Trying Out Flipper Zero(twitter.com) |
Trying Out Flipper Zero(twitter.com) |
If you can unlock your car with the flipper zero you can also do it with a ~100 USD SDR and an old laptop.
I’m not arguing for or against anything here, but what I am arguing is that the discussion seems more nuanced.
Is there an easy solution to improve locks on cars?
Too many fancy electronic locks can be bypassed with a single magnet placed correctly.
https://www.youtube.com/@lockpickinglawyer
These devices are the electronic equivalent of a lock-pick. They still need skill and intent to use, by itself they shouldn't be illegal. They should motivate companies to make proper security measures.
You can grab a $10 ESP32 and a battery pack, load some ready-made software on it and flood everything in a 50 meter radius with so many fake Wifi-APs most devices will go offline. Or you can deauth every wireless device within range.
The tech is available and doesn't require much skill to use.
This is where the story falls apart. I own both a HackRF One and a Flipper. I thought it would be a great teaching tool for my kids to show them physical world insecurities. While it's a great device it's nowhere near as potent as the HackRF as a real tool. And straight out of the box the Flipper does very little from a nefarious point of view.
The "influencers" did a great job of hyping it up on YouTube and Twitter. And my guess is that the majority of the devices sold will be used to pop Tesla charge port doors for giggles. I've gone through a few different firmware and repos and you've got to have just as much interest to learn and use compared with an SDR. And in fact in many cases the Flipper is harder to use because it's limited by its physical footprint.
It's a fun little tool but it's not making much "point and click" besides a handful of known replay attacks that shouldn't have existed in the first place. If anything I hope the Flipper pushes the likes of physical access systems manufacturers / integrators to be questioned on why their systems fail to authorize access correctly against trivial attacks. This is not the fault of tools like Flipper.
> A general teenager or thief wanting to cause issues would not know what to do with an SDR and laptop, versus something like the Flipper making it point and click
This is just your imagination. Flipper is barely less obscure than running some scripts on a Linux laptop, both of which general teens can do.
Yes. Your security might have been good enough, but world moves on. Back in the day Triple DES was good enough, but you are very irresponsible if you use it today.
I get that whenever you are looking anything from inside the industry there is constant need to make processes faster and cheaper. I am sure all car manufacturers would immediately remove seat belts and air bags if they could. However is maximizing profit really what society needs? I think we should have more laws and regulations around product security. *All* products should meet some minimum security standard, but until we have some governing body that can enforce this we will from time to time run into issues like with this device where the large company is decade or more behind the world due to neglecting R&D and now they don't want to pay for their mistakes.
Public/Private Keys? You know a secure protocol like SSH?
Expose their flaws and let the manufacturers properly mitigate their creation.
Turn off keyless entry and use the mechanical key.
I wouldn't want flipper to be discontinued or anything but script kiddos are real.
Edit: Flipper Price, as it were.
However, there is an ongoing discussion about offensive security tools such as Flipper Zero, IMSI-catchers, phishing frameworks, meterpreter lookalikes, etc. and their consequences on the overall security landscape. It used to be that tools were just tools, but now legislators and the general public ask for more responsibility from tools vendors. For example publishing a complete n-day exploit for a major vulnerability (windows/Linux RCE, O365 RCE, etc.) is becoming more and more frown upon since it primarily enables attackers.
While the offensive side keeps innovating and improving, defense seems to have stopped bothering and instead is resorting to twitter trolling, pissing, and moaning.
Auto makers had ample time to learn that their current radio-operated locks are insecure by design. They had years while everybody even slightly interested knew e.g. how a replay attack can be done. Did they need any more responsible disclosure time in order to act?
BTW there's no need to radically invent anything in that space; say, SSH offers a working example of a tamper-proof, eavesdropping-proof establishment of a secure connection (after a secure initial pairing, expected between a key and the car anyway).
Anyone who wants to do real harm with flipper will have to learn a lot, and when they do flipper won't be the tool they stick with. It is limited compared to something like hackrf.
Criminals can buy all kinds of turnkey kits to do crime, flipper isn't one of them.
What's not good is that tons of tech now relies on radio garbage for no reason, especially car keys.
I'm curious what you mean by "radio garbage" and "for no reason."
> "The secondary goal of ProtoView is to provide a somewhat-documented application for the Flipper [...] ."
Having a well-documented, not too complicated and somewhat canonical beginner application is so important.
Anyone know where can I find more info on this "successor" I tried googling with no luck.
I heard that a shipment was seized a couple months ago, maybe due to national sanctions.
