Flock cameras are riddled with security vulnerabilities and hard-coded credentials

Flock 摄像头充斥着安全漏洞和硬编码凭据

This morning, DDoSecrets published an exciting new dataset: Filesystem images of the partitions from an in-use Flock ALPR camera. 404 Media and Wired published a joint investigation into it. I downloaded the dataset and am now thoroughly nerd-spined. 今天早上，DDoSecrets 发布了一个令人兴奋的新数据集：来自一台正在使用中的 Flock ALPR（自动车牌识别）摄像头的分区文件系统镜像。404 Media 和 Wired 对此进行了联合调查。我下载了该数据集，现在完全沉浸在技术分析中。

Hackers from a collective called stegan0gram collected the data. “Why just destroy [Flock cameras] when we can reverse engineer them and find the secrets of those spying on us?” one of the hackers told 404 Media and Wired in an interview. “We liberated hardware in the field, disarmed them, and proceeded with reverse engineering of the cameras and associated solar equipment.” 来自一个名为 stegan0gram 的黑客组织收集了这些数据。其中一名黑客在接受 404 Media 和 Wired 采访时表示：“既然我们可以对它们进行逆向工程，找出那些监视我们的人的秘密，为什么还要仅仅摧毁它们（Flock 摄像头）呢？我们解放了现场的硬件，解除了它们的武装，并对摄像头及相关的太阳能设备进行了逆向工程。”

Below are a few of the secrets that I’ve found so far. I’m crunching data and writing these newsletters in my free time. If you want to support my work, consider becoming a paid supporter. 以下是我目前发现的一些秘密。我利用业余时间处理数据并撰写这些通讯。如果您想支持我的工作，请考虑成为付费支持者。

This camera is running an obsolete, end-of-life version of Android

该摄像头运行着过时且已停止支持的 Android 版本

Flock cameras run on a modified version of Android. The specific build that this Flock camera was running at the point in time the firmware was extracted was from June 5, 2025. Despite being a relatively recent build, the Flock camera was running Android 8.1. This version of Android was released in 2017, and officially stopped getting support from Google in 2021 (see the Android end-of-life page for more info). And despite Google publishing security fixes for Android 8.1 until 2021, the Android patch level is 2018-06-05. This camera is missing Android security updates for the last eight years. Flock 摄像头运行在修改版的 Android 系统上。在提取固件时，这台 Flock 摄像头运行的具体版本构建日期为 2025 年 6 月 5 日。尽管构建日期较新，但该摄像头运行的却是 Android 8.1。该版本 Android 发布于 2017 年，并于 2021 年正式停止获得 Google 的支持（更多信息请参阅 Android 停止支持页面）。尽管 Google 在 2021 年之前一直为 Android 8.1 发布安全补丁，但该摄像头的 Android 补丁级别仍停留在 2018 年 6 月 5 日。这意味着该摄像头缺失了过去八年的 Android 安全更新。

Android runs on the Linux kernel. This Flock camera was running Linux 3.18.71, released in 2017. The 3.18 series was maintained until May 2019, ending at 3.18.140 — this camera is 69 releases short of even that. This kernel is over nine years out-of-date. Android 运行在 Linux 内核之上。这台 Flock 摄像头运行的是 2017 年发布的 Linux 3.18.71。3.18 系列维护至 2019 年 5 月，最终版本为 3.18.140——而这台摄像头甚至比该版本还落后了 69 个更新。该内核已经过时超过九年了。

Publicly-known vulnerabilities

公开已知的漏洞

Here are a few publicly-known vulnerabilities that this camera is probably vulnerable to, and that affect components that this camera ships with. I don’t actually have this Flock camera to test these on and confirm that the hacks work, but what I do know is that this Flock camera’s patch level predates all of these vulns, despite patches being available for many years. 以下是该摄像头可能容易受到攻击的几个已知漏洞，这些漏洞影响了该摄像头所搭载的组件。虽然我手头没有这台 Flock 摄像头来测试并确认这些攻击是否有效，但我确定的是，尽管这些漏洞的补丁已经发布多年，但这台摄像头的补丁级别仍早于所有这些漏洞。

• CVE-2021-1905 Qualcomm Adreno GPU – use-after-free. Any code running on the Flock camera, including in unprivileged apps, can corrupt kernel memory through the GPU driver and take full control of the device. Patched in May 2021. CVE-2021-1905 高通 Adreno GPU – 释放后重用 (use-after-free) 漏洞。 任何在 Flock 摄像头上运行的代码（包括无特权的应用程序）都可以通过 GPU 驱动程序破坏内核内存，并完全控制设备。该漏洞已于 2021 年 5 月修复。
• CVE-2018-9568 (“WrongZone”) – kernel socket type confusion. A program running on the camera can confuse the kernel’s socket handling over IPv6 and escalate itself to root. Patched in December 2018. (Here’s public exploit code for this one.) CVE-2018-9568 (“WrongZone”) – 内核套接字类型混淆。 在摄像头上运行的程序可以混淆内核对 IPv6 的套接字处理，从而将自身权限提升至 root。该漏洞已于 2018 年 12 月修复。（此处为该漏洞的公开利用代码。）

In a statement to 404 Media and Wired, a Flock spokesperson said: 在一份给 404 Media 和 Wired 的声明中，Flock 发言人表示：

