If you want to know what a "Vulnerability Disclosure Policy" (VDP) would look like if its main purpose is to claim we have VDP and create an appearance of responsible security posture, but not really to learn about vulnerabilities - read Flock's VDP.

They sincerely welcome your vulnerability disclosures, except in cases where you have to "interact" with the device/service or download its data. Other than that TINY carveout, everything is okay.

Oh, if the vuln about configuration and hardening "preferences" like SSL/TSL - Sorry, not interested.

And also, infrastructure vulnerabilities like DNS config - no no, try harder.

I know what you're thinking..ha ha...but we are good guys. You can still report vulnerabilities in the above categories, but the onus is on you to convince us that we should care about them. It is only fair.

https://www.flocksafety.com/legal/vulnerability-disclosure-p...

Having hardcoded credentials is a sign of total incompetence. In this case at least it wasn't a password, but an API key which can be used to request credentials (stored in plaintext) which look like they'd get you access Flock's servers. Not quite as bad as a hardcoded admin password, and it's not clear what you'd be able to do if you did authenticate successfully as a camera, but its worrying enough. There have been enough vulnerabilities found in Flock's systems that it's pretty clear they aren't concerned about their security and it's plainly obvious that they don't care at all about our privacy or security.

Even if we decided that this level of mass surveillance on the American public was acceptable to us, Flock Safety/Flock Group as already demonstrated that they can't and shouldn't be trusted to implement it.

This is pure laziness aka “reduced time to market” on the part of Flock.

It takes time and effort to think through proper secure boot architecture and to implement key management in a way that doesn’t kill developer productivity.

Their product managers, though, should have realized that setting these up in unsecured public spaces means that their threat model really does include local physical access to everything.

Using off the shelf hardware and software stacks all but guarantees attackers have tools at their fingertips to exploit said physical access.

Given all the recent exploits hitting the kernel, there’s a good chance that there exists an exploitable over-the-air vulnerability present in their WiFi/bluetooth stack, too.

This reporting was done in collaboration with 404media. Here's the discussion for 404's article: https://news.ycombinator.com/item?id=49726577

Distributed Denial of Secrets has published the partition images: https://ddosecrets.org/article/flock-alpr-camera

So… all that data is literally there for any unauthorized person to walk up and take it.

It’s not even suitably encrypted on device?

Zero trust in anything Flock says.

> According to our analysis, the camera’s logs recorded about 21 days of activity across several periods. During those windows, the device photographed roughly 50,200 vehicles and generated about 1.6 million images. On a typical day, it logged around 3,300 vehicles, with a high of 4,454.

Has there been any report about which state this camera was recovered in? New Hampshire has a strict 3 minute rule for non-hit plate data before the captured images and records must be deleted [1].

[1] (N.H. Rev. Stat. § 261:75-b) requires ALPR systems to delete non-hit plate data within 3 minutes

The article says that Flock says "their cameras don't do facial recognition" The cameras don't, but they don't say the system doesn't. They don't say facial recognition isn't a click away through another integration.

I would absolutely assume that any system that sends your image to LE is part of a facial recognition system in practice. We know now that the cameras do recognize people and intentionally transmits images of them, for later identification.

A friend in China built a Flock overlay network that sends live video and audio from ~100 cameras near me to an AWS server for processing and search.

>At the same time, about every two minutes, code checked that the camera was still running and logged the message, “Who’s a good boy?!

All these cameras do is pre-select the images that are worthy uploading. Everything else happens at Flock.

That's why they don't give anything about the camera's security.

The images are all from a public place, so no privacy expectations and what's theworst that could happen? Someone uploads their cat images or the pr0n collection?

Ai figures that one out rather quickly.

I wonder if a stingray could be used to force a software update in a flock camera. If so maybe it could brick all the flock cameras it can connect to.

Curious how/why all this negative attention is focused directly on the Flock brand (current example notwithstanding)?

Seems like if I were a competitor of Flock I'd be pretty happy right now and all this negative press is making them artificially cheap to buyout right now.

Motorola/Vigilant, Rekor, Leonardo/ELSAG, and Axon are huge companies making mint off the same thing and no once in 20 years have I seen this level of attention... not on the overarching issue of surveillance-state-ing, but of one particular company.

I think I should start posting a reminder in Flock threads that Axon is a Flock competitor, is also engaged in mass surveillance, and is possibly even worse, but there’s rarely any mention of it. Journalists need to do some digging there. This shouldn’t just be a Flock story, or Flock will just get bought up or something and everyone will move on.

(The above should not be read as supporting Flock or discouraging further investigation.)

> The camera’s logs also show the camera struggling with storage. Its logs recorded more than 27,000 “no space left on device” errors while trying to save full-resolution images, along with tens of thousands of related errors, crashes, and reboots. At the same time, about every two minutes, code checked that the camera was still running and logged the message, “Who’s a good boy?!” More than 12,000 of those messages appear in the recovered logs.

Lol

It's surprising that an American company would forego so many common sense safety and security mechanisms just to protect their bottom line.

undefined

Title is missing "(YC S17)" after "Flock".

Why did we not get the cool dystopia ala Gibson's Chiba City?

