Bird Hunting Season - The Final Flight

This talk closes a multi-year, self-funded research project on Flock Safety surveillance hardware, bought secondhand on eBay. The devices covered are Raven gunshot detectors, Falcon and Sparrow license plate readers, and Picard and Bravo edge compute boxes. The speaker traces the path from physical access over UART and an unauthenticated download mode to weak boot protections, broken mutual TLS, hardcoded keystore secrets, and a root-level log cleanup routine that could be abused for command injection.

The middle section covers the most significant new finding. Internet-wide scanning data showed live camera feeds and admin services reachable without authentication over a cellular data connection. The speaker expanded the search by checking the network block that owned those addresses, which turned up dozens of listings. Another chain used a three-press button sequence to open a hotspot with a shared default password, then moved from a wireless connection to a root shell. The speaker also described a "flea market supply chain" idea: contacting component makers or using vendor tooling can yield SDKs far faster than reverse engineering alone.

The talk ends with BirdShot, a public toolkit of more than a dozen modules that automates several of these chains, and BirdEye, a harness for running a vision model against camera or webcam input. The takeaways are that surveillance devices often ship with debugging enabled, no secure boot or disk encryption, and an assumption of physical isolation that fails once they reach the internet. The speaker also urged people to inventory the surveillance technology around them.