Numerous Flock AI camera streams were left exposed online.
A significant security oversight left livestreams from over 60 of Flock’s AI-driven surveillance cameras accessible online, enabling anyone to view real-time feeds without needing any login credentials, as revealed by tech YouTuber Benn Jordan and an investigative outlet.
Flock specializes in deploying a network of AI cameras for various law enforcement agencies and businesses across the nation. Recently, they teamed up with Ring, allowing Flock users to request footage from the Ring Neighbors app. Many of Flock’s cameras are designed to capture vehicle license plates, but the exposed feeds were from Flock’s Condor cameras, which have the capability to pan, tilt, and zoom, allowing them to automatically track individuals and vehicles.
In his video, Jordan shared his experience: “I watched a man leave his house in the morning in New York. I watched a woman jogging alone on a forest trail in Georgia. This trail had multiple cameras, and I could watch a man rollerblade and then take a break to watch rollerblading videos on his phone. How? Because the camera’s AI automatically zoomed in on it — just like it zoomed in on a couple arguing at a street market in Atlanta.”
Jordan collaborated with Jon “GainSec” Gaines, who previously identified security vulnerabilities in Flock’s system, to discover the live feeds on Shodan, a search engine for internet-connected devices.
The duo found numerous Flock live feeds and admin control panels, where they could not only watch the streams but also download video archives from the past 30 days, modify settings, delete footage, access log files, and run diagnostics. Anyone with the stream links could view them without any credentials.
In some instances, Jordan and Jason Koebler from the investigative outlet visited the locations of the Flock cameras, where they were recorded and broadcasted on the publicly accessible livestreams.
A spokesperson for Flock stated, “This was a limited misconfiguration on a very small number of devices, and it has since been remedied.” Flock did not respond immediately to requests for further comment.
