Hardcoded Passwords and Live Camera Feeds on the Open Internet: 51 Security Flaws in the Nation's Largest Police Surveillance Network

Somewhere in the Bay Area, a Flock Safety Condor camera was pointed at a children's playground. It was streaming live, unencrypted high-definition video directly to the open internet. No username. No password. No authentication of any kind. Anyone with a web browser and a specialized search engine could watch children play in real time from anywhere on the planet.

That camera was one of roughly 60 to 70 Flock Condor PTZ units that independent security researcher Jon "GainSec" Gaines discovered streaming openly during his examination of the company's infrastructure. The exposed feeds included residential driveways in New York, public forest trails in Georgia, and the Bay Area playground. One exposed endpoint revealed a live API key embedded in 5,000 lines of source code that provided tracking access to live police patrol cars in Aurora, Colorado, and a massive map layer from Dallas, Texas, containing 6,000 records of hot-list alerts spanning five continuous months.

The company responsible for this system tracks the movements of hundreds of millions of American vehicles. It operates in more than 6,000 cities. It is valued at $8.4 billion. And its security posture, as documented by independent researchers and reported to the National Vulnerability Database, is catastrophic.

51 Findings, 20 CVEs, One White Paper

Between late 2024 and mid-2025, GainSec conducted a systematic security assessment of Flock Safety's hardware and software ecosystem. The findings were published in a formal white paper titled "Examining the Security Posture of an Anti-Crime Ecosystem." The document catalogued 51 severe security findings, which resulted in the assignment of over 20 Common Vulnerabilities and Exposures through the National Vulnerability Database.

The scope of the failures was not limited to a single product or a single software version. The vulnerabilities spanned the entire Flock ecosystem: the Falcon ALPR cameras deployed on American roadways, the Condor PTZ video cameras providing live surveillance of public spaces, the mobile applications used by law enforcement to access the database, and the web portals that serve as the primary interface for thousands of police departments nationwide.

The technical specifics reveal a company that prioritized the speed of deployment over every basic principle of security engineering. These were not sophisticated zero-day exploits requiring state-level resources to discover. They were elementary failures that a first-year security student would flag in a classroom exercise.

The Password Was in the Code

CVE-2025-59407 documented that the Flock Safety Android application bundled a Java Keystore file named flock_rye.bks along with its hardcoded password, flockhibiki17, directly in the application's source code. The keystore contained a private key. Anyone who downloaded the application and decompiled it, a trivial operation requiring freely available tools, could extract the key and use it to impersonate authorized system components.

CVE-2025-59405 revealed a parallel failure. Cleartext DataDog API keys were embedded within the client-side software running on Falcon and Sparrow readers. An attacker could decompile the application and extract OAuth secrets with no specialized knowledge. The keys were sitting in the code, readable as plain text, waiting for anyone who looked.

Hardcoded credentials are not a minor oversight. They are the single most basic security failure in software engineering. The practice is explicitly prohibited by every major security framework, including OWASP, NIST, and CISA guidelines. A company that hardcodes passwords into production systems deployed across 6,000 American cities is not making a technical error. It is demonstrating that security was never a design priority.

Seven Feet Off the Ground, Zero Physical Security

The Falcon cameras that form the backbone of Flock's nationwide ALPR network are mounted approximately seven feet off the ground using simple hose clamps. They are attached to public utility poles, street signs, and existing infrastructure on public roadways. They are physically accessible to anyone who can reach them.

Researchers demonstrated that the cameras lacked basic physical tamper protections. Pressing a specific sequence of physical buttons on the back of the device, or plugging a malicious USB device into an exposed port, immediately bypassed the system's security controls and generated a rogue Wireless Access Point. From that access point, an attacker could obtain a root shell, granting total remote control over the camera.

With root access, an attacker could exfiltrate unencrypted data, including stored license plate images and vehicle fingerprints. They could alter historical footage, planting false evidence or erasing real records. They could install persistent malware that would survive reboots and continue operating indefinitely. The entire attack could be executed with a $5 USB "Rubber Ducky" device available from any electronics retailer.

The underlying operating system running on the Falcon cameras was Android 8, a version of the Android OS that Google released in August 2017 and stopped providing security patches for years ago. Every known vulnerability in Android 8, and there are hundreds, is an exploitable attack surface on every Falcon camera in the country.

35 Stolen Accounts on the Dark Web

The web portals used by law enforcement officers to access Flock's nationwide database did not require mandatory multi-factor authentication. An officer's account was protected by a password and nothing else. No hardware token. No authenticator app. No biometric verification. Just a password.

