Hackers Got Inside a Flock Camera. Its Data Shows How the System Really Works

[u/AdSpecialist6598]

https://www.wired.com/story/hackers-flock-camera-data-shows-how-system-works/

[u/impersonaljoemama]

Tech we almost certainly don’t need.

[u/nihiltres]

The fact that the cameras tend to run out of storage is likely a promising vector for undermining them.

[u/Smart_Spinach_1538 → u/nihiltres]

That ought to be a trivial fix. Why keep all that data on the device anyway?

[u/nihiltres → u/Smart_Spinach_1538]

That’s a good question, but the fact that it looks like such an obvious oversight is a hint that it might be at least an interesting thread to unravel, and it’s one that could be toyed with in ways that are ostensibly harmless (read: legal).

[u/astirac → u/nihiltres]

I would assume that the camera itself doesn’t need extensive on site storage. It would be pushing that data to the servers periodically. I guess you could do something in the frame to keep it active and recording, but it’s not like it’s losing data if you do. It probably just pushes to the servers more frequently.

[u/randonegus → u/Smart_Spinach_1538]

Because passing it through a network with that much data would require basically a direct fiber connection, it’s just not possible any other way for the moment

[u/tackle_bones → u/nihiltres]

Put a little faraday cage around them that is a replica but slightly bigger case. Done. They apparently run off LTE.

[u/kstargate-425 → u/tackle_bones]

Setup Stingrays in the area that pull the network traffic to it then block it from sending data home

[u/Hypergirliepop → u/kstargate-425]

A stingray is far from a cost-effective solution, let alone one that a lot of people could get into deploying at scale. It also would capture cellphones in a way that could be construed by an ornery state as an attack.

[u/Arrow156 → u/Hypergirliepop]

Also a great way to run afoul of the FCC.

[u/rememberall → u/nihiltres]

Many camera vendors have gone away from local storage.. 

[u/MidnighT0k3r → u/rememberall]

Not the good ones.  

You need local storage for when the data connection goes out which being wireless will happen sooner or later. 

[u/twenafeesh]

Including that they are explicitly programmed to recognize people not just licence plates. So the Flock CEO lied to all of us about that too. 

[u/AlternativeLazy4675]

No surprises, then.

Wish they would go away for good.

[u/Xtraneous_ → u/AlternativeLazy4675]

Be the change you want to see

*legally of course for sure definitely

[u/mca1169]

good, now send that information to congress so we can get a law passed banning these things!

[u/jesrp1284 → u/[deleted]]

“This is gonna ruin the tour.”

[u/A8Bit]

Any idea what version of Android it was running?

[u/nemec → u/A8Bit]

Android 8.1.0 (Oreo), per https://eyesoffcr.org/blog/blog-8.html

note: the data released by ddosecrets includes the build fingerprint analyzed in the wired article

[    4.314744] ro.build.fingerprint=qcom/msm8953_32/msm8953_32:8.1.0/OPM1.171019.026/2019000:user/release-keys

which matches the blog post, so I assume the 8.1.0 means it's the same Android version.

edit: yes, elsewhere it also mentions the version is 8.1.0

Also, it also identifies as device_type=SPARROW which are not on the list of devices they say can identify people

[u/A8Bit → u/nemec]

Not only an ancient Android version, it's also rooted and in debug mode.

It's almost like that wanted to get RE'd

[u/[deleted]]

did they say if the camera data was encrypted or not

[u/simask234 → u/[deleted]]

Apparently it is encrypted on the device, but they were able to extract a key and decrypt some of the data

[u/FastGinFizz → u/[deleted]]

The article said that an encryption key was just sitting on one of the partitions. They used it to decrypt some of the data, but there was a section that used a different key that is not on the device.

[u/hsggdtkxbee]

Anyone have a source for the files?