202
Micah Lee: Hard-coded API token that Flock cameras use to identify themselves and get OAuth credentials, which can then be used to talk to Flock's production servers. (bsky.app)
submitted 1 month ago by to c/cybersecurity@sh.itjust.works
38 comments fedilink hide all child comments
 
HaJ3FgupAm8RrDJW3MHgT9X7Ft27eVaD
you are viewing a single comment's thread
view the rest of the comments
[–] 25 points 1 month ago (6 children)

We are soon to find out if Flock blindly onboards random MAC addresses as new cameras.

If so, it seems anyone with the hardcoded key can authenticate with Flock ask if they were a new camera.

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 8 points 1 month ago (4 children)

    And it doesn't have to be a camera. It can just be a random set of images.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 7 points 1 month ago (3 children)

    It can be

    Gasp

    Can it pretend to be information about me, but then instead it's all butt holes?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •