4 ms·

I was just thinking about this last night. I've discovered a pretty serious security issue with a leading manufacturer of IP cameras. To keep it short you can t

I was just thinking about this last night. I've discovered a pretty serious security issue with a leading manufacturer of IP cameras. To keep it short you can takeover every single camera that is connected to the cloud (not by randomly enumeration of the devices, you have access to the central database with more than 1mil connected devices). I did the "right" thing. If I'm lucky I'm probably going to get a 4 digit bounty and a nice blog post for my CV. But I can't help to think what would happen if I handed this to a competitor or just shorted the company (listed with billions market cap) and helped create a nice clickbaity media shitstorm.

tptacek 10y ago
I think you'd find the company's competitors pretty disinterested. You might find that doing so simply gets your bug disclosed to the vendor through its competitors, costing you credit and the bounty and potentially some legal fees.
iaw 10y ago
I'd be concerned that taking any action with securities could be construed as insider trading (the SEC has been expanding the definition recently). On the idea of giving/selling the information to a competitor (possibly for some stock as well) seems like a reasonable course of action. The current bug reporting environment doesn't properly motivate some companies to fix their issues and reward the people that find them, maybe develop one that does. If a company letting fatal security issues through became a competitive problem, we may stop seeing as many fatal security issues.
- eli 10y ago
  I don't understand. What would a competitor do with a flaw in someone else's product? Exploit it? Release it? Having a hard time imagining they would pay more than the company itself.
  - iaw 10y ago
    Publicize on it. Imagine an ad where they demonstrate how flawed their competitors product is by showing you anyone can watch you on it?
- JumpCrisscross 10y ago
  > I'd be concerned that taking any action with securities could be construed as insider trading (the SEC has been expanding the definition recently). One, the courts have been narrowing - not expanding - the definition of insider trading [1]. Two, you are correct. Don't short a stock before tweeting a vulnerability. If you want to do this, retain a securities and investments lawyer. Vet your plan, trades and disclosure language carefully. [1] http://www.scotusblog.com/case-files/cases/salman-v-united-states/ http://www.scotusblog.com/case-files/cases/salman-v-united-s...
  - sokoloff 10y ago
    Concur. Generating one's own non-public information and trading on it as a non-insider is not insider trading. This is no different than doing foot traffic counts (or satellite parking lot surveillance).
    - Negitivefrags 10y ago
      Lets say you run a large company, and you are about to make a big purchase from another public company. Lets say you are planning on increasing their sales by some non-trivial amount like 20%. Is it legal to purchase shares in that company before you make the purchase? You are leveraging private information, but not information gleaned from insider knowledge from the other company.
      - dmurray 10y ago
        This was given as the example of a trade we shouldn't do when I was first exposed to the insider trading policy at my current employer, a US trading firm. I think it might still be defensible and not insider trading by US standards, but it's at least a grey area.
        whamlastxmas 10y ago
        > it's at least a grey area. This is 90% of where money is made in my experience
- evanpw 10y ago
  This seems to be pretty textbook not insider trading (at least in the US). This is new, independent research about a company's products. At no point did you receive information from a company insider. You own your own information, so there's no insider trading. Incidentally, courts have recently been narrowing the definition of insider trading (see US vs. Newman).
  - iaw 10y ago
    Let's say they've been changing the definition of insider trading. See: Bonan Huang and Nan Huang
ISL 10y ago
A 'golden' aphorism which may apply: Do unto others as you'd have them do unto you.
tajen 10y ago
Logitech at least, if not other IP camera producers too, aren't interested in security. My flatmate had a Logitech which "uploads in your Dropbox account", only to discover that it uploads to Dropbox... when the computer is on. As in, the Logitech driver downloads the files from the cam periodically, and you can set Dropbox to backup the data folder to the cloud. Pretty useless security if you have a laptop. And that's for a mainstream several-hundred-dollars camera. Besides, 3 years after leaving the flatshare, I can still see his home through my Logitech iPad app. If I inadvertently can rape his privacy through the official Logitech app (Note: I was on the phone with him and we were testing his camera), I'm afraid there's no need to worry about attackers. What a creepy world we live in.

tptacek 10y ago

I think you'd find the company's competitors pretty disinterested. You might find that doing so simply gets your bug disclosed to the vendor through its competitors, costing you credit and the bounty and potentially some legal fees.

iaw 10y ago

I'd be concerned that taking any action with securities could be construed as insider trading (the SEC has been expanding the definition recently). On the idea of giving/selling the information to a competitor (possibly for some stock as well) seems like a reasonable course of action. The current bug reporting environment doesn't properly motivate some companies to fix their issues and reward the people that find them, maybe develop one that does. If a company letting fatal security issues through became a competitive problem, we may stop seeing as many fatal security issues.

eli 10y ago
I don't understand. What would a competitor do with a flaw in someone else's product? Exploit it? Release it? Having a hard time imagining they would pay more than the company itself.
- iaw 10y ago
  Publicize on it. Imagine an ad where they demonstrate how flawed their competitors product is by showing you anyone can watch you on it?
JumpCrisscross 10y ago
> I'd be concerned that taking any action with securities could be construed as insider trading (the SEC has been expanding the definition recently). One, the courts have been narrowing - not expanding - the definition of insider trading [1]. Two, you are correct. Don't short a stock before tweeting a vulnerability. If you want to do this, retain a securities and investments lawyer. Vet your plan, trades and disclosure language carefully. [1] http://www.scotusblog.com/case-files/cases/salman-v-united-states/ http://www.scotusblog.com/case-files/cases/salman-v-united-s...
- sokoloff 10y ago
  Concur. Generating one's own non-public information and trading on it as a non-insider is not insider trading. This is no different than doing foot traffic counts (or satellite parking lot surveillance).
  - Negitivefrags 10y ago
    Lets say you run a large company, and you are about to make a big purchase from another public company. Lets say you are planning on increasing their sales by some non-trivial amount like 20%. Is it legal to purchase shares in that company before you make the purchase? You are leveraging private information, but not information gleaned from insider knowledge from the other company.
    - dmurray 10y ago
      This was given as the example of a trade we shouldn't do when I was first exposed to the insider trading policy at my current employer, a US trading firm. I think it might still be defensible and not insider trading by US standards, but it's at least a grey area.
      - whamlastxmas 10y ago
        > it's at least a grey area. This is 90% of where money is made in my experience
evanpw 10y ago
This seems to be pretty textbook not insider trading (at least in the US). This is new, independent research about a company's products. At no point did you receive information from a company insider. You own your own information, so there's no insider trading. Incidentally, courts have recently been narrowing the definition of insider trading (see US vs. Newman).
- iaw 10y ago
  Let's say they've been changing the definition of insider trading. See: Bonan Huang and Nan Huang

ISL 10y ago

A 'golden' aphorism which may apply: Do unto others as you'd have them do unto you.

tajen 10y ago

Logitech at least, if not other IP camera producers too, aren't interested in security. My flatmate had a Logitech which "uploads in your Dropbox account", only to discover that it uploads to Dropbox... when the computer is on. As in, the Logitech driver downloads the files from the cam periodically, and you can set Dropbox to backup the data folder to the cloud. Pretty useless security if you have a laptop. And that's for a mainstream several-hundred-dollars camera. Besides, 3 years after leaving the flatshare, I can still see his home through my Logitech iPad app. If I inadvertently can rape his privacy through the official Logitech app (Note: I was on the phone with him and we were testing his camera), I'm afraid there's no need to worry about attackers. What a creepy world we live in.