Trying Out Flipper Zero (opens in new tab)

Too many fancy electronic locks can be bypassed with a single magnet placed correctly.

https://www.youtube.com/@lockpickinglawyer

These devices are the electronic equivalent of a lock-pick. They still need skill and intent to use, by itself they shouldn't be illegal. They should motivate companies to make proper security measures.

You can grab a $10 ESP32 and a battery pack, load some ready-made software on it and flood everything in a 50 meter radius with so many fake Wifi-APs most devices will go offline. Or you can deauth every wireless device within range.

The tech is available and doesn't require much skill to use.

This is where the story falls apart. I own both a HackRF One and a Flipper. I thought it would be a great teaching tool for my kids to show them physical world insecurities. While it's a great device it's nowhere near as potent as the HackRF as a real tool. And straight out of the box the Flipper does very little from a nefarious point of view.

The "influencers" did a great job of hyping it up on YouTube and Twitter. And my guess is that the majority of the devices sold will be used to pop Tesla charge port doors for giggles. I've gone through a few different firmware and repos and you've got to have just as much interest to learn and use compared with an SDR. And in fact in many cases the Flipper is harder to use because it's limited by its physical footprint.

It's a fun little tool but it's not making much "point and click" besides a handful of known replay attacks that shouldn't have existed in the first place. If anything I hope the Flipper pushes the likes of physical access systems manufacturers / integrators to be questioned on why their systems fail to authorize access correctly against trivial attacks. This is not the fault of tools like Flipper.

> A general teenager or thief wanting to cause issues would not know what to do with an SDR and laptop, versus something like the Flipper making it point and click

This is just your imagination. Flipper is barely less obscure than running some scripts on a Linux laptop, both of which general teens can do.

Yes. Your security might have been good enough, but world moves on. Back in the day Triple DES was good enough, but you are very irresponsible if you use it today.

I get that whenever you are looking anything from inside the industry there is constant need to make processes faster and cheaper. I am sure all car manufacturers would immediately remove seat belts and air bags if they could. However is maximizing profit really what society needs? I think we should have more laws and regulations around product security. *All* products should meet some minimum security standard, but until we have some governing body that can enforce this we will from time to time run into issues like with this device where the large company is decade or more behind the world due to neglecting R&D and now they don't want to pay for their mistakes.

Public/Private Keys? You know a secure protocol like SSH?

Expose their flaws and let the manufacturers properly mitigate their creation.

Turn off keyless entry and use the mechanical key.

Edit: Flipper Price, as it were.

While the offensive side keeps innovating and improving, defense seems to have stopped bothering and instead is resorting to twitter trolling, pissing, and moaning.

Auto makers had ample time to learn that their current radio-operated locks are insecure by design. They had years while everybody even slightly interested knew e.g. how a replay attack can be done. Did they need any more responsible disclosure time in order to act?

BTW there's no need to radically invent anything in that space; say, SSH offers a working example of a tamper-proof, eavesdropping-proof establishment of a secure connection (after a secure initial pairing, expected between a key and the car anyway).

Then it went out of stock.

I shared the capabilities and a test program with a colleague (in the USA) who went onto the site and it was available again. They have one too now.

They really do seem to be adding stock as and when they receive it, so just make a bookmark and check back daily.