Hackers Got Inside a Flock Camera
Hackers Got Inside a Flock Camera
黑客成功入侵 Flock 监控摄像头
Hackers ripped down a Flock camera above a roadway, made a near-complete copy of the data stored inside it, and shared the files with 404 Media and WIRED, revealing in new detail how exactly Flock Safety’s cameras track the movements of both vehicles and people. The hackers say they are also publishing details on how they managed to obtain the software, in the hopes that other people may copy them.
黑客从道路上方拆下了一台 Flock 摄像头，对其中存储的数据进行了近乎完整的复制，并将这些文件分享给了 404 Media 和《连线》（WIRED）杂志。这些文件详细揭示了 Flock Safety 的摄像头究竟是如何追踪车辆和行人动向的。黑客表示，他们还将公布获取该软件的具体方法，希望其他人能够效仿。
The breach provides an unprecedented look inside a system that Flock has described as protected by on-device encryption. The hackers were able to copy the camera’s storage and recover an encryption key stored on the device, which unlocked videos of thousands of vehicle detections. The hackers shared the material with 404 Media and the transparency nonprofit Distributed Denial of Secrets, which shared the data with WIRED. 404 Media and WIRED then analyzed those files as part of a joint investigation.
此次泄露事件让人们得以史无前例地窥探该系统的内部，而 Flock 此前一直声称其系统受到设备端加密的保护。黑客成功复制了摄像头的存储内容，并恢复了存储在设备上的加密密钥，从而解锁了数千段车辆检测视频。黑客将这些资料分享给了 404 Media 和透明度非营利组织 Distributed Denial of Secrets，后者又将数据转交给了《连线》。随后，404 Media 和《连线》对这些文件进行了联合调查分析。
While much of the automatic license plate reader’s most sensitive storage remained encrypted and inaccessible, the joint analysis of the recovered data shows that software running on the device explicitly detects people as well as vehicles, license plates, and bicycles. The camera can produce dozens of images of a single passing vehicle and, according to several weeks of recovered logs, generated more than a million images. Its computer-vision software also sometimes isolated bumper stickers and other graphics, including, in one case, an American flag patch on a motorcyclist’s saddlebag.
尽管该自动车牌识别系统中最敏感的存储部分仍处于加密且无法访问的状态，但对恢复数据的联合分析显示，设备上运行的软件不仅能识别车辆、车牌和自行车，还能明确检测到行人。该摄像头可以针对单辆过往车辆拍摄数十张照片；根据恢复的数周日志显示，它总共生成了超过一百万张图像。其计算机视觉软件有时还会单独识别保险杠贴纸和其他图形，其中一个案例甚至识别出了摩托车手马鞍包上的美国国旗补丁。
The act of removing the camera and dumping its software shows that some people are not content with just destroying or removing the cameras. Across the country, multiple people have been arrested for allegedly tampering with or otherwise sabotaging Flock’s cameras. In response, some towns have announced that they are going to stop using Flock’s cameras altogether, and in one case, a police department even made a fake, 3D-printed Flock camera case in order to bait potential vandals.
拆除摄像头并导出其软件的行为表明，有些人并不满足于仅仅破坏或移除这些设备。在美国各地，已有多人因涉嫌篡改或破坏 Flock 摄像头而被捕。作为回应，一些城镇宣布将彻底停止使用 Flock 摄像头；在其中一个案例中，某警察局甚至制作了一个 3D 打印的假 Flock 摄像头外壳，以诱捕潜在的破坏者。
“Why just destroy them when we can reverse engineer them and find the secrets of those spying on us?” one of the hackers, from a collective calling itself stegan0gram, said in an interview. “We liberated hardware in the field, disarmed them, and proceeded with reverse engineering of the cameras and associated solar equipment.”
“既然我们可以对它们进行逆向工程，找出那些监视我们的人的秘密，为什么还要仅仅摧毁它们呢？”来自一个自称 stegan0gram 的黑客组织的成员在采访中说道，“我们解放了现场的硬件，解除了它们的武装，并对摄像头及相关的太阳能设备进行了逆向工程。”
Flock’s cameras photograph passing vehicles and send the images and other data to the company’s servers. There, Flock’s system presumably reads the license plate and can identify characteristics such as the vehicle’s color, make, and model. Flock then makes these time-stamped records searchable by whichever local agency owns or has access to the cameras. But in many cases, Flock’s system also allows other police departments from all over the country to search those cameras too, as part of the company’s national network. In Alpharetta, Georgia, for example, WIRED found that records from the city’s Flock cameras were accessible to more than 2,000 agencies, including police departments, colleges, airports, and, inexplicably, the Office of Inspector General for the federal General Services Administration.
