Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Got Inside a Flock Camera

wired.com

Post reply on HN
Print view View original

111–120 of 268 posts

Re: Hackers Got Inside a Flock Camera

#111

Post by leonidasrup »

runjake wrote: post #98
drfloyd51 wrote: post #9

So… all that data is literally there for any unauthorized person to walk up and take it. It’s not even suitably encrypted on device? Zero trust in anything Flock says.

My working assumption based on what I hear out of Flock is that they have a public feature set (mass license plate surveillance for LEO) and a covert feature set (even more mass surveillance, beyond license plates and privacy agreements, for intelligence communities).

The man who would choose security over freedom deserves neither.

        -  Thomas Jefferson

Re: Hackers Got Inside a Flock Camera

#112

Post by afavour »

wat10000 wrote: post #106
killbot5000 wrote: post #95

This is pure laziness aka “reduced time to market” on the part of Flock. It takes time and effort to think through proper secure boot architecture and to implement key management in a way that doesn’t kill developer productivity. Their product managers, though, should have realized that setting these up in unsecured public spaces means that their threat model really does include local physical access to everything. U…

The question is, why should they care at all? Will this hurt their business?

Quite potentially, yes. Their name is already mud among many voters, if they're shown to be treating data insecurely then that's another reason why local governments might consider terminating contracts with them.

Re: Hackers Got Inside a Flock Camera

#113

Post by stefangordon »

drfloyd51 wrote: post #9

So… all that data is literally there for any unauthorized person to walk up and take it. It’s not even suitably encrypted on device? Zero trust in anything Flock says.

The devices are entirely open for all practical purposes - but worrying about individual cameras is silly, because they have no meaningful security at all around the API's to access all the cloud data - you can buy law enforcement credentials dirt cheap in dark web marketplaces to log in and track anyone/anywhere you want and access all footage.

Re: Hackers Got Inside a Flock Camera

#115

Post by NichoPaolucci »

wat10000 wrote: post #106
killbot5000 wrote: post #95

This is pure laziness aka “reduced time to market” on the part of Flock. It takes time and effort to think through proper secure boot architecture and to implement key management in a way that doesn’t kill developer productivity. Their product managers, though, should have realized that setting these up in unsecured public spaces means that their threat model really does include local physical access to everything. U…

The question is, why should they care at all? Will this hurt their business?

Any breach of security on a system like this is a big flashing red-alert to me.

If it could lead an attacker to get ANY of their data... Persons, places, events, etc is pretty damning stuff to be exfiltrated.

Stalking/Domestic Violence, blackmail, timed robberies, you name it... That data shouldn't really be in anyone's hands in my opinion, but in anyone's hands (good guys / bad guys) it's pretty powerful.

Re: Hackers Got Inside a Flock Camera

#116

Post by sumeno »

leonidasrup wrote: post #111
runjake wrote: post #98

Earlier quoted context omitted.

My working assumption based on what I hear out of Flock is that they have a public feature set (mass license plate surveillance for LEO) and a covert feature set (even more mass surveillance, beyond license plates and privacy agreements, for intelligence communities).

The man who would choose security over freedom deserves neither. - Thomas Jefferson

Didn’t realize Jefferson misquoted Franklin

Re: Hackers Got Inside a Flock Camera

#117

Post by crumpled »

wilburTheDog wrote: post #102

I wonder if a stingray could be used to force a software update in a flock camera. If so maybe it could brick all the flock cameras it can connect to.

Yeah, you could potentially MITM them with a rogue cell tower, I suppose. I'm curious about the researchers still having the device. They could also see all the cloud endpoints that were being accessed. Are they secure?

Re: Hackers Got Inside a Flock Camera

#118

Post by SauciestGNU »

scarecrowbob wrote: post #77
goolz wrote: post #11

Why did we not get the cool dystopia ala Gibson's Chiba City?

I remember walking over a hill into a rave in the Utah desert that we'd set up and thinking that it actually was the cyberpunk dystopia that I had been hoping for. That kind of stuff is around but maybe not evenly distributed or legible to large demographics. Unfortunately, so is the rest of the vicious horrorshow, equally illegible and equally uneven in distribution.

Interesting that you frame it as "hoping" for a dystopia. Like even in our wildest imaginations we can't envision a future where society works for regular folks.

Re: Hackers Got Inside a Flock Camera

#120

Post by crumpled »

The article says that Flock says "their cameras don't do facial recognition" The cameras don't, but they don't say the system doesn't. They don't say facial recognition isn't a click away through another integration.

I would absolutely assume that any system that sends your image to LE is part of a facial recognition system in practice. We know now that the cameras do recognize people and intentionally transmits images of them, for later identification.

Post reply on HN