Commenters say leak disproves Flock's 'no video' claims
3 Sep 16 10:39 AM · 9d ago · 10 articles · 8 posts · 18 comments · 3 sources · development 3 of 6
On Hacker News, commenters argued the dump undercuts official assurances that Flock systems only read license plates without recording video, and criticized the company's vulnerability disclosure policy and overall security posture.
“The flip side of this laziness is that now, when my elected representatives tell me "these are just license-plate readers that don't record video", I have evidence to show them that's false.”
teraflopstegan0gram Hacker collectiveMicah Flee Independent security researcherFlock Safety Manufacturer of the ALPR camera404 Media / WIRED Journalists who broke the joint investigationDDoSecrets Data leak publisher
The whole story articlespostscomments the bright band is this development · numbered dots are the others · click one to jump
Reported in the same hours no headline names this development itself — these 3 claims were published in its stretch
-
first by New Republic, 9d ago · also Wired, Beehaw, Straight Arrow
3 more headlines
- Hackers Got Inside a Flock Camera. Its Data Shows How the System Really Works Wired · 9d ago
- Hackers stole a Flock camera. Here's what they found inside Straight Arrow · 9d ago
- Hacked Data Shows What Flock Cameras Really Record—and It's Terrifying New Republic · 9d ago
-
first by NewsMax.com, 9d ago · also 404 Media
1 more headline
-
first by Mashable, 8d ago
What people said 21 voices · best of 22 · verbatim
-
A
👀 "...Hackers ripped down a Flock camera above a roadway, made a near-complete copy of the data stored inside it, and shared the files with 404 Media and WIRED, revealing in new detail how exactly Flock Safety’s cameras track the movements of both vehicles and people. The hackers say they are also publishing details on how they managed to obtain…
-
Yep. Clown show.> The hackers said they were able to access the Android system on the camera, and found two partitions—sections of its hard-drive, essentially. A few of these were unencrypted, the hackers said, including one called “vendor” and another called “media.” The latter contained an encryption key that unlocked another part, which…
-
L
BREAKING: Hackers dump Flock camera code (Android!) and successfully decrypt
-
If you want to know what a "Vulnerability Disclosure Policy" (VDP) would look like if its main purpose is to claim we have VDP and create an appearance of responsible security posture, but not really to learn about vulnerabilities - read Flock's VDP.They sincerely welcome your vulnerability disclosures, except in cases where you have to "interact"…
-
K
https://www. wired.com/story/hackers-flock- camera-data-shows-how-system-works/
-
This is pure laziness aka “reduced time to market” on the part of Flock.It takes time and effort to think through proper secure boot architecture and to implement key management in a way that doesn’t kill developer productivity.Their product managers, though, should have realized that setting these up in unsecured public spaces means that their…
-
M
ok so you all know that the one thing I find more upsetting than an actual privacy-violating outrage that does harm to millions is when it's done -badly- and those fucking idiots at Flock STORED THE GODSDAMNED ENCRYPTION KEYS ON-DEVICE https://www. 404media.co/hackers-stole-floc ks-camera-software-revealing-how-the-company-tracks-cars-and-people-2/
-
The article understates how bad it is. For months people have been able to walk up next to these these cameras and obtain root immediately and access all the video footage, redirect it to their own servers, etc. The cameras include self-signed certs, credentials, update scripts that can execute anything you want as root, and much more.Dark web is…
-
The flip side of this laziness is that now, when my elected representatives tell me "these are just license-plate readers that don't record video", I have evidence to show them that's false.If Flock had done a more competent job of securing their system, it would be harder to demonstrate this in a compelling way. To a technically-inclined person…
-
has been for a long time - there's a sound engineer who developed quite a following (and is fairly involved with local movement hackerspaces) who demo'd how easy it was to hack Flock cameras nearly a year ago: https://www.youtube.com/watch?v=uB0gr7Fh6lYthe Flock response has been 'it doesn't count if a Youtuber did it' lol:
-
> According to our analysis, the camera’s logs recorded about 21 days of activity across several periods. During those windows, the device photographed roughly 50,200 vehicles and generated about 1.6 million images. On a typical day, it logged around 3,300 vehicles, with a high of 4,454.Has there been any report about which state this camera was…
-
Curious how/why all this negative attention is focused directly on the Flock brand (current example notwithstanding)?Seems like if I were a competitor of Flock I'd be pretty happy right now and all this negative press is making them artificially cheap to buyout right now.Motorola/Vigilant, Rekor, Leonardo/ELSAG, and Axon are huge companies making…
-
The article says that Flock says "their cameras don't do facial recognition" The cameras don't, but they don't say the system doesn't. They don't say facial recognition isn't a click away through another integration.I would absolutely assume that any system that sends your image to LE is part of a facial recognition system in practice. We know now…
-
It is bad.But think the real danger in Flock is the aggregate data, tracking between camaras. So if someone hacks a single camara, they probably don't get much, unless it is pointed right at someone, which is bad. Aren't they selling these as should be pointing at traffic? If they are pointing right at people, like at playgrounds, then they are…
-
All these cameras do is pre-select the images that are worthy uploading. Everything else happens at Flock.That's why they don't give anything about the camera's security.The images are all from a public place, so no privacy expectations and what's theworst that could happen? Someone uploads their cat images or the pr0n collection?Ai figures that…
-
I really hate how Product Managers somehow get to take the reins of engineering teams instead of having to sell them product ideas.It's madness, they often lack the technical skills and "optimise away" requirements surfaced by eng teams they don't comprehend or just don't like having to deal with.
-
I always assumed Flock's security posture was like most other companies. It's nice to see confirmation.I think I should add a "X'); DROP TABLE Cameras;--" bumper sticker to my car now.
-
So… all that data is literally there for any unauthorized person to walk up and take it.It’s not even suitably encrypted on device?Zero trust in anything Flock says.
-
I wonder if a stingray could be used to force a software update in a flock camera. If so maybe it could brick all the flock cameras it can connect to.
-
A friend in China built a Flock overlay network that sends live video and audio from ~100 cameras near me to an AWS server for processing and search.
-
>At the same time, about every two minutes, code checked that the camera was still running and logged the message, “Who’s a good boy?!
All 6 developments of Hackers dump Flock ALPR camera firmware, exposing hardcoded… →
NewswiresMastodonRedditBlueskyHacker NewsXLobsters