Post

Micah Lee
@micahflee.com

I've got a lot of work to do today but I'm getting absolutely nerdsniped by the new Flock dataset. You can download it here. It's all of the Android partitions extracted from a Flock device ddosecrets.org/article/floc...

ddosecrets.orgFlock ALPR camera - Distributed Denial of SecretsFilesystem images of the partitions on an in-use Flock ALPR camera, including custom Android APK files installed on the device, as well as its recorded media. The data reveals how the devices track bo...
404 Media@404media.co

NEW: Hackers ripped down a Flock camera above a roadway, made a near-complete copy of the data stored inside it, and shared the files with 404 Media and @wired.com, revealing in new detail how exactly Flock Safety’s cameras track the movements of both vehicles and people.

404media.coHackers Stole Flock’s Camera Software, Revealing How the Company Tracks Cars and PeopleWhile people around the U.S. are tearing down Flock cameras, one group of hackers went a step further: extracting the camera's software too.
Micah Lee
@micahflee.com

I tracked down the very likely specific Flock camera itself. It's in Wauwatosa, a suburb of Milwaukee. Here's a photo of it from Google Street View. The GPS coordinates were in the logs

Micah Lee
@micahflee.com

This Flock camera is running obsolete, end-of-life software. - It's on Android 8.1, released in 2017, support ended in 2021 - It's on Android patch level 2018-06-5 - It's running Linux 3.18, released in 2017 This shit is like 8 or 9 years old, and full of vulnerabilities.

312 reposts1.4K likes

Micah Lee
@micahflee.com

HaJ3FgupAm8RrDJW3MHgT9X7Ft27eVaD What is that? That's a hard-coded API token that Flock cameras use to identify themselves and get OAuth credentials, which can then be used to talk to Flock's production servers. Like, anyone on the internet can probably do this right now.

Micah Lee
@micahflee.com

Read the analysis. Unless I'm getting something totally wrong, you use that API token to make a POST request to https://hpnotiq[.]flocksafety[.]com/api/v3/devices/credentials, along with the camera's MAC address, and it gives you OAuth credentials

😸
@kittensmcmittens.bsky.social

Purely for research purposes, are you aware if you need to POST exactly that MAC address? If you do, I guess at least there's that level of security. If not, lmao.

EssayWells
@essaywells.bsky.social

Just remembered that "get into one of the surveillance cameras so we can hack the surveillance network" was a plot point in the Arnie "Running Man". Somehow this idea has become *less ridiculous*.

sandeen
@sandeen.bsky.social

"Flock takes security seriously and maintains a public Vulnerability Disclosure Policy for security researchers to report potential vulnerabilities directly to us. We received no report through that process" LOL indeed.

Dr. Ew
@skweetis.bsky.social

@ourseattle.bsky.social Have you seen this? I know this is Flock, not Axon, but things like hard-coded API tokens are *bad*. Do you guys have an angle of "Has there been a 3rd party security audit of these devices and software? How do we know things aren't implemented insecurely?"

denartha.bsky.social
@denartha.bsky.social

In a meeting, a number of devs were complaining about how long it was taking to get Pull Requests approved. Part of my job was reviewing Pull Requests. On the call, someone goes "Do we even need pull requests?". Me:

Claire
@crystalclairenight.bsky.social

Either you have someone who does it right from the start and defends it aggressively, or you're a lesson to others waiting to happen. From the outside nobody can tell which applies to any piece of software in advance. It mostly comes from temporary solutions becoming permanent.

Marc Sobel
@marcsobel.bsky.social

This is a terrible exposure. With hundreds of known unpatched vulnerabilities, a bad actor could capture uncountable numbers videos of police and federal agents in action. Which could be a signifcant legal liability. And prove exculpatory for numerous defendants.

Madam Airlock
@madamairlock.bsky.social

I really hope that hackers don't find out about this, find their way into the Flock network, and cause all those expensive cameras to become expensive bricks. What a terrible waste of taxpayer money that would be.

Natanael, Tech janitor
@natanael.bsky.social

They have to port drivers to much newer kernels which is very painful if the hardware OEM no longer offers support. Or backport security fixes to the newest kernel that were supported, also a ton of work. If they skip that it will leave permanent security holes

Tex Eckerle
@mattexx.bsky.social

I know next to nothing about android dev, but seems like someone with access and the right USB cable could reflash the OS, assuming they had the system creds?