Normalize flipping off Flock cams.

[chuckmcmanis@chaos.social]

@alice We need to find a qr code that encodes an exploit that takes the camera off line to wear on t-shirts.

[castanea_jo@ni.hil.ist]

@CorvidCrone @Shdwdrgn @SymTrkl @alice

last time I looked, if you wanted to destroy cameras (flock, ring, et al) you need at least a class 3 laser, hypothetically

[alice@lgbtqia.space]

@Shdwdrgn modern ALPRs use a lot of anti-fuckery technology.

@SymTrkl

[ambientspace@cloudisland.nz]

@alice I feel like I saw Benn Jordan detailing several things which one should never do to those cameras.

[shdwdrgn@tech.lgbt]

@alice @SymTrkl Heh I'm not really surprised.

[dianea@lgbtqia.space]

@alice

I recently lived where Flock cameras that were put on a map were met by a specially modified off road truck like target practice. The county eventually had every Flock camera contracted to be removed.

[azulrin@c.im]

@alice the only flipping is to flip the camera over so it stops invading public spaces. Also make sure to wear a proper mask

[bit@ohai.social]

@alice I can also wave a Mexican flag in from of them to throw them off.

[0x00string@infosec.exchange]

@alice yes, off the mounts, onto the cement

[aprilfollies@mastodon.online]

@alice Someone in my neighborhood seems to have flipped one right off of its pole. Seem to have repurposed its solar panel, too. Very conscientious of them.

[geonz@mathstodon.xyz]

@alice Oh, I hadn't thought of that. They're on my college campus and public safety watches the feral cats on them (and got one of 'em a home...)

[kajer@infosec.exchange]

@alice

the yolov3tiny models the falcon cameras uses detect "birds." But it's probably just detecting "person" and uploading those frames.

[kajer@infosec.exchange]

@ChuckMcManis @alice

Sadly, the cameras don't do any actual OCR or object decoding in real time. The YOLO models just crop objects and upload to AWS for "processing."

[chuckmcmanis@chaos.social]

@kajer @alice Okay, but what if we had a QR code that made AWS "processing" really really expensive. I'm thinking an HTTPS page with a six billion link referrer link chain.

[kajer@infosec.exchange]

@ChuckMcManis @alice

Once testing renders results, then maybe it's an attack path

Mike Sheward (@SecureOwl@infosec.exchange)

Update on my QR porch ornament experiment. There have now been 4 Amazon proof of delivery images containing the code. The first two, reliably hit the canary token within 20-40 minutes of the delivery, from a non-phone QR code. Definitely some sort of automated process. The third one, did hit the QR, but it was because the delivery person took it upon themselves to scan the QR code with their phone to see what it did - user agent confirmed that. There were no programatic hits like the first two. Fourth one, in the picture, but no hit registered. UPS/FedEx/USPS - not even as much as a flicker of a GET request to my canary. Bonus points, while driving I exposed my QR code to a couple of Flock cameras, but alas they didn't do anything. Next step will be a new QR code, one that points to a different domain, because the next thing to check is - did they start blocking the requests to Canarytoken dot org from whatever process was ingesting the images - because that is what it seems like.

Infosec Exchange (infosec.exchange)

[w_b@mastodon.world]

@SymTrkl @alice

Often thought about building a license plate frame loaded with ir LEDs to mess with ALPRs

[lambdacalculus@masto.hackers.town]

@alice Next step: laser right in the Flock's lens!

[ferrix@mastodon.online]

@alice Flip Flock

[momo@social.linux.pizza]

@mindpersephone
Honestly? You need a bit of a capacitor to stabilize the power supply but strobing the leds means they are not constantly using power but stay off for some time. You can easily double your battery time that way!
@alice @SymTrkl

[dzwiedziu@mastodon.social]

@alice
I would, but I couldn't pull it's pole from the ground.