(I have a Flipper Zero, but no time to play with it. Wondering whether I should sell it, or hold onto it because I won't be able to re-obtain one later.)
Then it went out of stock.
I shared the capabilities and a test program with a colleague (in the USA) who went onto the site and it was available again. They have one too now.
They really do seem to be adding stock as and when they receive it, so just make a bookmark and check back daily.
Jamming codes - https://github.com/RocketGod-git/Flipper_Zero/tree/main/subg...
Demo here - https://www.youtube.com/watch?v=Vls4FHw_0AE
What sort of terrorist invasions have you indirectly funded?
That's a good point on it moving the needle where there's reason and capability to.
(No offense to our Flipper-creating friends. I suspect many hackers can appreciate the interesting and humorous human dynamics that are sometimes at play.)
If anything the Flipper helps to spread the knowledge where the frontier of practical feasibility is to a wider demographic. This demarcation line is far from trivial but the world would be a better place if all of us knew more about what they should be afraid of and where they can chill.
That was my point.
What geographic area? In the northeast US I've noticed that the cheap, easy to pick locks seem to dominate.
Of course all lock companies will say that their lock is secure.
It’s pretty easy to tell if you know what you’re looking for. Most reputable quality pick resistant locks use a different style key or are a specific identifiable brand.
For these cars it's enough that the key is near and it is considered a feature that no user interaction (like pressing a button on the keyfob) is required. This can be exploited by relaying the signal from the original key to an attacker who is near the car. Cryptography alone cannot protect against this attack scenario (which is called a "relay attack", not to be confused with a "replay attack").
I remember reading about how MITM is prevented in U2F [1] by using information about the connection as part of the challenge that the authenticator has to sign. Could something similar be possible in this scenario?
[1] https://fidoalliance.org/specs/u2f-specs-master/fido-u2f-ove...
Keyless is not going anywhere and you need more than an SSH-like protocol to protect it.
That is, the current proximity-based keyless access would work the same, from the customer's POV: you're around and you have the key, the car grants you all access. You're away, and the car beeps and locks up.
It would just require somehow larger and more expensive components in the keyfob, which is anyway a rounding error compared to the price of the car. But, more importantly, it would require to make a fuss and change something in an area which "just works" now, which is always a hard and thankless task in a large corporation. Beside that, car manufacturers have little interest in making your car harder to steal (unless they look excessively bad compared to every competitor); they'll gladly sell you a new car instead.
"anyway a rounding error compared to the price of the car. But, more importantly,"
For car manufacturers rounding errors start many, many digits behind the decimal point. At their volume a cost down of a fractional cent is significant.
Have you ever owned a push button start vehicle? It is a strictly superior UX.
Doubly so when it's temperature sensitive, so most likely to strand you when you are very cold. If given the choice I'd rather have something that works for the life of the car instead of depending on a battery powered dongle.
Presumably the argument is that the benefits you get from this new medium being introduced (being able to unlock your car from a distance) can be argued to not be useful enough to warrant the new issues it brings along with it (verifying the authenticity of the transmission, avoiding jamming, etc.), and one can argue that the Flipper Zero is shining a light on these issues in a new way: they have always been there as fundamental parts of the choice of the radio medium, but they are now easier to exploit.
True, if you don't care about security upload you password to the cloud or open your Car without any manual action ;)
Cars are trivially broken into. Increasing the safety of the locking mechanism would do some good but not prevent. This is what I was referring to by appropriate. Maybe that weakens my argument about at least considering the Flipper as a potentially harmful device, but the Flipper can do a lot of things.
There is a lot of security that relies on things simply being inconvenient.
Remember how in the mid-00s it was pretty trivial for any nerd with a Linux laptop to sniff traffic on a WiFi network and intercept passwords? For years the security-aware community was making a point of this, but major web sites just kept using unencrypted HTTP for their logins and such.
Then someone released a Firefox extension which made it literally point and click for almost anyone on any OS to capture and reuse passwords over the air. Suddenly it went from trivial for nerds with the right tools and a bit of training to trivial for anyone who wants to try, and very soon after that we started seeing the "HTTPS Everywhere" movement explode in popularity, sites like Facebook locking down at least their login endpoints if not the entire site to only work over HTTPS, etc.
Insecure communication was always a problem, but it took the combination of popularity of WiFi and point-and-click tools to make the world care enough for the problems to get solved. Until that happened, those with the ability to solve it didn't care enough because it didn't impact their bottom line because not enough of their customers cared.
Good, this will hopefully lead to less of that.
edit: Like Firesheep, as my sibling comment pointed out.