195
Micah Lee: Hard-coded API token that Flock cameras use to identify themselves and get OAuth credentials, which can then be used to talk to Flock's production servers. (bsky.app)
submitted 2 days ago by to c/cybersecurity@sh.itjust.works
32 comments fedilink hide all child comments
 
HaJ3FgupAm8RrDJW3MHgT9X7Ft27eVaD
you are viewing a single comment's thread
view the rest of the comments
[–] 24 points 1 day ago (6 children)

We are soon to find out if Flock blindly onboards random MAC addresses as new cameras.

If so, it seems anyone with the hardcoded key can authenticate with Flock ask if they were a new camera.

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 7 points 1 day ago (4 children)

    And it doesn't have to be a camera. It can just be a random set of images.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 6 points 1 day ago (3 children)

    It can be

    Gasp

    Can it pretend to be information about me, but then instead it's all butt holes?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •