Motorola ALPR systems expose vehicle data and live video feeds
More than 150 Motorola automated license plate recognition (ALPR) cameras exposed live video feeds and vehicle data to the public internet without authentication, according to security researcher Matt Brown who discovered the flaw after reverse-engineering a camera purchased on eBay. The exposed data includes real-time video, license plates, photos, and vehicle details that were intended only for law enforcement access.
What happened
More than 150 Motorola ALPR cameras exposed live video feeds and detailed vehicle records to the public internet without authentication, according to security researcher Matt Brown who discovered the flaw after purchasing an ALPR camera on eBay and reverse engineering it.
The exposed systems broadcast real-time footage in color and infrared, covering single traffic lanes, along with logged data including license plate photographs, vehicle makes, models, colors, and metadata. The cameras were intended for law enforcement access only but became accessible to anyone on the internet.
Reported impact
The exposed data could be exploited for stalking, harassment, or commercial purposes, and paints a detailed picture of vehicle movements that could reveal individuals' routines, habits, and frequented locations without their knowledge or consent.
In a 20-minute period, one system captured photographs and information from nearly 1,000 vehicles passing a location geolocated to Tennessee.
Index analysis
The vulnerability stems from misconfiguration during deployment by law enforcement agencies, with cameras inadvertently exposed to the public internet instead of being secured within private networks.
Governance controls
Motorola confirmed the exposures and stated it was working with its customers to close the access.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.