The cybersecurity intelligence firm Hudson Rock reported the inevitable consequence: hackers had successfully breached and stolen at least 35 Flock customer accounts. Those credentials were offered for sale on dark web marketplaces. Anyone who purchased them could log into the system as an authorized law enforcement officer and run queries against the movement histories of hundreds of millions of American vehicles.

The MFA methods that Flock did offer as optional features relied on SMS text messages, a method that CISA has explicitly classified as insecure and unsuitable for protecting sensitive government systems. Phishing-resistant, hardware-token MFA, the standard mandated by CISA for federal operations, was not available.

The absence of mandatory MFA produced a cascading failure that destroyed the integrity of the system's audit trail. Senator Ron Wyden and Representative Raja Krishnamoorthi identified this in their formal letter to FTC Chair Andrew Ferguson: because officers could access the system using other users' credentials without detection, the internal audit logs that Flock markets as a "Transparency Portal" are functionally worthless. The logs record which account ran a query. They cannot verify which human being was sitting at the keyboard.

The Senator, the Representative, and the FTC

The scale of the security failures prompted federal lawmakers to act. Senator Ron Wyden and Representative Raja Krishnamoorthi formally petitioned FTC Chair Andrew Ferguson to launch an investigation into Flock Safety's data security practices.

The letter was unequivocal. The lawmakers wrote that Flock Safety's "cavalier attitude towards cybersecurity needlessly exposes Americans to the threat of hackers and foreign spies tapping this data." They highlighted the company's failure to mandate multi-factor authentication, the exposure of live camera feeds on the open internet, and the fact that federal agents were able to access the system using other users' passwords without triggering any security alert.

The letter raised a question that the company has never publicly answered: if hackers, foreign intelligence services, and unauthorized federal agents can access the same database that tracks the daily movements of the American public, what exactly is the system protecting?

The Irony of the Locked Box

Flock Safety's contracts with municipalities include strict provisions prohibiting cities from decompiling, reverse engineering, or independently auditing the cameras or the software running on them. The Hardware-as-a-Service model means the city pays for the cameras but does not own them. The city cannot open the hardware. The city cannot inspect the code. The city cannot verify that the vulnerabilities documented in GainSec's white paper have been patched.

The company that refuses to let taxpayers audit its security has been proven, by independent researchers operating without the company's cooperation, to have deployed a nationwide tracking system with hardcoded passwords in the source code, live camera feeds accessible without authentication, physical hardware exploitable with a $5 USB stick, and a login system so weak that stolen credentials are being sold on criminal marketplaces.

The company's response to the security research followed a pattern well-documented in the cybersecurity community. Rather than embracing the findings and implementing rapid remediation, the company's posture toward the researchers who discovered the vulnerabilities was adversarial. The 51 findings were not the product of a collaborative bug bounty program. They were the product of independent researchers who looked at a system that the company did not want examined and found that it was broken at every level.

The cameras are still on the poles. The subscriptions are still active. The data is still flowing. And the question of whether the 51 documented vulnerabilities represent the full scope of the system's security failures, or merely the ones that a small team of independent researchers had the time and resources to find, remains unanswered.

Next in this series: Two Virginia residents are suing their own city for placing them under warrantless surveillance by 200 Flock cameras. Their case could establish that tracking your commute is constitutionally identical to reading your diary, and if they win, it could dismantle the legal foundation of an $8.4 billion company.

Disclaimer: This article is for informational and journalistic purposes only and does not constitute legal advice. References to CVE identifiers, security research findings, and congressional correspondence are based on publicly available documents, published white papers, and government records. Guerrilla News is an independent journalism outlet and is not affiliated with any company, government agency, security researcher, or legal proceeding discussed in this report.

Sources

1. "Flock Safety Camera Vulnerabilities: 50+ Flaws Found," SimeonOnSecurity
2. "Examining the Security Posture of an Anti-Crime Ecosystem," GainSec (GitHub)
3. Key Documents, DeFlockOKC
4. CVE-2025-59407 Detail, National Vulnerability Database
5. CVE-2025-59405 Detail, National Vulnerability Database
6. "Lawmakers Ask FTC to Probe Flock Safety's Cybersecurity Practices," Recorded Future News
7. "US Lawmakers Call for FTC Probe Into Flock Safety Over Data Security Failures," Biometric Update
8. "The Case Against Flock Safety," DeFlockOKC
9. "How a $7.5 Billion Surveillance Company Built America's Largest Warrantless Tracking Network," MyPrivacy Blog