i would recommend you email the vendor, ask give them 14 days to reply on whether they are interested in having a 60 day window to issue a fix (without telling more than "remote exploit, full camera access"). If they do not reply, publish immediately, if they do, you let them know how it works, and give them a date in the calendar for when it will be disclosed publicly.
Ask HN: Do I publish code that affects millions of wireless security cameras?
81–90 of 109 posts
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#82Earlier quoted context omitted.
There is no universal duty to disclose security flaws. Some people have value systems that require disclosure (I'm one of them), but other people don't, and there are coherent, ethical rationales behind those value systems. A lot of it comes down to what you personally believe will happen after you disclose. I'm automatically itchy when people talk about "ethical disclosure". If you truly do believe that people who b…
> Some people have value systems that require disclosure (I'm one of them), but other people don't If you don't believe that your value system binds anyone else to behave in a certain way then how much does it really bind you to behave that way? Ethics and morality are either objective and universally binding or they're merely an arbitrary personal inclination that isn't even binding on those that have the inclinatio…
"Morality is either objective or completely arbitrary" is a false dichotomy. Obviously ethics isn't objective (I mean what would that even mean, absent some deity?), but with some reasonable foundational beliefs such as "I generally want people to have it good and not suffer", you're already pretty constrained and guided in your reasoning. But the belief that it's generally good when people don't suffer is obviously subjective, even if widespread.
Ethics is hard. There's a reason it's not a solved problem.
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#83Earlier quoted context omitted.
There is no universal duty to disclose security flaws. Some people have value systems that require disclosure (I'm one of them), but other people don't, and there are coherent, ethical rationales behind those value systems. A lot of it comes down to what you personally believe will happen after you disclose. I'm automatically itchy when people talk about "ethical disclosure". If you truly do believe that people who b…
> Some people have value systems that require disclosure (I'm one of them), but other people don't If you don't believe that your value system binds anyone else to behave in a certain way then how much does it really bind you to behave that way? Ethics and morality are either objective and universally binding or they're merely an arbitrary personal inclination that isn't even binding on those that have the inclinatio…
Agreeing with the other comment, that’s a false binary in your logic. Ethics, and morality, are different things and can’t be contained in an either/or statement well.
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#84Earlier quoted context omitted.
> Some people have value systems that require disclosure (I'm one of them), but other people don't If you don't believe that your value system binds anyone else to behave in a certain way then how much does it really bind you to behave that way? Ethics and morality are either objective and universally binding or they're merely an arbitrary personal inclination that isn't even binding on those that have the inclinatio…
"Morality is either objective or completely arbitrary" is a false dichotomy. Obviously ethics isn't objective (I mean what would that even mean, absent some deity?), but with some reasonable foundational beliefs such as "I generally want people to have it good and not suffer", you're already pretty constrained and guided in your reasoning. But the belief that it's generally good when people don't suffer is obviously…
> "Morality is either objective or completely arbitrary" is a false dichotomy
> some reasonable foundational beliefs such as "I generally want people to have it good and not suffer"
> But the belief that it's generally good when people don't suffer is obviously subjective, even if widespread.
Why is generally not wanting to hurt people a "reasonable foundational belief?" It's definitely not universal in humanity right now let alone historically just look at the celebrations of war crimes in Russia. Everyone who thinks there are binding ethical beliefs in any way must ascribe it to others otherwise they're just talking about personal taste and we don't need words like "ethics" or "morals."
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#85Eufy has allowed this for a while. I use it myself for Home Assistant[0]. I believe their implementation also does autodiscovery so you don't have to scan for the camera. As long as you can't trigger the stream with a websocket (rogue JS apps shouldn't be able to read my network cameras) then I think you're fine. It's restricted to the local network. [0]: https://github.com/fuatakgun/eufy_security
The handshake involves telling the camera which IP address to stream the video to so this can be done on any IP address whether local or not.
[deleted]
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#86Are you talking about accessing the stream of a camera via its IP on your local network, or externally by the public IP of your home connection? This pretty drastically changes the severity of what you're describing.
The protocol uses UDP hole punching so it doesn't matter if it's local or not.
Definitely not Amcrest whew
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#87Ethically, you’ve uncovered a flaw that provides a modest benefit to you (direct access to your IP camera), but serious detriment to both the manufacturer and the other owners of the cameras. Leaving aside the company’s position, this flaw could result in malign actors invading the privacy of a large number of innocent parties. Given the probability that other actors have already, or will otherwise, uncover and explo…
"this flaw could result in malign actors invading the privacy of a large number of innocent parties."
It's also possible this is a feature, not flaw. There's longstanding suspicion that some Chinese made camera have vulnerabilities for their benefit. Several manufacturers are based from government use over these concerns.
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#88Surprised no one has asked. Does this affect the manufacturer's income? That is, is this also a way to escape an otherwise mandatory subscription fee?
If no, I say publish it without further consideration.
If yes, there might be a DMCA claim against you and you'll want to consider that in your decision. Personally I would likely keep it to myself.
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#89> given an IP of the camera So this is an internal tool, not something you can gain access to remote cameras behind NAT firewalls? I think a lot of people are assuming this is a WAN attack. Sounds genuinely useful, especially if it can be worked into PVR software to integrate with more hardware.
OP didn’t specify if it worked on IPv6. There each device is theoretically reachable from the www.
Re: Ask HN: Do I publish code that affects millions of wireless security cameras?
#90RTSP running on generic crappy ip cams is a known issue. Google it. There’s entire websites to browse these streams. Some even have access to the PTZ.
Fwiw, most of the cameras are behind NATs, the ones on the sites have public IPs. A NAT effectively firewalls your camera from the internet, but yes once on LAN they’re unauthenticated.
The way these IP cameras work is that when you configure them from an app or some dodgy viewer is that that software calls the cloud server, and tells it what the details are for your LAN connected IP cameras.
You really can't let them know how to dial out. Most of them have hardcoded passwords and/or known exploits.
It's why they're so cheap on the 'zon.