Flock cameras are riddled with security vulnerabilities and hard-coded credentials. Here's my analysis of today's @ddosecrets Flock leak https://micahflee.com/flock-cameras-are-riddled-with-security-vulnerabilities-and-hard-coded-credentials/

RE: https://infosec.exchange/@micahflee/117282688510612709

*Jabba the Hut laugh* ho ho ho ho

Flock API key = НаJ3FgupAm8RrDJW3МНgT9X7Ft27eVaD

https://ddosecrets.org/article/flock-alpr-camera

This discussion in the ⁠binutils⁠ mailing list is interesting. I had no idea the target binary could easily detect and interact with Valgrind directly. Valgrind provides a header (⁠valgrind.h⁠) to help the client do exactly that.

A change in the ⁠gas⁠ assembler that optimized ⁠xchg reg, reg⁠ to ⁠mov reg, reg⁠ in specific conditions broke Valgrind. That optimization yielded more efficient code because the ⁠mov⁠ instruction is cheaper.

Valgrind implements a trapdoor—a "hypercall"-like mechanism between the target and Valgrind, officially called the Client Request Mechanism. This trapdoor relies on a magic sequence of preamble instructions followed immediately by an ⁠xchg⁠ instruction.

Because the ⁠gas⁠ optimization replaced that ⁠xchg⁠ with a ⁠mov⁠, Valgrind was seeing a ⁠mov⁠ and failing to recognize the request.

The problem occurred both when Valgrind itself was built with the optimization, and when target binaries were built with the client-request mechanism through the ⁠valgrind.h⁠ file. ⁠systemd⁠ was one of the affected projects. Because there are many projects out there built with the Valgrind header that hardcode the expectation of an ⁠xchg⁠ instruction, the optimization had to be reverted.

That problem resulted in the following error in Valgrind:

vex amd64->IR: unhandled instruction bytes: 0x48 0xC1 0xC7 0x3 0x48 0xC1 0xC7 0xD 0x48 0xC1
vex amd64->IR: REX=0 REX.W=0 REX.R=0 REX.X=0 REX.B=0
vex amd64->IR: VEX=0 VEX.L=0 VEX.nVVVV=0x0 ESC=NONE
vex amd64->IR: PFX.66=0 PFX.F2=0 PFX.F3=0
==568970== valgrind: Unrecognised instruction at address 0x484f1e9.

[PATCH 1/2] x86: optimize XCHG to MOV for same-register forms
https://sourceware.org/pipermail/binutils/2026-July/149944.html

x86: Disable XCHG to MOV optimization
https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=49652cd8ecbb4c305a9a0e9099016edb138e6953

Using and understanding the Valgrind core: Advanced Topics
https://valgrind.org/docs/manual/manual-core-adv.html

@cR0w Exquisite meme, sir!

The entity drifted dreamlessly through space, as it had for aeons. It woke when it neared a star. Scanned for planets, life, signs of technology.

Having found all, it analyzed and decoded radio emissions, then composed a message to send.

"My hovercraft is full of feels."

It resumed dormancy.

#TootFic #MicroFiction #SmallStories

Another legend passed away, R.I.P. Bill! :,(

https://www.youtube.com/watch?v=SfMyJIX6S0k

#music #blues #hungary

@dey Locally, most likely. You have to pay extra for cross-AZ. Most people don't have missile attacks in their threat model.

James Forshaw at @44CON found an old email about the Morris worm.

Sorry my picture actually shows it in rainbow 🌈. colors !!

[RSS] Fragnesia primitive via Open vSwitch. Deterministic local privilege escalation.

https://blog.doyensec.com/2026/09/17/ovs.html

Why Ctrl+Alt shouldn’t be used as a shortcut modifier:

https://devblogs.microsoft.com/oldnewthing/20040329-00/?p=40003

Unfortunately Microsoft doesn't seem to follow this wisdom:

https://github.com/microsoft/WinDbg-Feedback/issues/158

#WinDbg

[RSS] Reversing Factorio's RNG

https://gegell.github.io/posts/factorio-rng/

[RSS] Overview of Passive Optical Networks (PONs) Security

http://blog.quarkslab.com/overview-of-passive-optical-networks-pons-security.html

[RSS] Original Sony PlayStation 2 security chip 'broken wide open' after 26 years

https://www.tomshardware.com/video-games/playstation/26-year-old-sony-ps2-security-chip-broken-wide-open-after-four-years-of-effort-reverse-engineering-enthusiast-successfully-unlocks-cxp102064-mechacon-chip

[RSS] Why building a Rust LSP is hard

https://rust-glancer.github.io/blog/why-lsp-is-hard/

[RSS] Evading Machine Learning Based Detections

https://msecops.de/blog/posts/ml-evasion/

In 1983, Gavilan Computer Corporation introduced what it dubbed "the first mobile computer." The Gavilan was a briefcase-sized machine with a 3-inch disk drive, an 8-line display, and promised 7 hours of battery life. But Gavilan was a bust. It burned $31 million in venture capital and only managed to ship about 1,000 machines before filing for bankruptcy.

I detailed Gavilan's history in a 2024 podcast. You can read the entire transcript here:

https://www.computerchronicles.blog/transcript-gavilans-31-million-ride-to-bankruptcy/

#retrocomputing

Patch your Cisco ISE. CVE-2026-76460 a perfect 10 and is EITW. 🥳

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5

The Cisco PSIRT is aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.

New: hackers tore down a Flock camera and managed to extract the software running on it. We then analyzed the data to find how a Flock camera really track cars and people. The amount of data this single camera gathered in a short period was huge, 50,000+ vehicles https://www.404media.co/hackers-stole-flocks-camera-software-revealing-how-the-company-tracks-cars-and-people-2/

@algernon @gaborudvari I agree that's cringe but I'd also like to note that the largest companies in the world are built on AdTech. People/societies are weird when it comes to desires and consumption.