Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Got Inside a Flock Camera

wired.com

Post reply on HN
Print view View original

91–100 of 267 posts

Re: Hackers Got Inside a Flock Camera

#91

Post by zzzeek »

nullable_bool wrote: post #49
zzzeek wrote: post #36

If I had to guess now it works it would be: 1. Take pictures 2. Send to a big server that all cops nationwide can log into whenever they want to stalk their exes Did I miss something

The system they log into is called DAVID(Driver and Automobile Information Database) which logs activity. If an officer access that information for unlawful purposes, they can be prosecuted. You probably wont believe it, but the reason you hear about cops stalking their ex's is because they got caught doing so.

emphasis on "can"

Re: Hackers Got Inside a Flock Camera

#92

Post by Arrowmaster »

tyrabound wrote: post #83
incee wrote: post #48

Earlier quoted context omitted.

3.18.71-perf-gaf770dc is a Qualcomm Android vendor kernel from roughly late 2017. The 3.18 branch went fully EOL in 2019, so nothing after that was ever backported to it.

2017 was also the year Flock was funded and founded and went through the YConbinator cohort. But you would have thought that by 2021 when Andreessen Horowitz funded them or at least by 2025 [1] when both further funded them, someone would have actually done some minor due diligence. Coincidentally too, 2025 was when the flock surveillance matrix went up all over the country almost immediately. We constantly hear that…

It's almost as if they paid a contractor to design the hardware back in 2017 and put all the funding into marketing(bribes) since then. Shocker.

Re: Hackers Got Inside a Flock Camera

#94

Post by megous »

fullstop wrote: post #66
megous wrote: post #32

Earlier quoted context omitted.

I'm in the process of optimizing a bootolader for my various SoC/SBCs and even the cheapest, oldest least powerful SoC from 15 years ago can manage AES-CBC via crypto accelerator at 50 MiB/s. There's no excuse.

You can achieve 50MiB/s if that's all that you're doing. I've worked with some DSPs (TI's DaVinci line) where some operations would abort if DDR was overwhelmed. For example, passing a frame of video (YUV) into the peripheral which can resize the overall image, would fail if the system was busy with other DMA transfers. You could attempt to resize again, but there were no guarantee that it would complete successfully…

They can choose the SoC that would be able to fill the requirements. Eg. almost all Rockchip SoCs have NoC with configurable QoS on master ports (even the cheapest IP camera targetted SoCs that cost like 2-3$), or some other interconnect mechanism that can make it so that SDRAM controller gets tasks in some user selected priority order (eg. you deprioritize CPU in favor of camera interface and other things). This is not a new tech. It already existed when Flock was founded.

And in any case. Passing compressed video streams or pictures through HW encryption engine will not saturate 1.5+ GiB/s or whatever even the lousiest 16-bit DDR3 at 400MHz would give you, not even close. It would be like a fraction of a percent of total bandwidth.

Re: Hackers Got Inside a Flock Camera

#95

Post by killbot5000 »

This is pure laziness aka “reduced time to market” on the part of Flock.

It takes time and effort to think through proper secure boot architecture and to implement key management in a way that doesn’t kill developer productivity.

Their product managers, though, should have realized that setting these up in unsecured public spaces means that their threat model really does include local physical access to everything.

Using off the shelf hardware and software stacks all but guarantees attackers have tools at their fingertips to exploit said physical access.

Given all the recent exploits hitting the kernel, there’s a good chance that there exists an exploitable over-the-air vulnerability present in their WiFi/bluetooth stack, too.

Re: Hackers Got Inside a Flock Camera

#96

Post by mring33621 »

writtenone wrote: post #43

A friend in China built a Flock overlay network that sends live video and audio from ~100 cameras near me to an AWS server for processing and search.

This is one of the most interesting comments on here.

Hints at unauthorized, illegal mass surveillance riding on top of authorized (but also possibly illegal) mass surveillance

Re: Hackers Got Inside a Flock Camera

#97

Post by Obscurity4340 »

Quinner wrote: post #80
glaslong wrote: post #46

Earlier quoted context omitted.

Yep. Clown show. > The hackers said they were able to access the Android system on the camera, and found two partitions—sections of its hard-drive, essentially. A few of these were unencrypted, the hackers said, including one called “vendor” and another called “media.” The latter contained an encryption key that unlocked another part, which contained much of the media—think, the videos and stills—the camera took. > I…

How could anyone possibly physically access a device that is just sitting out in public?

Its impossible, I tell ya

Re: Hackers Got Inside a Flock Camera

#98

Post by runjake »

drfloyd51 wrote: post #9

So… all that data is literally there for any unauthorized person to walk up and take it. It’s not even suitably encrypted on device? Zero trust in anything Flock says.

My working assumption based on what I hear out of Flock is that they have a public feature set (mass license plate surveillance for LEO) and a covert feature set (even more mass surveillance, beyond license plates and privacy agreements, for intelligence communities).

Re: Hackers Got Inside a Flock Camera

#99

Post by fullstop »

samudrijan wrote: post #84
fullstop wrote: post #67

Earlier quoted context omitted.

Why? Does Flock really care about encryption? It checks off a box for their sales team, even if it's done poorly.

Because data should be secure. Full stop.

In a perfect world, yes, but this is a for-profit company and there's almost zero repercussion for doing it half-assed. They'd have to pay someone to implement it, and deal with the overhead and complexity.

Now they are in a position where they can sell new models with enhanced encryption and more features.

Re: Hackers Got Inside a Flock Camera

#100

Post by antonvs »

xnx wrote: post #73
drfloyd51 wrote: post #9

So… all that data is literally there for any unauthorized person to walk up and take it. It’s not even suitably encrypted on device? Zero trust in anything Flock says.

> all that data is literally there for any unauthorized person to walk up and take it. All that data about ... license plates if you're willing to steal/damage private property. Seems like it would be a lot easier to setup your own ALPR.

You don't think that because it's called a "license plate reader," that it only captures license plates, do you?

Flock cameras capture the make, model, color, and body style of vehicles. They capture bumper stickers and other decals, as well as potentially identifying dents and scratches. They capture accessories like roof racks, bike racks, trailers, and toolboxes.

The OP story covers some of this. There's more at:

https://www.aclu.org/campaigns-initiatives/get-the-flock-out

https://www.nytimes.com/2026/08/10/us/flock-cameras-can-trac...

Post reply on HN