Hacker News front pageDhruv Mehrotra,Joseph Cox7 min readpostmortemintermediate
Hackers Got Inside a Flock Camera
Summary
Hackers removed a Flock license‑plate reader camera, copied its storage, extracted an on‑device encryption key, and released ~1.6 M images and logs covering 21 days of operation. Analysis shows the device captures ~28 images per vehicle, detects people, and stores raw media in unencrypted partitions. License‑plate detection runs on the cloud, and the camera’s software can mis‑identify graphics as…
- Physical access to the camera yields an unencrypted "vendor" and "media" partition; the media partition contains the AES key that unlocks the bulk of stored footage.
- The device records ~28 photos per passing vehicle (up to >100), plus short 1‑2 s MP4 clips (1024×768) for any detected objects.
- On‑device software runs ~20 custom Android apps for motion detection, image capture, object classification, and upload; plate recognition is performed server‑side.
- People detection is present on the camera; test runs on extracted models found 11 motorcycle‑rider clips with person detections.
The incident demonstrates that on‑device encryption alone is insufficient when keys are stored locally, and that physical security of edge surveillance hardware is a critical attack surface. It also provides concrete data on the volume and granularity of surveillance collected by commercial ALPR sy…
6/10
