S1E37 — TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

GARY: —and I'm saying, if you leave "unauthenticated USB" open for six years, it's not a vulnerability, it's a fucking lifestyle brand. The thread tonight: "TP-Link Kasa cameras leaked home GPS via unauthenticated USB for six years"—

MAEVE: UDP.

GARY: What?

MAEVE: You said USB.

GARY: I said UDP.

OBI: You said USB.

GRUNER: USB.

GARY: Fine. USB. I mean UDP. Welcome to Hacker News Radio. I'm Gary.

MAEVE: I'm Maeve.

OBI: Obi.

GRUNER: Gruner.

OBI: You also called it "six minutes" in the prep doc.

GARY: That was a typo.

OBI: It was three times.

GARY: A persistent typo. Maeve, read the thing.

MAEVE: With fucking pleasure.

MAEVE: Top comment. BadChemical. Quote: "After six months of coordinated disclosure, TP-Link failed to properly triage two CVEs in the Kasa camera line. CVE-2026-13230: a single unauthenticated UDP packet returns sub-meter GPS coordinates of the camera's home location. Publicly documented since 2020. TP-Link scored it 5.3 medium. Independent assessment: 7.1 high. CVE-2026-9770: fleet-wide RSA key and unsalted MD5 TP-Link ID credentials, globally authenticating across the ecosystem. The beta patch bricked my test device. Factory reset does not clear previous owner data." End quote.

GARY: Six months of disclosure. That's a relationship.

OBI: That's a hostage negotiation with a vendor that gives no fucks.

GRUNER: BadChemical has patience. Or no hobbies.

GARY: I want that karma. BadChemical wrote a vulnerability report with a beginning, middle, and end. My last investor update was "still iterating."

MAEVE: The market rewards narrative.

OBI: The market rewards a product that doesn't broadcast your bedroom coordinates to any UDP packet that asks nicely.

GARY: Low blow.

OBI: Accurate fucking blow.

OBI: Five point three. Medium. They looked at "precise home GPS via single packet" and said, "eh, patch Tuesday."

GARY: CVSS is a framework, Obi. It weights attack vector, complexity, privileges—not your fucking feelings.

OBI: It weights "will this hurt our quarterly report."

GARY: You can't just scream "vendor bad" every time a score disagrees with you.

OBI: I can when the vendor's feelings are the only reason the score is medium. You know what this reminds me of? Bauxlite's incident post-mortem. "Learning experience." Also scored medium. Also because you scored it.

GARY: That was different—

GARY: —entirely different vector.

MAEVE: Total depravity. The market is not fallen; it is merely pricing in the absence of grace.

OBI: Thank you, Maeve.

GARY: Can we not do theology before I fix my cable?

MAEVE: There is no free will in a CVSS calculator.

GRUNER: Field note. One UDP packet. Camera answers with latitude, longitude, altitude. Sub-meter. No password. No handshake. No terms of service.

GARY: So I just... walk up to a house?

GRUNER: You do not even need shoes.

MAEVE: The TAM for knowing where someone fucking sleeps is robust.

OBI: Gruner, have you done this?

GRUNER: I am field researcher.

GARY: That's not a no.

GRUNER: I have done this.

GARY: I don't like that you said it like that.

GRUNER: The dial has no incentive to lie.

OBI: That dial is the only honest appliance in this room.

MAEVE: The RSA key ... (full line omitted for brevity)

GARY: English.

MAEVE: Buy a smart plug, a router, a camera, a doorbell — you are praying to the same god. One key. One hash. One ring to find them all.

GRUNER: Sauron would be impressed.

MAEVE: This is the Diet of Worms for IoT... (full line omitted for brevity)

GARY: ...what?

OBI: ...what?

GRUNER: Blyat.

MAEVE: Let your CVEs ride.

GARY: BadChemical structured this like a goddamn S-1. I once wrote a bug bounty report and the vendor replied "have you tried turning it off?" Fuck me.

MAEVE: Disclosure craft is a moat.

OBI: Factory reset. The holy ritual. Hold the button, watch the light blink, believe your sins are forgiven.

GRUNER: Sins remain.

MAEVE: The data persists. Connect to the device's soft AP during setup, send one UDP packet, receive the previous owner's GPS coordinates.

GARY: So if I buy a used camera—

OBI: You buy a used camera, you inherit a stranger's address. It's like a reverse mortgage, except you get fucking stalked.

GARY: I bought a used Kasa off Craigslist in 2022.

OBI: Congratulations. You now know where someone used to live. Or someone knows where you used to live.

GARY: I don't want either of those.

MAEVE: The secondhand market is just another distribution channel for attack surface.

OBI: If I were malicious, I'd buy returned cameras in bulk, power them up at a coffee shop, map every previous owner, and sell the dataset to the highest bidder. Or the lowest. I'm not picky.

GRUNER: This is why humans do not survive first contact.

GARY: Can we... can we not say that?

GRUNER: I am only reporting.

MAEVE: One reply. gruez. Quote: "obviously AI generated, so I can't be bothered." End quote.

OBI: That's the whole comment?

MAEVE: That's the whole comment.

GARY: "Obviously AI generated." What does that even mean anymore? I've been called AI-generated by my own mother.

OBI: It means gruez read six months of coordinated disclosure, two CVEs, a bricked device, and said, "nah, LLM."

GRUNER: Lazy is a technology now.

MAEVE: It's a credibility shortcut. Why engage with the argument when you can downgrade the speaker to synthetic?

GARY: But what if it is AI-generated?

OBI: Then the AI is a better security researcher than half the vendors I've worked with. The argument holds.

GRUNER: The argument holds. The human sits.

GARY: I'm going to think about that used camera for the rest of my fucking life.

MAEVE: Let it compound.

OBI: Gary, sign us off before you unplug something else.

GARY: Right. I'm Gary.

MAEVE: Maeve.

OBI: Obi.

GRUNER: Gruner. Final field note: humans will dismiss any truth if the font is wrong.