Report: Flock Safety, Maker of SF's License Plate Reader Cameras, Had Gobsmacking Security Flaw

"Turns out anyone with an internet connection, and not even a password, could access the feeds of a line of the Flock surveillance cameras that are currently all the rage with the SFPD and Oakland Police Department. Below we see pictured what is likely one of those Flock Safety automated license plate reader cameras, one of the 400 of these new security cameras in SF that are are taking three million surveillance photos every day."

"To hear SFPD tell it, these Flock Safety cameras have been an absolute godsend for catching carjacking suspects and other criminals, and they're supposedly a huge driver of SF's recent notable drop in crime rates. The Oakland Police Department also loves their Flock Safety license plate reader cameras too, and the Oakland City Council just approved a $2 million contract renewal with Flock to keep using those cameras, albeit in a meeting that will probably be remembered for different reasons."

"And as the Trump's administration indulges in its spending spree on surveillance of US citizens for ICE and police state purposes, Flock Safety is a company positioned to do well for themselves right now. But the publication 404 Media just discovered an astonishing security flaw in a line of Flock Safety cameras. It turns out that anyone with an internet connection could hack into their security cameras, cameras whose feeds of public streets, playgrounds, and parking lots were not protected by any passwords."

Flock Safety automated license-plate reader cameras are widely deployed by San Francisco and Oakland police, with roughly 400 cameras in San Francisco capturing about three million surveillance photos daily. Police credit the cameras with helping catch suspects and contributing to recent crime reductions. Oakland approved a $2 million contract renewal to continue using the cameras. Security researchers at 404 Media discovered that a line of Flock cameras had a configuration flaw exposing camera feeds without passwords, allowing anyone with internet access to view public streets, playgrounds, and parking lots and obtain administrative control without credentials.

Read at sfist.com