Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Do I publish code that affects millions of wireless security cameras?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 109 posts

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#31

Post by ianburrell »

silksowed wrote: post #16

related but not related, how does a security camera transmit data via TCP/IP without a mobile network connection? does it run off a local wifi network to send and receive data? is there an interface to translate data from a mobile network connection back to TCP/IP allowing you to access via the IP addr?

Network security cameras connect to Wifi and/or Ethernet; they use TCP/IP. Connecting remotely can be done by opening up firewall or by camera connecting to cloud.

Mobile networks use IP, there is no translation needed. But mobile networks do not allow remote connections. Access would require cloud service, either from the provider or VPN.

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#32

Post by lepapillon »

I suspect you're using the rtsp protocol to get the A/V streams from the camera, in which case I would consider your software another front-end for an IP CCTV system-- is that right?

There are plenty of IP CCTV solutions that use any number of manufacturer's cameras because of standard protocols, and that sort software should be fine to publish. However, if you're spawning the streams because the camera mfg. has a closed protocol and you're exploiting some bug, then maybe give it some more thought.

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#33

Post by HillRat »

Ethically, you’ve uncovered a flaw that provides a modest benefit to you (direct access to your IP camera), but serious detriment to both the manufacturer and the other owners of the cameras. Leaving aside the company’s position, this flaw could result in malign actors invading the privacy of a large number of innocent parties. Given the probability that other actors have already, or will otherwise, uncover and exploit this flaw, I’d say you have an ethical duty to try and prevent those invasions of privacy from taking place. Ethical disclosure to the company, followed by public disclosure (of the flaw’s existence, not or not necessarily of the exploit code or details) if they affirmatively refuse to take action, would be the responsible course here.

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#35

Post by matai_kolila »

umvi wrote: post #11
dingosity wrote: post #2

Google "ethical disclosure." The standard in the security research community is you inform the manufacturer and give them an opportunity to patch the flaw. Then you wait some number of days (some people say 30, other say "depends on the details of the vulnerability"). Then you publish the code along with enough text to explain the vulnerability to a reasonably technical audience.

But it sounds like OP wants the flaw. If the company fixes it then OP will no longer have "full local access to [their] wireless security cameras without the cloud", so disclosing is directly against OP's interests. In that case it's probably best to just keep the flaw private to yourself.

OP may or may not want to live in a society where people are not vulnerable to an invasion of privacy from outside parties, which would (or would not) make it in their best interest to ethically disclose this vulnerability.

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#36

Post by bobkazamakis »

As someone who has submitted vulnerability reports to these bullshit camera manufacturers, I can promise you this is effectively working as intended from their end. You'll submit, they'll say "patched", give you a binary where it is patched, then next week they'll "forget" to merge it back in. Name and shame; anyone telling you about responsible disclosure has no experience in this field with this particular industry.

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#39

Post by blobbers »

blobbers wrote: post #38

RTSP running on generic crappy ip cams is a known issue. Google it. There’s entire websites to browse these streams. Some even have access to the PTZ.

Fwiw, most of the cameras are behind NATs, the ones on the sites have public IPs. A NAT effectively firewalls your camera from the internet, but yes once on LAN they’re unauthenticated.

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#40

Post by jliptzin »

Please, please share with the general public. I have wanted something like this for years. I hope it works with Nest. My Nest cams work pretty well, I just wish I had control over the awful fucking interface it comes with. I have about 10 cameras in multiple locations, it is impossible to display all feeds tiled on one screen like you used to be able to do in, I don’t know, the 80s?
Post reply on HN