Now Android and Windows devices aren't safe from Flipper Zero either

retiolus@lemmy.cat to Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ@lemmy.dbzer0.com – 84 points –
news.retiolus.net
31

You could also just hit someone’s phone/tablet/PC with a rock.

Can someone please explain to me what's the point of Flipper Zero? In what way is it capable to do anything Android phones with custom software aren't?

It has hardware that most cell phones don't have.

Sub-ghz
"allowing it to receive and send radio frequencies between 300 and 928 MHz. These switches, radio locks, wireless doorbells, remote controls, barriers, gates, smart lighting, "

RFID
" including plastic cards, key fobs, tags, wristbands, and animal microchips."

Infrared
" that use infrared light (IR) such as TVs, air conditioners, or audio devices. It can learn and save infrared remote controls or use its own Universal remotes"

It also has an iButton reader.

Isn't RFID compatible with NFC antennas? There's plenty of apps on F-Droid to interact with RFID tags using NFC.

Same thing for IRDA, some manufacturers still do include it in their devices.

RFID compatible with NFC antennas

Only the HF RFID stuff. There is also LF and UHF RFID. FZ has an LF RFID antenna.

"NFC tags are a subcategory of HF RFID technology. All NFC tags are HF RFID tags, but not all HF RFID tags are NFC tags. NFC operates in a very specific subset of the high-frequency range —13.56 MHz— and have very different use cases and implementation considerations from other RFID categories"
https://www.resourcelabel.com/resources/comparing-different-types-of-rfid-tags/

Same thing for IRDA

IrDA isn't the same as IR. There were some phones with an actual IR blaster built in but most were IrDA.

okay, so what are practical things flipper zero can do that phones with NFC antennas and IR blasters can't?

It's a learning tool, it also has gpio pins and a long lasting battery.

It's a toy for people who are interested in hacking/pentesting. Sure, you can do everything it does with a phone, but without the toy like aspects.

Tbh you can do literally everything that a PC can with a phone. Doesn't mean that a phone is the most fun to use for whatever you're trying to use it for.

"Sure, you can do everything it does with a phone"

No, you can't do everything with a phone. A phone doesn't have the same radios, GPIO for expandability, IR transceiver, etc. Not to mention the radios a phone does have doesn't like it when you start forcing it to do fun things.

Wait... a cell phone can clone, erase, and reprint an rfid chip?

Depends but it's definitely possible. Friend had a mid-high level phone some 2-3 years ago and did it and my Xiaomi 9 does it.

Some RFID are encrypted though so I guess they're out of scope.

1 more...
1 more...
1 more...

Light on details, but would be interesting to see what range of devices and OS versions this works against. Should be easy enough to ban devices that are spamming automatically as a counter measure.

Ehhhh it’s flexible enough that I’d bet it can change its “identity” and make it seem like 1000 different devices

There seems to (at least theoretically) whitelist pairing-requests by mac-adress. Randomly hitting those few approved adresses consistently seems fairly unlikely: https://kb.vmware.com/s/article/50121103 (how to do it on Samsung, wish I had this option as well)

Yes, but these are requests for new devices to pair

And most people aren’t going to bother with that white list

And even if they did, the attack can be tailored to the white list, because you don’t need to have a real Mac address, it can be spoofed

You should get one and find out. I love mine.

I'm honestly just now hearing of it. Sounds cool, but I feel like I'd only use it once every 6 months just to see if it still works on specific things. Will keep an eye on it.

Yeah, same. I have literally zero use for it outside tinkering, and knowing myself, I'll play with it for a couple of days, then forget it in a drawer, rinse and repeat every handful of months. It's just expensive enough that it feels pretty wasteful to do so lol

I mean if you werent into tamagachis and the like, probably.

But its got this dolphin that gets all sad if you dont use it. That alone keeps me playing.

what do people actually use them to do?

I've used it around the house to make copies of the light switches (they are small battery operated radios.)

I've also used it to clone my car fab as a backup.

I've found out what my neighbors are doing that is radio controlled. Some times I just scan for packets and try and decrypt them.

I've used it to get the full metadata on my pets RFID tags. I now have full records for all my pets.

I've used it in a gimmicky way to get my credit card information, and I've considered using it for payment, but havent' tried yet.

Honestly, its a great tool to have. Its a swiss army knife for radio signals. I'm mostly concerned with leveling up my dolphin though.

I've also used it to clone my car fab as a backup.

does that work? I thought modern cars used a challenge/response or rolling key system.

Probably not, and it can actually cause issues with some cars and make the original fob not work anymore

hey that is actually pretty cool.

if it weren't for the price, I'd probably pick one up.

I'm surprised they haven't been cloned and sold for much less.

I mean, the build quality is there. It feels great in the hands. Is the price a lot? I mean, its quite a tool for what it is.