This Week In Security: Flock Cameras Are Old, Microsoft Patches Patches, And Researchers Attack SSH

September 18, 2026 by 9 Comments

Leak site Distributed Denial of Secrets has released a dump of the filesystems of a Flock camera, and Micah Lee has published a dive into the contents.  Apparently the Flock security model did not include “angry citizens with a hacksaw in the middle of the night” in the physical security category.

The first thing Micah notes is that the Flock hardware runs Android 8.1 (for those not keeping track, the current Android release is Android 17 released in June 2026).  The version of Android running on the Flock camera was last patched in June of 2018, and the Linux kernel (3.18.71) is over nine years out of date, and the 3.18 series went end-of-life in 2019.

You might assume “wouldn’t an operating system this old have known vulnerabilities?”, and you’d be completely right.  Micah calls out two in particular, one in the Qualcomm GPU which allows any program to manipulate kernel memory and gain root (similar, yet simpler, than the spate of kernel vulnerabilities this year that allowed manipulating memory via the disk IO cache), and the “WrongZone” vulnerability which allows a process to escalate to root via socket handling errors.  You might also guess both of these have been patched, and again, you’d be right, in 2021 and 2018 respectively.

Digging deeper, Micah discovers that API keys with access into the Flock infrastructure appear to be hard-coded into the binaries.  Each camera appears to request credentials from an authentication server, using the MAC address of the camera.  After obtaining the credentials from an Okta Auth0 sign-in service, the Flock stores them, in plain text.

Also stored on the camera unencrypted are logs and position data:  The camera dumped to Distributed Denial of Secrets came from a suburb of Milwaukee. Continue reading “This Week In Security: Flock Cameras Are Old, Microsoft Patches Patches, And Researchers Attack SSH” →

Meta Portal Given New Life As Extended Display

September 18, 2026 by 4 Comments

The Meta Portal and associated devices are effectively defunct, having been abandoned by the company in 2022. If you’ve still got one at home, you might be wondering what to do with it. That’s where Wormhole Display from [pgodlews] comes in handy.

The thing about the Meta Portal, and much of the rest of the related lineup, is that they were effectively just heavily branded Android tablets. The screens and speakers were good, and the basic functionality was all there — albeit locked down somewhat to prevent users from easily repurposing them at will. However, it’s possible to enable Android Debug Bridge (ADB) and turn the device to doing your own bidding.

To that end, [pgodlews] built Wormhole Display as an APK that can be dropped on to the Meta Portal to make it an extendable display for Apple devices. It shows up via AirPlay, letting you use it as a wireless display for your Mac, iPhone, or iPad. You can do screen mirroring or use it as an extended display, as desired, including use of the Portal’s speakers if needed. Under the hood, it’s an Android port of UxPlay, a Unix AirPlay server which uses Android’s MediaCodec and AudioTrack in place of GStreamer to take advantage of the Meta Portal’s onboard H.264 decoder.

Extended displays can be incredibly useful, so if you’ve got an old Meta Portal laying around, consider putting it back to work. We’ve seen it done with e-readers, too. If you’ve got your own hacks to repurpose old, forgotten hardware, don’t hesitate to let us know on the tipsline!

TV Audio Tube Makes A Transceiver

September 18, 2026 by 13 Comments

It’s not often we see a tube project here, so [Helge Fykse]’s PCL86 transceiver is a welcome find.

If you know anything about the European Pro-Electron device naming system you’ll be familiar with it as it applies to tubes. The first letter denotes the heater specification, for example “E” is for a 6.3 volt heater. Everyone wants the familiar 6.3 V devices, but they have a set of cousins which often pass unnoticed. “P” tubes have a 300 mA heater designed such that all tubes in a device could be connected in series at the same current. Of those tubes the PCL86 is a mundane example, filling the function taken in the semiconductor years by the LM386. It’s a small-signal triode and a power pentode in one device, and it’s an audio amplifier. Every 1960s TV set in Europe had one, and thus it’s a good choice for experimentation.

This transceiver is a conventional crystal oscillator and power amplifier on transmit, but with a flick of a switch it transforms into a direct conversion receiver in which the triode becomes oscillator and mixer while the pentode becomes an audio amplifier. It’s simple, and the video below the break explains it in great detail. We’re not sure whether or not it could unintentionally radiate in receive mode, but we’re guessing the energy would be tiny.

A simple tube project can make an interesting departure from modern surface mount electronics, so if you get the chance we’d suggest you try one. If you don’t need a transceiver, an audio amplifier is the archetypal PCL86 project.

Continue reading “TV Audio Tube Makes A Transceiver” →

Building A DIY Centrifuge For Blood Processing

September 17, 2026 by 19 Comments

If you want to do certain types of lab work with blood, you’ll need a centrifuge. It’s often possible to find serviceable units on the used market, but they may not meet your requirements if you’re doing something quite specific. For that reason, [Thomas Nguyen] decided to build his own centrifuge from scratch.

