Hackers breach Flock camera, recover 1.6m images

Hackers who physically removed a Flock Safety roadside camera were able to copy much of its internal storage, uncover an encryption key and access tens of thousands of video clips and data linked to about 1.6 million images generated over 21 days.

The compromise involved a single camera taken from above a roadway and did not amount to a remote breach of Flock Safety’s cloud network. The group behind the operation, calling itself stegan0gram, reverse engineered the device and shared its contents for independent technical examination.

The copied material included 27,321 short MP4 video files, each roughly one to two seconds long, recorded at 1,024 by 768 pixels and without audio. Logs recovered from the device showed that, across about 21 days of recorded activity, the camera photographed roughly 50,200 vehicles and generated around 1.6 million still images.

A typical passing vehicle triggered about 28 images, while some generated more than 100. The camera used different exposures to capture licence plates and wider views, then selected and cropped useful frames before transmitting data over a cellular connection. The recovered software indicated that plate reading and identification of vehicle make, model and colour were carried out on Flock’s servers rather than entirely on the roadside unit.

The hackers also found an encryption key stored on an accessible area of the device. That key was used to unlock another partition containing media. More sensitive parts of the camera’s storage remained encrypted and could not be accessed, meaning the extraction was substantial but not complete.

The findings raise questions about the resilience of on-device protections when a camera is physically compromised. Flock has previously said its cloud infrastructure has not been hacked and has emphasised that customer information is protected through encryption and other security controls.

Responding to the disclosure, a Flock spokesperson said the unauthorised removal and tampering of a camera was illegal. The company said it had received no report through its public vulnerability disclosure process and did not have enough technical detail to assess the claims. It urged anyone who identified a legitimate vulnerability to submit findings through that process for review.

Analysis of the recovered software also showed that the camera could detect people as well as vehicles and licence plates. Tests of the extracted models against the stored video files identified people in 11 clips, all riding motorcycles. No evidence was found that the system was actively using facial recognition beyond capabilities present by default in the Android operating system.

The camera’s object-detection software also produced occasional errors. In some instances, it treated bumper stickers, dealership frames and other graphics as licence plates. One motorcycle clip showed an American flag patch on a saddlebag being cropped as though it were a plate.

The recovered logs showed heavy local processing and storage activity. On a typical recorded day, the device logged about 3,300 vehicles, with a peak of 4,454. Older logs had been overwritten or were no longer recoverable, so the 21-day dataset did not represent the full operating life of the camera.

The incident also highlights the distinction between compromising a field device and penetrating a central service. Physical possession gave the group time to inspect storage partitions and software directly, while there was no evidence that credentials obtained from the unit were used to enter Flock’s cloud systems or access other customers’ data. That distinction limits what can be inferred about the security of the wider network from this camera alone.

Flock’s devices are used by police departments, municipalities, businesses and neighbourhood organisations to identify vehicles associated with criminal investigations or other alerts. The company markets its cameras as automated licence plate readers that can search for vehicle characteristics and movements across participating networks.

The extracted software indicated that the roadside unit ran roughly 20 Flock-built applications handling tasks including motion detection, image capture, object classification, uploading data and receiving remote updates. The camera’s processor was comparable to hardware used in mid-range smartphones.