One Flock camera generated 1.6 million images over 21 days, and hackers discovered just how much data it was storing.
After physically removing the roadside device, the group recovered more than 27,000 video clips, an encryption key that helped unlock stored footage, and logs covering roughly 50,200 vehicles. The hackers did not breach Flock’s central servers, and some sensitive storage remained encrypted.
Still, the findings offer a rare look inside Flock’s camera system and show what can become accessible when an edge device deployed in public falls into someone else’s hands.
Hackers found the encryption key on the camera
The hacker collective stegan0gram removed a Flock camera positioned above a roadway and copied much of its stored data, according to a joint investigation by WIRED and 404 Media.
The Android-based device contained two unencrypted partitions called “vendor” and “media.” Investigators found an encryption key in the media partition that unlocked another section containing videos and still images. Some of the camera’s most sensitive storage remained inaccessible.
The finding raises questions about Flock’s on-device protections. The company says data is encrypted on the device, in transit, and at rest.
Flock had also said that even someone with physical access to a camera would not be able to access the footage because the images were encrypted and retained only briefly.
Flock said removing and tampering with its cameras is illegal. The company also said it had not received the hackers’ technical findings through its vulnerability disclosure program and did not have enough information to fully assess their claims.
Must-read security coverage
- UK Police Convicts Pair in £5.5 Billion Bitcoin Launder Case
- Blackpoint Cyber vs. Arctic Wolf: Which MDR Solution is Right for You?
- How GitHub Is Securing the Software Supply Chain
- 8 Best Enterprise Password Managers
One camera produced 1.6 million images in 21 days
The recovered logs covered about 21 days across several periods. During that time, the camera photographed roughly 50,200 vehicles and generated about 1.6 million images.
Tom’s Hardware reported that a typical passing vehicle triggered about 28 images, while some triggered more than 100. Investigators also recovered 27,321 short video clips stored on the device.
The camera did more locally than simply capture license plates. Its software could detect people, vehicles, bicycles, and plate-like shapes before selecting images and sending data to Flock’s servers.
Mashable said that plate reading and identification of vehicle characteristics, such as make, model, and color, appear to occur on Flock’s servers rather than on the camera itself.
Investigators found no evidence that Flock’s software was actively performing facial recognition. The device could, however, detect when a person appeared in an image and record the location of that detection along with a confidence score.
What IT and security teams should review
The Flock incident offers a useful checklist for organizations deploying cameras, sensors, and other unattended edge devices. The hackers did not remotely compromise Flock’s network, but physical access to a single device was sufficient to expose local software, stored media, and an encryption key.
IT and security teams should review three areas:
- Protect encryption keys: Check whether keys are adequately separated from the data they protect and whether credentials can be revoked after a device is compromised.
- Limit local retention: Determine how much footage, logs, and other sensitive data remain on hardware after information has been uploaded.
- Prepare for device theft: Make sure tampered or stolen hardware can be detected quickly, isolated from backend systems, and, where supported, remotely disabled or wiped.
The incident does not show that attackers can remotely pull millions of images from Flock cameras. It shows why organizations securing edge deployments need to think beyond the cloud and consider what becomes accessible when someone gets their hands on the hardware itself.
Hackers are also targeting sensitive personal data, with the FBI and NCAA recently warning that attackers are stealing private photos from college athletes’ online accounts.