Flock cameras expose security vulnerabilities and hardcoded credentials

The Flock cameras are operating on an outdated version of Android that is no longer receiving security updates. This lack of updates leaves the devices vulnerable to various exploits that have been patched in more recent versions of the operating system. The outdated kernel further exacerbates the potential for security breaches.

Among the vulnerabilities, two critical issues were identified: a use-after-free vulnerability in the Qualcomm Adreno GPU and a kernel socket type confusion vulnerability. These issues allow for potential escalations in privilege and remote code execution, presenting serious risks if exploited by malicious actors.

Additionally, the cameras contain hardcoded API keys that provide access to Flock's backend infrastructure. This means that anyone with access to the camera's firmware could potentially gain unauthorized access to sensitive data and services, leading to significant security concerns for users relying on these systems.

In light of these vulnerabilities, Flock's response, which suggests a lack of reported issues through their vulnerability disclosure policy, raises concerns about the company's commitment to addressing security flaws. This could diminish trust among users and stakeholders who rely on the safety and security of these surveillance systems.

Finally, the findings highlight a crucial need for manufacturers to prioritize security throughout the lifecycle of their products. Regular updates and robust security practices are essential to protect against evolving threats in the cybersecurity landscape.