Episode 165: Oh, Canada! Independent Security Researchers Feel the Chill Up North

A 19-year-old researcher, Noah Clements, discovered a serious vulnerability in the dbell DB01-S Gen 1 smart doorbell: an unauthenticated embedded web server accessible via TCP port 81 that allows arbitrary commands and could be used to unlock integrated smart locks. The vendor initially responded positively but later threatened legal action when Clements sought public disclosure; with legal help from CIPPIC the threats were dropped. The report highlights both the technical risk to consumer physical security and the uncertain legal protections for independent security researchers in Canada.