Post

I've got a lot of work to do today but I'm getting absolutely nerdsniped by the new Flock dataset. You can download it here. It's all of the Android partitions extracted from a Flock device ddosecrets.org/article/floc...

I tracked down the very likely specific Flock camera itself. It's in Wauwatosa, a suburb of Milwaukee. Here's a photo of it from Google Street View. The GPS coordinates were in the logs

This Flock camera is running obsolete, end-of-life software. - It's on Android 8.1, released in 2017, support ended in 2021 - It's on Android patch level 2018-06-5 - It's running Linux 3.18, released in 2017 This shit is like 8 or 9 years old, and full of vulnerabilities.

HaJ3FgupAm8RrDJW3MHgT9X7Ft27eVaD What is that? That's a hard-coded API token that Flock cameras use to identify themselves and get OAuth credentials, which can then be used to talk to Flock's production servers. Like, anyone on the internet can probably do this right now.

do these things accept any kind of inbound connections?

"Flock takes security seriously and maintains a public Vulnerability Disclosure Policy for security researchers to report potential vulnerabilities directly to us. We received no report through that process" LOL indeed.

Took a moment to look at said policy. These guys are clearly pros.

AI tools are extraordinarily good at finding and exploiting vulnerabilities, this isn't a problem in itself. what's a problem is these guys are also too negligent to actually have a good enough process to catch mundane shit like this and whoever did pentesting and signed off on the build were morons

The people on this bus are probably wondering what I am laughing so hard about