As the guy says you must hack the tool. Out of the box it comes plain bog standard with hardly any viable usable functions. Basically comes as Vanilla. You need to flash it with Firmware like "Momentum" for example there are a few different firmware you can flash it with and it doesn't take long plus you can switch between firmware (Check how to multiboot.) a must have for it though is a WiFi Development addon board. (GPIO) Once flashed you will love the flipper instead of Daddy says no to everything. Great and honest video though. I think we all start in your perspective as some point. You also need desktop or mobile app software like "QFlipper"
Flashing a firmware is not hacking, also having an esp32 stuck to it does not making it a wifi hacking tool, you can capture handshakes with a basic laptop + you can also do something with that handshake except look at it. As for deauth attacks, I could do that with an android device like 10 years ago even more. In my opinion this is a interesting toy, you pay for the small form factor
Quick note about recording the car fob: If your car was close enough to receive your keyfob at time of recording then when you replayed the keyfob signal the car will reject receiving that signal a second time. This is thankfully due to most cars having a "rolling code" that changes with each button press which prevent replays... usually.
@saveitforparts - You might retry recording the fob activation when you're a far enough distance away from the car. Or if you can put the fob and the Flipper in the equivalent of a Faraday Cage / metal box when you activate the fob, that could work too. Or you could use another radio very close to your car that would jam reception of the signal, but not trip up the Flipper.
It's called a "rolling code" system and lots of RF-based systems use it. Every time you use the fob it moves to the next code in a pre-programmes set. The car remembers which code you used last time and only opens if the code you send is in the next X codes in that list. If not, it doesn't open. In fact if you play with your keyfob too much you may move the fob to a code outside of the expected set of codes of your car and you'll have to re-sync the fob to the car. So yeah, moist RF systems have ptotection against these simple replay attacks.
This can be used for a denial of service attack because if the car computer reads the same (cloned) signal/code coming in a second time, it assumes it is an attack, and locks the remote fob with that ID out. The physical key will still work, but the owner will have to get the key fob re-synched at the dealership. This can get annoying fast for obvious reasons.
@vinny142 Its probably less of a list and more an algorithm that manipulates an initial seed value in a programmatic fashion. All the car needs is the same seed value, and with unique seed values your fob wont unlock someone elses car.
I work as a general contractor, my Flipper has been one of my favorite tools I have ever owned. A lot of my clients live in gated communities, apartment complexes, etc. Being able to get in and out of these communities with a pushbutton is one of the most pleasant feelings in the world, that is all. No memorizing codes, don't have to do shit, I can even open some of my customers garages if they ever need me to. Of course, I have to program it first, but it takes seconds
Yeah I use my flipper more for convenience than some Project Mayhem type of stuff. Save a lot of day to day/ week to week key fobs and what not to it. Instead of having to keep up with the office key, the gym key, the parking garage key, the gate code, etc. I just pull out the flipper and use it. Also, flipper nerfed a lot of their features so this thing wouldn't get banned in more places. You can somewhat 'jailbreak it' to access a lot of these gate codes, and even get a full library of remotes without having to program any. Additionally, I think the BadUSB is cool, but that can definitely be where the real hacker stuff comes in. I played around with a few scripts, and stopped. You can download scripts to brute force laptop passwords, and a bunch of other things. I really think the makers wanted to downplay it's capabilities to avoid getting banned. Still more powerful tools out there, but it was limited to what it can do out of the box.
I'm a contractor/electrician. My job is similar to yours any tips or can you point me in the right direction as far as what could be useful? I just purchased one based on your advice.
Hey man, I use my flipper for opening my gated community gate, but I cannot for the life of me figure out how to program it as a garage remote. What steps did you take? I have the Rougemaster CFW if that helps
iButton is not actually some Apple nonsense! It's a one-wire communication protocol used in a lot of older security keys and even as a transit pass in some cities! It also goes by the names "touchmemory" or "dallas keys".
We use iButton to identify drivers and road tankers at a fuel loading facility in Australia. I’ve been wanting to try storing all my iButton ID’s on the Flipper because every time I swap tanker trailers I need to use the associated iButton - if I have them all on my device they’re effectively a backup (or spare) of the original. The only problem being using the device while at the gantry goes against all the safety protocols for the safe loading of flammable liquids😢. I could probably use it at the automatic security gate at the entrance and exit of the facility though.
It did not lock the car because vehicles and keyfobs use a synchronous rolling code. The car and the key have a seed value stored in them, and whenever you send a command such as lock, unlock, etc, using the fob it uses that seed value and then they update the value internally. By recording the key fob you are replaying an old value. So the car wont listen to it. You need to do whats called a Rolljam attack which will prevent the car from hearing the keyfob while you record the value. Buyer beware! This can disassociate the fob from your car and you need to manually reset the rolling code inside the vehicle in order to reassociate the key fob with your vehicle. If your car doesnt allow you to do this manually you might need to have it taken to a dealership. Its not such a problem if you have a metal key in addition to your fob. If you are entirely pushbutton though as many modern vehicles are... You wont be able to drive your car. And thus you will have to have it towed to a dealership.
If it's push-to-start you can almost always hold the fob to the button and it will read it using NFC (or something similar, not sure) to allow you to start the car. This is mostly meant as a way to still be able to start the car if the fob battery dies.
You are correct and I just want to say that there is a workaround for this basically it's just an algorithm and a process of figuring out the hex table wildcards. But like a lot of things it wouldn't be responsible to post exactly how to do it.
Yeah ok, but when he recorded the fob signal he recorded the next rolling number away from the car (not in range) so that means the recorded number on the flipper is in fact the correct number the car should receive and therefore lock/unlock. You know what I mean?
The separate on and off buttons are quite helpful for professional A/V situations where you might not be able to immediately tell if the projector has turned on or not. Instead of just telling the projector to change to an ambiguous "the opposite of the current state", you can specify exactly which state you're looking for. The result is that you can just spam the power button without needing to worry that you're turning it on and off and on and off and on....
