Reverse-Engineering Flock Cameras
Researchers reverse-engineered a captured Flock camera, finding person detection and an encryption key left unencrypted.
Bruce Schneier highlighted a joint analysis of a captured Flock automatic license-plate-reader camera. On-device software detects people, vehicles, license plates, and bicycles, can capture dozens of images of one vehicle, and produced more than a million images over several weeks of recovered logs. It also sometimes isolated bumper stickers and other graphics. Much of the sensitive storage stayed encrypted, but researchers found the key for an encrypted partition sitting on an unencrypted partition.
- Recovered Flock camera software detects people as well as vehicles, plates, and bicycles.
- Logs covering several weeks recorded more than one million images.
- An unencrypted partition contained the key for an encrypted partition.
- The most sensitive storage remained encrypted and inaccessible to the researchers.
Full article160 words · extracted from schneier.com · click to collapse
Hackers captured a Flock camera and got a look (alternate link) at the software:
While much of the automatic license plate reader’s (ALPR) most sensitive storage remained encrypted and inaccessible, the joint analysis of the recovered data shows that software running on the device explicitly detects people as well as vehicles, license plates, and bicycles. The camera can produce dozens of images of a single passing vehicle and, according to several weeks of recovered logs, generated more than a million images. Its computer-vision software also sometimes isolated bumper stickers and other graphics, including, in one case, an American flag patch on a motorcyclist’s saddlebag.
If you’re wondering how the hackers got by disk encryption, one of the unencrypted partitions contained the key for an encrypted partition. That’s pretty bad security engineering.
Tags: AI, cameras, cars, reverse engineering
Sidebar photo of Bruce Schneier by Joe MacInnis.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.schneier.com/blog/archives/2026/09/reverse-engineering-flock-cameras.html