Day: September 18, 2026

This Week In Security: Flock Cameras Are Old, Microsoft Patches Patches, And Researchers Attack SSH

September 18, 2026 by 9 Comments

Leak site Distributed Denial of Secrets has released a dump of the filesystems of a Flock camera, and Micah Lee has published a dive into the contents.  Apparently the Flock security model did not include “angry citizens with a hacksaw in the middle of the night” in the physical security category.

The first thing Micah notes is that the Flock hardware runs Android 8.1 (for those not keeping track, the current Android release is Android 17 released in June 2026).  The version of Android running on the Flock camera was last patched in June of 2018, and the Linux kernel (3.18.71) is over nine years out of date, and the 3.18 series went end-of-life in 2019.

You might assume “wouldn’t an operating system this old have known vulnerabilities?”, and you’d be completely right.  Micah calls out two in particular, one in the Qualcomm GPU which allows any program to manipulate kernel memory and gain root (similar, yet simpler, than the spate of kernel vulnerabilities this year that allowed manipulating memory via the disk IO cache), and the “WrongZone” vulnerability which allows a process to escalate to root via socket handling errors.  You might also guess both of these have been patched, and again, you’d be right, in 2021 and 2018 respectively.

Digging deeper, Micah discovers that API keys with access into the Flock infrastructure appear to be hard-coded into the binaries.  Each camera appears to request credentials from an authentication server, using the MAC address of the camera.  After obtaining the credentials from an Okta Auth0 sign-in service, the Flock stores them, in plain text.

Also stored on the camera unencrypted are logs and position data:  The camera dumped to Distributed Denial of Secrets came from a suburb of Milwaukee. Continue reading “This Week In Security: Flock Cameras Are Old, Microsoft Patches Patches, And Researchers Attack SSH” →

Meta Portal Given New Life As Extended Display

September 18, 2026 by 4 Comments

The Meta Portal and associated devices are effectively defunct, having been abandoned by the company in 2022. If you’ve still got one at home, you might be wondering what to do with it. That’s where Wormhole Display from [pgodlews] comes in handy.

The thing about the Meta Portal, and much of the rest of the related lineup, is that they were effectively just heavily branded Android tablets. The screens and speakers were good, and the basic functionality was all there — albeit locked down somewhat to prevent users from easily repurposing them at will. However, it’s possible to enable Android Debug Bridge (ADB) and turn the device to doing your own bidding.

To that end, [pgodlews] built Wormhole Display as an APK that can be dropped on to the Meta Portal to make it an extendable display for Apple devices. It shows up via AirPlay, letting you use it as a wireless display for your Mac, iPhone, or iPad. You can do screen mirroring or use it as an extended display, as desired, including use of the Portal’s speakers if needed. Under the hood, it’s an Android port of UxPlay, a Unix AirPlay server which uses Android’s MediaCodec and AudioTrack in place of GStreamer to take advantage of the Meta Portal’s onboard H.264 decoder.

Extended displays can be incredibly useful, so if you’ve got an old Meta Portal laying around, consider putting it back to work. We’ve seen it done with e-readers, too. If you’ve got your own hacks to repurpose old, forgotten hardware, don’t hesitate to let us know on the tipsline!

TV Audio Tube Makes A Transceiver

September 18, 2026 by 13 Comments

It’s not often we see a tube project here, so [Helge Fykse]’s PCL86 transceiver is a welcome find.

If you know anything about the European Pro-Electron device naming system you’ll be familiar with it as it applies to tubes. The first letter denotes the heater specification, for example “E” is for a 6.3 volt heater. Everyone wants the familiar 6.3 V devices, but they have a set of cousins which often pass unnoticed. “P” tubes have a 300 mA heater designed such that all tubes in a device could be connected in series at the same current. Of those tubes the PCL86 is a mundane example, filling the function taken in the semiconductor years by the LM386. It’s a small-signal triode and a power pentode in one device, and it’s an audio amplifier. Every 1960s TV set in Europe had one, and thus it’s a good choice for experimentation.

This transceiver is a conventional crystal oscillator and power amplifier on transmit, but with a flick of a switch it transforms into a direct conversion receiver in which the triode becomes oscillator and mixer while the pentode becomes an audio amplifier. It’s simple, and the video below the break explains it in great detail. We’re not sure whether or not it could unintentionally radiate in receive mode, but we’re guessing the energy would be tiny.

A simple tube project can make an interesting departure from modern surface mount electronics, so if you get the chance we’d suggest you try one. If you don’t need a transceiver, an audio amplifier is the archetypal PCL86 project.

Continue reading “TV Audio Tube Makes A Transceiver” →