Flock 的摄像头拍摄过往车辆，并将图像及其他数据发送到公司服务器。在那里，Flock 的系统会读取车牌，并识别车辆的颜色、品牌和型号等特征。随后，Flock 会将这些带有时间戳的记录提供给拥有或有权访问这些摄像头的当地机构进行搜索。但在许多情况下，作为公司全国网络的一部分，Flock 的系统还允许全国各地的其他警察部门搜索这些摄像头的数据。例如，在佐治亚州的阿尔法利塔（Alpharetta），《连线》发现该市 Flock 摄像头的记录可供 2,000 多个机构访问，其中包括警察局、大学、机场，以及令人费解的联邦总务署监察长办公室。
This national network has been a selling point for Flock but also a deep source of controversy. 404 Media revealed that local cops were performing lookups in the national network on behalf of Immigration and Customs Enforcement, including in areas that banned working with immigration authorities or transferring license plate data out of state. 404 Media also revealed that a cop in Texas searched Flock cameras nationwide for a woman who self-administered an abortion. Those stories, among others, triggered a national conversation about whether people want Flock cameras, or automatic license plate readers more generally, in their communities.
这个全国性网络既是 Flock 的卖点，也是争议的深层来源。404 Media 披露，当地警察曾代表移民和海关执法局（ICE）在全国网络中进行查询，甚至在那些禁止与移民当局合作或禁止将车牌数据转移到州外的地区也是如此。404 Media 还披露，德克萨斯州的一名警察曾在全国范围内搜索 Flock 摄像头，以追踪一名自行堕胎的女性。这些报道引发了全国范围内的讨论：人们是否希望在自己的社区中安装 Flock 摄像头，或者更广泛地说，是否需要自动车牌识别系统。
And in the case of stegan0gram, the answer is clearly no.
对于 stegan0gram 组织来说，答案显然是否定的。
The hackers said they were able to access the Android system on the camera and found two partitions—sections of its hard drive, essentially. A few of these were unencrypted, the hackers said, including one called “vendor” and another called “media.” The latter contained an encryption key that unlocked another part, which contained much of the media—the videos and stills—the camera took.
黑客表示，他们能够访问摄像头上的安卓系统，并发现了两个分区——本质上就是硬盘驱动器的不同部分。黑客称，其中几个分区未加密，包括一个名为“vendor”（供应商）的分区和一个名为“media”（媒体）的分区。后者包含一个加密密钥，可以解锁另一个分区，其中存储了摄像头拍摄的大量媒体文件，包括视频和静态图像。
In early 2025, security researcher Jon “GainSec” Gaines reverse engineered a Flock license-plate reader and documented flaws that could be used to gain root-level access. After Gaines disclosed his findings, the company acknowledged the findings but downplayed their severity, writing that the flaws required physical access to the device and that even someone who gained access to a camera “would still not be able to gain access to footage,” because images remained on the device only briefly after being transmitted to the cloud.
2025 年初，安全研究员 Jon “GainSec” Gaines 对 Flock 车牌识别器进行了逆向工程，并记录了可用于获取根权限（root-level access）的漏洞。在 Gaines 公布其发现后，该公司承认了这些发现，但淡化了其严重性，称这些漏洞需要物理接触设备，即使有人获得了摄像头的访问权限，“也无法获取视频片段”，因为图像在传输到云端后仅会在设备上短暂保留。
404 Media and WIRED analyzed the camera’s contents. The device’s processor is similar to those used in midrange smartphones, and it runs about 20 Flock-built apps that handle everything from detecting motion and taking pictures to classifying objects, uploading data, and receiving remote updates.
404 Media 和《连线》对摄像头的内容进行了分析。该设备的处理器与中端智能手机所用的处理器类似，运行着约 20 个由 Flock 开发的应用程序，负责处理从检测运动、拍照到分类物体、上传数据以及接收远程更新的所有任务。
According to the code, when something moves into view, the camera takes a rapid series of photos. A typical passing vehicle generated about 28 images, though some produced more than 100. The camera uses different exposures to capture both the license plate and the wider scene, then scans the images, selects and crops useful frames, and sends them with other data to Flock over the cellular network. The camera itself does not appear to read the plate or identify the vehicle’s make, model, and color. That appears to happen on Flock’s servers.
根据代码显示，当有物体进入视野时，摄像头会快速拍摄一系列照片。一辆典型的过往车辆会生成约 28 张图像，有些甚至超过 100 张。摄像头使用不同的曝光度来同时捕捉车牌和更广阔的场景，然后扫描图像，选择并裁剪有用的帧，并通过蜂窝网络将它们与其他数据一起发送给 Flock。摄像头本身似乎并不读取车牌或识别车辆的品牌、型号和颜色。这些处理过程似乎是在 Flock 的服务器上完成的。
According to our analysis, the camera’s logs recorded about 21 days of activity across several periods. During those windows, the device photographed roughly 50,200 vehicles and generated about 1.6 million images. On a typical day, it logged around 3,300 vehicles, with a high of 4,454. Those figures would vary considerably depending on where a camera is installed and how much…
根据我们的分析，摄像头的日志记录了跨越多个时段、总计约 21 天的活动。在这些时间窗口内，该设备拍摄了约 50,200 辆车，生成了约 160 万张图像。在典型的一天里，它记录了约 3,300 辆车，最高纪录为 4,454 辆。这些数字会根据摄像头的安装位置以及交通流量的大小而有很大差异……