I look at this flipper thing and it reminds me of the bygone days of PSP hacking. Back then you had firmware, flashing and all the cool software people came up with on forums you could even access through the PSP's internet Tbrowser. The fat PSP came with an RFID sensor which made it ideal as a grabber for remotes; I had the AC remote hotkey'd in, as well as the school projector remote :D
The fat psp was my drug😂 after it i started softmoded so many mp3 and phones. Work machines/cameras/networks/printers/vehicles/forklifts its considered geeky asfuk so no one cares if u do it…..all thanks to psp ❤
Unfortunately, I got into the hacking scene a little later, when the PSP 3000 was released. No Pandora battery, and basically had to wait for Pro CFW or others that were released, like Cold bird's (Thefl0w) stuff. No infared on the 3000, but I did get a 1000 later on and gave it to a brother of mine. I don't remember if I was able to get IRshell to work. 😞
I'm a A/V technician, I mostly use the flipper to emulate different IR remotes so I can have all the remotes I need in my pocket. I also think the rubber ducky USB scripts are immensly powerful and usefull. Imagine having to change say the network config like ip and submask on 5 different machines or download a bunch of software that you need on multiple machines. Even tho the option is called bad usb, for me it's a really neat timesaver
I want one largely to just use as a GREAT “universal remote”. No messing with button pressing/holding, just a nice GUI and it can control all the stuff not just IR devices.
@VynVdragon I agree but to be fair I have a flipper and the online repositories people upload of all the different IR brand and model controls for a big variety of equipment beyond just TVs and projectors or whatever. Sadly I live in the U.S. but Ive always wanted to mess with those A/Cs that are popular in Europe you know the white rectangular ones mounted indoors with the compressor mounted by the window outside. You could make everyone’s day by increasing the intensity of some AC in a very busy hot supermarket lol be a saint but yeah otherwise there are a slew of universal remotes that exist already including ones with much much stronger IR blasters than the flipper has (I have one myself obv I know it’s not that strong of a blaster) so you can do the actual funny stuff like turning off neighbors TV from two houses away or whatever I remember one was literally sold for that purpose I think it was called TV B Gone or something lol
I really appreciate your perspective on updates. On one hand, not updating some things has the potential to leave the user in a vulnerable state. On the other, it can (and often does) strip away features, or add things that benefit the manufacturer and not you. Even if it's just increased data collection that takes performance/battery life away from you. It's something worthy of consideration and discussion in my opinion.
I remember one of my friends got one of these and started testing it out with Flipper Unleashed... he then proceeded to accidentally change his AC unit from Fahrenheit to Celsius, couldnt figure out how to change it back, and then sold it to one of his uncles friends 💀
Also badusb is keyboard emulation to inject a payload, for malicious or prank purposes. Custom firmware adds BadBT which does the same thing to affected devices without even needing to connect physically
I have the Xtreme firmware on mine and have tried it on multiple garage doors, at least two of them could be opened after capturing the signal once. They both had a vulnerable rolling key based protocol. The IR functionality can be both fun and useful. I've used it to turn on the TV when I can't find the remote in hotels etc. I was also able to clone some access cards, for a gym for example. Some of the GPIO apps are nice too. The signal generator and apps for testing various sensors. Bad USB is very nice in a penetration test scenario. If you get one of the WiFi addon boards you can also do de-authing and some other stuff. A lot of people (including my kid) have been lead to believe that this device can "hack" anything. Mostly because of fake TikTok clips. But it's a great device with lots of features. My girlfriend has played way too much Tetris on it as well. 😄
A lot of people do not understand RFID. These devices do not transmit data unless they are in close proximity to a reading device. which briefly powers them just long enough to send a packet of data. I think you could probably do the same thing with NFC reader software installed on any modern cellphone.
My workplace uses NFC tags for security when they do rounds, and I can confirm my phone could easily read them, and likely could overwrite them rendering them useless. I use NFC tags at home so I had an app already for that.
I've got this device on my wish list, for no reason other than it seems fun and cool. I'm no criminal. I have researched it somewhat (watched youTube vids). You are going to get tons of great advice from actual users, so let me just ask that you please do an update soon!!!!! It was frustrating to see your results when I had seen others do some spooky, cool stuff! I have never seen weather satellite photos from junk before, so I have complete confidence in you, dude! I really love your channel!
I keep hearing that the "other" firmware options are better, but also that RUclips gets twitchy about videos with that, so if I jailbreak it I might not be able to show much of that :-P
@sdjhgfkshfswdfhskljh3360 it's his video! like who tf are you to tell him it's unfair? how about you make your own "fair" review and publish on your own channel..
David Beckham's car was stolen i think 4 times using a key fob playback device lol. i love that the flipper is making RF hacking so easy because now manufacturers are being forced to upgrade their security
00:02 Flipper Zero is a versatile hacking and security tool disguised as an electronic pet. 02:11 Consider updating the firmware for potential useful features. 04:27 Microchipping pets for identification purposes 06:18 The Flipper Zero can detect and analyze radio frequencies. 08:49 Flipper Zero has limitations in hacking capabilities 11:01 Flipper Zero can read and copy security codes from RFID cards and fobs. 13:10 Flipper Zero can clone access cards and emulate card information. 15:26 The Flipper Zero has mixed usability and may be helpful for niche projects. 17:40 The Flipper Zero is considered more like a toy with limited practical use.
I haven't tried anything but the Xtreme firmware. Most of the biggest names using the Flipper Zero seem to run Xtreme. I don't think there's anything there others do that Xtreme doesn't. They update it all the time to the latest abilities.
Fun fact : using an ESP32 you can transmit at 433 MHz, using the "LED controller" LEDC peripheral. You need to set the frequency to 33.875 MHz and the resolution to 1 bit using the ledcSetup function. You can then transmit by toggling the PWM between 0 and 1 using ledcWrite. Of course it transmits a whole bunch of harmonics at frequencies it's not supposed to, and one of them falls close to 433.92 MHz. Using a short piece of wire it can transmit up to 10 meters.
If you ever decide to automate your home to manipulate your projector, you will be very grateful for its discreet On and Off signals. Toggling power is hard to program around since you have no guarantee of starting state. Thanks for your videos.
ibutton is like a coin cell looking thing that runs Java, I believe. Used in apartment complexes as door keys, sometimes. inside the ibutton is a small computer and when you press the button up against a receptacle there's a challenge/response thing over a 1-wire protocol and if each half gives the right answers to things then (in the case of an apartment complex) unlocks the door. Sun Microsystems even made rings with built-in iButtons. Still commonly used, I believe. Definitely not apple.
