HaJ3FgupAm8RrDJW3MHgT9X7Ft27eVaD
What is that? That's a hard-coded API token that Flock cameras use to identify themselves and get OAuth credentials, which can then be used to talk to Flock's production servers. Like, anyone on the internet can probably do this right now.
Ethically? Expire the token since it’s compromised, and offer to refurbish all units in the field since flock screwed up, a now all customer data could be poisoned/suspect now.
Realistically? Keep going like nothing happened an make it a customer support problem while pushing new hardened cameras that cost more. Because the product alone loudly flags Flock as a bunch of amoral greedy fuckwits.
I won’t suggest ways to actually make their product bulletproof because I care and we don’t need to make this problem worse for everyone. It is a tantilizing problem space but there are never any perfect answers in security, only relatively better/worse ones.
One way would be to generate a unique private key on the secure element / TPM and its public key stored on the server for validation. Each API request would need to be signed with a relatively short expiration time. That way the code never contains sensitive content such as an API key, an exploited device only holds in RAM a signed certificate that is valid for a short period of time, and the certificate can be revoked/blocklisted on the server if compromised.
Unique private key per device, pre-provisioned certificate at manufacturing time, hardware-level separation of crypto operations so sensitive creds are never in memory.
It’s a bit more expensive to manufacture, in terms of BOM and logistics. And then you have a lot more complexity to your production system too.
O… Kay, I’m just trying to expand my knowledge about this particular case. I’m mostly a web dev but I’m trying to expand into security a little bit as well because I think that’s important for my field. It just wasn’t a part of my curriculum at uni 10–20 years ago.
Quick question: what would be the correct way to handle this, security wise? How should they acquire their token if it isn’t present on-device?
I mean, each device could have its own token, but you could still sniff it, maybe? I dunno.
How should Flock have gone about this if working to their own self-interest?
Ethically? Expire the token since it’s compromised, and offer to refurbish all units in the field since flock screwed up, a now all customer data could be poisoned/suspect now.
Realistically? Keep going like nothing happened an make it a customer support problem while pushing new hardened cameras that cost more. Because the product alone loudly flags Flock as a bunch of amoral greedy fuckwits.
I won’t suggest ways to actually make their product bulletproof because I care and we don’t need to make this problem worse for everyone. It is a tantilizing problem space but there are never any perfect answers in security, only relatively better/worse ones.
Oh, I don’t mean afterwards. I meant before it even happened.
You give each camera its own token, and validate it with hardware ID.
Even better, give them hardware token, that can sign, but does not leak its keys.
In either way, you can ID the device, and block unsold and confirmed stolen/damaged ones. And never accept traffic from anything else.
One way would be to generate a unique private key on the secure element / TPM and its public key stored on the server for validation. Each API request would need to be signed with a relatively short expiration time. That way the code never contains sensitive content such as an API key, an exploited device only holds in RAM a signed certificate that is valid for a short period of time, and the certificate can be revoked/blocklisted on the server if compromised.
Unique private key per device, pre-provisioned certificate at manufacturing time, hardware-level separation of crypto operations so sensitive creds are never in memory.
It’s a bit more expensive to manufacture, in terms of BOM and logistics. And then you have a lot more complexity to your production system too.
Is it possible to have several private keys per singleton public key?
No.
y’all just givin the work away huh? don’t answer this unless you are getting paid.
O… Kay, I’m just trying to expand my knowledge about this particular case. I’m mostly a web dev but I’m trying to expand into security a little bit as well because I think that’s important for my field. It just wasn’t a part of my curriculum at uni 10–20 years ago.
i was mostly joking 🙃 sorry if it came across as rude