As the guy says you must hack the tool. Out of the box it comes plain bog standard with hardly any viable usable functions. Basically comes as Vanilla. You need to flash it with Firmware like "Momentum" for example there are a few different firmware you can flash it with and it doesn't take long plus you can switch between firmware (Check how to multiboot.) a must have for it though is a WiFi Development addon board. (GPIO) Once flashed you will love the flipper instead of Daddy says no to everything. Great and honest video though. I think we all start in your perspective as some point. You also need desktop or mobile app software like "QFlipper"
I work as a general contractor, my Flipper has been one of my favorite tools I have ever owned. A lot of my clients live in gated communities, apartment complexes, etc. Being able to get in and out of these communities with a pushbutton is one of the most pleasant feelings in the world, that is all. No memorizing codes, don't have to do shit, I can even open some of my customers garages if they ever need me to. Of course, I have to program it first, but it takes seconds
Yeah I use my flipper more for convenience than some Project Mayhem type of stuff. Save a lot of day to day/ week to week key fobs and what not to it. Instead of having to keep up with the office key, the gym key, the parking garage key, the gate code, etc. I just pull out the flipper and use it. Also, flipper nerfed a lot of their features so this thing wouldn't get banned in more places. You can somewhat 'jailbreak it' to access a lot of these gate codes, and even get a full library of remotes without having to program any. Additionally, I think the BadUSB is cool, but that can definitely be where the real hacker stuff comes in. I played around with a few scripts, and stopped. You can download scripts to brute force laptop passwords, and a bunch of other things. I really think the makers wanted to downplay it's capabilities to avoid getting banned. Still more powerful tools out there, but it was limited to what it can do out of the box.
I'm a contractor/electrician. My job is similar to yours any tips or can you point me in the right direction as far as what could be useful? I just purchased one based on your advice.
Hey man, I use my flipper for opening my gated community gate, but I cannot for the life of me figure out how to program it as a garage remote. What steps did you take? I have the Rougemaster CFW if that helps
Quick note about recording the car fob: If your car was close enough to receive your keyfob at time of recording then when you replayed the keyfob signal the car will reject receiving that signal a second time. This is thankfully due to most cars having a "rolling code" that changes with each button press which prevent replays... usually.
@saveitforparts - You might retry recording the fob activation when you're a far enough distance away from the car. Or if you can put the fob and the Flipper in the equivalent of a Faraday Cage / metal box when you activate the fob, that could work too. Or you could use another radio very close to your car that would jam reception of the signal, but not trip up the Flipper.
It's called a "rolling code" system and lots of RF-based systems use it. Every time you use the fob it moves to the next code in a pre-programmes set. The car remembers which code you used last time and only opens if the code you send is in the next X codes in that list. If not, it doesn't open. In fact if you play with your keyfob too much you may move the fob to a code outside of the expected set of codes of your car and you'll have to re-sync the fob to the car. So yeah, moist RF systems have ptotection against these simple replay attacks.
This can be used for a denial of service attack because if the car computer reads the same (cloned) signal/code coming in a second time, it assumes it is an attack, and locks the remote fob with that ID out. The physical key will still work, but the owner will have to get the key fob re-synched at the dealership. This can get annoying fast for obvious reasons.
@@vinny142 Its probably less of a list and more an algorithm that manipulates an initial seed value in a programmatic fashion. All the car needs is the same seed value, and with unique seed values your fob wont unlock someone elses car.
The separate on and off buttons are quite helpful for professional A/V situations where you might not be able to immediately tell if the projector has turned on or not. Instead of just telling the projector to change to an ambiguous "the opposite of the current state", you can specify exactly which state you're looking for. The result is that you can just spam the power button without needing to worry that you're turning it on and off and on and off and on....
In my time with owning a flipper, I have realised that it doesn't do anything that other devices can't do, the only advantage is the tint size. All of the issues thst you have mentioned can be avoided by downloading a custom firmware, I use flipper unleashed. The main downside of the flipper is the lack of power, it often struggles with range and suchlike. I plan on making some external modules for the most often used modes. I see it in the same way that you said, as a multitool. It does the same job as dedicated tools, in a more compact size profile but not as well
I want one largely to just use as a GREAT “universal remote”. No messing with button pressing/holding, just a nice GUI and it can control all the stuff not just IR devices.
@@VynVdragon I agree but to be fair I have a flipper and the online repositories people upload of all the different IR brand and model controls for a big variety of equipment beyond just TVs and projectors or whatever. Sadly I live in the U.S. but Ive always wanted to mess with those A/Cs that are popular in Europe you know the white rectangular ones mounted indoors with the compressor mounted by the window outside. You could make everyone’s day by increasing the intensity of some AC in a very busy hot supermarket lol be a saint but yeah otherwise there are a slew of universal remotes that exist already including ones with much much stronger IR blasters than the flipper has (I have one myself obv I know it’s not that strong of a blaster) so you can do the actual funny stuff like turning off neighbors TV from two houses away or whatever I remember one was literally sold for that purpose I think it was called TV B Gone or something lol
iButton is not actually some Apple nonsense! It's a one-wire communication protocol used in a lot of older security keys and even as a transit pass in some cities! It also goes by the names "touchmemory" or "dallas keys".
We use iButton to identify drivers and road tankers at a fuel loading facility in Australia. I’ve been wanting to try storing all my iButton ID’s on the Flipper because every time I swap tanker trailers I need to use the associated iButton - if I have them all on my device they’re effectively a backup (or spare) of the original. The only problem being using the device while at the gantry goes against all the safety protocols for the safe loading of flammable liquids😢. I could probably use it at the automatic security gate at the entrance and exit of the facility though.
If you ever decide to automate your home to manipulate your projector, you will be very grateful for its discreet On and Off signals. Toggling power is hard to program around since you have no guarantee of starting state. Thanks for your videos.
A lot of people do not understand RFID. These devices do not transmit data unless they are in close proximity to a reading device. which briefly powers them just long enough to send a packet of data. I think you could probably do the same thing with NFC reader software installed on any modern cellphone.
My workplace uses NFC tags for security when they do rounds, and I can confirm my phone could easily read them, and likely could overwrite them rendering them useless. I use NFC tags at home so I had an app already for that.
It did not lock the car because vehicles and keyfobs use a synchronous rolling code. The car and the key have a seed value stored in them, and whenever you send a command such as lock, unlock, etc, using the fob it uses that seed value and then they update the value internally. By recording the key fob you are replaying an old value. So the car wont listen to it. You need to do whats called a Rolljam attack which will prevent the car from hearing the keyfob while you record the value. Buyer beware! This can disassociate the fob from your car and you need to manually reset the rolling code inside the vehicle in order to reassociate the key fob with your vehicle. If your car doesnt allow you to do this manually you might need to have it taken to a dealership. Its not such a problem if you have a metal key in addition to your fob. If you are entirely pushbutton though as many modern vehicles are... You wont be able to drive your car. And thus you will have to have it towed to a dealership.
If it's push-to-start you can almost always hold the fob to the button and it will read it using NFC (or something similar, not sure) to allow you to start the car. This is mostly meant as a way to still be able to start the car if the fob battery dies.
You are correct and I just want to say that there is a workaround for this basically it's just an algorithm and a process of figuring out the hex table wildcards. But like a lot of things it wouldn't be responsible to post exactly how to do it.
it's amazing how many "keyless" fobs have keys hidden in them. I couldn't believe it the first time someone showed me my fob had a really stripped down tiny key inside it. Push button start just needed the key to be in car, even when dead.
I really appreciate your perspective on updates. On one hand, not updating some things has the potential to leave the user in a vulnerable state. On the other, it can (and often does) strip away features, or add things that benefit the manufacturer and not you. Even if it's just increased data collection that takes performance/battery life away from you. It's something worthy of consideration and discussion in my opinion.
I have the Xtreme firmware on mine and have tried it on multiple garage doors, at least two of them could be opened after capturing the signal once. They both had a vulnerable rolling key based protocol. The IR functionality can be both fun and useful. I've used it to turn on the TV when I can't find the remote in hotels etc. I was also able to clone some access cards, for a gym for example. Some of the GPIO apps are nice too. The signal generator and apps for testing various sensors. Bad USB is very nice in a penetration test scenario. If you get one of the WiFi addon boards you can also do de-authing and some other stuff. A lot of people (including my kid) have been lead to believe that this device can "hack" anything. Mostly because of fake TikTok clips. But it's a great device with lots of features. My girlfriend has played way too much Tetris on it as well. 😄
I look at this flipper thing and it reminds me of the bygone days of PSP hacking. Back then you had firmware, flashing and all the cool software people came up with on forums you could even access through the PSP's internet Tbrowser. The fat PSP came with an RFID sensor which made it ideal as a grabber for remotes; I had the AC remote hotkey'd in, as well as the school projector remote :D
The fat psp was my drug😂 after it i started softmoded so many mp3 and phones. Work machines/cameras/networks/printers/vehicles/forklifts its considered geeky asfuk so no one cares if u do it…..all thanks to psp ❤
Unfortunately, I got into the hacking scene a little later, when the PSP 3000 was released. No Pandora battery, and basically had to wait for Pro CFW or others that were released, like Cold bird's (Thefl0w) stuff. No infared on the 3000, but I did get a 1000 later on and gave it to a brother of mine. I don't remember if I was able to get IRshell to work. 😞
RSSI = "receive signal strength indicator" in dB relative to 1 milliwatt (0 dB is 1 milliwatt on the antenna). Typical lower receiver sensitivity is going to be from -90 dB to -120 dB. It looks like you can set a threshold of when the device will start recording as sort of a squelch feature.
Also badusb is keyboard emulation to inject a payload, for malicious or prank purposes. Custom firmware adds BadBT which does the same thing to affected devices without even needing to connect physically
I'm a A/V technician, I mostly use the flipper to emulate different IR remotes so I can have all the remotes I need in my pocket. I also think the rubber ducky USB scripts are immensly powerful and usefull. Imagine having to change say the network config like ip and submask on 5 different machines or download a bunch of software that you need on multiple machines. Even tho the option is called bad usb, for me it's a really neat timesaver
I remember one of my friends got one of these and started testing it out with Flipper Unleashed... he then proceeded to accidentally change his AC unit from Fahrenheit to Celsius, couldnt figure out how to change it back, and then sold it to one of his uncles friends 💀
Dude! I've had mine for a few months now and I love it! But I'm also the guy who bought a Cat S61 for the upgrade. As an old Radiohead, this thing has got all kinds of abilities. I use the IR for my window shaker! Great for figuring out what your transmitting at too. It can't spoof rolling code systems and other high security. That was purposeful in the design. The GPIO can control any small device similar to PLC. I didn't know it did pets! You were looking at every BT, Cell or other wireless device around. It will save a list over time for you. You can physically hunt them with RSSI. Fox and hound style. I'm sure one of your little parabolics will do the trick. RSSi is the line at the bottom. You raise it to filter out nosier/weak signals. You played the noise back to the car! You need to hack the region settings. If you want play that way.
Highly recommend the unleashed firmware - one day at work this device saved me twice, first as a keyboard and mouse to interface with a headless computer and second when a TV I had to configure had a broken remote and I was able to download codes and even customize a page to quickly interface with it.
I use mine as a vault for all the RFID cards used to access different locations I service. If I visit a location and they loan me an access card I just clone it and give it back or generate one on fly and add to whatever system they use. It also came in handy to re-purpose some ioProx cards that we were originally going to throw out because we moved to an HID access based badge system.
ibutton is like a coin cell looking thing that runs Java, I believe. Used in apartment complexes as door keys, sometimes. inside the ibutton is a small computer and when you press the button up against a receptacle there's a challenge/response thing over a 1-wire protocol and if each half gives the right answers to things then (in the case of an apartment complex) unlocks the door. Sun Microsystems even made rings with built-in iButtons. Still commonly used, I believe. Definitely not apple.
Back when I was a steeley-eyed security dev, I had an iButton ring. It was too small for me, though, so I wasn't in the habit of wearing it. I remember McDonalds used iButton fobs for employees logging-in to the sales terminals, back when iButtons were popular.
iButton uses the 1-wire protocol and is based on the javachip/javacard API, the same chipset and APi that still powers billions of smartcards. At JavaOne 1998 Sun introduced the JavaRing, the original setup provided in the SWAG bag that plugged into a reader that sent a REST request to a server that lit a pixel that represented you in a giant mosaic that was supposed to gradually appear in a large overhead screen. I remember hacking those requests so they had to shut it down and actually implement the security protocols built into the ring. Still have that ring somewhere. Ah, memories.
Its actually an embedded subset version of Java called the JavaCard API that runs on the JavaChip architecture. The iButton implements security protocols in JavaCard and also includes tamper resistance that zeros the stored data if physical or electromagnetic tampering is detected.
Fun fact : using an ESP32 you can transmit at 433 MHz, using the "LED controller" LEDC peripheral. You need to set the frequency to 33.875 MHz and the resolution to 1 bit using the ledcSetup function. You can then transmit by toggling the PWM between 0 and 1 using ledcWrite. Of course it transmits a whole bunch of harmonics at frequencies it's not supposed to, and one of them falls close to 433.92 MHz. Using a short piece of wire it can transmit up to 10 meters.
They ship them nerfed to appease regulators. Better firmware will enable more functionality. Also: most cars and garage doors use rolling codes these days. It's much harder to crack than just playback.
I've got this device on my wish list, for no reason other than it seems fun and cool. I'm no criminal. I have researched it somewhat (watched youTube vids). You are going to get tons of great advice from actual users, so let me just ask that you please do an update soon!!!!! It was frustrating to see your results when I had seen others do some spooky, cool stuff! I have never seen weather satellite photos from junk before, so I have complete confidence in you, dude! I really love your channel!
I keep hearing that the "other" firmware options are better, but also that RUclips gets twitchy about videos with that, so if I jailbreak it I might not be able to show much of that :-P
@@saveitforparts without update your review feels unfair. Of course, you may not have known how to use this device correctly before. But now you know.
@@sdjhgfkshfswdfhskljh3360 it's his video! like who tf are you to tell him it's unfair? how about you make your own "fair" review and publish on your own channel..
I haven't tried anything but the Xtreme firmware. Most of the biggest names using the Flipper Zero seem to run Xtreme. I don't think there's anything there others do that Xtreme doesn't. They update it all the time to the latest abilities.
David Beckham's car was stolen i think 4 times using a key fob playback device lol. i love that the flipper is making RF hacking so easy because now manufacturers are being forced to upgrade their security
The reason why it didn't work on your car is because of the implementation of security on modern car remotes. When remote locking first started appearing replay attacks where very real and a huge problem, someone would sit in a parking lot wait for you to lock or unlock your vehicle then modify and or replay that message gaining access to your vehicle. These days however there is a small security algorithm running on the fob and on the vehicles computer creating a rolling encryption key that keeps changing every time you use that fob, it has to match with the vehicle computer, otherwise it just ignores it. Its still possible to "replay" but it requires you to reverse engineer that algorithm, and run it at the same point as it is currently in the vehicle you are attacking.
Flipper definetly needs custom firmware, there's way too many restrictions (but you know gotta keep it legal by default) Doing a replay attack on your garage door should have been the easiest thing ever It's just a CC1101 chip inside for the radio, that's what you'd use on any micro controller based project that needs to transmit and receive below 1ghz On a side note you can actually do NFC and IR stuff with any rooted android phone that has an ir blaster, so flipper is only good for RFID and SubGHz radio imo
Its this simple... if kids can learn to shoot physical combat weapons, they can learn to use cyber weapons. The second amendment says ARMS, not firearms.
Fresh out the box flipper software is very minimal but when you install either of the 2 popular custom firmwares then all those restrictions are gone and the world is your to mess with
The RF "core" of this device is a TI CC1101 multi-mode RF transceiver chip that "understands" several different modulation standards and (I think) protocol/coding standards. It has an RSSI output, and can scan the tuner fairly quickly, so you can use that as a scanning spectrum analyser with a fixed RBW. It's not really an SDR in any meaningful way.
This is like the script kiddy version of an SDR. Great for emulating stuff someone else has already figured out, but a real SDR and a full fledged suite like GNU Radio is a million times more powerful, but you need to know what you're doing, not just press a few buttons on your tomogachi dolphin
In the case of trying to capture/emulate signals from specific frequencies you would want to raise the rssi to get rid of unwanted noise the biggest reason people can’t get these to work is because we live in a world of satellites and fm radios in every car you will almost always have some sort of egress, specifically in this video he demonstrated that his flipper was picking up stray signals definitely coming from a Bluetooth device. In all honesty it depends on the device: you won’t see a key fob putting out 8db of signal so it’s kinda hard to judge what levels something should be coming in. Also a great time to learn what frequencies are what so that you don’t go messing around the LTE bands or cause your neighbor to lose his direct tv channels. Clearly you won’t be blowing any telecom nodes with a flipper BUT a hackrf one maybe
I want one of these now! Not for anything nefarious, mind you, but as a fun little device to mess with my family since I already love to hijack the devices my parents use to stream on when they fall asleep with my smartphone’s remote play feature so I can change whatever’s playing to a RUclips video of an alarm clock or EAS message to see what they do in response.
I keep hearing that the "other" firmware options are better, but also that RUclips gets twitchy about videos with that, so if I jailbreak it I might not be able to show much of that :-P
@@saveitforparts you don't have to say you jailbroke it, you just "updated the software". It would be nice to see all of the capabilities of the unit without restriction since its a pain that you payed for the device and cant use all of it. also I wonder what you can add to it through the gpio pins.
I think you were picking up your weather stations or other low powered transmitters. I use an sdr dongle for pc, and theres a 433 plugin to see all the stuff transmitting. Even tire pressure sensor data.
I got this primarily as a more convenient Proxmark alternative. Those alone are very expensive, the one I have has become increasingly finicky, and I’m left preferring older versions of the software. The antennas in the Flipper have generally been a lot more consistent than other hardware I’ve used in cases where I’ve wanted to clone a work badge to the 125kHz tag I implanted in my left hand, or some other seemingly simple operation. I’ve also found some novel applications that I won’t share here c;
i button is an authentication protocol that has nothing to do with Apple. It’s a round button style device. I have one for my company vehicle that needs to be authenticated every time you start the vehicle so that it lets the owner know when it’s being driven and also where it’s being driven. Edit… it looks like someone’s already answered this in a post already. Sorry for the redundancy. Enjoy your videos very much.
