Hackers Stole Flock's Camera Software, Revealing How the Company Tracks Cars and People (404media.co)
- Reference: 0185677016
- News link: https://yro.slashdot.org/story/26/09/17/0517235/hackers-stole-flocks-camera-software-revealing-how-the-company-tracks-cars-and-people
- Source link: https://www.404media.co/hackers-stole-flocks-camera-software-revealing-how-the-company-tracks-cars-and-people-2/
Though Flock has [3]described its system as protected by on-device encryption, "The hackers were able to copy the camera's storage and recover an encryption key stored on the device, which unlocked videos of thousands of vehicle detections."
> The hackers shared the material with 404 Media and the transparency nonprofit [4]Distributed Denial of Secrets , which shared the data with WIRED. 404 Media and WIRED then analyzed those files as part of a joint investigation... [T]he joint analysis of the recovered data shows that software running on the device explicitly detects people as well as vehicles, license plates, and bicycles. The camera can produce dozens of images of a single passing vehicle and, according to several weeks of recovered logs, generated more than a million images. Its computer-vision software also sometimes isolated bumper stickers and other graphics, including, in one case, an American flag patch on a motorcyclist's saddlebag...
>
> According to our analysis, the camera's logs recorded about 21 days of activity across several periods. During those windows, the device photographed roughly 50,200 vehicles and generated about 1.6 million images. On a typical day, it logged around 3,300 vehicles, with a high of 4,454... The software running on the camera explicitly detects people, something [5]which is typically overlooked in discussions around Flock cameras. When it spots a person, it records where they appear in the image and how confident it is in the detection.
It was a collective calling itself stegan0gram that breached the cameras, according to the interview they did with Wired and 404 Media. "Why just destroy them when we can reverse engineer them and find the secrets of those spying on us?"
[1] https://www.404media.co/hackers-stole-flocks-camera-software-revealing-how-the-company-tracks-cars-and-people-2/
[2] https://www.wired.com/story/hackers-flock-camera-data-shows-how-system-works/
[3] https://www.flocksafety.com/faq
[4] https://en.wikipedia.org/wiki/Distributed_Denial_of_Secrets
[5] https://www.404media.co/how-cops-use-flock-to-track-people-not-cars/
Adversarial patterns FTW! (Score:2)
Aside from giving us solid data on how badly Flock is behaving vs what they claim, there's one extremely useful detail this dump reveals: Flock sucks at correctly identifying the interesting parts of its targets.
Time to absolutely wallpaper the front and back of our cars with bumper stickers that look like faces and license plates. Let 'em burn police time chasing down "8008135" stickers to the point nobody even checks the alerts anymore.
Re:Adversarial patterns FTW! (Score:5, Interesting)
I don't think that's what this means, though I'm not creating an account to read the full article. It identifies marks like bumper stickers in *addition* to the license plate. So even if you miss the plates (or the suspect changes plates), you can identify it by other means. This would be like identifying a person by tattoos when you can't get a good photo of their face.
Re:Adversarial patterns FTW! (Score:4, Insightful)
Automated detection of political identify through bumper stickers?
Re: (Score:2)
> Automated detection of political identify through bumper stickers?
Probably, yes.
Re: (Score:1)
For when an officer wants to search for people with stickers he doesn't like...
Re: Adversarial patterns FTW! (Score:2)
So no matter what they don't like, you still come up? Doesn't sound fun to me
Re: (Score:2)
If you are dumb enough to advertise everything about yourself through bumper stickers, don't be surprised when...
Re: Adversarial patterns FTW! (Score:2)
That's why I don't advertise my politics on my truck. If the wrong people in government found out that I am for a constitutional republic with elected representation and a system of checks and balances with three coequal branches of government, I would surely be labeled as an agitator, a far left radical, and perhaps even a terrorist.
Re: (Score:2)
I'm not suggesting that as a way to specifically avoid detection; rather, as a way to poison the data with 99% irrelevant matches. We all know the [1]relevant XKCD [xkcd.com], but there's more options than a sawzall to fight back.
As an aside, the full Wired article is freely available. I can't say if there's any additional information in the 404 Media version (because I'm also not signing up), but the Wired writeup is pretty solid.
[1] https://xkcd.com/1105/
Re: (Score:3)
> I'm not suggesting that as a way to specifically avoid detection; rather, as a way to poison the data with 99% irrelevant matches.
Your plan to "absolutely wallpaper the front and back of our cars with bumper stickers that look like faces and license plates" just makes your car even more uniquely identifiable. You're a complete fucking idiot.
Re: (Score:2)
Do you understand people are being pulled over at gunpoint for false matches on Flock?
To repeat myself for the hard of thinking, "I'm not suggesting that as a way to specifically avoid detection". There's no practical and legal way to really "hide" while driving a car you own on public roads. I have no interest, positive or negative, in whether or not Flock helps catch actual criminals - That detail is completely irrelevant to the fact it's a blatant end-run around the fourth amendment.
