Hackers rip down Flock camera, steal its data, share findings with media

Hackers dismantled a Flock camera to examine its inner workings, according to reports by 404 Media and WIRED. The hacking group known as stegan0gram took down the camera above a road, extracted nearly all the data stored within, and shared the files with journalists for a joint investigation. The attack exposed two unencrypted partitions on the camera's internal storage, one containing vendor files and the other holding media.

Within the media partition, the hackers discovered an encryption key that unlocked most of the footage recorded by the device. Despite expectations that the Flock camera could identify license plates and vehicle details, the analysis revealed that the processing of this information occurs on Flock's servers after the device transmits its photos.

The camera's software explicitly detects people, logging their appearance in frame along with a confidence score. This capability, though not widely discussed, was confirmed in the analysis. Flock spokesperson stated that tampering with its cameras is illegal and that the company had not received a vulnerability report through its official disclosure process.

Flock claims its cameras do not perform facial recognition, but the outlets found no evidence of active facial recognition capability beyond default Android features, which were not enabled. The camera's software runs on a midrange smartphone processor and operates around 20 Flock-built applications, including motion detection, image classification, and remote updates.

The recovered logs covered roughly three weeks of activity, showing the camera photographed over 50,000 vehicles and produced 1.6 million images. Despite the camera's individual role, Flock's system routes captured data to a searchable national database, allowing records from a single city's cameras to be accessed by various agencies, including police departments, universities, and airports.

This network has been used by local police to run searches on behalf of ICE and in a case involving an individual who self-administered an abortion, fueling the backlash against the cameras.