Flock cameras are riddled with security vulnerabilities and hardcoded creds
Leaked Flock ALPR camera firmware reveals EOL Android 8.1, a 2017 Linux kernel, and hardcoded API keys granting access to production credentials.
DDoSecrets published filesystem images from an in-use Flock ALPR camera, obtained by the hacker collective stegan0gram and investigated by 404 Media and Wired. Micah Lee's analysis shows the camera runs Android 8.1 with a security patch level of 2018-06-05 and Linux kernel 3.18.71, missing roughly eight years of Android fixes. The firmware exposes a hardcoded API key for Flock's hpnotiq backend that can retrieve Auth0 client credentials for any camera by MAC address, with credentials stored in plaintext. Likely unpatched flaws include CVE-2021-1905 (Qualcomm Adreno use-after-free) and CVE-2018-9568 (WrongZone kernel socket type confusion); Flock says it received no reports via its disclosure policy.
- Flock camera firmware shows Android 8.1 with patch level 2018-06-05 and Linux 3.18.71, both long unsupported.
- A hardcoded API key in a shared library can request Auth0 device credentials from hpnotiq.flocksafety.com by MAC address.
- Credentials are stored in plaintext and can mint bearer tokens against Flock's production backend.
- Kernel vulnerabilities CVE-2021-1905 and CVE-2018-9568 predate the camera's patch level and likely apply.
- Dataset was produced by physically disarming fielded cameras, not by remote exploitation, per the hackers.
- ATT&CK
- T1552.001 Credentials In FilesT1068 Exploitation for Privilege EscalationT1528 Steal Application Access Token
- Products
- Flock ALPR cameraAndroidLinux
- Threat actors
- stegan0gram
- Organizations
- DDoSecrets404 MediaWired
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-9568 | In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion | 7.8 | <1% | ||
| CVE-2021-1905 | Use-After-Free in Qualcomm Snapdragon Chipsets Allows Local Privilege Escalation | 7.8 | 2% | KEV | KEV |
From the original article
6 min read at micahflee.com
This morning, DDoSecrets published an exciting new dataset: Filesystem images of the partitions from an in-use Flock ALPR camera. 404 Media and Wired published a joint investigation into it. I downloaded the dataset and am now thoroughly nerd-sniped.
By micahflee · micahflee.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.