This must not be allowed to continue! I just do not have the words for this.

Find your local Flock camera installations: https://deflock.me/

all 13 comments

sorted by: hot top controversial new old
[–] 14 points 10 months ago (2 children)

My former coworker left to work at Flock in their R&D department and every time I see Flock popup I check his LinkedIn to see if he's still there and hyup. I didn't take him for the type, but I mean as recently as a month ago he was praising them.

  • source
  • hideshow 2 child comments
  • [–] 11 points 10 months ago

    Flock is a disgrace for the technology and innovation section.

    And governments just like it way too much. Do with your tax money govements are paying these companies a lot of money so they can track you again. It's insane and I don't believe this should be legal.

  • source
  • [–] 1 point 10 months ago (1 child)
  • [–] -4 points 10 months ago* (6 children)

    Lot of mixed feelings from this video. Author doesn’t seem to know you can also do the exact same thing with any other HikVision camera too. I was pulling (at least one) month-old feeds back in July from generic cameras using default credentials. Definitely seems like a configuration issue to not require any at all. Given the sheer amount of these (there’s a lot in my area), why could the author only find 60 feeds? Also none of these are responding to HTTP requests anymore as I have tried all links from his shodan query.

  • source
  • hideshow 6 child comments
  • [–] 20 points 10 months ago* (last edited 10 months ago)

    you can also do the exact same thing with any other HikVision camera too

    Most people that install security cameras don't directly connect them to the internet like this. A company that's installing them at scale should be aware of this.

    using default credentials

    Modern Hikvision and Dahua cameras don't have a default password. They require you to set a strong password during initial setup.

    In general, a lot of electronics have moved away from generic default passwords, as many jurisdictions ban them now. Any modern device should either require you to set the password during initial setup, or have a randomly-generated password printed on a sticker under the device.

    The device you found was either a very old one, or one where the owner intentionally set a basic password.

  • source
  • parent
  • [–] 16 points 10 months ago

    There's a huge difference between someone putting a webcam on their house for personal security and an AI driven face tracking camera that purposefully records every person that wanders into its field of vision being setup in a public park and on every street corner in the country.

  • source
  • parent
  • [–] 12 points 10 months ago

    The author does know - I guarantee it. The author wasn't claiming that this is an unique issue to Flock cameras, but rather that the folks behind the Flock cameras are negligent and creating an unsafe environment (among orher things)

  • source
  • parent
  • [–] [S] 6 points 10 months ago

    Are HikVision cameras being used to surveil people on a level never before seen in this country? Serious question, I truly don't know..

    It's all well and good to prove someone wrong, and it seems you've done this with only one of his arguments but only partially. It seems a safe argument that security ought to be default for something that gets placed anywhere and everywhere. He should never have been able to make that video due to the high quality of the security of the devices.

  • source
  • parent
  • [–] 5 points 10 months ago

    This is a much wider issue. So many people leave the default password on devices. I once installed an automatic gate with a pushbutton keypad at an airport and they wanted me to leave the default password of 0000 because it was easy to remember. I argued with them for 10 min, but they had the programming instructions and the airport manager straight up told me he'd just do it himself after I left, so I imagine that's what happened because he seemed pretty thick and didn't think that was an issue at all.

  • source
  • parent
  • 2 comments in c/privacy@lemmy.dbzer0.com view that post
    [–] 1 point 10 months ago (1 child)

    Is this the link you intended to post?

  • source
  • hideshow 1 child comment
  • 2 comments in c/DeFlock@lemmy.ml view that post
    [–] [S] 1 point 10 months ago (1 child)

    This was a great moment to showcase the vulnerability. Reading his own YouTube script in the live footage to prove access is wide open. Unreal!

  • source
  • hideshow 1 child comment
  • [–] 3 points 10 months ago

    That wasn't a YouTube script, it was Flock's response to his previous video where they were saying their production devices were not accessible in the same way. Which is just the most powerful and hilarious demonstration that not only were they straight up fucking lying , but that they still did not patch any of the insane vulnerabilities that he uncovered.

  • source
  • parent
  • 1 comment in c/privacy@programming.dev view that post
    [–] 2 points 10 months ago

    Would love to see the google dork that found some of these

  • source