Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Got Inside a Flock Camera

wired.com

Post reply on HN
Print view View original

161–170 of 270 posts

Re: Hackers Got Inside a Flock Camera

#161

Post by lenerdenator »

vayup wrote: post #105

If you want to know what a "Vulnerability Disclosure Policy" (VDP) would look like if its main purpose is to claim we have VDP and create an appearance of responsible security posture, but not really to learn about vulnerabilities - read Flock's VDP. They sincerely welcome your vulnerability disclosures, except in cases where you have to "interact" with the device/service or download its data. Other than that TINY ca…

It'd be interesting to know how much of that they put second to "Americans seem to like using our hardware as targets for firearms, reciprocating saws, spray paint, and garbage bags" in their list of corporate concerns.

Re: Hackers Got Inside a Flock Camera

#162

Post by mmooss »

antonvs wrote: post #90
bdangubic wrote: post #75

Earlier quoted context omitted.

so is my all-passwords.txt file on my desktop

My passwords are in an encrypted block in a text file that can be unencrypted inline in an Emacs session with a keystroke sequence that looks like a cat just chased a mouse across the keyboard, and that's before entering the decryption password. To access it, an attacker would first have to learn Emacs. Pretty sure that's a post-quantum level of security.

They could use an LLM to lookup your HN posts and then to wrangle Emacs. Or just decrypt the text in another application - I doubt Emacs is the only platform for whatever crypto method you use. M-x rot13 ?

Re: Hackers Got Inside a Flock Camera

#163

Post by tEem21 »

Grimeton wrote: post #147
petcat wrote: post #39

> According to our analysis, the camera’s logs recorded about 21 days of activity across several periods. During those windows, the device photographed roughly 50,200 vehicles and generated about 1.6 million images. On a typical day, it logged around 3,300 vehicles, with a high of 4,454. Has there been any report about which state this camera was recovered in? New Hampshire has a strict 3 minute rule for non-hit plat…

The images were deleted the moment they were uploaded. But the record in the log files persisted. The camera doesn't have enough memory to store that many data.

This does not seem to be the case. 404media's article includes extracted (redacted) images

Re: Hackers Got Inside a Flock Camera

#164

Post by petcat »

Grimeton wrote: post #147
petcat wrote: post #39

> According to our analysis, the camera’s logs recorded about 21 days of activity across several periods. During those windows, the device photographed roughly 50,200 vehicles and generated about 1.6 million images. On a typical day, it logged around 3,300 vehicles, with a high of 4,454. Has there been any report about which state this camera was recovered in? New Hampshire has a strict 3 minute rule for non-hit plat…

The images were deleted the moment they were uploaded. But the record in the log files persisted. The camera doesn't have enough memory to store that many data.

> The images were deleted the moment they were uploaded.

???

> VIII. Records of number plates read by each LPR shall not be recorded or transmitted anywhere and shall be purged from the system within 3 minutes of their capture [...]

But you're saying that these non-hit image captures were uploaded somewhere?

Re: Hackers Got Inside a Flock Camera

#165

Post by Grimeton »

dpkirchner wrote: post #148
Grimeton wrote: post #142

All these cameras do is pre-select the images that are worthy uploading. Everything else happens at Flock. That's why they don't give anything about the camera's security. The images are all from a public place, so no privacy expectations and what's theworst that could happen? Someone uploads their cat images or the pr0n collection? Ai figures that one out rather quickly.

Assuming the point of these cameras is security (and not just surveillance for stalker cops), being able to upload replacement footage would subvert that entirely. This has been a feature of many spy and cops/robber movies.

The point of these cameras is to deliver as many images of good quality as possible that show something of interest like a person, a car's numberplate and so on.

I almost guarantee you, if the camera even has a SIM-Card then it's pre-configured with all the necessary information to find and join the mobile core network via APN.

It turns on, joins the core network, gets handed an ip address and additional information like a servername/ip as its reporting endpoint, establishes the connection and starts taking pictures that it then sorts out and uploads.

