A hacker collective calling itself stegan0gram took Flock Safety licence plate cameras out of the field, pulled them apart, and published the filesystem images through DDoSecrets. The teardown that followed describes a product that is, functionally, an Android phone on a pole with a solar panel.
The software stack is the headline. Android 8.1, released in 2017 and out of support since 2021. A Linux kernel at 3.18.71, also from 2017. The security patch level is frozen at June 5, 2018, which means these devices are carrying eight years of unfixed public vulnerabilities while recording vehicle movements for police departments.
What’s Actually in the Firmware
Researchers found an embedded API key in the firmware that appears to allow retrieval of credentials for any Flock camera given only its MAC address. Auth0 client credentials were sitting in plaintext on an unencrypted persist partition. A single unit recovered in Wauwatosa, Wisconsin had logged more than two thousand API calls to Flock’s backend.
Given the frozen patch level, the analysis notes the hardware is likely still exposed to CVE-2021-1905, a Qualcomm GPU use-after-free that yields full device control, and CVE-2018-9568, the kernel bug known as WrongZone that gets an attacker to root. Working exploit code for both has been public for years.
Flock’s answer was that nobody filed through its vulnerability disclosure process and that there wasn’t enough detail to evaluate the claims. That response is being read by city councils as evasive, and Boston is among the jurisdictions winding down deployments.
The Procurement Problem Behind the Technical One
Municipalities bought these systems the way they buy parking meters. A vendor demo, a council vote, a subscription. There is rarely a security requirement in the contract, rarely a firmware update obligation with teeth, and rarely anyone on staff who could verify compliance if there were.
Surveillance hardware gets procured on capability and priced on monthly fee, and the security posture of the device is treated as the vendor’s internal business. That works until the devices are physically accessible on public streets, which is the entire point of where they’re installed.
What Changes for the Vendors
The ALPR market has been consolidating around a few subscription providers with strong municipal sales motions and weak hardware engineering. Competitors will now lead with signed firmware, secure boot, hardware-backed key storage and a published update cadence, because those are suddenly things a city attorney can be made to care about.
Expect state procurement frameworks to catch up next. Once one state adds firmware currency and secret handling to its surveillance equipment schedule, the rest copy the language, and a product built on a 2017 Android image stops being sellable regardless of how good the plate reads are.
The cameras will keep working. The contracts are what’s at risk.