Live data from Hacker News

Flipper Zero: Multi-Tool Device for Geeks

flipperzero.one

271–280 of 346 posts

Re: Flipper Zero: Multi-Tool Device for Geeks

#271
I saw this and thought "I need this toy!"

Their website wouldn't take my credit card. Needless to say, it's a good card and I used it on other sites that same day and after. I wrote to Support.

Three days later, they wrote back and suggested I try a different card. Sorry, Flipper, you lose. Nice idea, but a company is more than a piece of hardware.

Re: Flipper Zero: Multi-Tool Device for Geeks

#272
post #84

I got one not too long after the official launch and I've used it a decent amount (granted I am in cybersecurity and have a more real-world use cases then the average person). My favorite use case is the IR remote since phones no longer have IR blasters. It's saved me twice so far in having to buy/find a remote for something. One thing people don't realize is that the custom firmware [0] that you can run allows you t…

> Lots of things use that range (garage doors, gates, fan remotes, etc.) and are not very secure.

https://en.wikipedia.org/wiki/Rolling_code I didn't know this wasn't secure enough. I thought this was the basis of most modern vehicle keyless entry too?

It is hard for me to not think of the Flipper Zero as a script-kiddie tool to do super illegal things like open your neighbor's garage illegally.

Re: Flipper Zero: Multi-Tool Device for Geeks

#273

Earlier quoted context omitted.

You just need a small Bluetooth-enabled box sitting on your coffee table near the TV that has an IR transmitter and a paired app on your phone that can send commands to the box. Edit: I had only search and one did appear: https://www.amazon.com/PUCK-Smart-Universal-Remote-Model/dp/...

Universal remotes are still a thing, and much cheaper than that or a Flipper Zero.

yeah, but you have to be line of sight for a universal remote to work. the app enabled IR box means you can be anywhere within range. that does have its advantages. also, being in the kitchen while the remote is near the couch when your streaming platform of choice asks "Are You Still There?" means you can answer from the kitchen.

Re: Flipper Zero: Multi-Tool Device for Geeks

#274
post #249

Earlier quoted context omitted.

> When people realized anyone with a sophisticated police scanner could listen in on cordless (and then early cellular) phone calls, it forced manufacturers to actually implement a bare-minimum level of security on those devices. Did it? IIRC, the biggest thing to fall out of that is the US government banned scanners that could pick up the frequencies commonly used by cordless phones.

> IIRC, the biggest thing to fall out of that is the US government banned scanners that could pick up the frequencies commonly used by cordless phones. I recall that. I think the age of SDR's made such a ban (law?) almost impossible to enforce.

When did the age of SDRs begin where these devices were still in vogue? What's the overlap?

Re: Flipper Zero: Multi-Tool Device for Geeks

#275

Earlier quoted context omitted.

The part I don't get is even if you flash the firmware, does that mean you can make sure it doesn't make all other remotes fail? My understanding of the whole rolling code system was that you could get a few uses and then you were screwed. If that's not the case I really need to do this because having it handle my tv's, ceiling fans, and garage door would be a nice trick.

If you have control of the opener, couldn’t you use the door’s learning mode and make it into a real opener?

For Chamberlain brands [0] there is some research that shows that their rolling code system (Security+ and Security+ 2.0) is quite easy to decode/decrypt [1]. This feature is supported in the flipper firmware, but is restricted (you can't create a custom remote, only clone is supported) without custom firmware. However, I'm sure you could decode a raw capture file if needed in a pinch.

[0] https://chamberlaingroup.com/our-brands

[1] https://github.com/argilo/secplus

Re: Flipper Zero: Multi-Tool Device for Geeks

#276
post #142

When people realized anyone with a sophisticated police scanner could listen in on cordless (and then early cellular) phone calls, it forced manufacturers to actually implement a bare-minimum level of security on those devices. I hope this pushes more manufacturers to switch to rolling-code algorithms (like the key fob your car uses), in place of simpler, less secure codes that can be captured and replayed.

Well, DECT wasn't exactly very secure, and neither was GSM (2G) call encryption. And check out the recent TETRA-related CVE's for more fun ;)

https://www.midnightblue.nl/tetraburst

Re: Flipper Zero: Multi-Tool Device for Geeks

#277
I have found it pretty useful in a few situations: - USB/Mouse keyboard when the iMac you are working on has totally dead batteries for the mouse/keyboard- its not fun but works in a pinch.

- Cloning weird ceiling fans/lights. Apparently I've bought horrible remotes but this helped.

- Used this as a nightstand clock while traveling.

- Used the authenticator app as a backup Yubi key

- Mouse jiggler to keep a computer awake

- blasting tvs at restaurants is a ton of fun and my kids like that.

- And the IR functionality for Nerf Laser Ops Pro (IR laser tag) is an absolute blast - the actual Nerf guns have a delayed trigger, but with Flipper there is no delay or need to "reload" so you are an unstoppable beast.

Re: Flipper Zero: Multi-Tool Device for Geeks

#278
post #233

I would love to get one but articles like this about the Russian connection put me off. https://simovits.com/flipper-zero-zero-trust/

So, they found nothing suspicious with devices or apps.

Also made some far fetched connections of Flipper Devices to companies owning the hackspace Pavel Zhovner worked in, and attributed his trolling and making anti-censorship tools "as actively supporting the authorities in Russia". lol.

Re: Flipper Zero: Multi-Tool Device for Geeks

#279
post #212

Earlier quoted context omitted.

I thought so at first by my initial reading left me somewhat confused on if there's a private key that only certain remotes have or something like that?

It's less of a private key and more a random per-remote prng seed that gets set both on the remote and the door controller when they are paired. When you press the button, remote increments its sequence number and send this number, its ID and a hash of all that and the seed to the controller. Controller checks the hash, then checks that seq number is more than last seen for this remote and opens the door. This protec…

This sounds a lot like the KeeLoq algorithm [0] (minus the hashing part). From my research into the rolling code space, I think most remotes don't quite have the CPU/featureset to support a real, secure crypto system with things like SHA, AES, and RSA/ECC. Would love to see one though!

[0] https://en.wikipedia.org/wiki/KeeLoq

Re: Flipper Zero: Multi-Tool Device for Geeks

#280
post #206

Earlier quoted context omitted.

Someone on Twitter mentioned how some kid managed to crash and shutdown their insulin pump using the flipper zero.

source? sounds fishy to me, can't believe insulin pumps are so vulnerable.

Medical devices with shit firmware are hardly uncommon. I can totally believe someone crashed one with a device like this.
Post reply on HN