Surveillance Camera Security? It’s Completely Flocked!

Surveillance cameras from Flock Safety have become a controversial privacy battleground, as the communities in which they are installed wake up to their sinister potential, and stories roll in of …. Surveillance Camera Security? It’s Completely Flocked! One has had its disk contents dumped, and we’ve been treated to some insights courtesy of [Micah Lee].

In short: their approach to security is deeply flawed. It’s interesting to find that instead of a custom hardened OS, these devices run Android. Not just Android, but Android 8.1, a long out of support version originally released in 2017.

This is is the year Flock Safety was founded, which may or may not be coincidental. Like any old version of a widely used operating system it has a host of known vulnerabilities, none of which are patched on this version. The Android version is small beer compared to the revelation that they contain a hard-coded and very open-access API key that can be used by any mildly curious miscreant to reveal information from any Flock camera using its MAC address.