Live data from Hacker News

Flipper Zero: Multi-Tool Device for Geeks

flipperzero.one

281–290 of 346 posts

Re: Flipper Zero: Multi-Tool Device for Geeks

#281

I have found it pretty useful in a few situations: - USB/Mouse keyboard when the iMac you are working on has totally dead batteries for the mouse/keyboard- its not fun but works in a pinch. - Cloning weird ceiling fans/lights. Apparently I've bought horrible remotes but this helped. - Used this as a nightstand clock while traveling. - Used the authenticator app as a backup Yubi key - Mouse jiggler to keep a computer…

Just a heads up about the Flippers U2F implementation [0] and the possible weaknesses compared to a Yubikey/other U2F key.

[0] https://modusmundi.com/posts/u2f-flipper/

Re: Flipper Zero: Multi-Tool Device for Geeks

#282
post #84

I got one not too long after the official launch and I've used it a decent amount (granted I am in cybersecurity and have a more real-world use cases then the average person). My favorite use case is the IR remote since phones no longer have IR blasters. It's saved me twice so far in having to buy/find a remote for something. One thing people don't realize is that the custom firmware [0] that you can run allows you t…

> Lots of things use that range (garage doors, gates, fan remotes, etc.) and are not very secure. https://en.wikipedia.org/wiki/Rolling_code I didn't know this wasn't secure enough. I thought this was the basis of most modern vehicle keyless entry too? It is hard for me to not think of the Flipper Zero as a script-kiddie tool to do super illegal things like open your neighbor's garage illegally.

While rolling codes can be secure (KeeLoq [0] is a more secure example but has it's own issues), this [1] is an example of some of the weaknesses that can happen if a rolling code algorithm is broken. I have personally been able to capture, decode, encode, and transmit garage door codes using that python script and a HackRF (which can also be done with a flipper and custom firmware).

[0] https://en.wikipedia.org/wiki/KeeLoq

[1] https://github.com/argilo/secplus

Re: Flipper Zero: Multi-Tool Device for Geeks

#283
post #266

Earlier quoted context omitted.

A friend got this for me, but I'm struggling to put it into any useful purpose, any pointers with things I can experiment it. Using it as a remote seems so cool, esp bc I lost my roku remote not so long ago so if you have any resources that could help I'd appreciate it. The documentation I've seen so far seems far and scattered and it seems people are more scared of being implicit in illegal activities based on their…

For IR remotes, there are a few ways to go about it. If you have a remote you want to clone, you can just use the flipper to clone and map buttons to a custom remote. If you don't have the remote and have a common device (like TVs), I would check this repo on Github [0] and see if you can find a compatible IR file. Note, you need a micro SD card in order to move the files onto the flipper, but a small one works fine.…

sweet. thank you

Re: Flipper Zero: Multi-Tool Device for Geeks

#284
post #199

Recent news discussions: Flipper Zero can be used to crash iPhones running iOS 17 https://news.ycombinator.com/item?id=37919396 Apple Shuts Down Flipper Zero's Ability to Shut Down iPhones https://news.ycombinator.com/item?id=38656607 Flipper Zero banned by Amazon for being a ‘card skimming device’ https://news.ycombinator.com/item?id=35481580 UK airport confiscates passenger's Flipper Zero https://news.ycombinator.c…

The last one is hilarious, just endless speculation on how the guy could have handled it better, the guy coming in with the account of how he handled thing pretty nicely, and then just crickets .

Good read indeed - a lot of conclusions being jumped to there.

Re: Flipper Zero: Multi-Tool Device for Geeks

#285
post #282

Earlier quoted context omitted.

> Lots of things use that range (garage doors, gates, fan remotes, etc.) and are not very secure. https://en.wikipedia.org/wiki/Rolling_code I didn't know this wasn't secure enough. I thought this was the basis of most modern vehicle keyless entry too? It is hard for me to not think of the Flipper Zero as a script-kiddie tool to do super illegal things like open your neighbor's garage illegally.

While rolling codes can be secure (KeeLoq [0] is a more secure example but has it's own issues), this [1] is an example of some of the weaknesses that can happen if a rolling code algorithm is broken. I have personally been able to capture, decode, encode, and transmit garage door codes using that python script and a HackRF (which can also be done with a flipper and custom firmware). [0] https://en.wikipedia.org/wiki…

Can you help me understand why rolling code attacks aren't broken on most cars but are broken for garages?

Also, are attacks like this real/common/easy to pull off? https://youtu.be/1SUGf6OwRzw Where the signal is amplified from the key inside the house to the car. How does the car/keyfob not detect it's signal/noise ratio or time for roundtrip is all messed up distance wise?

