71–80 of 109 posts
Honestly I don't get people who do ethical disclosure: you are going out of your way (and wasting your time) to do what? Tell a company that likely hasn't even took security into consideration hoping that they publish a patched version of the firmware nobody will install either way?
Is it actually a vulnerability? Or is this just the way the camera is supposed to operate (even if undocumented)?
It's technically the way the camera is supposed to operate but in order to find that mode of operation I had to disassemble and study a binary. I'll say it's not a user-facing feature.
If it still requires user authentication it sounds like a useful feature that many users would appreciate!
You do whatever you want. You weren't paid to find this issue with the cameras. If you're relying on the behavior, disclosing it will almost certainly get the bug killed. People hold back more serious vulnerabilities than this all the time. If your values include maximizing the number of people who can tinker with their cameras, publish (make sure you're not falling afoul of the camera's license before you do). If yo…
Just out of curiosity, is 60 days a sort of undefined (or defined, I don't know) "standard" for disclosure? Not the first time I've seen that duration in reference to a bug like this.
So this is an internal tool, not something you can gain access to remote cameras behind NAT firewalls? I think a lot of people are assuming this is a WAN attack.
Sounds genuinely useful, especially if it can be worked into PVR software to integrate with more hardware.
Ethically, you’ve uncovered a flaw that provides a modest benefit to you (direct access to your IP camera), but serious detriment to both the manufacturer and the other owners of the cameras. Leaving aside the company’s position, this flaw could result in malign actors invading the privacy of a large number of innocent parties. Given the probability that other actors have already, or will otherwise, uncover and explo…
There is no universal duty to disclose security flaws. Some people have value systems that require disclosure (I'm one of them), but other people don't, and there are coherent, ethical rationales behind those value systems. A lot of it comes down to what you personally believe will happen after you disclose. I'm automatically itchy when people talk about "ethical disclosure". If you truly do believe that people who b…
If you don't believe that your value system binds anyone else to behave in a certain way then how much does it really bind you to behave that way? Ethics and morality are either objective and universally binding or they're merely an arbitrary personal inclination that isn't even binding on those that have the inclination beyond legal or professional implications.
2. Share on github. Give back to the community and ask people to pay it forward.
3. Entered into a dangerous conversation with the company that could provide you with some cash or land you in legal trouble depending on how the conversation goes.
Facing those choices I would probably do 1 because it is the easiest and safest but seeing how you made a post about it.. I think you want to do 2 and I think you should share.
So I'm voting for the github option.
If this was ten years ago myself might have agreed with others on the full-disclosure approach. However considering the irresponsibility of 'lowest common denominator' of people in modern times do you really want to enable script-kiddies to violate the privacy of many unwitting victims with a metaphorical loaded gun?
Perhaps an amicable middle-ground could be demonstrating the existence of these vulnerabilities in public (such as with a video) and withholding the exact exploit code from publication at least initially. Assuming you are at minimal risk of retaliation from the vendor and a diplomatic resolution fails to achieve results you could carefully measure the pros and cons of full publication and wash your hands of it.
You do whatever you want. You weren't paid to find this issue with the cameras. If you're relying on the behavior, disclosing it will almost certainly get the bug killed. People hold back more serious vulnerabilities than this all the time. If your values include maximizing the number of people who can tinker with their cameras, publish (make sure you're not falling afoul of the camera's license before you do). If yo…
You must deal with much better vendors than my coworkers do.