00:02 Flipper Zero is a versatile hacking and security tool disguised as an electronic pet. 02:11 Consider updating the firmware for potential useful features. 04:27 Microchipping pets for identification purposes 06:18 The Flipper Zero can detect and analyze radio frequencies. 08:49 Flipper Zero has limitations in hacking capabilities 11:01 Flipper Zero can read and copy security codes from RFID cards and fobs. 13:10 Flipper Zero can clone access cards and emulate card information. 15:26 The Flipper Zero has mixed usability and may be helpful for niche projects. 17:40 The Flipper Zero is considered more like a toy with limited practical use.
It didn't unlock your car because your car is using rolling codes. If your keyfob is near the car, the signal you recorded is burned and invalidated after the first use. You would need to jam at the same time. For a real test, record your fob in a daraday cage or far away from ypur car and then replay it. Chances are, if you fet the recording right, it will work. This attack is known as RollJam and I have a Python script I developed myself to do this on my own car and garage opener. If you go to apartment complexes or gated communities, their gates usually do not use rolling codes. So, you could sit there and record when someone opens the gate and then have permanent access. You can do that very easily with a FlipperZero. A car requires a little more prep, but mot impossible with a FlipperZero.
The custom firmware will do the garage opening and counts on what your car uses if your car uses rolling code then you’ll have to record the remote being outta distance from the car
Interesting. This is the entrance to a deep rabbit hole that will have to wait a bit because I have too many pots on the stove. But, down the road yea, I'd like to experiment a bit which is where all the fun lay.
“Received Signal Strength Indicator,” is a measurement of how well your device can hear a signal. In other words, RSSI is a value for determining a good wireless connection.
The reason is didn't let you save and replay the first garage door code is that it recognised the protocol as being from a device that uses rolling codes. The dev team are paranoid about causing desynchronization issues between existing keyfob and reader (both for cars and garage doors) so they've made the choice to block the send. It's definitely not a government imposed decision. On the plus side this means your garage door is immune to replay attacks. The second garage door is FCC regulations - in the US there are some garage door openers that operate on a licensed band. Only devices made by the license holder can transmit there, so the Flipper isn't legally allowed to. Unfortunately, this isn't respected by chinese equipment manufacturers, so many of them work in the same licensed band. Flipper is under a lot of scrutiny, so has to really follow the letter of the law.
@@Corn0nTheCobb The stock firmware can receive on the frequencies already (it does detect the garage door opener after all). Transmitting would be breaking the law - the license to transmit on those frequencies is attached to the device, not the operator. I won't help you break the law, sorry. Lobby your representative or the FCC to open up those frequencies.
6:25 I have a problem with spurious emissions too 😢 7:38 there’s no point in trying to unlock a modem car as the key changes at random, older cars older than 2008 or 2006 will unlock. 9:04 stock firmware is locked down, Unleashed firmware is the best IMHO
This thing is pretty neat as and idea at least, kinda reminds me of something a punk anarchic netrunner from Cyberpunk would pull out and hack into a secure corpo van full of tech
The way you sliced through the tape to open the box toward your thumb compelled me to share a screenshot of 0:33 with my kid's scout troop as a scary example of knife usage. 😲
oh i know exactly what those spurios signals were lol. thats what got me started on this whole path is when i hooked up a receiver and found out we are all getting bathed in these signals. 1 is going to be your power most likely. 2 is going to be some other company meter. If you have any weather stations about that was also one of those range of signals. I can track everyone in my areas water and gas as its all wide open and being broadcast.
Guys i have had the Flipper Zero for a while now. I managed to find the WiFi Developer board, C1101 and NRF24 addon modules but there does not seam to be any boards about and at a reasonable price. Is there somewhere where i can buy the bare boards and assemble them myself ? Maybe someone here can make a lot of money supplying kits. The boards i bought component wise would probably cost less that £5.00. I would like to see modular boards kind of like an Arduino module.
I think it allowed you to clone the keyfob because you need to have it very close to read it, and it is NFC like device, so it will not work at distance (at least not with very specialized equipment). But garage remote could be picked far away quiet easily, even without extra antenna.
2:45 yes!! So true. Mega corps almost always intentionally make their products worse via updates, which is why I update most things very rarely. My thought is, if I have a perfectly working version, why risk an update.
Security vulnerabilities. That's the biggest reason why you should update. It's unrelated to the fact that mega corps do often load up bloatware and tracking features to show you more ads, but without those security updates, you're leaving yourself vulnerable to recently reported zero-days and malware.
It is a bit scary, but I think it is a good thing. A lot of devices, like door key fobs, garage doors, etc, are super insecure, and poorly implemented. This device will force most manufacturers to finally do some proper handshake and cryptography, do tof ranging, etc, not just fixed signals or ID, which were always easy to spoof or duplicate.
11:33 - As someone who works in an ID card factory, I know ALL ABOUT these RFID fobs, cards etc. and I’ve programmed many MiFare cards in my time working there. It’s actually really cool stuff if you know what all those numbers mean! Obviously, I’ll leave the explaining to the pros (mostly because I do NOT want to be responsible for breaking any laws), but basically, most RFID chips have four different pieces of data stored on them. Those are the format, card number, facility code (marked as FC), and sometimes a few fixed fields (marked as F3 and F4 generally). And those are just the basic, everyday ones. MiFare chips are a whole different beast altogether. And don’t even get me started on UHF chips…
A lot of electronics over the last 20-30 years have gone to rolling codes to defeat these replay attacks. I have low confidence this can work on cars or garage doors.
You can't do it on its own. You need another device to stop the receiver and then send the codes if captured correctly. It's not for the faint of heart and a beginner wouldn't be able to do it.
Honestly its primary use for pentesting in my opinion is to clone low frequency RFID access codes just as phase 1 of an intrusion. This obviously can be done with many other devices, but the flipper zero is just so cute and fun! I mean just look at the amber LCD.
@@olso8621 There's advantage in clandestine devices and low level attacks, but the window of insecure devices, specifically for replay attacks, is so small. IMO it's better to focus on things that are less entertaining but incredibly insecure. Like tracking specific vehicles using their tire pressure sensors.
Your car fobs, and garage door openers run rolling codes. If you aren't careful you can brick your car remote. With custom firmware there's interesting things you can do. The kids like popping open Tesla charging ports on parked Tesla's. We're also frequent Dave and Buster's visitors. The kids all have NFC armbands to play the games. I have cloned all of their wrist bands and I play games using their credits. An unethical person could also get close to a technician who is working on a machine and clone their NFC tag. While you wouldn't be able to use any won tickets/rewards you could play the pusher games that drop cards where you collect the full set for a nice bonus.
