Reverse-Engineering Flock Cameras

Hackers captured a Flock camera and got a look (alternate link) at the software:

While much of the automatic license plate reader’s (ALPR) most sensitive storage remained encrypted and inaccessible, the joint analysis of the recovered data shows that software running on the device explicitly detects people as well as vehicles, license plates, and bicycles. The camera can produce dozens of images of a single passing vehicle and, according to several weeks of recovered logs, generated more than a million images. Its computer-vision software also sometimes isolated bumper stickers and other graphics, including, in one case, an American flag patch on a motorcyclist’s saddlebag.

If you’re wondering how the hackers got by disk encryption, one of the unencrypted partitions contained the key for an encrypted partition. That’s pretty bad security engineering.

Tags: AI, cameras, cars, reverse engineering

Posted on September 21, 2026 at 10:37 AM • 9 Comments

Comments

Anonymous • September 21, 2026 10:46 AM

Screw the Mudd-Slimeys. God bless Israel – the holy land.

Clive Robinson • September 21, 2026 1:51 PM

@ Bruce, ALL,

With regards,

“… one of the unencrypted partitions contained the key for an encrypted partition. That’s pretty bad security engineering.”

But is it really surprising?

I looked at a video of a Flock camera getting physically stripped down to see what hardware it used.

I was not impressed, to be blunt much of it was low cost “not made in the USA” type stuff.

The issue that the designers would have had as they are battery operated from a small solar cell is

How to do key negotiation when powering up from a flat battery…

I have a sneaky suspicion / feeling that encryption from any camera unit back to Flock HQ will use the same Key-Mat at some point. So when you know what it is for one you know what it is for others…

I guess we will have to wait for a full breakdown on that.

Clive Robinson • September 21, 2026 2:34 PM

@ Bruce, ALL,

Is the boot on the other foot?

Apparently the Washington D.C. Police force is challenging the use of Flock Cameras by the Internal Affairs [1].

But such news I hope is going to probably finally hit even the dimmest of those “Folks on The Hill” that every single road user that turns up to their homes no matter what the time of day will be recorded and available to who ever can get / be given access the pictures.

Worse any one with Flock access will be able to track backwards to where the road users originated and who they are.

And the “blackmail potential” of Flock and others who can “get access to the images” will be enormously persuasive…

[1] There are a lot of articles so I won’t bother with a link. Just say a search with the string

“D.C. Police union challenge Flock usage by internal affairs”

Will get you a whole selection only some of which will be Paywalled.

Anonymous • September 21, 2026 8:10 PM

You don’t have to wait, all of this was already done a year ago… and they didn’t fix any of the issues… https://media.defcon.org/DEF%20CON%2034/DEF%20CON%2034%20presentations/DEF%20CON%2034%20-%20Jon%20Gaines%20-%20Bird%20Hunting%20Season%20The%20Final%20Flight%20-%20PDF%20v1.pdf

U Think U'r A Man But U'r Only A Boy • September 22, 2026 4:10 AM

What happened to the USA?

https://www.aclu.org/issues/privacy-technology/surveillance-technologies/stingray-tracking-devices

After landing on the above page, tried clicking on the main story titled:
“Stingray Tracking Devices: Who’s Got Them?”

but the page is gone? Does anyone have a link to a site with a list of the
27 States with StingRays?

Thankee.

Anonymous • September 22, 2026 4:58 AM

@ U Think U’r A Man But U’r Only A Boy,

that article is eight years old so it is pretty safe to be certain that they/stingrays are now in 2026 – present in most if not in all 50 United States of America.
Then came Flock, and sadly we’re gonna get all chipped very soon (“for our own good/for the sake of children”).

Anonymous • September 22, 2026 5:44 AM

Your comment is being held for moderation and will be reviewed as soon as possible.

