Flock Surveillance Camera Hack Exposes Vehicle and Person Tracking
Hackers extracted encryption keys and analyzed millions of images from Flock's roadside cameras.
1Breach methodology
Hackers physically removed a Flock surveillance camera from a roadway and copied its internal storage. They recovered an encryption key stored on the device, bypassing Flock's claimed on-device encryption protections. This allowed access to thousands of vehicle detection videos and system logs. The group stegan0gram conducted the breach to expose what they called 'secrets of those spying on us' through reverse engineering rather than simple destruction.
2Data analysis findings
Analysis of 21 days of recovered logs showed the camera photographed approximately 50,200 vehicles, generating 1.6 million images. Daily averages reached 3,300 vehicles, peaking at 4,454. The computer vision system created dozens of images per passing vehicle and unexpectedly logged detailed person detection data, recording positions and confidence levels - functionality typically unmentioned in Flock's public discussions about its surveillance capabilities.
3Person detection capabilities
The hacked data revealed Flock's software actively detects and tracks people, not just vehicles as commonly assumed. When identifying individuals, the system records their position within images and assigns confidence scores to each detection. This person-tracking functionality was operational despite not being prominently disclosed in Flock's public materials about its automated license plate recognition system.
4Unexpected data collection
Beyond vehicles and people, Flock's system isolated and stored specific vehicle details like bumper stickers and graphics, including an American flag patch on a motorcyclist's saddlebag. This granular data collection suggests the system's computer vision capabilities extend far beyond basic license plate recognition, capturing potentially identifiable vehicle characteristics without clear disclosure.
5Data sharing aftermath
After extracting the data, hackers shared it with 404 Media and the transparency group Distributed Denial of Secrets, which then provided it to WIRED for analysis. This joint media investigation analyzed weeks of surveillance logs, revealing the extensive tracking capabilities of what Flock markets primarily as an automated license plate recognition system for law enforcement.
6Encryption vulnerabilities
The breach exposed critical flaws in Flock's security architecture. Despite company claims of on-device encryption protecting stored data, hackers successfully extracted both the encrypted data and the encryption keys from the physical devices. This vulnerability allowed complete access to stored surveillance footage and system logs without needing to compromise Flock's central systems.
7Surveillance scale
A single Flock camera generated over a million images during several weeks of operation, demonstrating the massive scale of data collection possible with these devices. With thousands of such cameras deployed nationwide, the breach highlights the potential for expansive surveillance networks that capture detailed movement patterns of both vehicles and individuals across communities.
8Security implications
This breach reveals dual concerns: the expansive tracking capabilities of Flock's systems beyond their stated purpose, and the vulnerability of these surveillance devices to physical compromise. The incident raises questions about both the proportionality of mass surveillance technologies and the adequacy of their security protections against unauthorized access to sensitive tracking data.
Original article: Slashdot — Flock Surveillance Camera Hack Exposes Vehicle and Person Tracking