Back when I was a steeley-eyed security dev, I had an iButton ring. It was too small for me, though, so I wasn't in the habit of wearing it. I remember McDonalds used iButton fobs for employees logging-in to the sales terminals, back when iButtons were popular.
iButton uses the 1-wire protocol and is based on the javachip/javacard API, the same chipset and APi that still powers billions of smartcards. At JavaOne 1998 Sun introduced the JavaRing, the original setup provided in the SWAG bag that plugged into a reader that sent a REST request to a server that lit a pixel that represented you in a giant mosaic that was supposed to gradually appear in a large overhead screen. I remember hacking those requests so they had to shut it down and actually implement the security protocols built into the ring. Still have that ring somewhere. Ah, memories.
Its actually an embedded subset version of Java called the JavaCard API that runs on the JavaChip architecture. The iButton implements security protocols in JavaCard and also includes tamper resistance that zeros the stored data if physical or electromagnetic tampering is detected.
We use iButtons for a opening a specific type of door. Not phased out yet, so I won't be too specific, but didn't realise they were quite so easily emulated. Good job we're getting rid.
I use mine as a vault for all the RFID cards used to access different locations I service. If I visit a location and they loan me an access card I just clone it and give it back or generate one on fly and add to whatever system they use. It also came in handy to re-purpose some ioProx cards that we were originally going to throw out because we moved to an HID access based badge system.
The reason why it didn't work on your car is because of the implementation of security on modern car remotes. When remote locking first started appearing replay attacks where very real and a huge problem, someone would sit in a parking lot wait for you to lock or unlock your vehicle then modify and or replay that message gaining access to your vehicle. These days however there is a small security algorithm running on the fob and on the vehicles computer creating a rolling encryption key that keeps changing every time you use that fob, it has to match with the vehicle computer, otherwise it just ignores it. Its still possible to "replay" but it requires you to reverse engineer that algorithm, and run it at the same point as it is currently in the vehicle you are attacking.
I keep hearing that the "other" firmware options are better, but also that RUclips gets twitchy about videos with that, so if I jailbreak it I might not be able to show much of that :-P
@saveitforparts you don't have to say you jailbroke it, you just "updated the software". It would be nice to see all of the capabilities of the unit without restriction since its a pain that you payed for the device and cant use all of it. also I wonder what you can add to it through the gpio pins.
Thank you for the video, If I had watched this sooner I may not have ordered one but i'm sure I will come up with some project to take advantage of it!
The custom firmware will do the garage opening and counts on what your car uses if your car uses rolling code then you’ll have to record the remote being outta distance from the car
While I have only had the Flipper for a short time, I find it useful when I forget my access card to work or if the remote for a TV at work is missing. It remains to be seen if I can record my parents' garage door, but if I can, it will be very nice. As for projectors having separate buttons to turn them on and off, I, too, found that strange initially. However, it is beneficial. This makes a lot of sense due to the considerable delay in turning the projector on or off. The projector will continue to run the fan for a long time after you have turned it off. If you are impatient to turn it off, you may accidentally turn it on again, which is the opposite of your intended action. Having two separate buttons solves this issue both ways.
Interesting. This is the entrance to a deep rabbit hole that will have to wait a bit because I have too many pots on the stove. But, down the road yea, I'd like to experiment a bit which is where all the fun lay.
“Received Signal Strength Indicator,” is a measurement of how well your device can hear a signal. In other words, RSSI is a value for determining a good wireless connection.
I want one of these now! Not for anything nefarious, mind you, but as a fun little device to mess with my family since I already love to hijack the devices my parents use to stream on when they fall asleep with my smartphone’s remote play feature so I can change whatever’s playing to a RUclips video of an alarm clock or EAS message to see what they do in response.
This thing is pretty neat as and idea at least, kinda reminds me of something a punk anarchic netrunner from Cyberpunk would pull out and hack into a secure corpo van full of tech
Fresh out the box flipper software is very minimal but when you install either of the 2 popular custom firmwares then all those restrictions are gone and the world is your to mess with
RSSI = "receive signal strength indicator" in dB relative to 1 milliwatt (0 dB is 1 milliwatt on the antenna). Typical lower receiver sensitivity is going to be from -90 dB to -120 dB. It looks like you can set a threshold of when the device will start recording as sort of a squelch feature.
I would bet the iButton feature is referring to the little fobs that use the 1-Wire protocol over physical contacts. It just sends a simple ID over the bus. Probably could use the GPIO to read one of them.
The RF "core" of this device is a TI CC1101 multi-mode RF transceiver chip that "understands" several different modulation standards and (I think) protocol/coding standards. It has an RSSI output, and can scan the tuner fairly quickly, so you can use that as a scanning spectrum analyser with a fixed RBW. It's not really an SDR in any meaningful way.
This is like the script kiddy version of an SDR. Great for emulating stuff someone else has already figured out, but a real SDR and a full fledged suite like GNU Radio is a million times more powerful, but you need to know what you're doing, not just press a few buttons on your tomogachi dolphin
In the case of trying to capture/emulate signals from specific frequencies you would want to raise the rssi to get rid of unwanted noise the biggest reason people can’t get these to work is because we live in a world of satellites and fm radios in every car you will almost always have some sort of egress, specifically in this video he demonstrated that his flipper was picking up stray signals definitely coming from a Bluetooth device. In all honesty it depends on the device: you won’t see a key fob putting out 8db of signal so it’s kinda hard to judge what levels something should be coming in. Also a great time to learn what frequencies are what so that you don’t go messing around the LTE bands or cause your neighbor to lose his direct tv channels. Clearly you won’t be blowing any telecom nodes with a flipper BUT a hackrf one maybe
i button is an authentication protocol that has nothing to do with Apple. It’s a round button style device. I have one for my company vehicle that needs to be authenticated every time you start the vehicle so that it lets the owner know when it’s being driven and also where it’s being driven. Edit… it looks like someone’s already answered this in a post already. Sorry for the redundancy. Enjoy your videos very much.
I got this primarily as a more convenient Proxmark alternative. Those alone are very expensive, the one I have has become increasingly finicky, and I’m left preferring older versions of the software. The antennas in the Flipper have generally been a lot more consistent than other hardware I’ve used in cases where I’ve wanted to clone a work badge to the 125kHz tag I implanted in my left hand, or some other seemingly simple operation. I’ve also found some novel applications that I won’t share here c;
Highly recommend the unleashed firmware - one day at work this device saved me twice, first as a keyboard and mouse to interface with a headless computer and second when a TV I had to configure had a broken remote and I was able to download codes and even customize a page to quickly interface with it.
