3 ms·

This is the kind of thing where responsible disclosure is really very important. Let's say you're a woman. A woman who lives in one of these apartment complexe

This is the kind of thing where responsible disclosure is really very important. Let's say you're a woman. A woman who lives in one of these apartment complexes. A woman with a stalker. A stalker who has threatened to kill you, multiple times. Who has shown up at your apartment, but was rebuffed by the building security. One day you wake up and find out that a "security researcher" found a way that anyone in the world can get into the building at any time, in addition to looking up who lives at each address. And it turns out the security researcher waited only two months (including over christmas break) to try to resolve the issue in a way that would not leave the existing buildings exposed. If I were that woman, and something happened to me as a result of this disclosure, and assuming I was still alive, I would, at a minimum, sue the shit out of that security researcher.

inetknght 2y ago
I'm disappointed you're downvoted. I know a woman who is the exact situation you describe (sans hacker); their ex-husband has made threats to her life and has made attempts to act on those threats. She's extremely privacy sensitive as a result. You are right. But remember you can be sued for anything, and further remember that suing someone doesn't mean you have good cause to win. For corollaries, see good samaritan laws [0]: (specifically about Texas) https://www.uslawshield.com/can-get-sued-good-samaritan-laws-texas/ https://www.uslawshield.com/can-get-sued-good-samaritan-laws... [1]: https://www.themirror.com/news/weird-news/i-cpr-crash-victim-saved-352724 https://www.themirror.com/news/weird-news/i-cpr-crash-victim... [2]: (More generally) https://en.wikipedia.org/wiki/Good_Samaritan_law https://en.wikipedia.org/wiki/Good_Samaritan_law So it stands to reason that a white hat hacker who, in good faith, publicly releases information in an attempt to get things fixed shouldn't face negative repercussion.
- 0xbadcafebee 2y ago
  But they should face consequences if they were irresponsible, regardless of intention. If you found the nuclear launch codes, and you're pretty sure nobody else has found them, should you wait a week and then release them, because you had a good faith interest in exposing this hole? No, of course not, that'd be insane. What one should do in that situation is wait, and try to get the codes changed. You shouldn't wait forever, because someone else might find them. But you also should wait for as long as you reasonably can, because of how severe the risk of releasing is. This risk analysis is the calculus of responsible disclosure. Any ethical security researcher should err on the side of avoiding harm, making every effort to ensure the disclosure doesn't harm unnecessarily. For most researchers, that means waiting more than 2 months over a holiday season, even if it was just a bug in a javascript library or something. Knowingly exposing the privacy and security of thousands of people is pretty fucked up, imo. I'm pretty sure they could have come up with a half dozen different ways to try and get the issue resolved, if not through the company directly, then through individual apartment complexes, law enforcement, etc. Looking at this closer, it's actually worse than I originally thought. You can see what time everyone comes home every day, what their weekly routines are. So you know when they're gone, so you can rob their house. Or you know when they come home, so you know when you can attack them. This is fucking chilling.
  - me-vs-cat 2y ago
    The author contacted the current and former vendors, got a flippant answer, asked again, and was ghosted for two weeks. I see here a desire for a random person to accept a staggering amount of your personal responsibility. Anyone under long-term active threat without defense-in-depth redundancy isn't someone I can save by waiting longer before disclosure. I am frankly amazed you expect so much from a stranger for so little benefit. It is fucking chilling -- that the publisher would do this, in the first place, and blow him off now, too. Why don't YOU pick up what you said, and start contacting apartment buildings and police? How many of those half-dozen ways you mentioned will YOU act upon?
  - inetknght 2y ago
