Flock Safety Cameras Carry a Universal Hard-Coded Key

Anyone who knows a Flock Safety camera's MAC address can pull data from its backend using a hard-coded key embedded in the device's firmware, security researcher Micah Lee found in an analysis published Sept. 16.

Lee's findings follow a filesystem image that DDoSecrets, a nonprofit that publishes leaked and hacked datasets, released the same morning. The image was taken from the storage partitions of an in-use Flock automated license-plate reader, the type of camera departments use to log passing vehicles. Neither DDoSecrets nor Lee said how the camera's storage was obtained.

An Android build patched once, in 2018

The camera runs Android 8.1 with a security patch level of June 5, 2018, and a Linux kernel, version 3.18.71, that has been unsupported since 2019, according to Lee's analysis. Both carry known, high-severity flaws that were never patched on the device: CVE-2021-1905, a Qualcomm Adreno GPU use-after-free rated 7.8 on the CVSS scale and previously used to gain full control of Android devices, and CVE-2018-9568, a kernel socket type-confusion bug known as WrongZone, also rated 7.8, which grants root access without any additional privileges.

A key that reportedly works on every unit

The firmware also stores a hard-coded API key, beginning HaJ3FgupAm, tied to a backend at hpnotiq.flocksafety.com, along with an Auth0 client ID and client secret baked into the same build. Combined, Lee wrote, the credentials let anyone pull data for any Flock camera by its MAC address, not only the one he examined. The Terminal is not publishing the full key or secret.

What one Wisconsin camera showed

The device Lee examined carried serial number 23091220026 and was installed in Wauwatosa, Wisconsin. Its logs recorded 2,264 calls to Flock's backend and included the camera's own GPS coordinates 155 times, all within about 100 meters of each other, narrow enough to place the unit on a specific block.

Component	What Lee found	Status as of Sept. 16
Android	Version 8.1, patch level June 5, 2018	Unpatched roughly 8 years
Linux kernel	Version 3.18.71	End-of-life since 2019
CVE-2021-1905 (Adreno GPU)	CVSS 7.8, use-after-free	Present, unpatched
CVE-2018-9568 (WrongZone)	CVSS 7.8, root escalation	Present, unpatched

What Flock said, and did not say

In a statement Lee published, Flock said: "Flock takes security seriously and maintains a public Vulnerability Disclosure Policy for security researchers to report potential vulnerabilities directly to us." The statement did not address whether anyone had used that process to report the flaws Lee found before he published them.

Hackaday's Jenny List, reviewing Lee's findings Sept. 17, called the outdated build "a basic lapse" that "a product marketed for use by law enforcement might have paid attention to."

It is the second hard-coded-credential disclosure on this beat in two days. CISA's Sept. 17 advisory on the Bransys ELD trucking app described a similar flaw exposing live location data across a subset of carriers. Flock's camera joins routers running years-old MikroTik firmware on a growing list of fielded hardware that goes years between updates once it leaves the factory.

Flock has not said whether the credentials Lee found are unique to the camera he examined or shared across its fleet, and it has not said whether it has rotated them since publication.