> This camera is missing Android security updates for the last eight years.

Right. So expect thousands of Flock cameras to be hacked soon.

Possible perps include foreign intelligence agencies (Khamenei in Iran was tracked down for his assassination using Iranian traffic cams), stalkers, domestic violence perps tracking their victims, the list goes on....

More than likely though, multiple of the above.

https://i.ibb.co/WWWYznHX/flock-future.png ;-)

See also: https://dave.autonoma.ca/blog/2019/06/06/web-of-knowledge/

Interesting to note that if you don't look like a car or a person, through "adversarial fashion" or some other visual trick, your image potentially won't leave the camera and won't reach the flock cloud for further analysis.

I wonder if they were able to find any of the Bluetooth signal-data these cameras are said to be obtaining from devices within its' vicinity. This in itself is wild, im glad they're coming down around where I am

Flock is a scourge on democracy. Flock is YC. But looks like they did YC nearly ten years ago. Who knows what their pitch deck looked like? If they pivoted since then to their current sinister incarnation? I don’t see any evidence that YC is still actively supporting them.

Benefit of the doubt: Funding them for a community/city-owned traffic camera type thing seems like it would have been a much more reasonable proposition than funding Flock for their current use case of allowing police to stalk their ex girlfriends or mistresses.

The other day I was imagining that everyone can just own any device near them. I suppose this implies that we have the resources and access to a capable model

undefined

Tyranny of government invites terrorism from its constituents.

We have all heard the argument that when corporations intentionally make the legal option worse it drives otherwise law abiding customers to pirate the content instead because piracy provides a better service than paying the corporation for their kneecapped product.

I dont see how the same thing doesnt apply to governments.

The people tell you over and over they dont want to live under a surveilance police state. So natually the corporations and government work together to create a fascist police state and they expect the people to be good little slaves and simply sell their souls to their government.

Especially in the day of ai when they could just fake those images incredibly easily to frame someone. They dont need a patsy the next time they jfk someone they just find some sucker with a weak alibi from a list of potential suckers and then fake some cctv images and cell phone data and they can put you where ever they want to.

The only real defence is to buy your own body cam and document every moment of your life so you can have competing evidence.

At this point im surprised damaging the cameras is the only thing these activists are doing.

I wouldnt be surprised to see flock employees and corrupt politicians finding bombs under their cars. Which will likely be used to justify more cameras which will only intensify the terrorist activity.

The tree of liberty is long overdue for a good watering.

With that kind of protection it is guaranteed that that no Flock camera will ever be sold in Europe after december 2027... CRA et al...

I wonder what would happen if one of their customers asked for a 62443-4-2 certificate of compliance?

I feel like most of this was already known when someone here in Dallas figured out they had wifi connectivity you could connect and get access. I may not have the details exactly correct but I think someone got access then.

undefined

Really hoping some good guy hacker manages to take them all down somehow

>> Flock insists its cameras do not perform face recognition.

Probably technically true. But since the cameras detect people that makes it easier for their backend system to do face recognition.

This is SOP for IOT devices. I am beginning to think we need to regulate this stuff, because it is ubiquitous. The device manufacturers do not have a culture of security.

Next headline: Flock declares Hacker News a terrorist organization.

so when do we get it flipped to a nationwide bird migration tracking system?

as someone pointed out: let's make that "flock" name accurate

also make it identify bird song, I am sure there are microphones on there

It's always funny how such a "law and order" company not only lies through their teeth but also maliciously files false police reports. As in there's literally video evidence of them calling the police and telling the police things that are not happening.

It's also really annoying me that police departments around the nation are petulantly implying they were "forced" to do this because of lawlessness and silly-villain karens...also claiming, without the press even remotely challenging them, that they're disappointed because "we believe they work."

There literally isn't a single fucking shred of evidence that Flock cameras do jack shit, that isn't from a study Flock paid for, which heavily cherry-picked communities, particularly ones with very low crime rates where a Flock camera happened to be involved and the crime rate which was already low dropped by a couple crimes a year and resulted in a "200% reduction in crime."

1984 but stupid-mode.

And this seems designed around the assumption that the physical camera can be trusted indefinitely

Move fast and break things*

* Privacy, civic trust, society if you get a chance!

This is the end product of tech leadership taking fat rips of disruption cocaine for the last 15 years. Flock Safety got VC money so that they could build a panopticon. There is nothing surprising about the fact that they did a hack job with terrible security; the fact that their service names are various types of alcohol is beyond parody.

Oh well, at least Flock Safety's IPO will be a critical cash infusion in the pursuit of building the torture nexus so that's cool.

If I had to guess now it works it would be:

1. Take pictures

2. Send to a big server that all cops nationwide can log into whenever they want to stalk their exes

Did I miss something

What could go wrong?

if this data is public information, then why does it need encrypted secrecy, paywalls, or any kind of gatekeeping?

if the information does need to be protected from the public, then it must be private data and flock is an illegal system

[flagged]

[dead]

[dead]

[dead]

[flagged]

[dead]

[dead]

[flagged]

> "We liberated hardware"

Ya know, I'm not on Flock's side here.. but be real, this is theft. You should be able to own that if you're going to do something like this.