v0.74
Warning
Superseded by v0.75 — use that instead.
The sustained-probe-rate gate described below could never open. The companion
watches one channel for 300 ms out of every 3900 ms, so the 3-probes-in-2000 ms
threshold was unsatisfiable by anything, including a real camera. On this build
the OUI + probe request detection path is dead — the path that finds most
fielded cameras.
v0.75 removes the gate and keeps the OUI demotion, which is what actually fixed
the reported T-Mobile false positive. Reflash the companion too, not just
the .fap.
Update the companion firmware too, not just the .fap
Both fixes below live partly on the ESP32. Flash
flipdeflock_companion_esp32wroom.bin from this release alongside your .fap, or
the false positive stays exactly as it was.
The app deliberately trusts the companion for every confidence rung below
Confirmed, because those depend on probe behaviour it cannot re-derive on its
own. A board on older firmware keeps reporting a prefix the app has already
dropped.
A T-Mobile hotspot was being reported as a Likely ALPR camera
Reported from the field. Two causes.
The built-in OUI list is mostly chip vendors, not Flock. Checked
prefix-by-prefix against the IEEE registry, 21 entries belong to Liteon and
only b4:1e:52 to Flock Safety itself. Two were worse: 48:27:ea is registered
to Samsung Electronics and a4:cf:12 to Espressif, and upstream rates
both "low confidence, WiGLE crowdsource" — its weakest tier. Both are demoted to
docs/signatures.seed.json, where you can opt back in. They are not retracted:
nothing says they are wrong, only that nobody corroborated them.
The ladder was the deeper cause. Flock OUI + wildcard probe request scored
Likely, and a wildcard probe is the single most ordinary frame a Wi-Fi client
emits — it is what scanning for a network looks like. So a Samsung-based hotspot
doing nothing unusual was flagged as a likely surveillance camera.
The companion now requires a sustained probe rate first. A fielded Flock
camera runs in station mode and probes roughly every 125 ms; a phone emits a
short burst and goes quiet for tens of seconds. Same frame type, very different
cadence — and cadence is what separates them.
Net Guardian can guard one network
Press Right on the Guardian screen and pick an access point. Only deauths
aimed at that BSSID and evil twins of that SSID feed the score; the bottom line
names the network instead of the OK=sus hint, and the choice persists across
restarts.
Untargeted, the Guardian answers "is anything around me under attack?" — which
in a flat or an office is mostly somebody else's traffic, and an alert you learn
to ignore. Flock detections, BLE trackers, a nearby Flipper and attack-tool
signatures still contribute whatever is targeted: those are about you, not the
network.
If no networks are listed yet, a Scan for networks row runs one and the list
fills in place.
RogueMaster gets its own artifact
RogueMaster names the app deflock.fap, so installing there meant renaming the
Unleashed file by hand. It now builds as a fourth target and ships under that
name. Contributed by @h00die in #21.
What was verified on hardware, and what was not
Run on a Flipper Zero (Momentum mntm-dev, API 87.1) with the ESP32 companion
attached and reflashed to this build.
Confirmed on a real device: Net Guardian targeting end to end, including the
in-place scan and persistence; the Axon device class rendering with its AX tag
and body/in-car kit label; and the v0.70 Detail-round-trip fix, verified on
hardware for the first time — a tagged tracker survived Back while the device
table grew 25 → 28 rather than resetting.
Not confirmed: the probe-rate gate's thresholds. No Flock hardware was present
to exercise a true positive. The gate is known to stop the reported false
positive and is not known to pass a real camera. Those thresholds remain
unmeasured, and the code comments say so.
A selection bug was also caught by that hardware run and fixed before release: the
network picker rebuilt its list as scan results arrived, which reset the cursor, so
the highlighted row and the selected row could diverge — it guarded the wrong
network silently. The cursor is now carried across the rebuild.
Verify your download
sha256sum --ignore-missing -c SHA256SUMS.txtFull Changelog: v0.73...v0.74
