Technology and Science · updated 1h ago · 2 min read
Stegan0gram Hackers Rip Down Flock Camera, Recover Encryption Key and Unlock Person Detection Data
Hackers ripped down a Flock camera, copied nearly all its data, and shared it. Leak shows cameras track vehicles and people; encryption keys enable decrypted data.
Whether it was cloud breach or local device compromise.
11 of 12 outlets skipped it: boston stopped using Flock after finding data-sharing despite agreements.
15outlets compared
Same story, two versions
tap a side to read it in full
NeoTeo
“The Flock camera incident was a physical compromise of one deployed device, not a demonstrated breach of Flock Safety’s centralized cloud platform.”Read the original ↗
GIGAZINE
“Since Flock uses symmetric-key cryptography, the hacker was able to successfully decrypt the encrypted data with the extracted key.”Read the original ↗
NeoTeo frames it as a single-device physical compromise, while GIGAZINE focuses on decrypting data after key extraction.
Key Unlocked at the Edge
A hacker collective calling itself stegan0gram ripped down a Flock camera above a roadway, made a near-complete copy of the data stored inside it, and recovered an encryption key from the device that unlocked videos of thousands of vehicle detections.
“The hackers were able to copy the camera’s storage and recover an encryption key stored on the device”
WIRED and 404 Media reported that the recovered logs from several weeks showed the camera generated more than a million images, while the camera could produce dozens of images of a single passing vehicle.
The joint analysis described software running on the device that explicitly detects people as well as vehicles, license plates, and bicycles, and it also sometimes isolated bumper stickers and other graphics, including an American flag patch on a motorcyclist’s saddlebag.
Flock has said its cameras do not have facial recognition capabilities, and the reporting described the camera as designed to collect more than a single plate snapshot while much of the most sensitive storage remained encrypted and inaccessible.
What the Data Revealed
The recovered camera activity described by WIRED and 404 Media included that the camera photographed roughly 50,200 vehicles and generated about 1.6 million images over a 21-day period, with a typical day containing about 3,300 vehicle detections and a peak of 4,454.
In testing described in the reporting, people appeared in 11 of the 27,321 recovered short clips, and all 11 detections involved motorcycle riders.
WIRED’s investigation also found that records from a Flock camera in Alpharetta, Georgia, were accessible to more than 2,000 agencies, including police departments, colleges, airports, and the Office of Inspector General for the federal General Services Administration (GSA).
Flock’s spokesperson told The Hill that “The unauthorized removal and tampering of a Flock camera is illegal,” while the same reporting said Flock maintained a vulnerability disclosure policy and said it received no report through that process.
Network Access and Policy
The reporting said Flock’s national network allows other police departments from all over the country to search those cameras too, and it described how the system makes time-stamped records searchable by whichever local agency owns or has access to the cameras.
“local cops were performing lookups in the national network on behalf of Immigration and Customs Enforcement”
404 Media revealed that local cops were performing lookups in the national network on behalf of Immigration and Customs Enforcement, including in areas that banned working with immigration authorities or transferring license plate data out of state, and it also described a cop in Texas searching Flock cameras nationwide for a woman who self-administered an abortion.
In South Windsor, Connecticut, South Windsor Police Chief Kristian Lindstrom said, “My biggest frustration and my biggest worry are that communities are going to make decisions based on bad information,” and he described a worst-case scenario as “a series of pictures of backs of cars.”
The same WTNH report said Flock Safety representative Josh Thomas told the council that the “Our default data retention period will be seven days instead of 30 days,” while Lindstrom said South Windsor’s sharing was set to just Connecticut and that “You can’t tell who’s in that car” from the data he described.