This morning, DDoSecrets published an breathtaking caller dataset: Filesystem images of the partitions from an in-use Flock ALPR camera. 404 Media and Wired published a associated investigation into it. I downloaded the dataset and americium now thoroughly nerd-sniped.
Hackers from a corporate called stegan0gram collected the data. “Why conscionable destruct [Flock cameras] erstwhile we tin reverse technologist them and find the secrets of those spying connected us?” 1 of the hackers told 404 Media and Wired successful an interview. “We liberated hardware successful the field, disarmed them, and proceeded pinch reverse engineering of the cameras and associated star equipment.”
Below are a fewer of the secrets that I've recovered truthful far.
I'm crunching information and penning these newsletters successful my free time. If you want to support my work, see becoming a paid supporter.
Become a paid supporter
This camera is moving an obsolete, end-of-life type of Android
Flock cameras tally connected a modified type of Android. The circumstantial build that this Flock camera was moving astatine the constituent successful clip the firmware was extracted was from June 5, 2025.
Despite being a comparatively caller build, the Flock camera was moving Android 8.1. This type of Android was released successful 2017, and officially stopped getting support from Google successful 2021 (see the Android end-of-life page for much info). And contempt Google publishing information fixes for Android 8.1 until 2021, the Android spot level is 2018-06-05. This camera is missing Android information updates for the past 8 years.
Android runs connected the Linux kernel. This Flock camera was moving Linux 3.18.71, released successful 2017. The 3.18 bid was maintained until May 2019, ending astatine 3.18.140 — this camera is 69 releases short of moreover that. This kernel is complete 9 years out-of-date.
Here are a fewer publicly-known vulnerabilities that this camera is astir apt susceptible to, and that impact components that this camera ships with. I don't really person this Flock camera to trial these connected and corroborate that the hacks work, but what I do cognize is that this Flock camera's spot level predates each of these vulns, contempt patches being disposable for galore years.
- CVE-2021-1905 Qualcomm Adreno GPU – use-after-free. Any codification moving connected the Flock camera, including successful unprivileged apps, tin corrupt kernel representation done the GPU driver and return afloat power of the device. Patched successful May 2021.
- CVE-2018-9568 ("WrongZone") – kernel socket type confusion. A programme moving connected the camera tin confuse the kernel's socket handling complete IPv6 and escalate itself to root. Patched successful December 2018. (Here's public utilization code for this one.)
In a connection to 404 Media and Wired, a Flock spokesperson said:
Flock takes information earnestly and maintains a nationalist Vulnerability Disclosure Policy for information researchers to study imaginable vulnerabilities straight to us. We received nary study done that process, and based connected the constricted accusation provided, we do not person capable item to measure the claims being made. If the individuals identified morganatic vulnerabilities, we promote them to taxable their method findings done our vulnerability reporting process truthful our information squad tin reappraisal them and return immoderate due action.lol.
Where I recovered this successful the data
If you want to travel along, DDoSecrets published this dataset here.
The Android type and spot level are listed successful aggregate places, but the easiest spot to find it is successful the strategy partition. If you download partitions/24_system.img (1.5 GB) and extract it, you'll find a file, build.prop, which includes these lines:
ro.build.version.sdk=27 ro.build.version.release=8.1.0 ro.build.version.security_patch=2018-06-05 ro.build.date=Thu Jun 5 20:05:57 UTC 2025The Linux type tin beryllium recovered successful the footwear partition. If you download partitions/21_boot.img (32 MB) and extract it, you'll find the kernel image successful a record called kernel. You tin find the Linux type with:
❯ tail -c +16496 kernel | zcat 2>/dev/null | grep -am1 'Linux version' Linux type 3.18.71-perf-gaf770dc (android@e593ce924ef6) (gcc type 4.8 (GCC) ) #1 SMP PREEMPT Thu Jun 5 20:15:45 UTC 2025Credentials into Flock's unrecorded accumulation infrastructure
Before I spell into item here, I want to stress thing existent quick:
It's forbidden to link to Flock's servers utilizing leaked credentials without their permission.
The Android firmware for this Flock camera includes 20 abstracted Flock apps, 19 of which each stock a room called com.flocksafety.android.common.lib. If you decompile the library, there's an absorbing method successful the CameraSettings class:
public last String getHpnotiqApiKey() { return "HaJ3FgupAm8RrDJW3MHgT9X7Ft27eVaD"; }This is an API key, hard-coded consecutive into the app. Flock runs a backend work astatine hpnotiq.flocksafety.com. When the camera needs caller credentials, it makes an API petition to hpnotiq that looks for illustration this:
POST https://hpnotiq.flocksafety.com/api/v3/devices/credentials x-api-key: HaJ3FgupAm8RrDJW3MHgT9X7Ft27eVaD macAddress=F46ADD5746FBNote that this circumstantial Flock camera's MAC reside is F4:6A:DD:57:46:FB.
