Surveillance Overload: Monitoring Dozens of AI Camera Feeds

Exposed Livestreams of Flock’s AI-Powered Surveillance Cameras

A concerning discovery by tech YouTuber Benn Jordan and 404 Media revealed that more than 60 livestreams from Flock’s AI-powered surveillance cameras were accessible on the web without the need for login credentials. This security vulnerability allowed anyone to view live feeds from various locations in real-time.

Flock, a technology company that collaborates with law enforcement agencies and businesses nationwide, deploys a network of AI-powered cameras. Recently, Flock partnered with Ring, enabling Flock customers to request footage from Ring’s Neighbors app users. The exposed livestreams connected to Flock’s Condor cameras, equipped with advanced features like pan, tilt, and zoom for automatic tracking of individuals and vehicles.

In a shocking revelation, Benn Jordan shared instances of observing individuals going about their daily activities, unaware that they were being monitored. From a man leaving his house in New York to a woman jogging in Georgia, the AI-powered cameras captured various moments with precision. Jordan’s collaboration with GainSec led to the discovery of these livestreams on Shodan, a search engine for internet-connected devices.

As detailed by 404 Media, the exposed livestreams not only provided real-time feeds but also access to administrator control panels. This allowed unauthorized individuals to download video archives, modify settings, delete footage, view log files, and conduct diagnostics. The lack of required credentials made it easy for anyone with the stream links to exploit this security loophole.

Further investigations by Jordan and Jason Koebler from 404 Media involved visiting the physical locations of the Flock cameras seen on the livestreams. This breach raised serious privacy concerns and highlighted the importance of robust security measures in surveillance technology.

In response to the incident, a Flock spokesperson acknowledged the misconfiguration on a limited number of devices, stating that it has been rectified. However, Flock did not immediately address inquiries from The Verge regarding the security breach.