DEF CON 34 - Main - Bird Hunting Season The Final Flight - Jon Gaines
Source: YouTube · DEFCONConference · published Nov 6, 2026 · 48:27
Independent security research on eBay-purchased Flock Safety hardware reveals systemic vulnerabilities across all devices—Raven, Sparrow/Falcon, Condor/Bravo—culminating in 67 publicly exposed live camera feeds despite Flock's claims of only a "limited configuration issue" 3:28-4:27.
Key Takeaways:
• All Flock devices share the same flaws: debug interfaces enabled, no secure boot or disk encryption, hardcoded plaintext passwords, and unsigned EDL firehose access enabling full firmware dumps and root shells 6:39-7:09.
• A "gated wireless RCE" chain needs no real physical access: triple-pressing a button starts a hotspot with hardcoded password "security," enabling ADB over TCP and root shell via parameter injection in ~20 seconds 32:37-34:24.
• After Flock blamed a "misconfiguration," expanded Shodan/ZoomEye enumeration found 67 exposed feeds across 19 cities—exposing live video, API keys, and passwords—caused by business data SIMs without CGNAT while debug services listened on all interfaces 28:11-30:29.
• Disclosure was contentious: Flock published CVEs before the 90-day window, combined issues, and mischaracterized collaboration; after stalled CISA/DHS mediation, John fully disclosed 24:48-25:24.
• He released "Birdshot," a CLI/web tool suite letting owners verify vulnerabilities and run ML models locally, already used by law enforcement 37:33-39:35.
• Exposed ML models revealed on-device tagging of vehicles, plates, and people; unencrypted models remain an open research path 21:32-22:49.
John argues such surveillance should be public-facing with opt-out, or genuinely secured with encryption and warrant-based access—not protected merely by physical placement and NAT assumptions.
Sources:
- 3:28-4:27 Flock hardware ecosystem overview and eBay purchases
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Uh, without further ado, I'm going to introduce John, who's going to talk about the research he did on flot cameras, which uh, I'm sure is you're all very excited to hear the first person account of the adventure that he went on. So, let's hear it up for give it up for John. >> Thanks. Cool. So, uh, before we start, I'm going to say it's pretty condensed. There's a lot of stuff. I'm not going to be able to get to everything. So, feel free to catch me after talk about whatever. Um, but, uh, this presentation is just going to be basically the final flight, my last my last piece. If you've been following it, I'll go over some of the stuff, learn a lot. Yeah. Cool. So, first before we jump in, I just need to have a wall of dis uh disclaimers. Most importantly, my past and current employers had…