It didn't unlock your car because your car is using rolling codes. If your keyfob is near the car, the signal you recorded is burned and invalidated after the first use. You would need to jam at the same time. For a real test, record your fob in a daraday cage or far away from ypur car and then replay it. Chances are, if you fet the recording right, it will work. This attack is known as RollJam and I have a Python script I developed myself to do this on my own car and garage opener. If you go to apartment complexes or gated communities, their gates usually do not use rolling codes. So, you could sit there and record when someone opens the gate and then have permanent access. You can do that very easily with a FlipperZero. A car requires a little more prep, but mot impossible with a FlipperZero.
In my time with owning a flipper, I have realised that it doesn't do anything that other devices can't do, the only advantage is the tint size. All of the issues thst you have mentioned can be avoided by downloading a custom firmware, I use flipper unleashed. The main downside of the flipper is the lack of power, it often struggles with range and suchlike. I plan on making some external modules for the most often used modes. I see it in the same way that you said, as a multitool. It does the same job as dedicated tools, in a more compact size profile but not as well
Just create a range extender . If blackies from the hood with no highschool diploma can steal Lexus’ with this , you can surely do regular stuff with it 😊
10:16 it’s a bit strange that they designed both the green and the red button with a 1/0 (on/off) symbol. It should have been a 1 on the green, and 0 on the red
They ship them nerfed to appease regulators. Better firmware will enable more functionality. Also: most cars and garage doors use rolling codes these days. It's much harder to crack than just playback.
6:25 I have a problem with spurious emissions too 😢 7:38 there’s no point in trying to unlock a modem car as the key changes at random, older cars older than 2008 or 2006 will unlock. 9:04 stock firmware is locked down, Unleashed firmware is the best IMHO
Flipper definetly needs custom firmware, there's way too many restrictions (but you know gotta keep it legal by default) Doing a replay attack on your garage door should have been the easiest thing ever It's just a CC1101 chip inside for the radio, that's what you'd use on any micro controller based project that needs to transmit and receive below 1ghz On a side note you can actually do NFC and IR stuff with any rooted android phone that has an ir blaster, so flipper is only good for RFID and SubGHz radio imo
It is a bit scary, but I think it is a good thing. A lot of devices, like door key fobs, garage doors, etc, are super insecure, and poorly implemented. This device will force most manufacturers to finally do some proper handshake and cryptography, do tof ranging, etc, not just fixed signals or ID, which were always easy to spoof or duplicate.
I keep hearing that the "other" firmware options are better, but also that RUclips gets twitchy about videos with that, so if I jailbreak it I might not be able to show much of that :-P
"To use this tool as a hacking tool, you must first hack this tool"
consider it as a litmus test
Absolutely! Standard software is limited. Go to Git Hub and dress that puppy up!
@shuriken2505there is custom software which can be used with this device
As the guy says you must hack the tool. Out of the box it comes plain bog standard with hardly any viable usable functions.
Basically comes as Vanilla. You need to flash it with Firmware like "Momentum" for example there are a few different firmware you can flash it with and it doesn't take long plus you can switch between firmware (Check how to multiboot.) a must have for it though is a WiFi Development addon board. (GPIO) Once flashed you will love the flipper instead of Daddy says no to everything. Great and honest video though. I think we all start in your perspective as some point. You also need desktop or mobile app software like "QFlipper"
Flashing a firmware is not hacking, also having an esp32 stuck to it does not making it a wifi hacking tool, you can capture handshakes with a basic laptop + you can also do something with that handshake except look at it. As for deauth attacks, I could do that with an android device like 10 years ago even more. In my opinion this is a interesting toy, you pay for the small form factor
You need to run custom firmware on there. This will open a whole bunch more.
Which custom firmware? Or are you suggesting he write his own?
@3nertiaroguemaster seems good. But it depends on the actual usecase.
@tripplefives1402 That knowledge is a bit intricate for such a device lol
@jboomhauer Thank you!
@3nertia RougeMaster
Quick note about recording the car fob: If your car was close enough to receive your keyfob at time of recording then when you replayed the keyfob signal the car will reject receiving that signal a second time. This is thankfully due to most cars having a "rolling code" that changes with each button press which prevent replays... usually.
my car has a rolling feature. you insert a piece of brass in to a specially shaped hole and roll the brass forward via it's attached miniature handle.
@saveitforparts - You might retry recording the fob activation when you're a far enough distance away from the car.
Or if you can put the fob and the Flipper in the equivalent of a Faraday Cage / metal box when you activate the fob, that could work too.
Or you could use another radio very close to your car that would jam reception of the signal, but not trip up the Flipper.
It's called a "rolling code" system and lots of RF-based systems use it. Every time you use the fob it moves to the next code in a pre-programmes set. The car remembers which code you used last time and only opens if the code you send is in the next X codes in that list. If not, it doesn't open. In fact if you play with your keyfob too much you may move the fob to a code outside of the expected set of codes of your car and you'll have to re-sync the fob to the car.
So yeah, moist RF systems have ptotection against these simple replay attacks.
This can be used for a denial of service attack because if the car computer reads the same (cloned) signal/code coming in a second time, it assumes it is an attack, and locks the remote fob with that ID out. The physical key will still work, but the owner will have to get the key fob re-synched at the dealership. This can get annoying fast for obvious reasons.
@vinny142 Its probably less of a list and more an algorithm that manipulates an initial seed value in a programmatic fashion. All the car needs is the same seed value, and with unique seed values your fob wont unlock someone elses car.
I work as a general contractor, my Flipper has been one of my favorite tools I have ever owned. A lot of my clients live in gated communities, apartment complexes, etc. Being able to get in and out of these communities with a pushbutton is one of the most pleasant feelings in the world, that is all. No memorizing codes, don't have to do shit, I can even open some of my customers garages if they ever need me to. Of course, I have to program it first, but it takes seconds
Yeah I use my flipper more for convenience than some Project Mayhem type of stuff. Save a lot of day to day/ week to week key fobs and what not to it. Instead of having to keep up with the office key, the gym key, the parking garage key, the gate code, etc. I just pull out the flipper and use it. Also, flipper nerfed a lot of their features so this thing wouldn't get banned in more places. You can somewhat 'jailbreak it' to access a lot of these gate codes, and even get a full library of remotes without having to program any.
