Flock's ALPR firmware hard-codes an API key that anyone can pull from a public image

The extraction path is three steps. Pull `partitions/24_system.img` out of the dataset, decompile `com.flocksafety.android.common.lib`, and read the string returned by `getHpnotiqApiKey()` in the `CameraSettings` class ^[10][11][12]. Micah Lee, who published the finding, describes what that string reaches as Flock's live production infrastructure, and puts a warning ahead of the details: "It's illegal to connect to Flock's servers using leaked credentials without their permission," he wrote ^[13][14].

The image exists because people took cameras out of the field. "We liberated hardware in the field, disarmed them, and proceeded with reverse engineering of the cameras and associated solar equipment," one of the hackers told 404 Media and Wired ^[4].

Both of the flaws Lee flags need code already running on the camera, and physical possession supplies that ^[26]. CVE-2018-9568, WrongZone, is a socket type confusion in the kernel's IPv6 handling that lifts a local program to root; Google patched it in December 2018, and exploit code is public ^[16]. CVE-2021-1905 is a use-after-free in the Qualcomm Adreno GPU driver, reachable from an unprivileged app, and it yields full control of the device; that fix landed in May 2021 ^[15]. Lee has the firmware and not a camera, so he did not confirm either one works ^[17].

Seven years separate the build date in `build.prop` from the security patch level it reports, to the day ^[20]. Android 8.1 came out in 2017, and Google stopped supporting it in 2021 ^[7]. That leaves roughly three years of 8.1 fixes that existed and were never applied, then four more years in which no fixes were written for the platform at all ^[21]. The kernel in the boot partition was compiled on the same June day in 2025 as the Android build ^[25].

A Flock spokesperson told 404 Media and Wired: "We received no report through that process, and based on the limited information provided, we do not have enough detail to assess the claims being made. If the individuals identified legitimate vulnerabilities, we encourage them to submit their technical findings through our vulnerability reporting process so our security team can review them and take any appropriate action." ^[18] Lee's post names the partition files, quotes the three property lines, and gives the command that prints the kernel version ^[24].

The dataset settles one unit at one moment. The camera whose firmware was extracted was on that build at that patch level on June 5, 2025; whether the rest of the deployed fleet is on the same Android 8.1 build is not in these images ^[6][1].