Your car uses a rolling code system, to prevent exactly what you were trying to do from happening. Basically, every time you press your keyfob's button, it transmits a different code, using an algorithm that matches the one the car expects. The flipper was retransmitting an old code that the car had already marked invalid. If you really want to try to open your car with a Flipper, the easiest way to do it is to record your keyfob's signal while it's out of range of your car, then replay it in range. Keep in mind that this may knock your regular keyfob out of sync with your car, though.
Suspect any RF dongle uses a random number generator & any NFC uses public key cryptography, so it's not going to do much. The amber LCD looks neat though. Would be nice to interrogate a credit card with it. A lot of us are having our chip cards suddenly die with no way to diagnose it.
NFCtaginfo by nxp semiconductors installed on a cellphone is good for contactless bank cards. One of my old issue bank cards several years ago was allowing me to read the card number and my name with no security. Thankfully my bank has switched to a more secure card now.
the whole script kiddie thing is back again . that also raised awareness about how insecure everything in the OS world was. with my own research I found that the stuff that everyone is using wireless coms for is incredibly insecure and this exposes it
I would bet the iButton feature is referring to the little fobs that use the 1-Wire protocol over physical contacts. It just sends a simple ID over the bus. Probably could use the GPIO to read one of them.
Thank you for the video, If I had watched this sooner I may not have ordered one but i'm sure I will come up with some project to take advantage of it!
I'm almost 50 and it is one of the coolest toys I own. I can do SOOOOOOO MUCH with it!!!! Think of it as a learning device. If you want to "get into something" you have to learn how it works (ie. codes, frequencies, types of communication, etc.). My flipper can control every IOT/smart device in my home, although I haven't tried my X!-C or my Phecda...yet. I have a new thing where all of these assholes in cars on their Iphones now have an endless amount of bluetooth spam courtesy of the latest IOS exploit. These things with the right GPIO boards have some serious potential for...... This "toy" as you call it, is a a very compact pin-testing tool, pretty much unlike any out there. Between just the Marauder or Evil Portal firmware options with the ESP32 GPIO, you can get wifi passwords, or even logon and passwords for many big name services like google, some airlines, etc., and that is just that. The BadKB/BadBT are both funny and frightening. Some of them can DESTROY your system, steal your info, etc.. Others are great if you like Rick Ashley.
I am not a hacker or inclined to hack anyone i am a tech helper as such. Mostly i use Flipper and HackRF and other devices probably un relevant to mention I use my knowlage to to help others. Occationally someone locks their keys in the car, battery dies, failed fob then i can open pretty much any lock, worst case i spend a little more time and pick the lock. Electronic picking is easy but i am old school and i learn more everytime by doing it the hard way. I have helped people with permission to get back hijacked and ransomeware networks and track back and clean the system. I get great satisfaction from helping people and i never charge for any services. I am the kind of person that likes to study everything and learn knowlage of just about anything that interests me. The harder the better. I am not the best, i know someone that is though but that is not a lifestyle for me however i learn in my own way. But guys remember hacking without concent is another persons property and must not be abused in any way shape or form and not even as a prank. it can be very dangerous to the hacked and hacker. Being hacked can cause extreme anxiety and stress. I would say, learn hacking and how it works to protect yourself and others with your knowlage.
I agree with the video, but a very important thing about flipper is the custom firmware. Now to install custom firmware you do need some IT knowledge but once you do that the device has much more functions and no restrictions. For example Xtreme or Unleashed are very good choices. EDIT: BTW Flipper is made to be a Swiss army knife of cybersecurity and as someone whos profession is cybersec i can say that it does its job very well.
I keep hearing that the "other" firmware options are better, but also that RUclips gets twitchy about videos with that, so if I jailbreak it I might not be able to show much of that :-P
@@saveitforpartsNot true. By & large the best firmware is Xtreme. There are dozens of videos with that firmware. The latest "Apple hack" videos all have the Xtreme firmware on it. I have Xtreme & they've unlocked so the shit that matters.
All I've gotten to work on this thing is the customer service announcements at Lowe's. I tried the gas station sign changer which didn't work. The garage door opener didn't work (rolling codes) That's all I've tried so far.
@@Curtis.Carpenter True. I consider it a sad reality. Neither one of us are wrong. The fact is regulation is not going to stop anyone. People can still make these tools in an afternoon with the right hardware and software.
"To use this tool as a hacking tool, you must first hack this tool"
consider it as a litmus test
Absolutely! Standard software is limited. Go to Git Hub and dress that puppy up!
@@shuriken2505there is custom software which can be used with this device
As the guy says you must hack the tool. Out of the box it comes plain bog standard with hardly any viable usable functions.
Basically comes as Vanilla. You need to flash it with Firmware like "Momentum" for example there are a few different firmware you can flash it with and it doesn't take long plus you can switch between firmware (Check how to multiboot.) a must have for it though is a WiFi Development addon board. (GPIO) Once flashed you will love the flipper instead of Daddy says no to everything. Great and honest video though. I think we all start in your perspective as some point. You also need desktop or mobile app software like "QFlipper"
I work as a general contractor, my Flipper has been one of my favorite tools I have ever owned. A lot of my clients live in gated communities, apartment complexes, etc. Being able to get in and out of these communities with a pushbutton is one of the most pleasant feelings in the world, that is all. No memorizing codes, don't have to do shit, I can even open some of my customers garages if they ever need me to. Of course, I have to program it first, but it takes seconds
Yeah I use my flipper more for convenience than some Project Mayhem type of stuff. Save a lot of day to day/ week to week key fobs and what not to it. Instead of having to keep up with the office key, the gym key, the parking garage key, the gate code, etc. I just pull out the flipper and use it. Also, flipper nerfed a lot of their features so this thing wouldn't get banned in more places. You can somewhat 'jailbreak it' to access a lot of these gate codes, and even get a full library of remotes without having to program any.
Additionally, I think the BadUSB is cool, but that can definitely be where the real hacker stuff comes in. I played around with a few scripts, and stopped. You can download scripts to brute force laptop passwords, and a bunch of other things. I really think the makers wanted to downplay it's capabilities to avoid getting banned. Still more powerful tools out there, but it was limited to what it can do out of the box.
