Flock Cameras Run 8-Year-Old Android and Ship Hardcoded API Keys
Flock cameras are riddled with security vulnerabilities and hardcoded creds
Security researchers from the stegan0gram collective obtained filesystem images of a Flock ALPR camera and found it running Android 8.1 with a 2018 security patch level, plus a Linux 3.18.71 kernel from 2017. The firmware contains a hardcoded API key that can retrieve Auth0 credentials for any camera by MAC address, and those credentials are stored in plaintext. Flock says it received no vulnerability report and disputes the findings.
Presumably, you can use this hard-coded API key to obtain credentials for any Flock camera, based on its MAC address.