Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Do I publish code that affects millions of wireless security cameras?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 109 posts

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#11

Post by umvi »

dingosity wrote: post #2

Google "ethical disclosure." The standard in the security research community is you inform the manufacturer and give them an opportunity to patch the flaw. Then you wait some number of days (some people say 30, other say "depends on the details of the vulnerability"). Then you publish the code along with enough text to explain the vulnerability to a reasonably technical audience.

But it sounds like OP wants the flaw. If the company fixes it then OP will no longer have "full local access to [their] wireless security cameras without the cloud", so disclosing is directly against OP's interests. In that case it's probably best to just keep the flaw private to yourself.

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#12

Post by hwbehrens »

One aspect that other commenters haven't addressed is that, if you do publicly disclose, it's likely (or at least possible) that the company would close the hole and remove the functionality that you're currently using, which you might not want.

Of course, if you keep the approach private and use it for yourself, there's no guarantee that someone won't find it in the future and either exploit it or report it themselves. Do you feel comfortable having cameras in your house that could (in theory) be accessed silently by an unknown 3rd party?

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#13

Post by mminer237 »

umvi wrote: post #11
dingosity wrote: post #2

Google "ethical disclosure." The standard in the security research community is you inform the manufacturer and give them an opportunity to patch the flaw. Then you wait some number of days (some people say 30, other say "depends on the details of the vulnerability"). Then you publish the code along with enough text to explain the vulnerability to a reasonably technical audience.

But it sounds like OP wants the flaw. If the company fixes it then OP will no longer have "full local access to [their] wireless security cameras without the cloud", so disclosing is directly against OP's interests. In that case it's probably best to just keep the flaw private to yourself.

You could presumably just not update its software.

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#14

Post by dehrmann »

dingosity wrote: post #2

Google "ethical disclosure." The standard in the security research community is you inform the manufacturer and give them an opportunity to patch the flaw. Then you wait some number of days (some people say 30, other say "depends on the details of the vulnerability"). Then you publish the code along with enough text to explain the vulnerability to a reasonably technical audience.

One thing I'd add is to be firm on the number of days you wait. As someone else said, that industry is scum, and I wouldn't be surprised for them to drag their feet on the fix. That's on them.

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#16

Post by silksowed »

related but not related, how does a security camera transmit data via TCP/IP without a mobile network connection? does it run off a local wifi network to send and receive data? is there an interface to translate data from a mobile network connection back to TCP/IP allowing you to access via the IP addr?

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#18

Post by umvi »

mminer237 wrote: post #13
umvi wrote: post #11

Earlier quoted context omitted.

But it sounds like OP wants the flaw. If the company fixes it then OP will no longer have "full local access to [their] wireless security cameras without the cloud", so disclosing is directly against OP's interests. In that case it's probably best to just keep the flaw private to yourself.

You could presumably just not update its software.

If they are wireless cameras that connect to the cloud it sounds like they might be prone to auto-updating. You'd have to do extra setup to ensure the cameras are both connected to your WiFi but are not connected to the internet.

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#20

Post by williamdclt »

umvi wrote: post #11
dingosity wrote: post #2

Google "ethical disclosure." The standard in the security research community is you inform the manufacturer and give them an opportunity to patch the flaw. Then you wait some number of days (some people say 30, other say "depends on the details of the vulnerability"). Then you publish the code along with enough text to explain the vulnerability to a reasonably technical audience.

But it sounds like OP wants the flaw. If the company fixes it then OP will no longer have "full local access to [their] wireless security cameras without the cloud", so disclosing is directly against OP's interests. In that case it's probably best to just keep the flaw private to yourself.

Depends on your criteria for "best". Utility or ethics?
Post reply on HN