Hacker collective stegan0gram dismantles a Flock camera, recovering an encryption key and showing it runs ~20 apps on a midrange smartphone-grade processor

Flock camera footage and software are now accessible outside the company's control.

A hacker collective named stegan0gram has successfully dismantled a Flock Safety camera, extracting its software and an encryption key. This breach allowed them to access footage of thousands of vehicle detections. The hackers shared the recovered data with 404 Media and WIRED, who conducted a joint investigation. Their analysis revealed that the camera's software explicitly detects not only vehicles and license plates but also people and bicycles. The device, powered by a processor comparable to those in mid-range smartphones, runs approximately 20 different Flock-developed applications. The camera captures numerous images of passing vehicles, with logs showing over a million images generated in a few weeks. While sensitive storage remained encrypted, the recovered data provided significant insight into the camera's operational capabilities, including its detection of vehicle details and, controversially, human presence.

The recovery of an encryption key from the Flock camera highlights a critical vulnerability in the company's on-device security claims. This incident directly challenges Flock's assertion that even with physical access, footage remains inaccessible, as the hackers were able to unlock a substantial portion of the stored media. The revelation that the camera's software is designed to detect people, not just vehicles, raises significant privacy concerns regarding its widespread deployment by law enforcement and other agencies.

This breach signals a heightened level of sophistication among groups actively targeting surveillance technology. The ability to not only physically access but also reverse-engineer and extract functional components like encryption keys from devices like Flock cameras suggests that future attacks could focus on compromising similar systems. The disclosed detection capabilities for people and other non-vehicle objects will likely fuel further public debate and regulatory scrutiny around the scope and use of automated surveillance technologies.