Sure, the local p
Re: (Score:2)
The more you type, the dumber everyone else gets.
Re: (Score:2)
Back in the '90s I was chatting with a skript-kliddie who actually had an AOL logon like that. He figured that none of the CS drones could type it in right to nuke his account. You should have seen his face when I said the magic words: "copy and paste."
Re: Adversarial patterns FTW! (Score:2)
It won't help in any way because the pictures are sent home for more processing.
Re: (Score:2)
Honestly, AI technology has gotten good enough that those types of things won't fool it anymore. Captchas take longer for a human than it does for an AI model with vision, and the human is more likely to make a mistake.
The point is, sure, their system may suck right now, but if adversarial patterns became common, they're a model update away from fixing it. Might need better hardware on the device, so at most you'll cost them some money, but it won't get us our privacy back.
Re: (Score:3)
I think you'd want panel on your car that are like e-ink screens. While you can't change your license plate, what if you could change the color of your car? What if you car had different bumper stickers in different locations for each Flock camera? Constantly evolving patterns, and maybe patterns shared between vehicles, seems like a good adversarial approach. Attack their assumptions.
Re: (Score:2)
Don't. Even when adversarial patterns work against one algorithm right now, they won't work against the next, but make you more recognizable. Each adversarial attack in neural networks is tailored to one specific network and does not affect others. Most the time it is also not simple to combine two attacks so both work, but you still won't fool a third iteration of the detection network anyway. So do you want to be the only person with five fake license plates? You become so easy to recognize even when your
Why aren't we talking about it? (Score:3)
> The software running on the camera explicitly detects people, something which is typically overlooked in discussions around Flock cameras.
Membership required to read the linked article, no thank you.
While it sounds like it's not necessarily facial recognition, how long until they start normalizing CCP / Minority Report level facial recognition and identity tracking?
I'm glad there's some political and cultural pushback but it still smells like boiling frogs.
Re: (Score:3)
> I'm glad there's some political and cultural pushback but it still smells like boiling frogs.
Make noise.
Enough people in my town gave negative comment to the board of supervisors that they rejected Flock cameras.
Re: (Score:2)
They've already had facial recognition tech deployed in airports for years now. No CCP boogeyman required!
Re: (Score:2)
Do you pay everywhere with a card? That ship has sailed, now they will just also know the route you drove to use that card at seven-eleven while on the way to your therapist.
Re: Why aren't we talking about it? (Score:2)
I do as far as you know.
New business opportunity (Score:2)
Anti-Flock patch. A small electronic screen patch that plus into your tail lights and attaches to your trunk.
Each day it randomly picks one of 900 different images to display. It includes things like bumper stickers, dents, grafiti, etc.
Every car that gets the device comes with the same 900 images, but it can receive updates so if Flock begins to recognize the images, they can change to a different set of 900 images.
Re: (Score:1)
Why not a screen or cover for your license plate that activates and obscures it when within a certain distance of any known Flock camera. Make it appear as to be something innocent, e.g. mud, so it looks like an accidentally obscured tag.
Re: (Score:2, Insightful)
> Why not a screen or cover for your license plate that activates and obscures it when within a certain distance of any known Flock camera. Make it appear as to be something innocent, e.g. mud, so it looks like an accidentally obscured tag.
Unfortunately that give the police a reason to kill you.
Re: New business opportunity (Score:2)
They don't need a reason.
I was going to say it's an excuse instead, but they don't need that either
Re: (Score:2)
Will the old trick of outlining your license plate with a bunch of high power IR LEDs obscure your plate from the camera, while still allowing human eyes to read them....?
Re: (Score:3)
That would be a temporary solution, but competitors of Flock are already using fingerprints from your car based on Bluetooth from infotainment, built-in modem for updates and telematics, and even your TPMS sensors which broadcast unique IDs. In addition to that the fingerprints can contain info from your phone (Wifi, Bluetooth, RFID, cellular modem) and other wireless devices such as headphones and AirTags. Apparently this is already available in a product known as Leonardo. Looks like it's time to build
Re: (Score:2)
> That would be a temporary solution, but competitors of Flock are already using fingerprints from your car based on Bluetooth from infotainment, built-in modem for updates and telematics, and even your TPMS sensors which broadcast unique IDs. In addition to that the fingerprints can contain info from your phone (Wifi, Bluetooth, RFID, cellular modem) and other wireless devices such as headphones and AirTags. Apparently this is already available in a product known as Leonardo. Looks like it's time to build a Faraday Cage around my vehicle.
Sounds like th epublic needs an OSS version of Leonardo to even th eplaying field and track police and elected officials...
