Micah Lee: Hard-coded API token that Flock cameras use to identify themselves and get OAuth credentials, which can then be used to talk to Flock's production servers.

Is that the token?

Ah yes, yes it is.

And it doesn't have to be a camera. It can just be a random set of images.

I wonder if that means you could “claim” a bunch of MAC addresses so you can block deployment of new or replacement flock cameras.

Hanlon's razor:

Never attribute to malice that which is adequately explained by stupidity.

But, also, Grey's law:

Any sufficiently advanced incompetence is indistinguishable from malice.

I'd like to live in a world in which the former is the case, but as an engineer I have seen some shit

damn that's good

Ethically? Expire the token since it's compromised, and offer to refurbish all units in the field since flock screwed up, a now all customer data could be poisoned/suspect now.

Realistically? Keep going like nothing happened an make it a customer support problem while pushing new hardened cameras that cost more. Because the product alone loudly flags Flock as a bunch of amoral greedy fuckwits.

I won't suggest ways to actually make their product bulletproof because I care and we don't need to make this problem worse for everyone. It is a tantilizing problem space but there are never any perfect answers in security, only relatively better/worse ones.

One way would be to generate a unique private key on the secure element / TPM and its public key stored on the server for validation. Each API request would need to be signed with a relatively short expiration time. That way the code never contains sensitive content such as an API key, an exploited device only holds in RAM a signed certificate that is valid for a short period of time, and the certificate can be revoked/blocklisted on the server if compromised.

Unique private key per device, pre-provisioned certificate at manufacturing time, hardware-level separation of crypto operations so sensitive creds are never in memory.

It’s a bit more expensive to manufacture, in terms of BOM and logistics. And then you have a lot more complexity to your production system too.

y'all just givin the work away huh? don't answer this unless you are getting paid.