Leak site Distributed Denial of Secrets has released a dump of the filesystems of a Flock camera, and Micah Lee has published a dive into the contents. Apparently the Flock security model did not include “angry citizens with a hacksaw in the middle of the night” in the physical security category.
The first thing Micah notes is that the Flock hardware runs Android 8.1 (for those not keeping track, the current Android release is Android 17 released in June 2026). The version of Android running on the Flock camera was last patched in June of 2018, and the Linux kernel (3.18.71) is over nine years out of date, and the 3.18 series went end-of-life in 2019.
You might assume “wouldn’t an operating system this old have known vulnerabilities?”, and you’d be completely right. Micah calls out two in particular, one in the Qualcomm GPU which allows any program to manipulate kernel memory and gain root (similar, yet simpler, than the spate of kernel vulnerabilities this year that allowed manipulating memory via the disk IO cache), and the “WrongZone” vulnerability which allows a process to escalate to root via socket handling errors. You might also guess both of these have been patched, and again, you’d be right, in 2021 and 2018 respectively.
Digging deeper, Micah discovers that API keys with access into the Flock infrastructure appear to be hard-coded into the binaries. Each camera appears to request credentials from an authentication server, using the MAC address of the camera. After obtaining the credentials from an Okta Auth0 sign-in service, the Flock stores them, in plain text.
Also stored on the camera unencrypted are logs and position data: The camera dumped to Distributed Denial of Secrets came from a suburb of Milwaukee. Continue reading “This Week In Security: Flock Cameras Are Old, Microsoft Patches Patches, And Researchers Attack SSH”
