tptacek

Engadget reports there are now over 100,000 Flock cameras in the US, running modified Android, feeding a searchable network where a Texas officer can query Massachusetts footage and ICE rides along through local police. Searcher Benn Jordan found 70-plus cameras streaming live, password-free, in December 2025.

Then an HN commenter who co-led the campaign that removed Flock from Eugene and Springfield, Oregon and helped draft state ALPR law said his team decompiled a device: the object-detection categories included 'cat,' 'dog,' 'person,' 'bicycle' — confirming from the binary what marketing implies.

Disclosure ran 124 days, when the fix was essentially adding an 's' to a couple of URLs. The eventual "signature verification"? A CRC32 checksum — which any attacker can trivially recompute.

Known security voices reframed it: AMD never denied it was a vulnerability, only that it was in scope — and at big vendors, bounty teams are measured on payouts. The dark comedy: the updater may be too broken to exploit.