T
I'm a contractor/electrician. My job is similar to yours any tips or can you point me in the right direction as far as what could be useful? I just purchased one based on your advice.
Hey man, I use my flipper for opening my gated community gate, but I cannot for the life of me figure out how to program it as a garage remote. What steps did you take? I have the Rougemaster CFW if that helps
@@TummySausage the problem is most garages have "rolling codes" which you should look up, its probably why you cant do it on yours
You need to run custom firmware on there. This will open a whole bunch more.
Which custom firmware? Or are you suggesting he write his own?
@@3nertiaroguemaster seems good. But it depends on the actual usecase.
@@tripplefives1402 That knowledge is a bit intricate for such a device lol
@@jboomhauer Thank you!
@@3nertia RougeMaster
Quick note about recording the car fob: If your car was close enough to receive your keyfob at time of recording then when you replayed the keyfob signal the car will reject receiving that signal a second time. This is thankfully due to most cars having a "rolling code" that changes with each button press which prevent replays... usually.
my car has a rolling feature. you insert a piece of brass in to a specially shaped hole and roll the brass forward via it's attached miniature handle.
@saveitforparts - You might retry recording the fob activation when you're a far enough distance away from the car.
Or if you can put the fob and the Flipper in the equivalent of a Faraday Cage / metal box when you activate the fob, that could work too.
Or you could use another radio very close to your car that would jam reception of the signal, but not trip up the Flipper.
It's called a "rolling code" system and lots of RF-based systems use it. Every time you use the fob it moves to the next code in a pre-programmes set. The car remembers which code you used last time and only opens if the code you send is in the next X codes in that list. If not, it doesn't open. In fact if you play with your keyfob too much you may move the fob to a code outside of the expected set of codes of your car and you'll have to re-sync the fob to the car.
So yeah, moist RF systems have ptotection against these simple replay attacks.
This can be used for a denial of service attack because if the car computer reads the same (cloned) signal/code coming in a second time, it assumes it is an attack, and locks the remote fob with that ID out. The physical key will still work, but the owner will have to get the key fob re-synched at the dealership. This can get annoying fast for obvious reasons.
@@vinny142 Its probably less of a list and more an algorithm that manipulates an initial seed value in a programmatic fashion. All the car needs is the same seed value, and with unique seed values your fob wont unlock someone elses car.
The separate on and off buttons are quite helpful for professional A/V situations where you might not be able to immediately tell if the projector has turned on or not. Instead of just telling the projector to change to an ambiguous "the opposite of the current state", you can specify exactly which state you're looking for.
The result is that you can just spam the power button without needing to worry that you're turning it on and off and on and off and on....
In my time with owning a flipper, I have realised that it doesn't do anything that other devices can't do, the only advantage is the tint size. All of the issues thst you have mentioned can be avoided by downloading a custom firmware, I use flipper unleashed. The main downside of the flipper is the lack of power, it often struggles with range and suchlike. I plan on making some external modules for the most often used modes. I see it in the same way that you said, as a multitool. It does the same job as dedicated tools, in a more compact size profile but not as well
I want one largely to just use as a GREAT “universal remote”. No messing with button pressing/holding, just a nice GUI and it can control all the stuff not just IR devices.
There are *much* cheaper devices for that, like anything lilygo makes.
The flipper zero is kind of very overpriced for the features...
@@VynVdragon I agree but to be fair I have a flipper and the online repositories people upload of all the different IR brand and model controls for a big variety of equipment beyond just TVs and projectors or whatever. Sadly I live in the U.S. but Ive always wanted to mess with those A/Cs that are popular in Europe you know the white rectangular ones mounted indoors with the compressor mounted by the window outside. You could make everyone’s day by increasing the intensity of some AC in a very busy hot supermarket lol be a saint but yeah otherwise there are a slew of universal remotes that exist already including ones with much much stronger IR blasters than the flipper has (I have one myself obv I know it’s not that strong of a blaster) so you can do the actual funny stuff like turning off neighbors TV from two houses away or whatever I remember one was literally sold for that purpose I think it was called TV B Gone or something lol
For a good ir remote hardware buttons are a must.
@@Cowloverdude there's a bunch of software options to upload to esp32 and esp8266 for remote IR too
lol I just want to use it to pirate amiibos
iButton is not actually some Apple nonsense! It's a one-wire communication protocol used in a lot of older security keys and even as a transit pass in some cities! It also goes by the names "touchmemory" or "dallas keys".
We use iButton to identify drivers and road tankers at a fuel loading facility in Australia. I’ve been wanting to try storing all my iButton ID’s on the Flipper because every time I swap tanker trailers I need to use the associated iButton - if I have them all on my device they’re effectively a backup (or spare) of the original. The only problem being using the device while at the gantry goes against all the safety protocols for the safe loading of flammable liquids😢. I could probably use it at the automatic security gate at the entrance and exit of the facility though.
Yup, Dallas 1-Wire. That's what the contacts on the back are for.
@@inothome any idea if I can connect and read iButton thermometers? would be a great application in my science projects...
@@twocrowsdown good way to get fired and tossed in prison.
yes@@spot1401
If you ever decide to automate your home to manipulate your projector, you will be very grateful for its discreet On and Off signals. Toggling power is hard to program around since you have no guarantee of starting state.
Thanks for your videos.
A lot of people do not understand RFID. These devices do not transmit data unless they are in close proximity to a reading device. which briefly powers them just long enough to send a packet of data. I think you could probably do the same thing with NFC reader software installed on any modern cellphone.
I don’t think most cellphones do 125kHz rfid, only the 13 MHz “NFC” stuff
@@jeremyloveslinux Correct
My workplace uses NFC tags for security when they do rounds, and I can confirm my phone could easily read them, and likely could overwrite them rendering them useless. I use NFC tags at home so I had an app already for that.
@@theussmirage NFC is not RFID
Near field, though I suppose "near" can be relative
It did not lock the car because vehicles and keyfobs use a synchronous rolling code. The car and the key have a seed value stored in them, and whenever you send a command such as lock, unlock, etc, using the fob it uses that seed value and then they update the value internally. By recording the key fob you are replaying an old value. So the car wont listen to it. You need to do whats called a Rolljam attack which will prevent the car from hearing the keyfob while you record the value.
