Reverse-Engineering a Flock Camera: It Detects People, and the Encryption Key Sat in the Open

Enthusiasts captured a Flock camera — an automatic license plate reader (ALPR) — and picked apart its software. A joint analysis of the recovered data showed the device does considerably more than its stated purpose would suggest.

More than plates

Beyond vehicles and license plates, the software explicitly detects people and bicycles. The computer-vision system can produce dozens of images of a single passing car. According to several weeks of recovered logs, the camera generated more than a million images.

What stands out is that the algorithm sometimes isolated bumper stickers and other graphics. In one case it singled out an American flag patch on a motorcyclist's saddlebag — a detail that has nothing to do with identifying a vehicle, yet readily lands in the system's field of view.

The key under the mat

Much of the most sensitive storage remained encrypted and inaccessible. But the researchers didn't have to break the encryption head-on: one of the unencrypted partitions contained the key to an encrypted one.

Bruce Schneier, who flagged the find, summed up this piece of security engineering bluntly — as pretty bad. Keeping the key next to the lock defeats the entire point of disk encryption.

The story is notable less for the technical details of the hack than for what it reveals: devices installed on the pretext of reading plates in fact assemble a far more detailed portrait of everyone who happens to enter the frame.

Source: Schneier on Security