Post

I've got a lot of work to do today but I'm getting absolutely nerdsniped by the new Flock dataset. You can download it here. It's all of the Android partitions extracted from a Flock device ddosecrets.org/article/floc...

I tracked down the very likely specific Flock camera itself. It's in Wauwatosa, a suburb of Milwaukee. Here's a photo of it from Google Street View. The GPS coordinates were in the logs

This Flock camera is running obsolete, end-of-life software. - It's on Android 8.1, released in 2017, support ended in 2021 - It's on Android patch level 2018-06-5 - It's running Linux 3.18, released in 2017 This shit is like 8 or 9 years old, and full of vulnerabilities.

HaJ3FgupAm8RrDJW3MHgT9X7Ft27eVaD What is that? That's a hard-coded API token that Flock cameras use to identify themselves and get OAuth credentials, which can then be used to talk to Flock's production servers. Like, anyone on the internet can probably do this right now.

You can read all the details in my write-up, which also shows exactly where in this public dataset you can find all of this micahflee.com/flock-camera...