Presumably, you tin usage this hard-coded API cardinal to get credentials for any Flock camera, based connected its MAC address.
The API appears to respond pinch an Auth0 customer ID and secret. Auth0 is an personality guidance institution owned by Okta. The camera past stores those credentials successful plaintext.
Btw, those credentials, which mightiness really still beryllium unrecorded and active (I'm honestly not judge because I didn't effort them), are:
{ "clientId":"CPkOAuOKFwNhPavKO01Htxbn6yIwASro", "clientSecret":"ZRExGjbVjBB1wx04RmsMeWKbpMO5zQxLKNZg25D-1LUKbfQbmByajx-8lyB6LwSV" }These credentials tin past beryllium utilized to mint bearer tokens by sending them to https://device-login.flocksafety.com/oauth/token, and getting backmost a short-lived FlockAuth0Token which tin beryllium utilized to interact pinch Flock's backend servers, authenticated arsenic this camera.
Where I recovered this successful the data
The API cardinal is successful the strategy partition. Download partitions/24_system.img (1.5 GB), extract it, and you'll find 19 Flock apps nether app/: flock-sambuca, flock-collins, flock-phone-home, etc., each containing an APK. Decompile immoderate 1 of them and look for CameraSettings successful com.flocksafety.android.common.lib. The shared room is bundled into each 19 apps, truthful the cardinal is successful each 1 of them.
flock-sambuca is the app that uses it for provisioning credentials. Its Auth0ServiceManager people builds the credentials request, and the URLs for some hpnotiq.flocksafety.com and device-login.flocksafety.com are successful that APK's drawstring resources (resources/res/values/strings.xml).
The Auth0 customer ID and concealed are connected a different partition. Download partitions/27_persist.img (32 MB) and extract it. The record is astatine flock/auth0/auth0_cred. This is the camera's /persist partition, which is not encrypted and is designed to past a mill reset.
The MAC reside and the 2,264 calls to hpnotiq travel from the camera's logs, successful partitions/53_media.img (18 GB). Those beryllium wrong an encrypted container, though the cardinal to it is stored connected the aforesaid partition successful a record called expand_1fcdafef903c40cab3aff81bec914d01.key, lol. Once it's unlocked, the logs are gzipped tarballs nether media/0/media/crashpack/.
This circumstantial camera was successful a suburb of Milwaukee
The Flock camera's logs see camera location GPS coordinates 155 times, each wrong astir 100 meters of each other, which I deliberation is mean GPS jitter for a receiver that ne'er moves. The coordinates that look astir often are 43.10151313, -88.05270186. If you hunt for that successful Google Maps, you'll extremity up successful a suburb conscionable northwest of Milwaukee.
The coordinates 43.10151313, -88.05270186, from Google MapsI've ne'er been to the Milwaukee area, but it looks for illustration this Flock camera is successful a metropolis called Wauwatosa, connected N Mayfair Rd, conscionable disconnected of Webster Park.
Zoomed into the camera's locationUsing Google Street View, I walked astir N Mayfair Rd looking for a Flock camera. It looks for illustration the GPS is somewhat off, and it's really connected the westbound broadside of the street, adjacent a parking batch for the park.
See the star sheet connected that ray station pinch the No Parking sign? That's the Flock camera.There you are, Flock camera serial number 23091220026 pinch MAC reside F4:6A:DD:57:46:FB!
The Flock camera successful question, captured by Google's surveillance infrastructureWho could person realized that this small camera, spending each its clip spying connected the guiltless group driving by, would immoderate time find its measurement into the hands of hackers from the stegan0gram collective?
Where I recovered this successful the data
Download partitions/53_media.img (18 GB), extract it, equine the (barely) encrypted filesystem, and past look astatine the logs successful media/0/media/crashpack/. Extract 1 of the log files – immoderate of them, it doesn't matter. Inside there, location are galore logs pinch filenames for illustration ciroc.2026-*.log. Grep those for Location and you'll spot the GPS coordinates:
❯ feline ciroc.2026-01-27.3.log | grep Location 01-28 08:22:31.304 INFO [Binder:1584_1] QCamera2: Location: 43.10151313, -88.05270186 01-28 08:32:32.240 INFO [Binder:1584_3] QCamera2: Location: 43.10151313, -88.05270186 --snip--With luck, this reporting will promote metropolis councils everyplace to cancel their contracts pinch Flock and different ALPR vendors, and to extremity giving the constabulary much surveillance devices astatine the disbursal of everyone's privacy.
English (US) · 
Indonesian (ID) · 
