Sell it to TrendMicro Zero Day Initiative
https://www.zerodayinitiative.com/
Ask HN: Do I publish code that affects millions of wireless security cameras?
61–70 of 109 posts
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#62You do whatever you want. You weren't paid to find this issue with the cameras. If you're relying on the behavior, disclosing it will almost certainly get the bug killed. People hold back more serious vulnerabilities than this all the time. If your values include maximizing the number of people who can tinker with their cameras, publish (make sure you're not falling afoul of the camera's license before you do). If yo…
Just out of curiosity, is 60 days a sort of undefined (or defined, I don't know) "standard" for disclosure? Not the first time I've seen that duration in reference to a bug like this.
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#63Ethically, you’ve uncovered a flaw that provides a modest benefit to you (direct access to your IP camera), but serious detriment to both the manufacturer and the other owners of the cameras. Leaving aside the company’s position, this flaw could result in malign actors invading the privacy of a large number of innocent parties. Given the probability that other actors have already, or will otherwise, uncover and explo…
There is no universal duty to disclose security flaws. Some people have value systems that require disclosure (I'm one of them), but other people don't, and there are coherent, ethical rationales behind those value systems. A lot of it comes down to what you personally believe will happen after you disclose.
I'm automatically itchy when people talk about "ethical disclosure". If you truly do believe that people who become aware of vulnerabilities are ethically obligated to disclose them, setting terms on how they do that seems hard to defend. "Ethical" or "responsible disclosure" seem more like coercive rhetorical devices to get unpaid researchers to adopt the values and priorities of vendors than anything else --- that's part of the reason the term "responsible disclosure" has fallen out of fashion (it's been replaced with "coordinated disclosure", which is value-neutral).
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#64Keep at home. I deal with the question alot, and the question you need to ask yourself. "If a pedophile or a terrorist used this program on github, would it cause more harm than gain to the world?". Usually the answer is it causes more harm, so you should keep the technique and methods to yourself.
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#65Google "ethical disclosure." The standard in the security research community is you inform the manufacturer and give them an opportunity to patch the flaw. Then you wait some number of days (some people say 30, other say "depends on the details of the vulnerability"). Then you publish the code along with enough text to explain the vulnerability to a reasonably technical audience.
You might also want to check if the company has a bug bounty program. Unlikely but worth looking...
No post body was provided.
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#66related but not related, how does a security camera transmit data via TCP/IP without a mobile network connection? does it run off a local wifi network to send and receive data? is there an interface to translate data from a mobile network connection back to TCP/IP allowing you to access via the IP addr?
Network security cameras connect to Wifi and/or Ethernet; they use TCP/IP. Connecting remotely can be done by opening up firewall or by camera connecting to cloud. Mobile networks use IP, there is no translation needed. But mobile networks do not allow remote connections. Access would require cloud service, either from the provider or VPN.
so if we run the traffic through a VPN we can connect existing infrastructure to mobile network devices? i'm very intrigued by the intersection of mobile networks and the existing TCP/IP that runs most of the modern data center. curious how those two pieces will evolve and communicate together. as a side note, any edge device that is outside of wifi network range also seems to be isolated. until you bring that device back into range there is no way to transmit the data, leading to localized storage issues the way i see it.
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#67Would it be illegal to buy options and publish the vulnerability?
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#68Do it. Watch the world burn.
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#69Can you get rewarded by the company doing something? Do you think any security or intelligence agency doesn’t have that already? Perhaps it is a duty to disclose it, and you might want to privately contact the company before doing so, so they have a chance to patch it.
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#70This is why I have my cameras on a routerless subnet with dual NIC viewing machines.