Additionally, I think the BadUSB is cool, but that can definitely be where the real hacker stuff comes in. I played around with a few scripts, and stopped. You can download scripts to brute force laptop passwords, and a bunch of other things. I really think the makers wanted to downplay it's capabilities to avoid getting banned. Still more powerful tools out there, but it was limited to what it can do out of the box.
T
I'm a contractor/electrician. My job is similar to yours any tips or can you point me in the right direction as far as what could be useful? I just purchased one based on your advice.
Hey man, I use my flipper for opening my gated community gate, but I cannot for the life of me figure out how to program it as a garage remote. What steps did you take? I have the Rougemaster CFW if that helps
@TummySausage the problem is most garages have "rolling codes" which you should look up, its probably why you cant do it on yours
iButton is not actually some Apple nonsense! It's a one-wire communication protocol used in a lot of older security keys and even as a transit pass in some cities! It also goes by the names "touchmemory" or "dallas keys".
We use iButton to identify drivers and road tankers at a fuel loading facility in Australia. I’ve been wanting to try storing all my iButton ID’s on the Flipper because every time I swap tanker trailers I need to use the associated iButton - if I have them all on my device they’re effectively a backup (or spare) of the original. The only problem being using the device while at the gantry goes against all the safety protocols for the safe loading of flammable liquids😢. I could probably use it at the automatic security gate at the entrance and exit of the facility though.
Yup, Dallas 1-Wire. That's what the contacts on the back are for.
@inothome any idea if I can connect and read iButton thermometers? would be a great application in my science projects...
@twocrowsdown good way to get fired and tossed in prison.
yes@spot1401
Coming at your thumb with that knife had me nervous.
It did not lock the car because vehicles and keyfobs use a synchronous rolling code. The car and the key have a seed value stored in them, and whenever you send a command such as lock, unlock, etc, using the fob it uses that seed value and then they update the value internally. By recording the key fob you are replaying an old value. So the car wont listen to it. You need to do whats called a Rolljam attack which will prevent the car from hearing the keyfob while you record the value.
Buyer beware! This can disassociate the fob from your car and you need to manually reset the rolling code inside the vehicle in order to reassociate the key fob with your vehicle. If your car doesnt allow you to do this manually you might need to have it taken to a dealership. Its not such a problem if you have a metal key in addition to your fob. If you are entirely pushbutton though as many modern vehicles are...
You wont be able to drive your car. And thus you will have to have it towed to a dealership.
If it's push-to-start you can almost always hold the fob to the button and it will read it using NFC (or something similar, not sure) to allow you to start the car. This is mostly meant as a way to still be able to start the car if the fob battery dies.
You are correct and I just want to say that there is a workaround for this basically it's just an algorithm and a process of figuring out the hex table wildcards. But like a lot of things it wouldn't be responsible to post exactly how to do it.
@samdunn717 those physical keys are for the door/glove box. There's no ignition to insert them into. It'd be cool if there was though.
After you record the value wouldn’t it still be an old value?
Yeah ok, but when he recorded the fob signal he recorded the next rolling number away from the car (not in range) so that means the recorded number on the flipper is in fact the correct number the car should receive and therefore lock/unlock.
You know what I mean?
The separate on and off buttons are quite helpful for professional A/V situations where you might not be able to immediately tell if the projector has turned on or not. Instead of just telling the projector to change to an ambiguous "the opposite of the current state", you can specify exactly which state you're looking for.
The result is that you can just spam the power button without needing to worry that you're turning it on and off and on and off and on....
I look at this flipper thing and it reminds me of the bygone days of PSP hacking. Back then you had firmware, flashing and all the cool software people came up with on forums you could even access through the PSP's internet Tbrowser. The fat PSP came with an RFID sensor which made it ideal as a grabber for remotes; I had the AC remote hotkey'd in, as well as the school projector remote :D
IRshell?
@fuchsia4326 kids arent playing with retro handhelds bro and powkiddy is one of the worst kinds you can get
I think you mean Infrared transmitter/receiver. Not RFID.
The fat psp was my drug😂 after it i started softmoded so many mp3 and phones. Work machines/cameras/networks/printers/vehicles/forklifts its considered geeky asfuk so no one cares if u do it…..all thanks to psp ❤
Unfortunately, I got into the hacking scene a little later, when the PSP 3000 was released.
No Pandora battery, and basically had to wait for Pro CFW or others that were released, like Cold bird's (Thefl0w) stuff.
No infared on the 3000, but I did get a 1000 later on and gave it to a brother of mine. I don't remember if I was able to get IRshell to work. 😞
I'm a A/V technician, I mostly use the flipper to emulate different IR remotes so I can have all the remotes I need in my pocket. I also think the rubber ducky USB scripts are immensly powerful and usefull. Imagine having to change say the network config like ip and submask on 5 different machines or download a bunch of software that you need on multiple machines. Even tho the option is called bad usb, for me it's a really neat timesaver
I want one largely to just use as a GREAT “universal remote”. No messing with button pressing/holding, just a nice GUI and it can control all the stuff not just IR devices.
There are *much* cheaper devices for that, like anything lilygo makes.
The flipper zero is kind of very overpriced for the features...
@VynVdragon I agree but to be fair I have a flipper and the online repositories people upload of all the different IR brand and model controls for a big variety of equipment beyond just TVs and projectors or whatever. Sadly I live in the U.S. but Ive always wanted to mess with those A/Cs that are popular in Europe you know the white rectangular ones mounted indoors with the compressor mounted by the window outside. You could make everyone’s day by increasing the intensity of some AC in a very busy hot supermarket lol be a saint but yeah otherwise there are a slew of universal remotes that exist already including ones with much much stronger IR blasters than the flipper has (I have one myself obv I know it’s not that strong of a blaster) so you can do the actual funny stuff like turning off neighbors TV from two houses away or whatever I remember one was literally sold for that purpose I think it was called TV B Gone or something lol
For a good ir remote hardware buttons are a must.
@Cowloverdude there's a bunch of software options to upload to esp32 and esp8266 for remote IR too
lol I just want to use it to pirate amiibos
I really appreciate your perspective on updates. On one hand, not updating some things has the potential to leave the user in a vulnerable state. On the other, it can (and often does) strip away features, or add things that benefit the manufacturer and not you. Even if it's just increased data collection that takes performance/battery life away from you. It's something worthy of consideration and discussion in my opinion.