Flock/Antiflock (Score:2)
It seems to me every business level security camera has these AI features now. Everyone focuses on just Flock while overlooking what the entire industry is doing. Cyberpunk is slowly becoming reality.
Obvious course of action - watching the watchers. (Score:4, Funny)
> "Hackers ripped down a Flock camera above a roadway, ...
Flock will install camera cameras to watch their traffic cameras.
Re: (Score:2)
>> "Hackers ripped down a Flock camera above a roadway, ...
> Flock will install camera cameras to watch their traffic cameras.
mounted on drones
Re: (Score:2)
>> "Hackers ripped down a Flock camera above a roadway, ...
> Flock will install camera cameras to watch their traffic cameras.
I hope they need camera camera cameras too.
Re: Obvious course of action - watching the watche (Score:2)
A three camera cluster should do - any one goes off line the other two can still coordinate laser fire.
Re: (Score:2)
> A three camera cluster should do - any one goes off line the other two can still coordinate laser fire.
Now that is thinking like a true public safety official!
Re: (Score:2)
>>> "Hackers ripped down a Flock camera above a roadway, ...
>> Flock will install camera cameras to watch their traffic cameras.
> I hope they need camera camera cameras too.
It'll be Turtles All the Way Down. :-)
Re: (Score:2)
It'll be Turtles All the Way Down. :-)
I wonder what Great A'Tuin thinks about that.
Re: Cops stake out Flock now too (Score:1)
So, as always, be careful, such as not being someone who has much to loose yet.
Security LOL !!! (Score:5, Insightful)
It's funny that the camera protects data on device by encryption, but also keeps a copy of the private key there. You only need the public key to encrypt. The private key is supposed to be kept in their infrastructure for decryption when needed. I guess they've never heard of physical security.
Re: (Score:2)
I got the impression they were only using a single key, not dual key encryption.
Minimal hardware requirements. (Score:2)
The Flock hardware requirements stood out to me. The hackers said that Flock software could run on a mid-range phone. This suggests that malware with Flock capabilities (and a little better data discipline) could hide on a high-end phone. Flock-like malware could easily hide on a modern laptop.
Re: (Score:2)
Someone told me once that the hardware in there is [1]this mediocre Android dev board [lantronix.com] with a little additional panopticon gear bolted onto it. So yeah, definitely in the "Free phones handed out in front of Walgreens" territory.
Not sure what would be the utility of running that sort of software on an individual endpoint machine, there's already much better malware intended to run on those. But it does point out the ease with which a sufficiently motivated actor can roll out an impressive surveillance grid wit
[1] https://www.lantronix.com/resources/case-studies/flock-safety/
Single key encryption? (Score:2)
With the key recoverable on the device?
Fucking amateur hour!
Re: (Score:2)
Did we really expect more from the company that also left a lot of its devices searching for WiFi APs with predictable SSIDs and passwords, then offering an ADB port? Or, for those that weren't actively connectable, requiring pushing the exposed power button on the back with a stick to make them connectable?
Startup culture, move fast, break things -- preferably someone else's things.
Did they try to inject image data? (Score:2)
Did they try to inject image data? Wouldn't it be funning to insert images of Putin, Kim, Washington, and Lincoln?
roads (Score:2)
They are pointed at roads - so the responsible thing to do is to drive across peoples' back yards
And bicycles (Score:2)
Well now, Flock is back in my good graces. We've got to wipe all those Pee-Wee Hermans off the face of the planet.
How hackers got inside a Flock Camera (Score:4, Informative)
[1]Hackers Got Inside a Flock Camera. Its Data Shows How the System Really Works [justpaste.it]
[2]Wired [wired.com]: “The hackers said they were able to access the Android system on the camera and found two partitions—sections of its hard drive, essentially. A few of these were unencrypted, the hackers said, including one called “vendor” and another called “media.” The latter contained an encryption key that unlocked another part, which contained much of the media—the videos and stills—the camera took.”
“In early 2025, security researcher Jon “GainSec” Gaines reverse engineered a Flock license-plate reader and documented flaws that could be used to gain root-level access. After Gaines disclosed his findings, the company acknowledged the findings but downplayed their severity, writing that the flaws required physical access to the device and that even someone who gained access to a camera “would still not be able to gain access to footage,” because images remained on the device only briefly after being transmitted to the cloud.”
[1] https://justpaste.it/gluh7
[2] https://www.wired.com/story/hackers-flock-camera-data-shows-how-system-works/
Endpoints (Score:1)
Those systems may reveal more about the endpoints used by the cameras to upload the data, as well as the IP addresses being used by the street-cameras. Those remote endpoints (likely in a cloud) can be better analyzed/targeted than a single flock instance.
They'll be branded as AntiFA (Score:1)
and deported if caught
Re:They'll be branded as AntiFA (Score:5, Insightful)
Enemies of the Surveillance State