Buyer beware! This can disassociate the fob from your car and you need to manually reset the rolling code inside the vehicle in order to reassociate the key fob with your vehicle. If your car doesnt allow you to do this manually you might need to have it taken to a dealership. Its not such a problem if you have a metal key in addition to your fob. If you are entirely pushbutton though as many modern vehicles are...
You wont be able to drive your car. And thus you will have to have it towed to a dealership.
If it's push-to-start you can almost always hold the fob to the button and it will read it using NFC (or something similar, not sure) to allow you to start the car. This is mostly meant as a way to still be able to start the car if the fob battery dies.
You are correct and I just want to say that there is a workaround for this basically it's just an algorithm and a process of figuring out the hex table wildcards. But like a lot of things it wouldn't be responsible to post exactly how to do it.
it's amazing how many "keyless" fobs have keys hidden in them. I couldn't believe it the first time someone showed me my fob had a really stripped down tiny key inside it. Push button start just needed the key to be in car, even when dead.
@@samdunn717 those physical keys are for the door/glove box. There's no ignition to insert them into. It'd be cool if there was though.
Nah bro, the Flipper Zero is absolutely worthless - which is why you should send me YOURS 😎
I have 3😂
I really appreciate your perspective on updates. On one hand, not updating some things has the potential to leave the user in a vulnerable state. On the other, it can (and often does) strip away features, or add things that benefit the manufacturer and not you. Even if it's just increased data collection that takes performance/battery life away from you. It's something worthy of consideration and discussion in my opinion.
I have the Xtreme firmware on mine and have tried it on multiple garage doors, at least two of them could be opened after capturing the signal once. They both had a vulnerable rolling key based protocol. The IR functionality can be both fun and useful. I've used it to turn on the TV when I can't find the remote in hotels etc. I was also able to clone some access cards, for a gym for example. Some of the GPIO apps are nice too. The signal generator and apps for testing various sensors. Bad USB is very nice in a penetration test scenario. If you get one of the WiFi addon boards you can also do de-authing and some other stuff. A lot of people (including my kid) have been lead to believe that this device can "hack" anything. Mostly because of fake TikTok clips. But it's a great device with lots of features. My girlfriend has played way too much Tetris on it as well. 😄
I look at this flipper thing and it reminds me of the bygone days of PSP hacking. Back then you had firmware, flashing and all the cool software people came up with on forums you could even access through the PSP's internet Tbrowser. The fat PSP came with an RFID sensor which made it ideal as a grabber for remotes; I had the AC remote hotkey'd in, as well as the school projector remote :D
IRshell?
@@fuchsia4326 kids arent playing with retro handhelds bro and powkiddy is one of the worst kinds you can get
I think you mean Infrared transmitter/receiver. Not RFID.
The fat psp was my drug😂 after it i started softmoded so many mp3 and phones. Work machines/cameras/networks/printers/vehicles/forklifts its considered geeky asfuk so no one cares if u do it…..all thanks to psp ❤
Unfortunately, I got into the hacking scene a little later, when the PSP 3000 was released.
No Pandora battery, and basically had to wait for Pro CFW or others that were released, like Cold bird's (Thefl0w) stuff.
No infared on the 3000, but I did get a 1000 later on and gave it to a brother of mine. I don't remember if I was able to get IRshell to work. 😞
RSSI = "receive signal strength indicator" in dB relative to 1 milliwatt (0 dB is 1 milliwatt on the antenna). Typical lower receiver sensitivity is going to be from -90 dB to -120 dB. It looks like you can set a threshold of when the device will start recording as sort of a squelch feature.
Thank you
Also badusb is keyboard emulation to inject a payload, for malicious or prank purposes. Custom firmware adds BadBT which does the same thing to affected devices without even needing to connect physically
I'm a A/V technician, I mostly use the flipper to emulate different IR remotes so I can have all the remotes I need in my pocket. I also think the rubber ducky USB scripts are immensly powerful and usefull. Imagine having to change say the network config like ip and submask on 5 different machines or download a bunch of software that you need on multiple machines. Even tho the option is called bad usb, for me it's a really neat timesaver
I remember one of my friends got one of these and started testing it out with Flipper Unleashed... he then proceeded to accidentally change his AC unit from Fahrenheit to Celsius, couldnt figure out how to change it back, and then sold it to one of his uncles friends 💀
bruh just learn the conversion at that point lol
who the fook uses Fahrenheit??? 😭
@@gaelr.s7123 one of the biggest countries in the world.
Dude! I've had mine for a few months now and I love it!
But I'm also the guy who bought a Cat S61 for the upgrade.
As an old Radiohead, this thing has got all kinds of abilities.
I use the IR for my window shaker!
Great for figuring out what your transmitting at too.
It can't spoof rolling code systems and other high security.
That was purposeful in the design.
The GPIO can control any small device similar to PLC.
I didn't know it did pets!
You were looking at every BT, Cell or other wireless device around.
It will save a list over time for you.
You can physically hunt them with RSSI. Fox and hound style.
I'm sure one of your little parabolics will do the trick.
RSSi is the line at the bottom. You raise it to filter out nosier/weak signals.
You played the noise back to the car!
You need to hack the region settings. If you want play that way.
Highly recommend the unleashed firmware - one day at work this device saved me twice, first as a keyboard and mouse to interface with a headless computer and second when a TV I had to configure had a broken remote and I was able to download codes and even customize a page to quickly interface with it.
Missed a lot of features and got a few wrong, but it's a fun tool and might take weeks to really discover its capabilities.
I use mine as a vault for all the RFID cards used to access different locations I service. If I visit a location and they loan me an access card I just clone it and give it back or generate one on fly and add to whatever system they use. It also came in handy to re-purpose some ioProx cards that we were originally going to throw out because we moved to an HID access based badge system.
ibutton is like a coin cell looking thing that runs Java, I believe. Used in apartment complexes as door keys, sometimes. inside the ibutton is a small computer and when you press the button up against a receptacle there's a challenge/response thing over a 1-wire protocol and if each half gives the right answers to things then (in the case of an apartment complex) unlocks the door. Sun Microsystems even made rings with built-in iButtons. Still commonly used, I believe. Definitely not apple.
