a high profile security site [1] do the public disclosing so they receive most blow-back from the vendor. Krebs is no stranger to drama and could refer to you by your security researcher nickname that is not used anywhere else. Some of the less reputable shoddy IoT manufacturers may respond poorly to public disclosure.

[1] - https://krebsonsecurity.com/