    > But they should face consequences if they were irresponsible, regardless of intention. Intention is important. If their intention is to highlight that a problem exists, then sure. They should be forced to participate in resolution (at the very minimum). As for liability? No, that definitely belongs on the owners of the insecure devices. If their intention is to show to "the bad guys" where the spots are vulnerable? Then yes, they are partly culpable. Again, being a good samaritan (showing that a problem exists) should NOT make you liable for the problems that already existed. > you also should wait for as long as you reasonably can That word, "reasonably", is loaded. I think waiting a couple of months is perfectly reasonable when being stonewalled by other parties, especially the owner. > that means waiting more than 2 months over a holiday season Yup, sure, because thieves definitely don't operate during holiday season. And please ask Russia and the US to hold off on their nuclear war. It's called Nuclear Winter, but that doesn't mean it has to happen during Winter, right? > This is fucking chilling. The problem existed before the announcement was made. You think it was chilling before? Just imagine that nobody who was capable of fixing it didn't know about the problem. So it could be abused without anyone being the wiser. That is fucking chilling. It's chilling that people would be more upset about the announcement and less upset about the apartment building owners not fixing the problem in the first place. That is fucking chilling.
- blueflow 2y ago
  I downvoted, because they wanted to create sympathy with a victim, and to achieve that, they made it a woman. What is the takeaway from that? I'm out of charitable explanations.
  - inetknght 2y ago
    [flagged]
    - blueflow 2y ago
      [flagged]
Lanolderen 2y ago
Tbh if someone's determined to kill you, enough to look up CVEs and so on on your security system, they might as well wait by the door to brick you in the head when you inevitably come out. It's even better for them since you're bound to be less armed than at home surrounded by kitchen knives, tools, chairs, etc.
4gotunameagain 2y ago
First of all there is no need in pointlessly gendering the risks involved. Secondly, if a person is determined enough to look for vulnerabilities in the access control system, they are determined to do much more. Thirdly, public disclosure more often than not leads to enhanced security down the line, protecting both men and women alike.
autoexec 2y ago
> assuming I was still alive, I would, at a minimum, sue the shit out of that security researcher. If you wanted to stay alive you'd be wise to think twice about going after people who go out of their way to inform you that the security you are dependent on is not doing its job. You'd be much better off instead going after the company who was negligent enough to create the system with such obvious flaws or the landlord who subjected you to it without even bothering to read the manual. The alternative is that researches will stop telling the public when they aren't safe and you stay ignorant while some attacker spends the 15 minutes it takes to find and try the default password. The person who disclosed this was right to get the information out as widely as possible as quickly as possible because, as you said, some people are likely depending on those locks for their safety. Thankfully everyone who learns that this product has made them vulnerable can now take measures to protect themselves accordingly. We'd probably agree that there could have been better ways to disclose this, ways that made it instantly clear that this product was putting people in danger, while also not making quite as easy for others to repeat the attack, but in this case you can bet that trying the default password was going to be high on the list of things people would try anyway. I think it's extremely unlikely that this security researcher was the first it. The most important thing is letting as many people as possible learn about their risk so that vulnerable people can protect themselves ASAP and so that the negligent company/landlord feels a lot of pressure to fix the situation as quickly as possible. If you make security researchers think twice about doing that you'll only allow yourself/others to come to harm. Ignorance really isn't always bliss.