Your comment is being held for moderation and will be reviewed as soon as possible.
⬛⬛⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬛⬛
⬛⬛⬛⬛⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬛⬛⬛⬛
⬛⬛⬛🟨⬛⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬛🟨⬛⬛⬛
⬛⬛⬛🟨🟨⬛⬛⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬛⬛🟨🟨⬛⬛⬛
⬜⬛⬛🟨🟨🟨🟨⬛⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬛🟨🟨🟨🟨⬛⬛⬜
⬜⬛⬛🟨🟨🟨🟨🟨⬛⬛⬜⬜⬛⬛⬛⬛⬜⬜⬛⬛🟨🟨🟨🟨🟨⬛⬛⬜
⬜⬜⬛🟨🟨🟨🟨🟨🟨🟨⬛⬛🟨🟨🟨🟨⬛⬛🟨🟨🟨🟨🟨🟨🟨⬛⬜⬜
⬜⬜⬛🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨⬛⬜⬜
⬜⬜⬜⬛🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨⬛⬜⬜⬜
⬜⬜⬜⬜⬛🟨⬛🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨⬛🟨⬛⬜⬜⬜⬜
⬜⬜⬜⬜⬜⬛🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨⬛⬜⬜⬜⬜⬜
⬜⬜⬜⬜⬜⬛🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨⬛⬜⬜⬜⬜⬜
⬜⬜⬜⬜⬛🟨🟨🟨⬛⬛🟨🟨🟨🟨🟨🟨🟨🟨⬛⬛🟨🟨🟨⬛⬜⬜⬜⬜
⬜⬜⬜⬜⬛🟨🟨⬛⬜⬛⬛🟨🟨🟨🟨🟨🟨⬛⬛⬜⬛🟨🟨⬛⬜⬜⬜⬜
⬜⬜⬜⬜⬛🟨🟨⬛⬛⬛⬛🟨🟨🟨🟨🟨🟨⬛⬛⬛⬛🟨🟨⬛⬜⬜⬜⬜
⬜⬜⬜⬜⬛🟨🟨🟨⬛⬛🟨🟨🟨⬛⬛🟨🟨🟨⬛⬛🟨🟨🟨⬛⬜⬜⬜⬜
⬜⬜⬜⬛🟨🟨🟥🟥🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟥🟥🟨🟨⬛⬜⬜⬜
⬜⬜⬜⬛🟨🟥🟥🟥🟥🟨🟨⬛🟨⬛⬛🟨⬛🟨🟨🟥🟥🟥🟥🟨⬛⬜⬜⬜
⬜⬜⬜⬛🟨🟥🟥🟥🟥🟨🟨🟨⬛⬛⬛⬛🟨🟨🟨🟥🟥🟥🟥🟨⬛⬜⬜⬜
⬜⬜⬜⬜⬛🟨🟥🟥🟨🟨🟨🟨⬛🟥🟥⬛🟨🟨🟨🟨🟥🟥🟨⬛⬜⬜⬜⬜
⬜⬜⬜⬜⬜⬛🟨🟨🟨🟨🟨🟨⬛🟥🟥⬛🟨🟨🟨🟨🟨🟨⬛⬜⬜⬜⬜⬜
⬜⬜⬜⬜⬜⬜⬛⬛🟨🟨🟨🟨🟨⬛⬛🟨🟨🟨🟨🟨⬛⬛⬜⬜⬜⬜⬜⬜
⬜⬜⬜⬜⬜⬜⬜⬜⬛⬛⬛🟨🟨🟨🟨🟨🟨⬛⬛⬛⬜⬜⬜⬜⬜⬜⬜⬜
⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬛⬛⬛⬛⬛⬛⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜
Your comment is being held for moderation and will be reviewed as soon as possible.

UthinkU’rAmanButU’rOnlyAboy • September 22, 2026 7:59 AM

@ Anonymous • September 22, 2026 5:44 AM,

hey lil bro, that scribble of yours, did they not teach you in your kindergarten that your frustrations should be controlled in public?

Go slap yr parents for not raising a decent human being because littering public spaces the way u do it is not decent. It’s rude. We all come here to learn a thing or two from professor Schneier and are very grateful that he’s willing to share for free while you scream for attention non-stop here in this comment section.
Is your diaper full and requires 2 b changed?

This is the true epidemic of our modern societies, mememememe, screaming for attention in public cause u didn’t get any at home. You’re a sick lil narcissist.

memememememe

Rontea • September 22, 2026 9:16 AM

Flock’s claims of on-device encryption are only as strong as the keys they leave behind.

Reverse-Engineering Flock Cameras

Comments

Leave a comment Cancel reply