I remember one of my friends got one of these and started testing it out with Flipper Unleashed... he then proceeded to accidentally change his AC unit from Fahrenheit to Celsius, couldnt figure out how to change it back, and then sold it to one of his uncles friends 💀
bruh just learn the conversion at that point lol
who the fook uses Fahrenheit??? 😭
@gaelr.s7123 one of the biggest countries in the world.
Only an American would sell an air conditioner unit because they couldn't be arsed to spend 6 seconds checking that room temp is 20c
@liammearslet me know when you can land on the moon
Also badusb is keyboard emulation to inject a payload, for malicious or prank purposes. Custom firmware adds BadBT which does the same thing to affected devices without even needing to connect physically
I have the Xtreme firmware on mine and have tried it on multiple garage doors, at least two of them could be opened after capturing the signal once. They both had a vulnerable rolling key based protocol. The IR functionality can be both fun and useful. I've used it to turn on the TV when I can't find the remote in hotels etc. I was also able to clone some access cards, for a gym for example. Some of the GPIO apps are nice too. The signal generator and apps for testing various sensors. Bad USB is very nice in a penetration test scenario. If you get one of the WiFi addon boards you can also do de-authing and some other stuff. A lot of people (including my kid) have been lead to believe that this device can "hack" anything. Mostly because of fake TikTok clips. But it's a great device with lots of features. My girlfriend has played way too much Tetris on it as well. 😄
This thing is a Leatherman, essentially. Doesn't work nearly as good as each single-use tool, but it's good enough and all in one package.
A lot of people do not understand RFID. These devices do not transmit data unless they are in close proximity to a reading device. which briefly powers them just long enough to send a packet of data. I think you could probably do the same thing with NFC reader software installed on any modern cellphone.
I don’t think most cellphones do 125kHz rfid, only the 13 MHz “NFC” stuff
@jeremyloveslinux Correct
My workplace uses NFC tags for security when they do rounds, and I can confirm my phone could easily read them, and likely could overwrite them rendering them useless. I use NFC tags at home so I had an app already for that.
@Steyr6500 NFC is not RFID
Near field, though I suppose "near" can be relative
Missed a lot of features and got a few wrong, but it's a fun tool and might take weeks to really discover its capabilities.
Neighbors wondering why his car keeps unlocking and unlocking and his garage door opening and closing
I've got this device on my wish list, for no reason other than it seems fun and cool. I'm no criminal. I have researched it somewhat (watched youTube vids). You are going to get tons of great advice from actual users, so let me just ask that you please do an update soon!!!!! It was frustrating to see your results when I had seen others do some spooky, cool stuff! I have never seen weather satellite photos from junk before, so I have complete confidence in you, dude! I really love your channel!
I keep hearing that the "other" firmware options are better, but also that RUclips gets twitchy about videos with that, so if I jailbreak it I might not be able to show much of that :-P
@saveitforparts without update your review feels unfair.
Of course, you may not have known how to use this device correctly before.
But now you know.
Yeah roger that.@saveitforparts
@sdjhgfkshfswdfhskljh3360 it's his video! like who tf are you to tell him it's unfair? how about you make your own "fair" review and publish on your own channel..
@dagfinissocool He's a guy with an opinion. Like you, obviously. Now quit being a dik.
David Beckham's car was stolen i think 4 times using a key fob playback device lol. i love that the flipper is making RF hacking so easy because now manufacturers are being forced to upgrade their security
00:02 Flipper Zero is a versatile hacking and security tool disguised as an electronic pet.
02:11 Consider updating the firmware for potential useful features.
04:27 Microchipping pets for identification purposes
06:18 The Flipper Zero can detect and analyze radio frequencies.
08:49 Flipper Zero has limitations in hacking capabilities
11:01 Flipper Zero can read and copy security codes from RFID cards and fobs.
13:10 Flipper Zero can clone access cards and emulate card information.
15:26 The Flipper Zero has mixed usability and may be helpful for niche projects.
17:40 The Flipper Zero is considered more like a toy with limited practical use.
Use the dark firmware. It gets updates almost weekly, and opens up a lot.
Better than Xtreme?
@CowloverdudeI recommend rogue master
RM is a joke @Skyronvfxx
Unleashed / Xtreme / Roguemaster... You wont be disappointed.
I haven't tried anything but the Xtreme firmware.
Most of the biggest names using the Flipper Zero seem to run Xtreme.
I don't think there's anything there others do that Xtreme doesn't.
They update it all the time to the latest abilities.
The way he opened the box with the knife was jawdropping
Fun fact : using an ESP32 you can transmit at 433 MHz, using the "LED controller" LEDC peripheral.
You need to set the frequency to 33.875 MHz and the resolution to 1 bit using the ledcSetup function.
You can then transmit by toggling the PWM between 0 and 1 using ledcWrite.
Of course it transmits a whole bunch of harmonics at frequencies it's not supposed to, and one of them falls close to 433.92 MHz.
Using a short piece of wire it can transmit up to 10 meters.
If you ever decide to automate your home to manipulate your projector, you will be very grateful for its discreet On and Off signals. Toggling power is hard to program around since you have no guarantee of starting state.
Thanks for your videos.
ibutton is like a coin cell looking thing that runs Java, I believe. Used in apartment complexes as door keys, sometimes. inside the ibutton is a small computer and when you press the button up against a receptacle there's a challenge/response thing over a 1-wire protocol and if each half gives the right answers to things then (in the case of an apartment complex) unlocks the door. Sun Microsystems even made rings with built-in iButtons. Still commonly used, I believe. Definitely not apple.
Back when I was a steeley-eyed security dev, I had an iButton ring. It was too small for me, though, so I wasn't in the habit of wearing it. I remember McDonalds used iButton fobs for employees logging-in to the sales terminals, back when iButtons were popular.
My local driving range uses a iButton fob to get balls from the machine
iButton uses the 1-wire protocol and is based on the javachip/javacard API, the same chipset and APi that still powers billions of smartcards. At JavaOne 1998 Sun introduced the JavaRing, the original setup provided in the SWAG bag that plugged into a reader that sent a REST request to a server that lit a pixel that represented you in a giant mosaic that was supposed to gradually appear in a large overhead screen. I remember hacking those requests so they had to shut it down and actually implement the security protocols built into the ring. Still have that ring somewhere. Ah, memories.
Its actually an embedded subset version of Java called the JavaCard API that runs on the JavaChip architecture. The iButton implements security protocols in JavaCard and also includes tamper resistance that zeros the stored data if physical or electromagnetic tampering is detected.
