Having hardcoded credentials is a sign of total incompetence. In this case at least it wasn't a password, but an API key which can be used to request credentials (stored in plaintext) which look like they'd get you access Flock's servers. Not quite as bad as a hardcoded admin password, and it's not clear what you'd be able to do if you did authenticate successfully as a camera, but its worrying enough. There have been enough vulnerabilities found in Flock's systems that it's pretty clear they aren't concerned about their security and it's plainly obvious that they don't care at all about our privacy or security.
Even if we decided that this level of mass surveillance on the American public was acceptable to us, Flock Safety/Flock Group as already demonstrated that they can't and shouldn't be trusted to implement it.
I don't think having credentials stored on the device is all that fatal. The device has to read them back, after all. What they did, however, is much worse: the credentials come from the MAC address. So they're literally broadcasted on every network packet.
The device runs Android, which makes it very simple to use the Keystore system and to store a device specific private key within the TEE or SE where it can't be very easily extracted. If you really don't want to provision in the factory, you could use secure boot measurements to do it remotely. Of course this isn't completely watertight either against a physical attacker, but it would survive a filesystem dump attack and is the least you can do to appear competent.
Discussion about the article this post is talking about: https://news.ycombinator.com/item?id=49726586
Comments moved thither. Thanks!
I've added https://micahflee.com/flock-cameras-are-riddled-with-securit... to the toptext there.
Having hardcoded credentials is a sign of total incompetence. In this case at least it wasn't a password, but an API key which can be used to request credentials (stored in plaintext) which look like they'd get you access Flock's servers. Not quite as bad as a hardcoded admin password, and it's not clear what you'd be able to do if you did authenticate successfully as a camera, but its worrying enough. There have been enough vulnerabilities found in Flock's systems that it's pretty clear they aren't concerned about their security and it's plainly obvious that they don't care at all about our privacy or security.
Even if we decided that this level of mass surveillance on the American public was acceptable to us, Flock Safety/Flock Group as already demonstrated that they can't and shouldn't be trusted to implement it.
I don't think having credentials stored on the device is all that fatal. The device has to read them back, after all. What they did, however, is much worse: the credentials come from the MAC address. So they're literally broadcasted on every network packet.
The device runs Android, which makes it very simple to use the Keystore system and to store a device specific private key within the TEE or SE where it can't be very easily extracted. If you really don't want to provision in the factory, you could use secure boot measurements to do it remotely. Of course this isn't completely watertight either against a physical attacker, but it would survive a filesystem dump attack and is the least you can do to appear competent.
[dead]
tldr from my skim, the two worst things:
* Probably vulnerable to CVEs that were patched in 2018 and 2021.
* Generates API key to phone home based only on its own MAC address.