A hacker collective called stegan0gram took down a Flock Safety camera installed above a US road, copied the entirety of its internal storage, and handed the files over to American outlets 404 Media and Wired. Flock, for context, equips American police with automatic license plate readers, with more than 120,000 cameras spread across some 6,000 cities.
Inside, several storage areas (partitions, in tech jargon) weren’t encrypted at all, and one of them contained, sitting there in plain text, the key that was supposed to protect the recordings. In other words, the lock and the key stored in the same box.
On the data side, it’s a bloodbath: more than 27,000 video clips of one to two seconds each, 1.6 million images accumulated over three weeks, all corresponding to roughly 50,000 vehicles. An average car triggers 28 photos per pass, and some go over a hundred.
Except the machine doesn’t just read license plates. The software also picks out pedestrians and cyclists, with location and confidence score, and isolates details like a bumper sticker or the American flag patch sewn onto a motorcyclist’s bag. So you can end up in the database without ever having driven.
The camera runs on Android 8.1, a system released in 2017 and abandoned for years, with a bunch of known flaws never patched, and a hardcoded access key made it possible to retrieve information about any device on the network from nothing more than its MAC address, the camera’s network identifier.
The internal logs were overflowing with errors and crashes, along with some lovely false positives, like a flag mistaken for a license plate. For equipment sold to municipal police forces, that’s still pretty messy.
Flock, which touts built-in encryption in its communications, responded that taking down one of its cameras was illegal and that nobody had reported anything through its bug bounty program. That’s a pretty thin answer.
The timing is all the more awkward given that American cities are already cancelling their contracts over documented abuses, a police officer who tracked his ex, or searches justified by a simple “LMAO” in the log, and that two members of Congress have introduced a bill called the No FLOCK Act to withhold 10% of federal highway funds from states that don’t regulate these cameras.
In California, one city even discovered that Flock was quietly reinstalling its cameras after the contract was terminated. Nice atmosphere.
Source:
Hackaday
Click Here For The Original Source.
