Leak site Distributed Denial of Secrets released a dump of the filesystems of a Flock camera, and Micah Lee has published a dive into the contents. Apparently the Flock …. Apparently the Flock security model did not include “angry citizens with a hacksaw in the middle of the night” in the physical security category.
The first thing Micah notes is that the Flock hardware runs Android 8.1 (for those not keeping track, the current Android release is Android 17 released in June 2026). The version of Android running on the Flock camera was last patched in June of 2018, and the Linux kernel (3.18.71) is over nine years out of date, and the 3.18 series went end-of-life in 2019. You might assume “wouldn’t an operating system this old have known vulnerabilities?”, and you’d be completely right.
Micah calls out two in particular, one in the Qualcomm GPU which allows any program to manipulate kernel memory and gain root (similar, yet simpler, than the spate of kernel vulnerabilities this year that allowed manipulating memory via the disk IO cache), and the “WrongZone” vulnerability which allows a process to escalate to root via socket handling errors. You might also guess both of these have been patched, and again, you’d be right, in 2021 and 2018 respectively. Digging deeper, Micah discovers that API keys with access into the Flock infrastructure appear to be hard-coded into the binaries.
Each camera appears to request credentials from an authentication server, using the MAC address of the camera. After obtaining the credentials from an Okta Auth0 sign-in service, the Flock stores them, in plain text. Also stored on the camera unencrypted are logs and position data: The camera dumped to Distributed Denial of Secrets came from a suburb of Milwaukee.
Wired also released research into the dumped filesystem images. While some video and photo data is encrypted on the device, the decryption keys are also stored on the device.
The hacker collective who obtained the camera decrypted the saved data, showing that the camera captured 1.6 million photos of 50,000 vehicles in under a month (21 days). Despite claims from Flock that the detection only captures vehicles, evidence in the analyzed photos and software appears to indicate it deliberately captures people, and does so using a video capture format instead of the still images used for license plates.
Flock, meanwhile, has said that it is not aware of any security issues because they have not been reported through the Flock security website, and can not make a security assessment based on incomplete reports. Presumably looking at known vulnerabilities from the past decade is too difficult?
Microsoft Releases emergency out-of-band fixes for Patch Tuesday fixes Last week was a record breaking Patch Tuesday with nearly 1000 security fixes, and Microsoft has begun issuing advice that security patches should be applied immediately, or at most, within three days. The risk of rapidly applying Microsoft patches in production or across large fleets of machines is that Microsoft hasn’t had the best track record regarding patch stability, which brings us to this emergency set of patches to fix the patches.
The September 2026 security update caused issues with remote desktop access to servers, impacting the management console, file explorer, and Windows update tools. It also caused folder sharing with Hyper-V virtual machines to fail in some cases, and USB audio issues with some devices.
The emergency patch also includes several security fixes itself to fix privilege escalation bugs. A handful of emergency fixes on top of a thousand patches may not feel like many, but for corporate environments, losing access to remote desktop or access to shared directories with virtual machines could be a work stopper, and any issue multiplied across potentially thousands of systems in a single company immediately becomes a significant cost.
If Microsoft expects corporate customers to be able to install patches immediately, the testing and certification process will have to improve quickly. Every time the IT department or the CISO has to explain downtime caused by patches, it becomes harder to deploy the next set of patches.
Korea fights data breaches with fines South Korea has raised the fines for major data breaches to up to ten percent of the companies yearly revenue. Under the new regulations, companies with data leaks impacting ten million or more people can be fined up to ten percent of the company yearly revenue.
Previously in South Korea, companies involved in large data breaches could be fined up to three percent of yearly revenue. The fines are imposed on companies which have had repeated violations within the past three years, and which are deemed to be grossly negligent.
Not all violations automatically rise to the ten percent limit, and companies who can demonstrate processes and investment in data protection can reduce the fines.
ChuckysCarnage 