LobstersMicah Lee6 min readintermediate
Flock cameras are riddled with security vulnerabilities and hard-coded credentials
Summary
Flock ALPR cameras run on severely outdated Android 8.1 and Linux 3.18, missing years of security patches. Analysis of leaked firmware revealed hard-coded API keys and plaintext Auth0 credentials, allowing access to Flock's backend for any camera given its MAC address.
- Flock cameras run Android 8.1 (2017) with a 2018 security patch level, missing 8 years of updates.
- They use Linux 3.18.71 (2017), 9 years out-of-date and vulnerable to known exploits like CVE-2021-1905.
- A hard-coded API key in the camera firmware allows requesting Auth0 credentials for any camera via its MAC address.
- Auth0 client ID and secret are stored unencrypted in the /persist partition, potentially still active.
This detailed exposé reveals severe security negligence in widely deployed surveillance technology, highlighting risks to public privacy and the potential for widespread compromise of ALPR systems.
8/10
