Hackers breach Flock Safety camera, expose tracking and data collection
Hackers removed a Flock Safety surveillance camera and recovered its encrypted data, revealing extensive tracking of vehicles and people that the company claimed was protected by on-device encryption. Analysis of the recovered files showed the system generates millions of images and detects not only vehicles but also people, bicycles, and fine details like patches and bumper stickers.
What happened
Hackers from a collective calling itself stegan0gram removed a Flock Safety camera from a roadway, made a near-complete copy of the data stored inside it, and shared the files with 404 Media and Wired journalists.
The hackers recovered an encryption key stored on the device that unlocked videos of thousands of vehicle detections. The recovered data revealed that software running on the device detects people, vehicles, license plates, and bicycles, and can produce dozens of images of a single passing vehicle.
Reported impact
Analysis of recovered logs showed the camera's computer-vision software generated more than a million images over several weeks and sometimes isolated details such as bumper stickers and graphics including an American flag patch on a motorcyclist's saddlebag.
Flock Safety describes its cameras as protected by on-device encryption, but the breach revealed that this protection could be circumvented to access video and other data.
Index analysis
The camera's automatic license plate reader software explicitly detects people as well as vehicles, license plates, and bicycles, according to analysis of the recovered files.
The breach demonstrated vulnerabilities in the physical and cryptographic security of deployed Flock cameras that allowed unauthorized removal and data extraction.
Governance controls
The hackers stated they were publishing details on how they obtained the software in the hopes that others might replicate the breach.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.