Thread

Flock cameras are riddled with security vulnerabilities and hardcoded creds

35 points · 4 comments · micahflee

Loading the complete thread in the background. This saved snapshot is available now. Refresh

zeech · 1789597638 · focus · HN ↗
Discussion about the article this post is talking about: <a href="https://news.ycombinator.com/item?id=49726586">https://news.ycombinator.com/item?id=49726586
1. dang · 1789598363 · focus · HN ↗
  Comments moved thither. Thanks!
  I've added <a href="https://micahflee.com/flock-cameras-are-riddled-with-security-vulnerabilities-and-hard-coded-credentials/" rel="nofollow">https://micahflee.com/flock-cameras-are-riddled-with-securit... to the toptext there.
  1. FlockIsYC · 1789600201 · focus · HN ↗
    [dead]
NuclearPM · 1789597769 · focus · HN ↗
1984 but stupid-mode.
1. toomuchtodo · 1789598215 · focus · HN ↗
  We should be so lucky these people are so incompetent.
coldbrewed · 1789598319 · focus · HN ↗
Move fast and break things*
* Privacy, civic trust, society if you get a chance!
This is the end product of tech leadership taking fat rips of disruption cocaine for the last 15 years. Flock Safety got VC money so that they could build a panopticon. There is nothing surprising about the fact that they did a hack job with terrible security; the fact that their service names are various types of alcohol is beyond parity.
Oh well, at least Flock Safety's IPO will be a critical cash infusion in the pursuit of building the torture nexus so that's cool.
asveikau · 1789598559 · focus · HN ↗
tldr from my skim, the two worst things:
* Probably vulnerable to CVEs that were patched in 2018 and 2021.
* Generates API key to phone home based only on its own MAC address.
autoexec · 1789599327 · focus · HN ↗
Having hardcoded credentials is a sign of total incompetence. In this case at least it wasn't a password, but an API key which can be used to request credentials (stored in plaintext) which look like they'd get you access Flock's servers. Not quite as bad as a hardcoded admin password, and it's not clear what you'd be able to do if you did authenticate successfully as a camera, but its worrying enough. There have been enough vulnerabilities found in Flock's systems that it's pretty clear they aren't concerned about security and it's plainly obvious that they don't care at all about our privacy.
Even if we decided that this level of mass surveillance on the American public was acceptable to us, Flock Safety/Flock Group as already demonstrated that they can't and shouldn't be trusted to implement it.
1. asveikau · 1789599586 · focus · HN ↗
  I don't think having credentials stored on the device is all that fatal. The device has to read them back, after all. What they did, however, is much worse: the credentials come from the MAC address. So they're literally broadcasted on every network packet.
  1. throwaway89201 · 1789605963 · focus · HN ↗
    The device runs Android, which makes it very simple to use the Keystore system and to store a device specific private key within the TEE or SE where it can't be very easily extracted. If you really don't want to provision in the factory, you could use secure boot measurements to do it remotely. Of course this isn't completely watertight either against a physical attacker, but it would survive a filesystem dump attack and is the least you can do to appear competent.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.