alt Hacker NewsHackers Got Inside a Flock Camera
Comments
This is pure laziness aka “reduced time to market” on the part of Flock.
It takes time and effort to think through proper secure boot architecture and to implement key management in a way that doesn’t kill developer productivity.
Their product managers, though, should have realized that setting these up in unsecured public spaces means that their threat model really does include local physical access to everything.
Using off the shelf hardware and software stacks all but guarantees attackers have tools at their fingertips to exploit said physical access.
Given all the recent exploits hitting the kernel, there’s a good chance that there exists an exploitable over-the-air vulnerability present in their WiFi/bluetooth stack, too.
So… all that data is literally there for any unauthorized person to walk up and take it.
It’s not even suitably encrypted on device?
Zero trust in anything Flock says.
This reporting was done in collaboration with 404media. Here's the discussion for 404's article: https://news.ycombinator.com/item?id=49726577
Distributed Denial of Secrets has published the partition images: https://ddosecrets.org/article/flock-alpr-camera
> According to our analysis, the camera’s logs recorded about 21 days of activity across several periods. During those windows, the device photographed roughly 50,200 vehicles and generated about 1.6 million images. On a typical day, it logged around 3,300 vehicles, with a high of 4,454.
Has there been any report about which state this camera was recovered in? New Hampshire has a strict 3 minute rule for non-hit plate data before the captured images and records must be deleted [1].
[1] (N.H. Rev. Stat. § 261:75-b) requires ALPR systems to delete non-hit plate data within 3 minutes
The article says that Flock says "their cameras don't do facial recognition" The cameras don't, but they don't say the system doesn't. They don't say facial recognition isn't a click away through another integration.
I would absolutely assume that any system that sends your image to LE is part of a facial recognition system in practice. We know now that the cameras do recognize people and intentionally transmits images of them, for later identification.
A friend in China built a Flock overlay network that sends live video and audio from ~100 cameras near me to an AWS server for processing and search.
I wonder if a stingray could be used to force a software update in a flock camera. If so maybe it could brick all the flock cameras it can connect to.
All these cameras do is pre-select the images that are worthy uploading. Everything else happens at Flock.
That's why they don't give anything about the camera's security.
The images are all from a public place, so no privacy expectations and what's theworst that could happen? Someone uploads their cat images or the pr0n collection?
Ai figures that one out rather quickly.
Curious how/why all this negative attention is focused directly on the Flock brand (current example notwithstanding)?
Seems like if I were a competitor of Flock I'd be pretty happy right now and all this negative press is making them artificially cheap to buyout right now.
Motorola/Vigilant, Rekor, Leonardo/ELSAG, and Axon are huge companies making mint off the same thing and no once in 20 years have I seen this level of attention... not on the overarching issue of surveillance-state-ing, but of one particular company.
I think I should start posting a reminder in Flock threads that Axon is a Flock competitor, is also engaged in mass surveillance, and is possibly even worse, but there’s rarely any mention of it. Journalists need to do some digging there. This shouldn’t just be a Flock story, or Flock will just get bought up or something and everyone will move on.
(The above should not be read as supporting Flock or discouraging further investigation.)
> The camera’s logs also show the camera struggling with storage. Its logs recorded more than 27,000 “no space left on device” errors while trying to save full-resolution images, along with tens of thousands of related errors, crashes, and reboots. At the same time, about every two minutes, code checked that the camera was still running and logged the message, “Who’s a good boy?!” More than 12,000 of those messages appear in the recovered logs.
Lol
>At the same time, about every two minutes, code checked that the camera was still running and logged the message, “Who’s a good boy?!
Interesting to note that if you don't look like a car or a person, through "adversarial fashion" or some other visual trick, your image potentially won't leave the camera and won't reach the flock cloud for further analysis.
Why did we not get the cool dystopia ala Gibson's Chiba City?