We use iButtons for a opening a specific type of door. Not phased out yet, so I won't be too specific, but didn't realise they were quite so easily emulated. Good job we're getting rid.
I use mine as a vault for all the RFID cards used to access different locations I service. If I visit a location and they loan me an access card I just clone it and give it back or generate one on fly and add to whatever system they use. It also came in handy to re-purpose some ioProx cards that we were originally going to throw out because we moved to an HID access based badge system.
it would be good for an IT team for small orgs needing to test physical security.
I can tell that this is not a sponsored review because you got the right answer.
The reason why it didn't work on your car is because of the implementation of security on modern car remotes. When remote locking first started appearing replay attacks where very real and a huge problem, someone would sit in a parking lot wait for you to lock or unlock your vehicle then modify and or replay that message gaining access to your vehicle. These days however there is a small security algorithm running on the fob and on the vehicles computer creating a rolling encryption key that keeps changing every time you use that fob, it has to match with the vehicle computer, otherwise it just ignores it.
Its still possible to "replay" but it requires you to reverse engineer that algorithm, and run it at the same point as it is currently in the vehicle you are attacking.
I would love to see a follow up video about putting custom firmware on that bad boy!
I keep hearing that the "other" firmware options are better, but also that RUclips gets twitchy about videos with that, so if I jailbreak it I might not be able to show much of that :-P
@saveitforparts you don't have to say you jailbroke it, you just "updated the software". It would be nice to see all of the capabilities of the unit without restriction since its a pain that you payed for the device and cant use all of it. also I wonder what you can add to it through the gpio pins.
Yeah, but some Karen will get upset and then report the video. He doesn't want a take-down notice...
@saveitforpartsflipper is like owning a Pixel phone; there's no jailbreak. You just flash it.
"I'm gonna set this to freedom units"
that box of electronics you have yet to put together looked so cool I love boxes like that
5:32 you could've save the chip data and then emulate it back and use your halo reader to show if it shows the same thing.
Thank you for the video, If I had watched this sooner I may not have ordered one but i'm sure I will come up with some project to take advantage of it!
The custom firmware will do the garage opening and counts on what your car uses if your car uses rolling code then you’ll have to record the remote being outta distance from the car
I'm considering getting this for apartment gates as a delivery driver who is often delivering to people who have never used a code to get in the gate.
I love the vibe of the flipper, too bad its very restricted
Restrictions are easily removed, that is not a problem.
Nah bro, the Flipper Zero is absolutely worthless - which is why you should send me YOURS 😎
I have 3😂
Guys he wants a flipper please give him
I'm looking into buying a used one to save some money, thanks for the video!
While I have only had the Flipper for a short time, I find it useful when I forget my access card to work or if the remote for a TV at work is missing. It remains to be seen if I can record my parents' garage door, but if I can, it will be very nice.
As for projectors having separate buttons to turn them on and off, I, too, found that strange initially. However, it is beneficial. This makes a lot of sense due to the considerable delay in turning the projector on or off. The projector will continue to run the fan for a long time after you have turned it off. If you are impatient to turn it off, you may accidentally turn it on again, which is the opposite of your intended action. Having two separate buttons solves this issue both ways.
I've used this to test the RFID blocking claims of wallets and be a backup/secondary remote for all kinds of things at home.
Interesting.
This is the entrance to a deep rabbit hole that will have to wait a bit because I have too many pots on the stove.
But, down the road yea, I'd like to experiment a bit which is where all the fun lay.
Cutting towards you finger is wild.
You can use the Ir remote with your camera. Upgrade to one of the non hindered firmware for a bunch more features.
“Received Signal Strength Indicator,” is a measurement of how well your device can hear a signal. In other words, RSSI is a value for determining a good wireless connection.
This is what the internet was actually made for. Straight fax and no useless "MAKE SURE TO LIKE AND" that is 20% of the video.
I want one of these now! Not for anything nefarious, mind you, but as a fun little device to mess with my family since I already love to hijack the devices my parents use to stream on when they fall asleep with my smartphone’s remote play feature so I can change whatever’s playing to a RUclips video of an alarm clock or EAS message to see what they do in response.
A bad usb is where a hacker can hack a computer or anything with usb, it make it think its a wired mouse or keyboard
This thing is pretty neat as and idea at least, kinda reminds me of something a punk anarchic netrunner from Cyberpunk would pull out and hack into a secure corpo van full of tech
I suspect the whole Flipper branding is an homage to the Cyber-Dolphin in Johnny Mnemonic. (The cartoon even looks similar).
It goes back even further to a 60's tv show 'flipper' about a boy and his dolphin.
I use this device as my backup garage door opener as well as my IR remote for my TVs and my Xbox one.
Fresh out the box flipper software is very minimal but when you install either of the 2 popular custom firmwares then all those restrictions are gone and the world is your to mess with
How would someone do that?
I had an old Honda CT70 that would open my garage when you turned the throttle.
The journey won't be complete until you can run Doom on it
He runs DOOM on it in the video.
When my flipper reads my dogs microchip it also tells me their temperature.
So this would be a gr8 back up for personal back ups if you lock yourself out of a car , house, office. You can save all your personal info.
pro cutting skills
12:33
"This one tells you not to do anything illegal with it. Yeah, Okay."
This is Donnie! I am trapped by this humon. Send mor catfud!
I just wanna go to a bar and shut off all the T.v's B-gone. Cheers Bro. Great video. I know what I'm getting my myself for Chrimbus.
great review. thanks!
RSSI = "receive signal strength indicator" in dB relative to 1 milliwatt (0 dB is 1 milliwatt on the antenna). Typical lower receiver sensitivity is going to be from -90 dB to -120 dB. It looks like you can set a threshold of when the device will start recording as sort of a squelch feature.
Thank you
Let me get that raspberry pi you not doing anything with it will give it a good home
I would bet the iButton feature is referring to the little fobs that use the 1-Wire protocol over physical contacts. It just sends a simple ID over the bus. Probably could use the GPIO to read one of them.
The RF "core" of this device is a TI CC1101 multi-mode RF transceiver chip that "understands" several different modulation standards and (I think) protocol/coding standards. It has an RSSI output, and can scan the tuner fairly quickly, so you can use that as a scanning spectrum analyser with a fixed RBW. It's not really an SDR in any meaningful way.
