FLOCK simeononsecurity vulnerabilities
page 1 / 9
SimeonOnSecurity — Flock Safety Camera Security Vulnerabilities: 50+ Flaws (2026)
retrieved 2026-07-11
archived for offline mesh reading
------------------------------------------------------------
simeononsecurity
en
Flock Safety Camera Security Vulnerabilities: Critical Analysis of 50+ Discovered Flaws in 2026
2026-05-24
— Written by
SimeonOnSecurity
— 25 min read
Edit Page
Edit Page
Table of Contents
50+ Critical Security Vulnerabilities Expose Nation’s Largest Private Surveillance Network
Introduction: A National Security Crisis
In late 2024 and throughout 2025, independent security researchers uncovered what may be the most significant security failure in law enforcement surveillance technology in American history. Over 50 critical vulnerabilities have been discovered in Flock Safety’s camera systems - the same cameras that photograph and track over 150 million vehicles daily across more than 80,000 deployments nationwide.
This article provides a comprehensive technical analysis of these vulnerabilities based on:
- GainSec’s formal white paper “Examining the Security Posture of an Anti-Crime Ecosystem” (51 findings, 22 assigned CVEs, 8 pending)
- Ben Jordan’s investigative journalism and hands-on security testing
- 404 Media’s reporting on publicly exposed camera feeds
- Official responses from Flock Safety and U.S. Senators
- National Vulnerability Database (NVD) published disclosures
For context on why these cameras exist and privacy implications, see our article: Flock Safety Camera Surveillance: Prevalence, Privacy Concerns, and Protection Strategies
For information on detecting these cameras, see: Flock-You Detection Project: Counter-Surveillance Hardware Guide
The Scope of the Problem
Scale of Vulnerable Infrastructure
As of May 2026:
- 80,000+ Flock Safety cameras deployed across the United States
- 5,000+ cities and towns using Flock services
- 3,500+ law enforcement agencies with system access
- 22,000+ law enforcement users accessing databases
- Billions of data points stored in searchable databases
Vulnerability Timeline
- Late 2024: Initial vulnerabilities discovered by security researcher Jon “GainSec” Gaines
- February 2025: Responsible disclosure to Flock Safety begins
- April 2025: First CVE assignments published
- November 2025: Formal white paper published with 51 findings
- December 2025: Ben Jordan demonstrates vulnerabilities on video
- January 2026: 404 Media discovers 60+ publicly accessible camera feeds
- February 2026: U.S. Senators request FTC investigation
- May 2026: Ongoing disclosure process continues
Vulnerability Categories
The 50+ vulnerabilities span multiple categories:
- Authentication & Authorization (hardcoded passwords, lack of MFA)
- Cryptography & Encryption (unencrypted data at rest and in transit)
- Network Security (exposed WiFi access points, clear-text credentials)
- Physical Security (button press exploits, exposed USB ports)
- Data Privacy (unauthorized data collection, extended retention)
- System Design (outdated software, inadequate access controls)
- Information Disclosure (exposed API keys, public camera feeds)
Critical Vulnerability #1: Button Press Wireless Access Point
CVE-2025-XXXXX (Pending Assignment)
Severity: CRITICAL (CVSS 9.8)
The Exploit
The most alarming vulnerability discovered allows anyone with physical access to a Flock Safety camera to gain complete control in under 60 seconds:
Step 1: Press the button on the back of Falcon/Sparrow camera three times
Step 2: Device creates open WiFi access point
Step 3: Connect to WiFi network (hardcoded password: documented in GainSec white paper)
Step 4: Send ADB (Android Debug Bridge) enable command
Step 5: Connect via ADB and obtain root shell access
Technical Details
Device: Flock Safety Falcon/Sparrow ALPR Camera
Hardware: Android Things 8.0/8.1 (EOL 2021)
Attack Vector: Physical button press sequence
Authentication: Hardcoded WiFi password (universal across devices)
Impact: Complete device compromise, data exfiltration, malware installation
What This Enables
Once shell access is obtained, an attacker can:
- Extract all stored imagery (including people, not just vehicles)
- Modify or delete evidence stored on device
- Install persistent malware (survives reboots)
- Clone device identity for spoofing
- Intercept and modify video streams
- Use device as botnet client for DDoS attacks
- Capture WiFi credentials from nearby devices (honeypot attacks)
- Disable camera or cause denial of service
Demonstration
Security researcher Ben Jordan demonstrated this exploit on YouTube, showing:
- Connection to WiFi access point in under 30 seconds
- Root shell access obtained in under 60 seconds total
- Complete access to file system, stored images, and system memory
- Ability to install arbitrary Android applications
Quote from demonstration:
“The password for that access point is [REDACTED] in all lowercase. For every single camera that we’ve tried, it all has that hard-coded password. Then you just send it a command to enable ADB…it’s probably under 30 seconds, you can completely shell the device and have full access to it.”