inetknght 2y ago

I'm disappointed you're downvoted. I know a woman who is the exact situation you describe (sans hacker); their ex-husband has made threats to her life and has made attempts to act on those threats. She's extremely privacy sensitive as a result. You are right. But remember you can be sued for anything, and further remember that suing someone doesn't mean you have good cause to win. For corollaries, see good samaritan laws [0]: (specifically about Texas) https://www.uslawshield.com/can-get-sued-good-samaritan-laws-texas/ https://www.uslawshield.com/can-get-sued-good-samaritan-laws... [1]: https://www.themirror.com/news/weird-news/i-cpr-crash-victim-saved-352724 https://www.themirror.com/news/weird-news/i-cpr-crash-victim... [2]: (More generally) https://en.wikipedia.org/wiki/Good_Samaritan_law https://en.wikipedia.org/wiki/Good_Samaritan_law So it stands to reason that a white hat hacker who, in good faith, publicly releases information in an attempt to get things fixed shouldn't face negative repercussion.

0xbadcafebee 2y ago
But they should face consequences if they were irresponsible, regardless of intention. If you found the nuclear launch codes, and you're pretty sure nobody else has found them, should you wait a week and then release them, because you had a good faith interest in exposing this hole? No, of course not, that'd be insane. What one should do in that situation is wait, and try to get the codes changed. You shouldn't wait forever, because someone else might find them. But you also should wait for as long as you reasonably can, because of how severe the risk of releasing is. This risk analysis is the calculus of responsible disclosure. Any ethical security researcher should err on the side of avoiding harm, making every effort to ensure the disclosure doesn't harm unnecessarily. For most researchers, that means waiting more than 2 months over a holiday season, even if it was just a bug in a javascript library or something. Knowingly exposing the privacy and security of thousands of people is pretty fucked up, imo. I'm pretty sure they could have come up with a half dozen different ways to try and get the issue resolved, if not through the company directly, then through individual apartment complexes, law enforcement, etc. Looking at this closer, it's actually worse than I originally thought. You can see what time everyone comes home every day, what their weekly routines are. So you know when they're gone, so you can rob their house. Or you know when they come home, so you know when you can attack them. This is fucking chilling.
- me-vs-cat 2y ago
  The author contacted the current and former vendors, got a flippant answer, asked again, and was ghosted for two weeks. I see here a desire for a random person to accept a staggering amount of your personal responsibility. Anyone under long-term active threat without defense-in-depth redundancy isn't someone I can save by waiting longer before disclosure. I am frankly amazed you expect so much from a stranger for so little benefit. It is fucking chilling -- that the publisher would do this, in the first place, and blow him off now, too. Why don't YOU pick up what you said, and start contacting apartment buildings and police? How many of those half-dozen ways you mentioned will YOU act upon?
- inetknght 2y ago
  > But they should face consequences if they were irresponsible, regardless of intention. Intention is important. If their intention is to highlight that a problem exists, then sure. They should be forced to participate in resolution (at the very minimum). As for liability? No, that definitely belongs on the owners of the insecure devices. If their intention is to show to "the bad guys" where the spots are vulnerable? Then yes, they are partly culpable. Again, being a good samaritan (showing that a problem exists) should NOT make you liable for the problems that already existed. > you also should wait for as long as you reasonably can That word, "reasonably", is loaded. I think waiting a couple of months is perfectly reasonable when being stonewalled by other parties, especially the owner. > that means waiting more than 2 months over a holiday season Yup, sure, because thieves definitely don't operate during holiday season. And please ask Russia and the US to hold off on their nuclear war. It's called Nuclear Winter, but that doesn't mean it has to happen during Winter, right? > This is fucking chilling. The problem existed before the announcement was made. You think it was chilling before? Just imagine that nobody who was capable of fixing it didn't know about the problem. So it could be abused without anyone being the wiser. That is fucking chilling. It's chilling that people would be more upset about the announcement and less upset about the apartment building owners not fixing the problem in the first place. That is fucking chilling.
blueflow 2y ago
I downvoted, because they wanted to create sympathy with a victim, and to achieve that, they made it a woman. What is the takeaway from that? I'm out of charitable explanations.
- inetknght 2y ago
  [flagged]
  - blueflow 2y ago
    [flagged]

Lanolderen 2y ago

Tbh if someone's determined to kill you, enough to look up CVEs and so on on your security system, they might as well wait by the door to brick you in the head when you inevitably come out. It's even better for them since you're bound to be less armed than at home surrounded by kitchen knives, tools, chairs, etc.

4gotunameagain 2y ago

First of all there is no need in pointlessly gendering the risks involved. Secondly, if a person is determined enough to look for vulnerabilities in the access control system, they are determined to do much more. Thirdly, public disclosure more often than not leads to enhanced security down the line, protecting both men and women alike.

autoexec 2y ago

> assuming I was still alive, I would, at a minimum, sue the shit out of that security researcher. If you wanted to stay alive you'd be wise to think twice about going after people who go out of their way to inform you that the security you are dependent on is not doing its job. You'd be much better off instead going after the company who was negligent enough to create the system with such obvious flaws or the landlord who subjected you to it without even bothering to read the manual. The alternative is that researches will stop telling the public when they aren't safe and you stay ignorant while some attacker spends the 15 minutes it takes to find and try the default password. The person who disclosed this was right to get the information out as widely as possible as quickly as possible because, as you said, some people are likely depending on those locks for their safety. Thankfully everyone who learns that this product has made them vulnerable can now take measures to protect themselves accordingly. We'd probably agree that there could have been better ways to disclose this, ways that made it instantly clear that this product was putting people in danger, while also not making quite as easy for others to repeat the attack, but in this case you can bet that trying the default password was going to be high on the list of things people would try anyway. I think it's extremely unlikely that this security researcher was the first it. The most important thing is letting as many people as possible learn about their risk so that vulnerable people can protect themselves ASAP and so that the negligent company/landlord feels a lot of pressure to fix the situation as quickly as possible. If you make security researchers think twice about doing that you'll only allow yourself/others to come to harm. Ignorance really isn't always bliss.