His goal was to separate T cells from blood for further lab analysis, and he needed to be able to work with blood in 15 mL conical tubes. Capable centrifuges weren’t affordable, but he figured he could build his own quite easily. To that end, he enlisted a Raspberry Pi Pico, a 3D printer, and an A2212 brushless motor with a 30 amp electronic speed controller.

Soon enough, he had a design for a fixed-angle centrifuge design that could spin up blood products to the required speed for separation. It has useful safety features, like an MPU-6050 for vibration detection to shut down in case of dangerous imbalance, and an IR sensor for monitoring and controlling rotational speed. For now, the project is still in development, with the first version built and spinning. [Thomas] aims to check that the build operates safely and can separate fluids like dyed water and glycerol successfully before running it with real blood products.

We’ve seen other successful DIY centrifuge builds before, too. Sometimes, the lab hardware you need is the lab hardware you build yourself. If it works and does the job safely, it can be all that you need to get your science goals coming to fruition.

Continue reading “Building A DIY Centrifuge For Blood Processing” →

Surveillance Camera Security? It’s Completely Flocked!

September 17, 2026 by 60 Comments

Surveillance cameras from Flock Safety have become a controversial privacy battleground, as the communities in which they are installed wake up to their sinister potential, and stories roll in of law enforcement professionals abusing their access. One has had its disk contents dumped, and we’ve been treated to some insights courtesy of [Micah Lee]. In short: their approach to security is deeply flawed.

It’s interesting to find that instead of a custom hardened OS, these devices run Android. Not just Android, but Android 8.1, a long out of support version originally released in 2017. This is is the year Flock Safety was founded, which may or may not be coincidental. Like any old version of a widely used operating system it has a host of known vulnerabilities, none of which are patched on this version.

The Android version is small beer compared to the revelation that they contain a hard-coded and very open-access API key that can be used by any mildly curious miscreant to reveal information from any Flock camera using its MAC address. One would hope that a product marketed for use by law enforcement might have paid attention to such a basic lapse, but it seems not. Whether or not this can be corrected by a software upgrade and the leaked key deactivated without turning off the network depends on whether thy can do upgrades tailored to specific devices, but either way we wouldn’t like to be the team tasked with fixing that one.

In a way it’s reassuring that the surveillance apparatus when it came was so incompetently managed, and we hope that these vulnerabilities will have moderated its effect. We’re sure more tasty discoveries will emerge as investigations proceed, and we’ve got the popcorn ready.

Image: Tony Webster, CC BY 2.0.

Your CYD Is Now A Telly

September 17, 2026 by 7 Comments

The Cheap Yellow Display is an all-in-one ESP32 board with a touchscreen, that’s as the name suggests, cheap. It’s appeared in a great many projects since it emerged from the depths of AliExpress, and today thanks to [Nickm324] it takes the turn of becoming a mini TV.

The tiny TV project world is one of successive developers building on previous works to deliver their own refinements on the idea, so this one borrows heavily from an earlier ESP32 project. Its twist on the idea is a single button interface using the CYD’s BOOT button. It supports a range of “channels” of which each one is a different piece of media played from the SD card. As far as we can see it’s only able to play synchronised .mjpeg and audio files, probably a shortcoming of the older ESP32 found on the CYD. The photo features a rather cutesy retro 3D printed TV case which annoyingly isn’t linked from the repository at the time of writing.

It’s a nice idea, and the CYD makes it as easy as possible with minimal wiring. Yes it’s a novelty, but we’re guessing there could be many non-novelty applications for it too. It’s certainly not the first such project we’ve seen, here’s an earlier one.

Keep Your Back Cool While Others Melt

September 17, 2026 by 17 Comments

With an El Niño event in full swing those of us in the northern hemisphere have just had a roasting hot summer, and those in the southern are about to have one. We know what that means, even with the best laid plans the slightest bit of exercise is going to raise a lot of sweat. And if you’re carrying a backpack that means a soaking down your back. Never fear though, because for that one, [Crafterboi] is here with a fan-assisted back protector.

The idea is simple enough, an open framework that sits between you and the backpack, allowing air to flow. If that weren’t enough, there are a couple of 5 volt fans at the top to blow air through the space. It’s printed using PETG, because as he explains, on a really hot day some surfaces can exceed the temperature at which PLA starts to soften.

We like the idea of this project, but what we especially like is that his prototype was made of a pizza box. ten out of ten for resourcefulness! Meanwhile this isn’t the first time we’ve seen a cooling backpack as others have had Peltier systems and evaporative coolers. We would link you to them, but sadly those are both from Hackaday’s early years and link rot has taken their websites.