Perhaps there's a chance other people already know about this bug and are already streaming video directly from your house. It's in your interest to have this fixed if you want to keep the camera.
Ask HN: Do I publish code that affects millions of wireless security cameras?
41–50 of 109 posts
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#42Since you are asking, I'd assume you care for the consequences on others. So I'd say contact the manufacturer, try to have it fixed in a reasonable time (like 2 months). After that the safest thing you can do for others is to disclose so that they can either fix themselves or stop using the product (as it's not unlikely you are not the only one to have found the flaw anyway and it becomes more and more likely as time passes)
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#43Are you talking about accessing the stream of a camera via its IP on your local network, or externally by the public IP of your home connection? This pretty drastically changes the severity of what you're describing.
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#44Earlier quoted context omitted.
You could presumably just not update its software.
If they are wireless cameras that connect to the cloud it sounds like they might be prone to auto-updating. You'd have to do extra setup to ensure the cameras are both connected to your WiFi but are not connected to the internet.
Which could be as simple as sequestering them off on their own subnet, no?
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#45You found a bug that potentially allows strangers to invade the privacy of others. My personal opinion is that you have a moral obligation to report it to the manufacturer and give them an opportunity to patch it before releasing anything publicly.
Not disclosing it is putting countless people at risk. How would you feel if someone looked into your house and was able to see you and your family members in situations where they were expecting privacy? You have a chance to prevent that.
Don't put others at risk for your own convenience. Doing the right thing is never the wrong thing.
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#46dLink, right?
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#47Check if the vendor has a responsible disclosure program.
Otherwise, try to contact them providing all the details.
If you don't get any response after a while (2 months) you can make it public.
Another way may be to contact your national CERT and inform them about the issue
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#48RTSP running on generic crappy ip cams is a known issue. Google it. There’s entire websites to browse these streams. Some even have access to the PTZ.
Fwiw, most of the cameras are behind NATs, the ones on the sites have public IPs. A NAT effectively firewalls your camera from the internet, but yes once on LAN they’re unauthenticated.
NAT wont stop an unsecured IP camera from happily streaming content out of your network. Always deploy (and properly configure) an actual firewall to control ingress and egress of packets on your network.
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#49You do whatever you want. You weren't paid to find this issue with the cameras. If you're relying on the behavior, disclosing it will almost certainly get the bug killed. People hold back more serious vulnerabilities than this all the time. If your values include maximizing the number of people who can tinker with their cameras, publish (make sure you're not falling afoul of the camera's license before you do). If yo…
Why do you assume this is a bug?
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#50I’d caution against publishing the code directly to the public if we’re talking about a well known brand name like Ring, Wyze, Nest, etc. You may end up getting involved in a legal dispute if you do that so for your sake report it through their vulnerability disclosure process. If it’s a no-name brand camera, those are frequently published and corrected in future firmware updates so it’s more or less ok to publish those.
Don’t count on that vulnerability being around forever though, at some point someone else is liable to find the same issue and report it. Sucks that vendors won’t give us access to the underlying OS for the device we’ve purchased. A lot of the consumer grade cameras would instantly be more valuable to me if I had that kind of access without having to hack the device for it.