That's pretty much it. No login credentials, no complicated protocols, nothing. The things is identified via IMEI, Mac or some other burned in "serial" and that's all that's necessary to make it happen.

So there are no credentials that could get lost, no technology that would be worth anything, access is being controlled on the network side and the images that are being taken are from a public place with no expectation for privacy.

The core system only has to be secure enough so that it doesn't get hacked via an open bluetooth tty or something and everything else is handled by the network it belongs to. That's why DNS manipulation and similar stuff doesn't get you anywhere.

Besides that, it has to be cheap and doesn't have to adhere to any security standards whatsoever. It's a pole with a mini camera and a solar cell that can just be vandalized by the next person that shows up.

Re: Hackers Got Inside a Flock Camera

#167

Post by QuiEgo »

teraflop wrote: post #130
killbot5000 wrote: post #95

This is pure laziness aka “reduced time to market” on the part of Flock. It takes time and effort to think through proper secure boot architecture and to implement key management in a way that doesn’t kill developer productivity. Their product managers, though, should have realized that setting these up in unsecured public spaces means that their threat model really does include local physical access to everything. U…

The flip side of this laziness is that now, when my elected representatives tell me "these are just license-plate readers that don't record video", I have evidence to show them that's false. If Flock had done a more competent job of securing their system, it would be harder to demonstrate this in a compelling way. To a technically-inclined person, it's obvious from the get-go that somewhere in Flock's pipeline, video…

Don’t worry, your elected representatives won’t be bothered by trivialities such as facts either way.

Re: Hackers Got Inside a Flock Camera

#168

Post by fullstop »

cucumber3732842 wrote: post #63
wl wrote: post #33

Earlier quoted context omitted.

Also, a reminder that ALPR abuse predates Flock. Flock has just made it more visible. About a decade ago I personally heard a cop let it slip that he had plate-stalked someone for the crime of saying mean things about his department on Twitter. The difference today is that more departments have access to these kinds of tools. Fixed ALPRs aren't the only privacy problem, either. Many tow trucks have roving ALPRs that…

I work in a different embedded space but our keepalive heartbeat messages have a payload of <3

Man, ours is just '\0'.

Re: Hackers Got Inside a Flock Camera

#169

Post by dyauspitr »

dietr1ch wrote: post #129
killbot5000 wrote: post #95

This is pure laziness aka “reduced time to market” on the part of Flock. It takes time and effort to think through proper secure boot architecture and to implement key management in a way that doesn’t kill developer productivity. Their product managers, though, should have realized that setting these up in unsecured public spaces means that their threat model really does include local physical access to everything. U…

I really hate how Product Managers somehow get to take the reins of engineering teams instead of having to sell them product ideas. It's madness, they often lack the technical skills and "optimise away" requirements surfaced by eng teams they don't comprehend or just don't like having to deal with.

That’s because computers are Turing complete anything is technically possible and comes down to the time quality cost triangle. Most management thinks they can optimize that triangle by squeezing the living bejesus out of their teams.

Re: Hackers Got Inside a Flock Camera

#170

Post by ipdashc »

vayup wrote: post #105

If you want to know what a "Vulnerability Disclosure Policy" (VDP) would look like if its main purpose is to claim we have VDP and create an appearance of responsible security posture, but not really to learn about vulnerabilities - read Flock's VDP. They sincerely welcome your vulnerability disclosures, except in cases where you have to "interact" with the device/service or download its data. Other than that TINY ca…

This looks like a pretty reasonable policy to me all things considered. And no, I'm no fan of Flock. But they do run security cameras for the cops, they can't just say go ahead, go wild on all our customers' cameras. The lawyers would throw a fit.

The carveouts for stuff like configuration and DNS are entirely reasonable. Have you ever been behind a security@ email before? You get a lot of BS reports of that sort.

Post reply on HN