This is like the script kiddy version of an SDR. Great for emulating stuff someone else has already figured out, but a real SDR and a full fledged suite like GNU Radio is a million times more powerful, but you need to know what you're doing, not just press a few buttons on your tomogachi dolphin
In the case of trying to capture/emulate signals from specific frequencies you would want to raise the rssi to get rid of unwanted noise the biggest reason people can’t get these to work is because we live in a world of satellites and fm radios in every car you will almost always have some sort of egress, specifically in this video he demonstrated that his flipper was picking up stray signals definitely coming from a Bluetooth device. In all honesty it depends on the device: you won’t see a key fob putting out 8db of signal so it’s kinda hard to judge what levels something should be coming in. Also a great time to learn what frequencies are what so that you don’t go messing around the LTE bands or cause your neighbor to lose his direct tv channels. Clearly you won’t be blowing any telecom nodes with a flipper BUT a hackrf one maybe
You should be able to play back the blocked frequencies with custom firmware
Which custom firmware?
@3nertia another commenter said unleashed-firmware on github
@3nertia unleashed firmware disables the regional frequency blocker
@3nertia I run RougeMaster.
@irontoe9001 Unleashed how?
Restricted defaults are good for calming down regulators, open source is good for anything else.
9:51 for me it works great but you would have to point the infrared straight at it even if it's across the room
It's a neat convenient tool, but it doesn't do anything new you couldn't have done before though.
Thank you for this video!
i button is an authentication protocol that has nothing to do with Apple. It’s a round button style device. I have one for my company vehicle that needs to be authenticated every time you start the vehicle so that it lets the owner know when it’s being driven and also where it’s being driven. Edit… it looks like someone’s already answered this in a post already. Sorry for the redundancy. Enjoy your videos very much.
There was a good article about Flipper Zeros in 2600 magazine earlier this year. If you are ever in Anoka, I will buy you a beer.
"aww, it won't let me desync the rolling codes of my car key and garage opener out of the box :sad face:"
used to have a xiaomi phone with ir... was super fun to mess around (it's fully controllable with java apis)
I got this primarily as a more convenient Proxmark alternative. Those alone are very expensive, the one I have has become increasingly finicky, and I’m left preferring older versions of the software. The antennas in the Flipper have generally been a lot more consistent than other hardware I’ve used in cases where I’ve wanted to clone a work badge to the 125kHz tag I implanted in my left hand, or some other seemingly simple operation.
I’ve also found some novel applications that I won’t share here c;
Novel like?
I’m honestly so curious how you got that tag implanted in your hand
what Implants do you have ? What do you use the flipper for with them? I have 9 of them all from DT .
"freedom units" 🤣 Thanks for your kind of review!
Highly recommend the unleashed firmware - one day at work this device saved me twice, first as a keyboard and mouse to interface with a headless computer and second when a TV I had to configure had a broken remote and I was able to download codes and even customize a page to quickly interface with it.
There are third-party radio transceivers you can attach via the GPIO pins to improve the range and accuracy of the device.
Who flinched when he almost chopped his thumb off?
GPIO addons open up a whole other realm of possibility, i.e. wifi modules for creating rogue APs for sniffing passwords
It didn't unlock your car because your car is using rolling codes. If your keyfob is near the car, the signal you recorded is burned and invalidated after the first use. You would need to jam at the same time. For a real test, record your fob in a daraday cage or far away from ypur car and then replay it. Chances are, if you fet the recording right, it will work. This attack is known as RollJam and I have a Python script I developed myself to do this on my own car and garage opener.
If you go to apartment complexes or gated communities, their gates usually do not use rolling codes. So, you could sit there and record when someone opens the gate and then have permanent access. You can do that very easily with a FlipperZero. A car requires a little more prep, but mot impossible with a FlipperZero.
a few custom updates should solve the region locking.
In my time with owning a flipper, I have realised that it doesn't do anything that other devices can't do, the only advantage is the tint size. All of the issues thst you have mentioned can be avoided by downloading a custom firmware, I use flipper unleashed. The main downside of the flipper is the lack of power, it often struggles with range and suchlike. I plan on making some external modules for the most often used modes. I see it in the same way that you said, as a multitool. It does the same job as dedicated tools, in a more compact size profile but not as well
Just create a range extender . If blackies from the hood with no highschool diploma can steal Lexus’ with this , you can surely do regular stuff with it 😊
*Me:* But will it run DOOM?
*saveitforparts:* ...yes?
*Me:* "Product purchased; await delivery information from the seller."
10:16 it’s a bit strange that they designed both the green and the red button with a 1/0 (on/off) symbol. It should have been a 1 on the green, and 0 on the red
I used mine to change text on construction signs via Bluetooth, it's quite fun times
They ship them nerfed to appease regulators. Better firmware will enable more functionality.
Also: most cars and garage doors use rolling codes these days. It's much harder to crack than just playback.
I have the WiFi module on mine, very helpful
6:25 I have a problem with spurious emissions too 😢
7:38 there’s no point in trying to unlock a modem car as the key changes at random, older cars older than 2008 or 2006 will unlock.
9:04 stock firmware is locked down, Unleashed firmware is the best IMHO
Also get TamaP1, brings back some 90's feels but in a 'hacker' feel =)
Flipper definetly needs custom firmware, there's way too many restrictions (but you know gotta keep it legal by default)
Doing a replay attack on your garage door should have been the easiest thing ever
It's just a CC1101 chip inside for the radio, that's what you'd use on any micro controller based project that needs to transmit and receive below 1ghz
On a side note you can actually do NFC and IR stuff with any rooted android phone that has an ir blaster, so flipper is only good for RFID and SubGHz radio imo
minor point of clarification - RFID cards are usually kHZ, not the mHZ range.
It is a bit scary, but I think it is a good thing. A lot of devices, like door key fobs, garage doors, etc, are super insecure, and poorly implemented. This device will force most manufacturers to finally do some proper handshake and cryptography, do tof ranging, etc, not just fixed signals or ID, which were always easy to spoof or duplicate.
Thanks for the review!
Lowering my expectations, but I’ll still pick one up for fun 😜
🖖🐰🏴☠️
Ironic you need to jailbreak your hacking device :)
Your cat's microchip is probably set to read-only and cannot be overwritten anyway.
Your gonna want firmware like Unleashed or rogue master.
I keep hearing that the "other" firmware options are better, but also that RUclips gets twitchy about videos with that, so if I jailbreak it I might not be able to show much of that :-P