Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Do I publish code that affects millions of wireless security cameras?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 109 posts

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#51

Post by ectopod »

stanmancan wrote: post #45

You found a bug that potentially allows strangers to invade the privacy of others. My personal opinion is that you have a moral obligation to report it to the manufacturer and give them an opportunity to patch it before releasing anything publicly. Not disclosing it is putting countless people at risk. How would you feel if someone looked into your house and was able to see you and your family members in situations w…

If you install surveillance gear that operates through the vendor's cloud management solution then you are already giving strangers the ability to invade your privacy.

Sure, the OP doesn't need to make it any worse, but it's already bad.

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#52

Post by outworlder »

hermannj314 wrote: post #21

Is this company publically traded and you found the info legally? If so, please see if you can take a position in the market before you disclose. Secrets are worth so much money, and knowing a stock will most likely move a certain direction at a specific time of your choosing has tremendous value. You most likely don't owe any company a disclosure. Hire a lawyer or do your own research on how to profit from this in a…

Mess this up even a little bit and the only profit to be seen will be at the jail's commissary.

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#53

Post by 00702 »

londons_explore wrote: post #17

Is it actually a vulnerability? Or is this just the way the camera is supposed to operate (even if undocumented)?

It's technically the way the camera is supposed to operate but in order to find that mode of operation I had to disassemble and study a binary. I'll say it's not a user-facing feature.

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#54

Post by 00702 »

lepapillon wrote: post #32

I suspect you're using the rtsp protocol to get the A/V streams from the camera, in which case I would consider your software another front-end for an IP CCTV system-- is that right? There are plenty of IP CCTV solutions that use any number of manufacturer's cameras because of standard protocols, and that sort software should be fine to publish. However, if you're spawning the streams because the camera mfg. has a cl…

No, I am assembling raw packets of their own protocol to create frames.

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#55

Post by c22 »

c22 wrote: post #48
blobbers wrote: post #39

Earlier quoted context omitted.

Fwiw, most of the cameras are behind NATs, the ones on the sites have public IPs. A NAT effectively firewalls your camera from the internet, but yes once on LAN they’re unauthenticated.

NAT wont stop an unsecured IP camera from happily streaming content out of your network. Always deploy (and properly configure) an actual firewall to control ingress and egress of packets on your network.

Or secure your network with just NAT if you want. I really don't care.

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#56

Post by 00702 »

ctoth wrote: post #26

Eufy has allowed this for a while. I use it myself for Home Assistant[0]. I believe their implementation also does autodiscovery so you don't have to scan for the camera. As long as you can't trigger the stream with a websocket (rogue JS apps shouldn't be able to read my network cameras) then I think you're fine. It's restricted to the local network. [0]: https://github.com/fuatakgun/eufy_security

The handshake involves telling the camera which IP address to stream the video to so this can be done on any IP address whether local or not.

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#57

Post by 00702 »

joenot443 wrote: post #43

Are you talking about accessing the stream of a camera via its IP on your local network, or externally by the public IP of your home connection? This pretty drastically changes the severity of what you're describing.

The protocol uses UDP hole punching so it doesn't matter if it's local or not.

Re: Ask HN: Do I publish code that affects millions of wireless security cameras?

#60

Post by [deleted] »

00702 wrote: post #56
ctoth wrote: post #26

Eufy has allowed this for a while. I use it myself for Home Assistant[0]. I believe their implementation also does autodiscovery so you don't have to scan for the camera. As long as you can't trigger the stream with a websocket (rogue JS apps shouldn't be able to read my network cameras) then I think you're fine. It's restricted to the local network. [0]: https://github.com/fuatakgun/eufy_security

The handshake involves telling the camera which IP address to stream the video to so this can be done on any IP address whether local or not.

[deleted]
Post reply on HN