3 ms·

Google "ethical disclosure." The standard in the security research community is you inform the manufacturer and give them an opportunity to patch the flaw. Th

Google "ethical disclosure." The standard in the security research community is you inform the manufacturer and give them an opportunity to patch the flaw. Then you wait some number of days (some people say 30, other say "depends on the details of the vulnerability"). Then you publish the code along with enough text to explain the vulnerability to a reasonably technical audience.

chunk_waffle 4y ago
You might also want to check if the company has a bug bounty program. Unlikely but worth looking...
- LinuxBender 4y ago
  Adding to this, when publicly disclosing after the grace period it may be safer to let a high profile security site [1] do the public disclosing so they receive most blow-back from the vendor. Krebs is no stranger to drama and could refer to you by your security researcher nickname that is not used anywhere else. Some of the less reputable shoddy IoT manufacturers may respond poorly to public disclosure. [1] - https://krebsonsecurity.com/ https://krebsonsecurity.com/
- mrtweetyhack 4y ago
umvi 4y ago
But it sounds like OP wants the flaw. If the company fixes it then OP will no longer have "full local access to [their] wireless security cameras without the cloud", so disclosing is directly against OP's interests. In that case it's probably best to just keep the flaw private to yourself.
- mminer237 4y ago
  You could presumably just not update its software.
  - umvi 4y ago
    If they are wireless cameras that connect to the cloud it sounds like they might be prone to auto-updating. You'd have to do extra setup to ensure the cameras are both connected to your WiFi but are not connected to the internet.
    - Arrath 4y ago
      Which could be as simple as sequestering them off on their own subnet, no?
- williamdclt 4y ago
  Depends on your criteria for "best". Utility or ethics?
- sjm-lbm 4y ago
  It's only in OP interests if nobody else ever has access to this exploit. I wouldn't feel great knowing that a camera somewhere in my space had an issue like this, because it seems somewhat naïve to assume nobody else ever figures this out.
- matai_kolila 4y ago
  OP may or may not want to live in a society where people are not vulnerable to an invasion of privacy from outside parties, which would (or would not) make it in their best interest to ethically disclose this vulnerability.
- out-of-ideas 4y ago
  yes, OP might want the "flaw" however it still could be discovered by somebody else and eventually patched, next week, next month, ect... just because you use bug now does not mean it won't be "fixed" (or broken worse) in the future. personally if i were in OP's shoes: i'd hope that said company has a bug-bounty program and use that for a little side cash and a "look what i found" - along with denying auto-updates to my own devices to keep utilizing said functionality (ive always been a fan of choice vs enforcement of arbitrary updates).
dehrmann 4y ago
One thing I'd add is to be firm on the number of days you wait. As someone else said, that industry is scum, and I wouldn't be surprised for them to drag their feet on the fix. That's on them.

chunk_waffle 4y ago

You might also want to check if the company has a bug bounty program. Unlikely but worth looking...

LinuxBender 4y ago
Adding to this, when publicly disclosing after the grace period it may be safer to let a high profile security site [1] do the public disclosing so they receive most blow-back from the vendor. Krebs is no stranger to drama and could refer to you by your security researcher nickname that is not used anywhere else. Some of the less reputable shoddy IoT manufacturers may respond poorly to public disclosure. [1] - https://krebsonsecurity.com/ https://krebsonsecurity.com/
mrtweetyhack 4y ago

umvi 4y ago

But it sounds like OP wants the flaw. If the company fixes it then OP will no longer have "full local access to [their] wireless security cameras without the cloud", so disclosing is directly against OP's interests. In that case it's probably best to just keep the flaw private to yourself.

mminer237 4y ago
You could presumably just not update its software.
- umvi 4y ago
  If they are wireless cameras that connect to the cloud it sounds like they might be prone to auto-updating. You'd have to do extra setup to ensure the cameras are both connected to your WiFi but are not connected to the internet.
  - Arrath 4y ago
    Which could be as simple as sequestering them off on their own subnet, no?
williamdclt 4y ago
Depends on your criteria for "best". Utility or ethics?
sjm-lbm 4y ago
It's only in OP interests if nobody else ever has access to this exploit. I wouldn't feel great knowing that a camera somewhere in my space had an issue like this, because it seems somewhat naïve to assume nobody else ever figures this out.
matai_kolila 4y ago
OP may or may not want to live in a society where people are not vulnerable to an invasion of privacy from outside parties, which would (or would not) make it in their best interest to ethically disclose this vulnerability.
out-of-ideas 4y ago
yes, OP might want the "flaw" however it still could be discovered by somebody else and eventually patched, next week, next month, ect... just because you use bug now does not mean it won't be "fixed" (or broken worse) in the future. personally if i were in OP's shoes: i'd hope that said company has a bug-bounty program and use that for a little side cash and a "look what i found" - along with denying auto-updates to my own devices to keep utilizing said functionality (ive always been a fan of choice vs enforcement of arbitrary updates).

dehrmann 4y ago

One thing I'd add is to be firm on the number of days you wait. As someone else said, that industry is scum, and I wouldn't be surprised for them to drag their feet on the fix. That's on them.