Flock cameras are even more vulnerable than we thought

Last week I covered how a hacking collective referring to itself as stegan0gram not only stole a Flock license plate reader camera but accessed its internal data. While much of the data was encrypted, as first reported by 404 Media and Wired, the hackers were able to find an exposed encryption key inside the camera’s storage that granted them access to thousands of videos and images of vehicles.

I was able to view some of those images for my reporting after stegan0gram provided the data to the nonprofit leak archiver DDoSecrets, which made the hacked data public. But after I published my story, renowned cybersecurity researcher and journalist Micah Lee dug into the software that runs Flock cameras. Micah agreed to speak with us about his findings.

Micah, if you don’t know, is a pretty legendary figure in the world of cybersecurity. He helped whistleblower Edward Snowden secure his communications when he was leaking NSA documents to journalists back in the early 2010s. He also builds tools to help journalists, activists or anyone else, for that matter, securely communicate and share documents in our increasingly surveilled world.

Well, Micah found that the stolen Flock camera had been running an outdated version of the Android operating system from 2017. The camera hadn’t received a security update in eight years. That means anyone could go online and find all the publicly listed vulnerabilities affecting the camera. Just one of those vulnerabilities would allow an attacker to take full control of the camera.

“I’m not surprised that Flock firmware is full of vulnerabilities,” Micah told me. “They’re just interested in creating and taking over a new market, not in creating a secure product. It’s obvious that they’ve never paid for a professional security audit.”

Micah also found credentials hardcoded in the camera’s storage that he believes would allow an attacker to interact with Flock’s servers. This could potentially give attackers a foothold to hack deeper into the company.

“With the hardcoded credentials, a hacker can basically impersonate a Flock camera inside Flock’s production infrastructure,” Micah said. “They can register as a camera, submit GPS coordinates and media, and things like that.”

“But more importantly, if Flock’s server code is as s— as its camera firmware, which I suspect it is, then they might be able to do anything: send commands to shutdown all Flock commands, delete all the data Flock stores, download it all and leak it on the internet, or anything else,” Micah continued.

Surveillance companies ask us to trust them with our private data and constantly reassure us that they “take security seriously.” In fact, in a statement to 404 Media and Wired, Flock said exactly that.

But the fact that Flock is not updating the software on at least some of its cameras, arguably the most basic and important step in securing any device, raises serious questions. This also reminds me of when another security researcher discovered that live feeds from Flock’s cameras were found openly exposed and streaming on the internet.

With more than 120,000 Flock cameras in 49 states, it only seems a matter of time before more serious exposures occur.

What I’m reading

• Irish privacy regulator fines Google €403 million over location data processing: Reuters reports that Google has been fined €403 million, or $463 million, by Ireland’s Data Protection Commission (DPC) following an inquiry into its processing of location data. The DPC said Google failed to properly inform users that their location was being used to, among other things, “influence them with ads or to infer their interests.”  
• Flock Offers Employees Buyouts as Customers Flee: Wired breaks down how the surveillance company Flock Safety has rolled out a voluntary employee separation program. The program comes amid widespread backlash against the company over its license plate reader cameras.
• Cybercrime feud erupts on dark web as notorious group claims hijack of rival’s website: Reuters breaks down the latest in the ongoing feud between the cybercrime groups ShinyHunters and cl0p. ShinyHunters says it hacked cl0p’s site on the dark web in response to the group’s alleged theft last year of a powerful software exploit.  

What do you want to know?

In last week’s Confidential Informant newsletter, I explained how I was recently hung up on after calling an individual to inform them that they’d fallen victim to hackers. I then asked readers what they think journalists could do to prevent such a scenario, as making such calls is a common occurrence when reporting on hacked and leaked data. While I do my best to introduce myself and explain the situation as quickly and succinctly as possible, here are some of the suggestions readers made.

Mary from Wisconsin said I should send the individuals a selfie while holding up my press credentials prior to making the call. Wayne in Virginia suggested having an editor reach out first who would encourage the hacking victim to call Straight Arrow’s headquarters to confirm the story. And a reader going by the name Tricky Ricky in “Commiefornia” (I’m going to assume that’s California) said I should send the victim “lots of money” first. Not so sure about that last one, but overall, great suggestions!

That’s all for this week. If you have a question you’d like me to answer about privacy, send me an email at mthalen@san.com, reach out on Signal at @mikaelthalen.12, or share it below. I’ll keep all your personal details private.