A stolen Flock Safety license-plate camera yielded roughly 1.6 million images after hackers physically removed and reverse-engineered the device, but a former Secret Service cybercrime expert says the incident does not appear to have compromised Flock’s broader cloud network.
Jason Brown, director of customer advisory and counter-fraud lead at threat intelligence firm iCOUNTER, spent 25 years with the U.S. Secret Service and specialized in cybercrime.
Brown told FOX Business that the distinction between accessing one physically stolen camera and breaching Flock’s network is critical.
“The biggest thing I keep hammering at home [is] that Flock was never compromised,” Brown said. “So there’s never been a large dump of information out of their network.”
AUSTRALIAN PRIME MINISTER SAYS OPENAI AGENT ACCESSED GOVERNMENT HEALTH WEBSITE, RAISES ‘EXTREME CONCERN’
According to WIRED, hackers physically removed a Flock camera from above a roadway and reverse-engineered it. They reportedly discovered encrypted and unencrypted portions of the device’s storage and recovered an encryption key stored on the camera that allowed them to unlock additional data.
“This was a situation where somebody physically had access to a camera because they stole it off of a pole, took it home, and then did backward engineering on that camera,” Brown said.
“That did not give them the capability to actually log into the cloud portion of Flock, and nothing in the cloud of Flock proper was accessed.”
According to WIRED’s analysis, the recovered logs covered roughly 21 days of activity, including 1.6 million images, 50,200 vehicles and 27,000 short video clips.
Flock cameras capture images and short videos of passing vehicles, which are transmitted to the company’s cloud infrastructure for processing and can then be searched by authorized law enforcement users.
OPENAI, 100+ COMPANIES WARN OF COMING SURGE IN AI-POWERED CYBERATTACKS, CALL FOR GLOBAL DEFENSE PUSH
Brown characterized the stolen-camera incident and an earlier security issue in which some cameras temporarily became accessible over the internet as isolated events rather than evidence, based on what he knows, of a broader compromise of Flock’s system.
“They are one-off situations and don’t show a larger problem for the Flock system that I’m aware of,” Brown said.
Brown said some cameras had previously been remotely accessible because of weak authentication controls, but said the issue was addressed and did not result in access to Flock’s cloud infrastructure.
He said Flock reports that about 97% of law enforcement agencies using the system now have multifactor authentication enabled.
Brown also argued that the presence of a Flock camera should not change how people conduct themselves in public.
“Should a person conduct themselves differently because a Flock camera is there? I would argue no,” he said.
BANKS WARN AI SHOPPING AGENTS COULD INCREASE RISK OF SCAMS, FRAUD AND DATA PRIVACY BREACHES
“We’ve seen good uses of the technology, where individuals, a murder is committed in one city and the individuals responsible for it were identified by Flock cameras in another city,” he continued. “You know that that’s a positive, but we all have to understand that whenever we’re out in public, we do not have a reasonable expectation of privacy. We are in public. Anybody can take a picture of us at any time. It may not be the polite thing to do, but anybody can do it at any point in time.”
“The debate of do you have Flock in your community – that’s a debate for the community,” Brown added.
Still, Brown said the incident illustrates a broader cybersecurity issue involving third-party and supply-chain risks “that many corporations would see.”
Brown said the rapid advancement of artificial intelligence makes addressing those risks increasingly important.
“The security posture of everything is changing by the minute,” he said.
“We have [to] gather intelligence on what is happening with the third parties and then work with those third parties before the incident even occurs to ensure that they are secure, so our customers are ultimately secured,” he continued. “And in this day of AI, the speed and the veracity of that only increases by the minute.”
FOX Business has reached out to Flock for comment.
Read the full article here