Full transcript
The city of Aurora
is celebrating the launch of a fleet of Flock camera drones
to layer on top of the Flock license plate tracking cameras,
just as researchers say that Flock's surveillance system
is incredibly easy
to hack.
Our Spencer Sawcher has that.
Quincy
and
Parker
Road eastbound.
Aurora police are excited to show off their new real-time information center
and their new partnership with Flock
for a drone as first responder program.
Aurora already has Flock's AI scanning cameras all over town.
I mean,
it's
extraordinarily easy.
Like 12 year olds could do it.
Cameras that experts.
Say are quite easy to hack.
It
would be about 30 seconds.
Um,
you took control of the cameras in under 30 seconds.
Correct?
Yeah,
yeah.
John Gaines is a cybersecurity researcher.
A camera would,
would connect to this,
right?
Uh,
but this is like the brain behind it,
right?
He bought Flock cameras on eBay and
started looking for vulnerabilities in Flock's system.
Before a bad actor could,
the stuff that is running on the devices themselves is also lacking,
he
says.
The security on the devices was so low level
he can plant data on the cameras
and was even able to pull footage off of the camera
from the factory where it was made.
A
hypothetical worst case,
I can,
uh,
remote wirelessly can connect to this device and plant footage that will result in,
let's say,
a hit coming up on the hotlist and the cops showing up to somebody.
Those issues caught Ben Jordan.
Attention,
a YouTuber and a researcher
whose new video featured some of the 51 vulnerabilities
that John found.
For
the video,
I kind of concentrate on the ones that were the most severe,
the most egregious vulnerability,
Ben believes is the no mandate of multi-factor authentication for police.
The same thing you have to use to log into your Google account
is not required for all police departments to log into Flock.
Well this is a national security risk like this actually needs to be
dealt with because I was finding accounts for sale on the dark web.
Ben says he was able to find police flock logins on the dark web,
though he didn't buy them for legal reasons.
Flock responded to this research,
saying 97% of their customers now use multi-factor authentication,
and that around this time last year it started forcing new customers to use it.
Not having multi-factor authentication
on
a camera that's logging
the location of everybody is
just unfathomably bad.
Both Aurora and Denver police told me tonight
that they require multi-factor authentication for their flock logins,
even though Kyle,
there is no mandate for that
with the company.
Oh boy,
so when you talk about the idea of not
just somebody getting in and looking at the video,
but somebody being able to plant
video in there.
We just saw that case out of the Denver suburbs where
cops told that woman they had her dead to rights,
accusing her of a crime,
she had to prove her innocence,
which she did
because they said that they supposedly had video of her.
Right,
it could be so consequential in the fact that
you put something on there and
people are very adamant that,
well,
our camera saw you in this particular place,
in this particular space,
you could easily,
easily,
uh.
Plant something,
put something there that could hurt somebody's
chances in court,
could really hurt their criminal record.
It could have awful outcomes.
Sure,
I think everybody understands how useful these cameras are to solving crimes.
But some of this stuff is like
pretty dystopian.
All right,
well,
I appreciate you staying on it,
Spencer Sawcher.
Thank you.