21–30 of 109 posts
Secrets are worth so much money, and knowing a stock will most likely move a certain direction at a specific time of your choosing has tremendous value.
You most likely don't owe any company a disclosure.
Hire a lawyer or do your own research on how to profit from this in a legal way. That's my advice.
It sounds like they need to rewrite it in Rust.
I wouldn't be surprised if this happened to this company before.
Is it actually a vulnerability? Or is this just the way the camera is supposed to operate (even if undocumented)?
I think a lot of us "unethical" geeks would love to gawk at your finding, but it's up to you whether you want to disclose it or not.
Google "ethical disclosure." The standard in the security research community is you inform the manufacturer and give them an opportunity to patch the flaw. Then you wait some number of days (some people say 30, other say "depends on the details of the vulnerability"). Then you publish the code along with enough text to explain the vulnerability to a reasonably technical audience.
But it sounds like OP wants the flaw. If the company fixes it then OP will no longer have "full local access to [their] wireless security cameras without the cloud", so disclosing is directly against OP's interests. In that case it's probably best to just keep the flaw private to yourself.
I wouldn't feel great knowing that a camera somewhere in my space had an issue like this, because it seems somewhat naïve to assume nobody else ever figures this out.
2. Demonstrate the exploitation of the vulnerability (without giving the whole thing away)
3. Negotiate timelines. Find out how quickly they can patch the system.
4. Negotiate a bounty. You're not obligated to give them anything without payment.
5. Sign NDA.
6. Deliver evidence of vulnerability.
7. Collect payment.
8. Wait until blackout period is over and the issue has been patched.
9. Publish your report (if allowed under NDA).
If your values include maximizing the number of people who can tinker with their cameras, publish (make sure you're not falling afoul of the camera's license before you do).
If your values include doing whatever you can to keep the most people safe, then inform the camera vendor, and give them 60 days to come up with a patch or a response before you publish.
If authentication is actually taking place, this sounds like a legitimate and useful feature that would steer me toward using this brand of camera. The only reasons that would make me hesitate to release would be 1) the cameras have an automatic remote firmware update mechanism, AND 2) it is likely the company would see this as a threat to a significant revenue stream. If one of those is not true I would release.
Either way, sounds very interesting!