Flock cameras vulnerable to 30-second hack, researcher says

September 26, 2026 at 11:05 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Cybersecurity researcher Jon Gaines published a white paper in November 2025 detailing vulnerabilities in Flock automated license plate readers. A YouTube video by Benn Jordan demonstrated that physical access allows a hacker to compromise a camera in under 30 seconds. Flock said the findings are legitimate but that its system has never suffered a real breach.

Key Facts

Jon Gaines published a white paper on GitHub in November 2025 detailing Flock camera vulnerabilities.
Benn Jordan's YouTube video demonstrated that a Flock camera can be compromised in under 30 seconds.
Flock said 3% of its law enforcement customers had not enabled multi-factor authentication before an August 2026 update made it mandatory.
Jordan's testing showed the camera saved images of him even when no license plates were in view.

Vulnerability Disclosure

Jon Gaines, a cybersecurity professional, published a white paper on GitHub in November 2025 detailing vulnerabilities in Flock automated license plate readers. Benn Jordan explored the findings in a YouTube video, demonstrating that physical access to a Flock camera allows a hacker to compromise the device in under 30 seconds. The process involved button presses, connecting to a network, and terminal commands, after which Gaines could access internal data and install arbitrary software. Flock acknowledged the findings as legitimate but stated that its system has never suffered a real breach.

Authentication and Data Practices

Flock did not require multi-factor authentication for all police department clients, and 3% of law enforcement customers had declined to enable it. An August 2026 update mandated multi-factor authentication across the board. Jordan's testing showed that a Flock camera saved images of him even when no license plates were in view, contradicting Flock's claim that cameras only save images of license plates. Jordan also reported that he did not have to crack or decrypt any data during the verification process.