IoT Camera Security: What a Stolen Camera Revealed

If your office has a camera over the parking lot, the lobby, or the warehouse door, IoT camera security is not a hobby topic. It is the question of who can walk off with footage of your customers, staff, and license plates.

This week a hacker group physically removed a Flock Safety license-plate camera, copied almost all of its storage, and handed the files to reporters. The device was supposed to encrypt footage and keep recordings only briefly. Investigators still recovered more than 27,000 short video clips, logs covering about 1.6 million images of 50,000 vehicles, and a key stored on the same unit. For a small business in Bradenton or Sarasota, that is a reminder: a camera is a computer bolted to a pole.

What happened

Flock cameras sit over public roads and private lots. They photograph passing vehicles, send frames over a cellular link, and feed a searchable network used by police departments. The company has said images stay on the device only briefly and that on-device encryption protects footage even if someone gets physical access.

A collective calling itself stegan0gram took a working camera down from a roadway, copied its partitions, and shared the dump with 404 Media, WIRED, and Distributed Denial of Secrets. The camera ran a modified Android system. Several storage areas were unencrypted. One of them held a key that unlocked a media partition with thousands of clips.

Joint analysis of the recovered files found:

• About 21 days of usable logs across several periods
• Roughly 50,200 vehicles photographed
• About 1.6 million still images generated
• 27,321 one- to two-second MP4 clips at 1024 by 768, with no audio
• Software that also flags people, bicycles, and license plates
• People detected in 11 of those clips, all motorcycle riders

Security researcher Micah Lee later inspected the same dataset. The camera ran Android 8.1 with a June 2018 security patch, even though the build date on the unit was June 2025. The Linux kernel was 3.18.71, a line that stopped receiving updates years ago. Firmware also contained hard-coded API material aimed at Flock backend services.

Flock called the removal illegal and pointed researchers at its disclosure policy. It has argued that physical access is required and that footage is forwarded quickly. The recovered clips and the key sitting on the same device are why this is a hardware hygiene story, not only a debate about license-plate readers. Logs also showed thousands of "no space left on device" errors. That is the opposite of "we keep almost nothing locally."

How it affects your business

You probably do not run a Flock unit. You may run the same class of gadget: a Wi-Fi camera over the register, a doorbell on the suite door, a solar unit in the lot, or a recorder in a closet that nobody has patched since install day.

Those devices are computers with a lens. They store video, they talk to a vendor cloud, and they often ship with default passwords and stale firmware. If someone steals the box or reaches it from guest Wi-Fi, they may get days of recordings, a key, or a path onto the same network as your bookkeeping.

Picture a 10-person Sarasota shop with one camera on the front door and one on the alley. Footage shows who arrives and when the last person leaves. If the recorder still uses a factory password, or stores clips on an unencrypted card, a thief does not need to hack the cloud. They unscrew the housing.

Customers did not agree to have faces and plates sit in the clear on a pole. A leaked lobby camera is an ugly conversation with clients who assumed you were careful. Shared vendor logins and leftover manager apps create the same problem Flock's wide search network creates at national scale: too many people can see too much.

CISA's guidance for small and medium businesses is blunt: inventory what you connect, keep software current, isolate cameras from the PCs that hold customer files, and treat physical theft as a real risk.

If you already read our honest guide to business security cameras in Sarasota, treat this incident as the field test. Marketing pages promise encryption. The question is whether the key lives on the same disk as the video.

What to do

You do not need a forensics lab. You need a Saturday morning walk and a written list.

1. Inventory every camera. Parking lot, lobby, warehouse, doorbell, baby-monitor leftovers in a back office. Write down the brand, who owns the cloud account, and whether it is on Wi-Fi, cellular, or a recorder in a closet.

2. Change the password as if the factory one is public. It often is. Use a unique passphrase. Turn on multi-factor authentication on the vendor account. Remove staff who left last year.

3. Put cameras on their own network. Guest Wi-Fi or a separate VLAN is enough for most small offices. The camera should not sit on the same LAN as QuickBooks, the file server, or the owner's laptop.

4. Ask where video lives, and for how long. Cloud only, local SD card, or both? How many days? Is the card encrypted? If a vendor says "nothing stays on the device," ask them to put that in writing and then assume a thief will still find a cache.

5. Update firmware or replace the unit. A camera running an operating system that vendors abandoned is a liability. If the maker no longer ships patches, budget a replacement. Do not keep an orphaned Android box over your door because it still records.

6. Limit who can export or share. One owner account. No shared passwords in a group text. If the product can share live views with a "partner," turn that off unless you have a reason.

7. Plan for theft. Outdoor cameras get stolen, smashed, or relocated. If the device holds a week of video and a key, treat physical security (height, lock, enclosure) as part of cybersecurity.

8. Decide what you actually need to record. A lot pointed at a public road is a different risk than a camera over a cash drawer. No retention policy means you will keep more than you can defend.

If that list feels larger than "the kid who set up the NVR in 2021," that is the point. Most local offices we visit never enrolled cameras in the same patching routine as the PCs.

Our managed IT services include reviewing devices on your network, not only laptops. For a short walkthrough of camera accounts, Wi-Fi isolation, and the recorder, get in touch.

Use this story as the nudge to treat the box on the wall like a computer that happens to have a lens.

---

Source: discussed on Hacker News. Original reporting: Hackers Got Inside a Flock Camera (WIRED) and Hackers Stole Flock's Camera Software (404 Media). Additional technical notes from Micah Lee.