Flock takes security seriously and maintains a public Vulnerability Disclosure Policy for security researchers to report potential vulnerabilities directly to us. We received no report through that process, and based on the limited information provided, we do not have enough detail to assess the claims being made. If the individuals identified legitimate vulnerabilities, we encourage them to submit their technical findings through our vulnerability reporting process so our security team can review them and take any appropriate action. Flock 非常重视安全性，并维护着一项公开的漏洞披露政策，供安全研究人员直接向我们报告潜在漏洞。我们没有通过该流程收到任何报告，且基于所提供的有限信息，我们没有足够的细节来评估这些说法。如果相关人员发现了合法的漏洞，我们鼓励他们通过我们的漏洞报告流程提交技术发现，以便我们的安全团队进行审查并采取适当行动。

lol. 笑死。

Where I found this in the data

我在数据中发现这些内容的位置

If you want to follow along, DDoSecrets published this dataset here. The Android version and patch level are listed in multiple places, but the easiest place to find it is in the system partition. If you download partitions/24_system.img (1.5 GB) and extract it, you’ll find a file, build.prop, which includes these lines: 如果您想跟进，DDoSecrets 在此处发布了该数据集。Android 版本和补丁级别在多个地方都有列出，但最容易找到的地方是在系统分区中。如果您下载 partitions/24_system.img (1.5 GB) 并解压，您会找到一个名为 build.prop 的文件，其中包含以下行：

ro.build.version.sdk=27 
ro.build.version.release=8.1.0 
ro.build.version.security_patch=2018-06-05 
ro.build.date=Thu Jun 5 20:05:57 UTC 2025

The Linux version can be found in the boot partition. If you download partitions/21_boot.img (32 MB) and extract it, you’ll find the kernel image in a file called kernel. You can find the Linux version with: Linux 版本可以在引导分区中找到。如果您下载 partitions/21_boot.img (32 MB) 并解压，您会在一个名为 kernel 的文件中找到内核镜像。您可以通过以下命令找到 Linux 版本：

❯ tail -c +16496 kernel | zcat 2>/dev/null | grep -am1 'Linux version' 
Linux version 3.18.71-perf-gaf770dc (android@e593ce924ef6) (gcc version 4.8 (GCC) ) #1 SMP PREEMPT Thu Jun 5 20:15:45 UTC 2025

Credentials into Flock’s live production infrastructure

进入 Flock 实时生产基础设施的凭据

Before I go into detail here, I want to emphasize something real quick: It’s illegal to connect to Flock’s servers using leaked credentials without their permission. 在深入细节之前，我想快速强调一点：未经许可使用泄露的凭据连接到 Flock 的服务器是违法的。

The Android firmware for this Flock camera includes 20 separate Flock apps, 19 of which all share a library called com.flocksafety.android.common.lib. If you decompile the library, there’s an interesting method in the CameraSettings class: 这台 Flock 摄像头的 Android 固件包含 20 个独立的 Flock 应用程序，其中 19 个共享一个名为 com.flocksafety.android.common.lib 的库。如果您反编译该库，会在 CameraSettings 类中发现一个有趣的方法：

public final String getHpnotiqApiKey() { return "HaJ3FgupAm8RrDJW3MHgT9X7Ft27eVaD"; }

This is an API key, hard-coded straight into the app. Flock runs a backend service at hpnotiq.flocksafety.com. When the camera needs new credentials, it makes an API request to hpnotiq that looks like this: 这是一个直接硬编码在应用程序中的 API 密钥。Flock 在 hpnotiq.flocksafety.com 运行后端服务。当摄像头需要新凭据时，它会向 hpnotiq 发送如下 API 请求：

POST https://hpnotiq.flocksafety.com/api/v3/devices/credentials 
x-api-key: HaJ3FgupAm8RrDJW3MHgT9X7Ft27eVaD 
macAddress=F46ADD5746FB

Note that this specific Flock camera’s MAC address is F4:6A:DD:57:46:FB. Presumably, you can use this hard-coded API key to obtain credentials for any Flock camera, based on its MAC address. 请注意，这台特定 Flock 摄像头的 MAC 地址是 F4:6A:DD:57:46:FB。据推测，您可以使用此硬编码的 API 密钥，根据任何 Flock 摄像头的 MAC 地址获取其凭据。

The API appears to respond with an Auth0 client ID and secret. Auth0 is an identity management company owned by Okta. The camera then stores those credentials in plaintext. 该 API 似乎会返回一个 Auth0 客户端 ID 和密钥。Auth0 是一家由 Okta 拥有的身份管理公司。摄像头随后会将这些凭据以明文形式存储。

Btw, those credentials, which might actually still be live and active (I’m honestly not sure because I didn’t try them), are: 顺便说一下，这些凭据（我真的不确定它们是否仍然有效，因为我没有尝试过）是：

{ 
  "clientId":"CPkOAuOKFwNhPavKO01Htxbn6yIwASro", 
  "clientSecret":"ZRExGjbVjBB1wx04RmsMeWKbpMO5zQxLKNZg25D-1LUKbfQbmByajx-8lyB6LwSV" 
}

These credentials can then be used to mint bearer tokens by sending them to https://device-login.flocksafety.com/oauth/token, and getting back a short-lived FlockAuth0Token which can be used to interact with Flock’s backend servers, authenticated as this camera. 这些凭据随后可用于通过发送到 https://device-login.flocksafety.com/oauth/token 来生成持有者令牌 (bearer tokens)，并获得一个短期的 FlockAuth0Token，该令牌可用于以该摄像头的身份与 Flock 的后端服务器进行交互。

Where I found this in the data

我在数据中发现这些内容的位置

The API key is in the system partition. Download partitions/24_system.img (1.5 GB), extract it, and you’ll… API 密钥位于系统分区中。下载 partitions/24_system.img (1.5 GB)，解压它，你就会……