Hackers Crack Flock Camera, Expose 1.6M Images in 21 Days
Edge-device security took a real-world hit when a roadside camera was physically removed and its on-board storage examined. The unit amassed a large dataset in roughly three weeks, prompting questions about what local hardware can expose even when it is designed to protect data in transit and at rest.
Investigation into the device revealed two unencrypted partitions named vendor and media. Within the media partition lay an encryption key that unlocked another segment containing videos and still images. Although some highly sensitive storage remained encrypted, the episode illustrates how physical access to a single edge device can reveal substantial material and keys until broader protections kick in.
The vendor behind the camera has stressed that tampering with devices is illegal and that, in practice, footage is protected by encryption and kept only briefly on the device. While the company notes that protection mechanisms are in place, the real-world outcome depended on the specifics of how hardware is managed and deployed.
Over the 21-day window, the camera logged about 50,200 vehicles and produced roughly 1.6 million images. In typical operation, a passing vehicle triggered around 28 images, though some runs generated more than 100. In addition, investigators recovered 27,321 short video clips stored on the device.
Beyond license plates, the device included capabilities to flag pedestrians, bicycles, and other vehicle shapes before selecting assets for transmission to central servers. Plate reading and vehicle attribute identification—such as make, model, and color—appeared to be handled on the server side rather than on the camera itself. Although the system could detect when a person appeared in a frame, there was no clear evidence that facial recognition was actively being run on the device at the time of exposure, though detections were logged with a location and a confidence score.
Best practices emerge from this incident for teams deploying cameras and other unattended edge devices:
- Protect encryption keys separately from the data they protect, and ensure credentials can be revoked if a device is compromised.
- Limit local retention by design, reducing how much footage and metadata remains on hardware after uploads.
- Prepare for theft or tampering by implementing tamper detection, rapid isolation from networks, and remote wipe or disable capabilities where supported.
Importantly, this case does not prove that attackers can remotely pull millions of clips from cameras. It underscores the need for security strategies that extend beyond the cloud and account for what can be exposed when hardware ends up in the wrong hands.