I wonder if they were able to find any of the Bluetooth signal-data these cameras are said to be obtaining from devices within its' vicinity. This in itself is wild, im glad they're coming down around where I am
It's surprising that an American company would forego so many common sense safety and security mechanisms just to protect their bottom line.
Really hoping some good guy hacker manages to take them all down somehow
Tyranny of government invites terrorism from its constituents.
We have all heard the argument that when corporations intentionally make the legal option worse it drives otherwise law abiding customers to pirate the content instead because piracy provides a better service than paying the corporation for their kneecapped product.
I dont see how the same thing doesnt apply to governments.
The people tell you over and over they dont want to live under a surveilance police state. So natually the corporations and government work together to create a fascist police state and they expect the people to be good little slaves and simply sell their souls to their government.
Especially in the day of ai when they could just fake those images incredibly easily to frame someone. They dont need a patsy the next time they jfk someone they just find some sucker with a weak alibi from a list of potential suckers and then fake some cctv images and cell phone data and they can put you where ever they want to.
The only real defence is to buy your own body cam and document every moment of your life so you can have competing evidence.
At this point im surprised damaging the cameras is the only thing these activists are doing.
I wouldnt be surprised to see flock employees and corrupt politicians finding bombs under their cars. Which will likely be used to justify more cameras which will only intensify the terrorist activity.
The tree of liberty is long overdue for a good watering.
Next headline: Flock declares Hacker News a terrorist organization.
With that kind of protection it is guaranteed that that no Flock camera will ever be sold in Europe after december 2027... CRA et al...
I wonder what would happen if one of their customers asked for a 62443-4-2 certificate of compliance?
The other day I was imagining that everyone can just own any device near them. I suppose this implies that we have the resources and access to a capable model
> At the same time, about every two minutes, code checked that the camera was still running and logged the message, “Who’s a good boy?!” More than 12,000 of those messages appear in the recovered logs.
> When the camera did restart, another service left a final message in the logs: “A reboot was requested! ¡Adiós, Amigos!”
Cool, so they were programmed by someone with the maturity of a teenager.
I feel like most of this was already known when someone here in Dallas figured out they had wifi connectivity you could connect and get access. I may not have the details exactly correct but I think someone got access then.
But will it run Doom?
so when do we get it flipped to a nationwide bird migration tracking system?
as someone pointed out: let's make that "flock" name accurate
also make it identify bird song, I am sure there are microphones on there
[flagged]
[dead]
[dead]
[dead]
[dead]
Flock is a scourge on democracy. Flock is YC. But looks like they did YC nearly ten years ago. Who knows what their pitch deck looked like? If they pivoted since then to their current sinister incarnation? I don’t see any evidence that YC is still actively supporting them.
Benefit of the doubt: Funding them for a community/city-owned traffic camera type thing seems like it would have been a much more reasonable proposition than funding Flock for their current use case of allowing police to stalk their ex girlfriends or mistresses.
If I had to guess now it works it would be:
1. Take pictures
2. Send to a big server that all cops nationwide can log into whenever they want to stalk their exes
Did I miss something
> "We liberated hardware"
Ya know, I'm not on Flock's side here.. but be real, this is theft. You should be able to own that if you're going to do something like this.
If you want to know what a "Vulnerability Disclosure Policy" (VDP) would look like if its main purpose is to claim we have VDP and create an appearance of responsible security posture, but not really to learn about vulnerabilities - read Flock's VDP.
They sincerely welcome your vulnerability disclosures, except in cases where you have to "interact" with the device/service or download its data. Other than that TINY carveout, everything is okay.
Oh, if the vuln about configuration and hardening "preferences" like SSL/TSL - Sorry, not interested.
And also, infrastructure vulnerabilities like DNS config - no no, try harder.
I know what you're thinking..ha ha...but we are good guys. You can still report vulnerabilities in the above categories, but the onus is on you to convince us that we should care about them. It is only fair.
https://www.flocksafety.com/legal/vulnerability-disclosure-p...