License Readers Leak Real-Time Video Feeds and Vehicle Data

In just 20 minutes this morning, an automated license plate recognition (ALPR) system captured photos and detailed information about nearly 1,000 cars as they drove by in Nashville, Tennessee. Among them: eight black Jeep Wranglers, six Honda Accords, an ambulance and a yellow Ford Fiesta with plates.

This real-time vehicle data, collected by one of Motorola’s ALPR systems, is intended to be accessible by law enforcement agencies. However, a flaw discovered by a security researcher exposed live video feeds and detailed recordings of passing vehicles, revealing the staggering scale of surveillance enabled by this widespread technology.

According to security researcher Matt Brown, more than 150 Motorola ALPR cameras have had their video footage and leaked data exposed in recent months. YouTube videos After buying and reverse engineering an ALPR camera on eBay.

In addition to streaming publicly available live footage, the misconfigured cameras exposed the data they collected, including photos of cars and records of license plates. No username or password is required to access real-time video and data feeds.

Next to it other technologistsWIRED reviewed video footage from several cameras and confirms that vehicle information, including vehicle makes, models and colors, was accidentally exposed. Motorola confirmed the exposures, telling WIRED it was working with its customers to block access.

Over the past decade, thousands of ALPR cameras have appeared in cities and towns across the United States. Cameras made by companies such as Motorola and Flock Safety automatically take pictures when they detect a passing vehicle. The collected data cameras and databases are often used by the police to search for suspects. ALPR cameras can be placed on roads, on dashboards of police cars, and even on trucks. These cameras shoot billions of car photos, including sometimes bumper stickers, lawn signs and t-shirts.

“Everybody I’ve discovered has been in some stable place on some path,” Brown, who runs the cybersecurity company Brown Fine Security, tells WIRED. The released video covers each lane of traffic with the camera’s view of the moving cars. It is snowing in some rivers. Brown found two streams, one in color and one in infrared, for each outdoor camera system.

Broadly speaking, when a car passes an ALPR camera, a photo of the car is taken and the system uses machine learning to extract text from the license plate. This is stored alongside details such as the location and time the photo was taken, as well as metadata such as the make and model of the vehicle.

Brown says the camera feeds and vehicle data likely weren’t set up on private networks, likely not hosted by law enforcement, and instead were exposed to the Internet without any authentication. “Incorrectly configured. It shouldn’t be open on the public internet,” he says.

WIRED tested the flaw by analyzing traffic from 37 different IP addresses connected to Motorola cameras spanning more than a dozen cities, from Omaha, Nebraska to New York. In just 20 minutes, those cameras recorded the brand, model, color and license plate of about 4,000 cars. Some cars were even filmed multiple times – in some cases up to three times – as they passed through different cameras.