Re: Flipper Zero: Multi-Tool Device for Geeks

#286

I have found it pretty useful in a few situations: - USB/Mouse keyboard when the iMac you are working on has totally dead batteries for the mouse/keyboard- its not fun but works in a pinch. - Cloning weird ceiling fans/lights. Apparently I've bought horrible remotes but this helped. - Used this as a nightstand clock while traveling. - Used the authenticator app as a backup Yubi key - Mouse jiggler to keep a computer…

I had a lot of fun playing with the Flipper's Bad USB DuckyScript to automate some repetitive and tedious CMS workflow for a client, filling in a lot of input fields on multiple browser windows with a single press of a button. It improved my productivity and happiness. I've since graduated to Playwright, but it was the Flipper that sparked the idea.

Re: Flipper Zero: Multi-Tool Device for Geeks

#287
post #46

$169 is a bit steep for me, so I went on Temu and bought a $8 125KHz RFID programmer & a $5 USB-C IR Blaster. Combined with my Samsung phones native NFC writing, bluetooth, etc I feel like it scratched the itch of 90% of what people do with Flipper for 10% the cost.

> I went on Temu and bought Too bad. I was sincerely hoping nobody would buy anything from them so they would die.

Amazon costs twice as much, and Aliexpress takes twice as long to ship. I have an adblocker installed, so I haven't experienced the annoying ads people are mentioning. I don't install apps when a website is available, so it's not a a spyware concern. If Temu is more evil that the other main two options, I have yet to see an explanation.

Re: Flipper Zero: Multi-Tool Device for Geeks

#288

Earlier quoted context omitted.

I'm not ver familiar with Temu. Are these shady practices documented somewhere, and are they worse than industry peers (aliexpress, wish, overseas ebay, etc)?

https://github.com/davincifans101/pinduoduo_backdoor_detaile...

I don't install apps when there is a website I can use from my desktop. So, I guess I have a green light to enjoy Temu.

Re: Flipper Zero: Multi-Tool Device for Geeks

#289

This is a super fun gizmo, it's discord channel is, uh, not great. One cool thing is that you can talk to it serially. I pretty quickly had it organized with an IoT temperature sensor so that it could send commands to my ceiling fan given the temperature in my office. I have also used it to capture the NFC code on a hotel card key so that I could still get into my room even after my key was inevitably "damaged" by ne…

Friend of mine has 3 yrs old. The "dolphin" is in constant use by the child. "What is he doing now?" " Let's check what dolphin is playing with today". "What does it say" "Does he miss me?" "Let's play with him".

It quickly became pal of the child.

Friend told that is one in top 5 toys of the child now :)

Re: Flipper Zero: Multi-Tool Device for Geeks

#290
post #282

Earlier quoted context omitted.

While rolling codes can be secure (KeeLoq [0] is a more secure example but has it's own issues), this [1] is an example of some of the weaknesses that can happen if a rolling code algorithm is broken. I have personally been able to capture, decode, encode, and transmit garage door codes using that python script and a HackRF (which can also be done with a flipper and custom firmware). [0] https://en.wikipedia.org/wiki…

Can you help me understand why rolling code attacks aren't broken on most cars but are broken for garages? Also, are attacks like this real/common/easy to pull off? https://youtu.be/1SUGf6OwRzw Where the signal is amplified from the key inside the house to the car. How does the car/keyfob not detect it's signal/noise ratio or time for roundtrip is all messed up distance wise?

From what I understand, cars are a bit more complex now then garages. KeeLoq, from my understanding, is not 'breakable' like garage doors. It does have weaknesses, but more related to the raw cryptography/math. Since KeeLoq is a cryptographic function, it can be broken by brute force or by gaining access to the manufacture key.

For the amplification attacks, my understanding of them is that the key fob and car may be able to detect this kind of attack, but require more logic/software to do so. Also, most of these attacks use high frequency 'backhaul' wireless networks (key fob at 3-400Mhz, backhaul at 2.4-5 Ghz Wifi with lower latency) to prevent such timing/signal-noise from being detected. If I had to guess, most key fobs/cars are more focused on making sure the key fob works at range or in hard-to-detect environments and not focused on preventing such relay/amplification attacks.

Also, some similar attacks to what you linked could also be done against Bluetooth (I think Tesla had this issue in the past few years) with a simple Bluetooth range extender/relay setup.

(Note: without one of those devices, most of this is just guesses/what I've seen is possible/theoretical in terms of attacks)

Post reply on HN