Flock's network is only as secure as its weakest user

Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

1. 20:46

   and what the response has been to that. I mean, starting out, I found out that they didn't have, at the time in early 2025, they didn't require multi-factor authentication. And I also witnessed a police officer logging into Flock from a Wi-Fi network that wasn't at a police station. And so immediately, like, you know, had you told me those things, I wouldn't believe them. But witnessing it happening made me go, oh, OK, this is something that needs more looking into.

2. 21:14

   So I started, I'm like, OK, well, it's probable at that point because now you have human error and you have, if all of these police departments are sharing data with one another, then it could just be the dispatcher, somebody who's not even deputized, that has a Flock account at, I don't know, a rural Louisiana police department, and that person could sell their account or that person could click the wrong link in an email and whatever.

3. 21:39

   So I started looking for flock credentials on the dark web, and I found some, and they were coming from a Russian vendor. And then I started thinking, okay, well, how exactly did that happen? That's when I met John Gaines, found that there was a lot of, at the time, there was a lot of hardware vulnerabilities in the camera where you could get them to open up a Wi-Fi access point, and then you could get complete control over the Android device and you could root it and have it do whatever you wanted in a way that would be undetectable because it's happening outside of the Flock ecosystem on the device.

4. 22:11

   I had found a bunch of Flock. cameras that were just, their administrative interfaces were open on the internet. So you could just type in the IP address and then delete footage, watch footage from 30 days ago. You could even like put files on the device, look at all the logs. In all of these situations, we found a lot of plain text credentials, things that shouldn't have been there. And yeah. And so, I mean, at first the pushback from the company was that I'm a YouTuber and I was doing magic tricks and I'm not a serious security researcher um i think that me reading their statement about having never been hacked through a camera through a flock camera and then downloading it on on my own machine kind of made that indisputable you know they still disputed it for a while but but it was i think that is what really got like the media involved in and i'm finally paying attention to

5. 23:04

   it since then it's been like smaller things that i've found but more so the bigger deal here is that no matter if you're using flock or axon or whatever it is it because now you have axon and motorola also launching their own private networks outside of the ncic and so now that you have this it's like yeah the the person on this entire network with the worst security hygiene is going to be as secure as the entire network will be right that that's the big problem if i were to have it my way um police police officers would not have access to flock at all like i mean if i If I were to have it my way, you wouldn't have this level of surveillance.