Brutkey

kajer | sudo bash
@kajer@infosec.exchange

Oh... This seems fun...

If you set a screen lock pin, and reboot...

The device will be stuck at a pre-boot password phase. Entering the PIN booted the device, and then it shut itself down right away. Booting again will do the same but without the shutdown.

So... uh, set a screenlock and reboot. done.

The screenlock can be a pin, password, swipe. etc.

kajer | sudo bash
@kajer@infosec.exchange

Flock Safety Kill Chain thus far:
Press back button on camera three times quickly
connect to Flock-xxxxxx hotspot with PSK: security
curl -x PUT http://192.168.43.1:8080/api/v1/system/adb/enable
adb connect 192.168.43.1
scrcpy
set a PIN/PASSWORD
adb shell reboot -p

bye bye

kajer | sudo bash
@kajer@infosec.exchange

since the camera has "encrypted" storage, the reboot will force the pre-boot password to be entered before loading the userdata partition. No userdata, no flock apps. No hotspot. Only USB adb bridge will get you scrcpy to then enter the password.

In theory you could use the usb adb to do some intent/keystroke commands to the screenlock screen, but scrcpy is already running, and easier.

If the camera doesn't get a boot password, it shuts down to a low power state until you press buttons on the internal boards locally.

kajer | sudo bash
@kajer@infosec.exchange

I am no longer in possession of the above pictured flock safety camera. I have passed it on to the next person who may extract it's darker secrets. Look for updates in the future. I will link when that time comes.