I picked up two of these bad boys. It literally took minutes to turn it into a universal remote for everything in my flat, from TV to air filter and everything in between. I love the form factor as well as the interface. I haven't yet had time to delve into the more advanced use-cases, but indeed, it is impressive for what it can do out of the box.
Trying Out Flipper Zero
51–60 of 109 posts
Re: Trying Out Flipper Zero
#52Earlier quoted context omitted.
There are a bunch of semi-easy tools for lockpicking too and a good percentage of American locks are reeeally bad at thwarting even a novice picker. In worst cases you just need a flat piece of metal. Too many fancy electronic locks can be bypassed with a single magnet placed correctly. https://www.youtube.com/@lockpickinglawyer These devices are the electronic equivalent of a lock-pick. They still need skill and int…
Exactly, and in regard to the parent comment mentioning teenagers: They are exactly the group that needs the Flipper least because they have might not have money but they often have plenty of time. If anything the Flipper helps to spread the knowledge where the frontier of practical feasibility is to a wider demographic. This demarcation line is far from trivial but the world would be a better place if all of us knew…
> and in regard to the parent comment mentioning teenagers: They are exactly the group that needs the Flipper least because they have might not have money but they often have plenty of time.
That was my point.
Re: Trying Out Flipper Zero
#53Earlier quoted context omitted.
Exactly, and in regard to the parent comment mentioning teenagers: They are exactly the group that needs the Flipper least because they have might not have money but they often have plenty of time. If anything the Flipper helps to spread the knowledge where the frontier of practical feasibility is to a wider demographic. This demarcation line is far from trivial but the world would be a better place if all of us knew…
> and in regard to the parent comment mentioning teenagers: They are exactly the group that needs the Flipper least because they have might not have money but they often have plenty of time. That was my point.
if your security model can't stand up to teenagers with plenty of time, it might be time to reconsider it.
Re: Trying Out Flipper Zero
#54Earlier quoted context omitted.
Honestly it's a bit of both in this situation : they are good RF protocols that are secure enough (e.g. Calypso has not been broken yet) but they are not used by vendors since the insecure version is "good enough". Now that Flipper Zero exists, they have to adapt. However, there is an ongoing discussion about offensive security tools such as Flipper Zero, IMSI-catchers, phishing frameworks, meterpreter lookalikes, et…
Responsible disclosure exists for serious exploits, and it sort of works. Auto makers had ample time to learn that their current radio-operated locks are insecure by design. They had years while everybody even slightly interested knew e.g. how a replay attack can be done. Did they need any more responsible disclosure time in order to act? BTW there's no need to radically invent anything in that space; say, SSH offers…
Opening (and mobilising) a car is a vastly different scenario from opening an SSH session and your typical Mercedes or BMW driver is not your average SSH user. Customers want their cars to unlock on approach and they've become used to it. They expect the trunk to open when they swipe their foot under the tail bumper while they are holding their groceries in both hands. Keyless entry systems are useful and the most important target group of buyers of cars that are worth stealing is accustomed to them.
Keyless is not going anywhere and you need more than an SSH-like protocol to protect it.
Re: Trying Out Flipper Zero
#55Earlier quoted context omitted.
>Is there an easy solution to improve locks on cars? Public/Private Keys? You know a secure protocol like SSH?
Doesn't help against a common attack possible for all reasonably modern luxury cars (which happen also to be the most interesting targets). For these cars it's enough that the key is near and it is considered a feature that no user interaction (like pressing a button on the keyfob) is required. This can be exploited by relaying the signal from the original key to an attacker who is near the car. Cryptography alone ca…
>No cryptography can protect against this scenario
I remember reading about how MITM is prevented in U2F [1] by using information about the connection as part of the challenge that the authenticator has to sign. Could something similar be possible in this scenario?
[1] https://fidoalliance.org/specs/u2f-specs-master/fido-u2f-ove...
Re: Trying Out Flipper Zero
#56Earlier quoted context omitted.
>Is there an easy solution to improve locks on cars? Public/Private Keys? You know a secure protocol like SSH?
Doesn't help against a common attack possible for all reasonably modern luxury cars (which happen also to be the most interesting targets). For these cars it's enough that the key is near and it is considered a feature that no user interaction (like pressing a button on the keyfob) is required. This can be exploited by relaying the signal from the original key to an attacker who is near the car. Cryptography alone ca…
Wouldn't measurements of ping between keyfob and car be able to detect such attacks?
Re: Trying Out Flipper Zero
#57Earlier quoted context omitted.
Mine was held up by the seizure. I got an email about it, but they were able get it out a month or so later. They were able to work around it, but I don’t recall the details. I think they had a blog post about it.
Mine was too. The seizure had more to do with the war (as the devices come from Russia and are explicitly labeled for hacking) - my package got to me fine, looks like it wasn’t tampered with or anything. I think business is as usual for the Flipper folks.
I thought they were shipped directly from China? On their shipping page they reported issues shipping to Belarus which would be unusual if they'd ship from Russia. If anything I'd expected issues with payment but I've never heard
that to be the case.
Re: Trying Out Flipper Zero
#58Earlier quoted context omitted.
Doesn't help against a common attack possible for all reasonably modern luxury cars (which happen also to be the most interesting targets). For these cars it's enough that the key is near and it is considered a feature that no user interaction (like pressing a button on the keyfob) is required. This can be exploited by relaying the signal from the original key to an attacker who is near the car. Cryptography alone ca…
Wouldn't measurements of ping between keyfob and car be able to detect such attacks?
There are mitigations, my point was mainly that there is more to it than a implementing a tried and proven protocol but developed for a completely different use case (like SSH). Keyless entry systems are what they are because of a complicated trade-off between convenience, reliability, security and other factors and not necessarily because all engineers at car companies are idiots.
Re: Trying Out Flipper Zero
#59Earlier quoted context omitted.
I’m speaking from 6 months ago. My hacker (vuln researcher) friend just convinced to buy one, I went to the store and bought one. Probably just an uptick in sales right now because of similar blog posts and the current HN hit.
Ah I don't imagine there are any physical stores by me that would stock this. That said I did a google search for "flipper zero site:cz" and it seems there's sometimes second-hand ones listed on ebay-like sites, so that's an option.
When I said store I meant online!
Re: Trying Out Flipper Zero
#60Earlier quoted context omitted.
Mine was too. The seizure had more to do with the war (as the devices come from Russia and are explicitly labeled for hacking) - my package got to me fine, looks like it wasn’t tampered with or anything. I think business is as usual for the Flipper folks.
I thought they were shipped directly from China? On their shipping page they reported issues shipping to Belarus which would be unusual if they'd ship from Russia. If anything I'd expected issues with payment but I've never heard that to be the case.
I don’t really know just regurgitating the communication I followed while my device was in limbo. Even if it’s from China, maybe there’s info surrounding the container that it’s a Russian company selling a hacking tool.