Live data from Hacker News

Hackers Got Inside a Flock Camera

wired.com

31–40 of 268 posts

Re: Hackers Got Inside a Flock Camera

#31

This reporting was done in collaboration with 404media. Here's the discussion for 404's article: https://news.ycombinator.com/item?id=49726577 Distributed Denial of Secrets has published the partition images: https://ddosecrets.org/article/flock-alpr-camera

do the articles have significantly different information/coverage to warrant two submissions?

I can't read the Wired article because I'm only allowed three excerpts and 15 ads a day at Wired.com

Re: Hackers Got Inside a Flock Camera

#32

So… all that data is literally there for any unauthorized person to walk up and take it. It’s not even suitably encrypted on device? Zero trust in anything Flock says.

Is this an older model? I could see them turning off or using weak encryption on media if the hardware couldn't keep up with the amount of data they were writing.

I'm in the process of optimizing a bootolader for my various SoC/SBCs and even the cheapest, oldest least powerful SoC from 15 years ago can manage AES-CBC via crypto accelerator at 50 MiB/s. There's no excuse.

Re: Hackers Got Inside a Flock Camera

#33

I think I should start posting a reminder in Flock threads that Axon is a Flock competitor, is also engaged in mass surveillance, and is possibly even worse, but there’s rarely any mention of it. Journalists need to do some digging there. This shouldn’t just be a Flock story, or Flock will just get bought up or something and everyone will move on. (The above should not be read as supporting Flock or discouraging furt…

Also, a reminder that ALPR abuse predates Flock. Flock has just made it more visible. About a decade ago I personally heard a cop let it slip that he had plate-stalked someone for the crime of saying mean things about his department on Twitter. The difference today is that more departments have access to these kinds of tools.

Fixed ALPRs aren't the only privacy problem, either. Many tow trucks have roving ALPRs that feed into big databases. The notion is that it helps them repossess cars that might be garaged at home. That data, however, is for sale to third parties.

Re: Hackers Got Inside a Flock Camera

#34
I feel like most of this was already known when someone here in Dallas figured out they had wifi connectivity you could connect and get access. I may not have the details exactly correct but I think someone got access then.

Re: Hackers Got Inside a Flock Camera

#35
Flock is a scourge on democracy. Flock is YC. But looks like they did YC nearly ten years ago. Who knows what their pitch deck looked like? If they pivoted since then to their current sinister incarnation? I don’t see any evidence that YC is still actively supporting them.

Benefit of the doubt: Funding them for a community/city-owned traffic camera type thing seems like it would have been a much more reasonable proposition than funding Flock for their current use case of allowing police to stalk their ex girlfriends or mistresses.

Re: Hackers Got Inside a Flock Camera

#37

I think I should start posting a reminder in Flock threads that Axon is a Flock competitor, is also engaged in mass surveillance, and is possibly even worse, but there’s rarely any mention of it. Journalists need to do some digging there. This shouldn’t just be a Flock story, or Flock will just get bought up or something and everyone will move on. (The above should not be read as supporting Flock or discouraging furt…

While highly unprofessional, the "Who's a good boy?!" status message makes me like them a tiny bit more

For those unaware, embedded devices usually have a "watchdog" timer that needs to be periodically reset ("fed"/"pet"/"kicked") when everything is operating correctly or else the device will reboot as a fail-safe.

This log message probably indicates when they're resetting the watchdog timer.

Re: Hackers Got Inside a Flock Camera

#38

This reporting was done in collaboration with 404media. Here's the discussion for 404's article: https://news.ycombinator.com/item?id=49726577 Distributed Denial of Secrets has published the partition images: https://ddosecrets.org/article/flock-alpr-camera

Thanks. Few saw that post: https://news.social-protocols.org/stats?id=49726577

Re: Hackers Got Inside a Flock Camera

#39
> According to our analysis, the camera’s logs recorded about 21 days of activity across several periods. During those windows, the device photographed roughly 50,200 vehicles and generated about 1.6 million images. On a typical day, it logged around 3,300 vehicles, with a high of 4,454.

Has there been any report about which state this camera was recovered in? New Hampshire has a strict 3 minute rule for non-hit plate data before the captured images and records must be deleted [1].

[1] (N.H. Rev. Stat. § 261:75-b) requires ALPR systems to delete non-hit plate data within 3 minutes

Re: Hackers Got Inside a Flock Camera

#40
post #31

Earlier quoted context omitted.

do the articles have significantly different information/coverage to warrant two submissions?

I can't read the Wired article because I'm only allowed three excerpts and 15 ads a day at Wired.com

same, but i'm not sure how that's related to my comment. workarounds or alternate articles without significant new information are typically posted within the same submission, not separate ones.
Post reply on HN