Flock cameras are riddled with security vulnerabilities and hardcoded creds

A leaked set of filesystem images from an in-use Flock automatic license-plate recognition camera reveals a device running an end-of-life software stack and containing obvious operational secrets. The camera’s Android build (sdk 27, release 8.1) reported a security patch date of 2018-06-05 and its kernel is Linux 3.18.71, leaving it unpatched for many years and exposed to publicly known exploits such as CVE-2021-1905 (Adreno GPU use-after-free) and CVE-2018-9568 (kernel socket type confusion), among others. The firmware images include system and boot partitions (e.g., partitions/24_system.img and partitions/21_boot.img) that make these versions trivial to verify, and a vendor response pointed to a vulnerability disclosure process rather than an immediate mitigation.

The firmware and persist/media partitions also contain hard-coded and plaintext credentials that link the device to Flock’s production infrastructure. A shared library bundled into dozens of Flock apps exposes an x-api-key embedded in CameraSettings; that key is sufficient to request per-device Auth0 client_id/client_secret pairs from hpnotiq.flocksafety.com, and those secrets were found in persist/auth0/auth0_cred. Logs stored (and only lightly protected) in media partitions include the camera’s MAC, thousands of provisioning calls, GPS coordinates (43.10151313, -88.05270186) and a serial number, pinpointing a camera on N Mayfair Rd in Wauwatosa, WI. The combined flaws enable backend impersonation and token minting and raise significant privacy and security concerns for deployed ALPR systems.