Back when I was a steeley-eyed security dev, I had an iButton ring. It was too small for me, though, so I wasn't in the habit of wearing it. I remember McDonalds used iButton fobs for employees logging-in to the sales terminals, back when iButtons were popular.
My local driving range uses a iButton fob to get balls from the machine
iButton uses the 1-wire protocol and is based on the javachip/javacard API, the same chipset and APi that still powers billions of smartcards. At JavaOne 1998 Sun introduced the JavaRing, the original setup provided in the SWAG bag that plugged into a reader that sent a REST request to a server that lit a pixel that represented you in a giant mosaic that was supposed to gradually appear in a large overhead screen. I remember hacking those requests so they had to shut it down and actually implement the security protocols built into the ring. Still have that ring somewhere. Ah, memories.
Its actually an embedded subset version of Java called the JavaCard API that runs on the JavaChip architecture. The iButton implements security protocols in JavaCard and also includes tamper resistance that zeros the stored data if physical or electromagnetic tampering is detected.
Fun fact : using an ESP32 you can transmit at 433 MHz, using the "LED controller" LEDC peripheral.
You need to set the frequency to 33.875 MHz and the resolution to 1 bit using the ledcSetup function.
You can then transmit by toggling the PWM between 0 and 1 using ledcWrite.
Of course it transmits a whole bunch of harmonics at frequencies it's not supposed to, and one of them falls close to 433.92 MHz.
Using a short piece of wire it can transmit up to 10 meters.
Use the dark firmware. It gets updates almost weekly, and opens up a lot.
Better than Xtreme?
@@CowloverdudeI recommend rogue master
RM is a joke @@ObedienceClearlyWins
Did you just do a CAT scan?
😂😂😂
They ship them nerfed to appease regulators. Better firmware will enable more functionality.
Also: most cars and garage doors use rolling codes these days. It's much harder to crack than just playback.
I've got this device on my wish list, for no reason other than it seems fun and cool. I'm no criminal. I have researched it somewhat (watched youTube vids). You are going to get tons of great advice from actual users, so let me just ask that you please do an update soon!!!!! It was frustrating to see your results when I had seen others do some spooky, cool stuff! I have never seen weather satellite photos from junk before, so I have complete confidence in you, dude! I really love your channel!
I keep hearing that the "other" firmware options are better, but also that RUclips gets twitchy about videos with that, so if I jailbreak it I might not be able to show much of that :-P
@@saveitforparts without update your review feels unfair.
Of course, you may not have known how to use this device correctly before.
But now you know.
Yeah roger that.@@saveitforparts
@@sdjhgfkshfswdfhskljh3360 it's his video! like who tf are you to tell him it's unfair? how about you make your own "fair" review and publish on your own channel..
@@dagfinissocool He's a guy with an opinion. Like you, obviously. Now quit being a dik.
Unleashed / Xtreme / Roguemaster... You wont be disappointed.
I haven't tried anything but the Xtreme firmware.
Most of the biggest names using the Flipper Zero seem to run Xtreme.
I don't think there's anything there others do that Xtreme doesn't.
They update it all the time to the latest abilities.
David Beckham's car was stolen i think 4 times using a key fob playback device lol. i love that the flipper is making RF hacking so easy because now manufacturers are being forced to upgrade their security
The reason why it didn't work on your car is because of the implementation of security on modern car remotes. When remote locking first started appearing replay attacks where very real and a huge problem, someone would sit in a parking lot wait for you to lock or unlock your vehicle then modify and or replay that message gaining access to your vehicle. These days however there is a small security algorithm running on the fob and on the vehicles computer creating a rolling encryption key that keeps changing every time you use that fob, it has to match with the vehicle computer, otherwise it just ignores it.
Its still possible to "replay" but it requires you to reverse engineer that algorithm, and run it at the same point as it is currently in the vehicle you are attacking.
This is what the internet was actually made for. Straight fax and no useless "MAKE SURE TO LIKE AND" that is 20% of the video.
Fax?
Flipper definetly needs custom firmware, there's way too many restrictions (but you know gotta keep it legal by default)
Doing a replay attack on your garage door should have been the easiest thing ever
It's just a CC1101 chip inside for the radio, that's what you'd use on any micro controller based project that needs to transmit and receive below 1ghz
On a side note you can actually do NFC and IR stuff with any rooted android phone that has an ir blaster, so flipper is only good for RFID and SubGHz radio imo
Its this simple... if kids can learn to shoot physical combat weapons, they can learn to use cyber weapons.
The second amendment says ARMS, not firearms.
Fresh out the box flipper software is very minimal but when you install either of the 2 popular custom firmwares then all those restrictions are gone and the world is your to mess with
How would someone do that?
The RF "core" of this device is a TI CC1101 multi-mode RF transceiver chip that "understands" several different modulation standards and (I think) protocol/coding standards. It has an RSSI output, and can scan the tuner fairly quickly, so you can use that as a scanning spectrum analyser with a fixed RBW. It's not really an SDR in any meaningful way.
This is like the script kiddy version of an SDR. Great for emulating stuff someone else has already figured out, but a real SDR and a full fledged suite like GNU Radio is a million times more powerful, but you need to know what you're doing, not just press a few buttons on your tomogachi dolphin
You are very kind to go out and buy a microchip reading tool just to help pets get back home. You are now number 4 on my list of good people
who are the other 3 ?
@@ZVEKOfficial Bill Gates, Johnny Depp, and Hitler
5:32 you could've save the chip data and then emulate it back and use your halo reader to show if it shows the same thing.
In the case of trying to capture/emulate signals from specific frequencies you would want to raise the rssi to get rid of unwanted noise the biggest reason people can’t get these to work is because we live in a world of satellites and fm radios in every car you will almost always have some sort of egress, specifically in this video he demonstrated that his flipper was picking up stray signals definitely coming from a Bluetooth device. In all honesty it depends on the device: you won’t see a key fob putting out 8db of signal so it’s kinda hard to judge what levels something should be coming in. Also a great time to learn what frequencies are what so that you don’t go messing around the LTE bands or cause your neighbor to lose his direct tv channels. Clearly you won’t be blowing any telecom nodes with a flipper BUT a hackrf one maybe
I love the vibe of the flipper, too bad its very restricted
Restrictions are easily removed, that is not a problem.
I sense a new era of Save It For Parts on the horizon 🌙
The way you open boxes with knives, one would think you really don't like your Thumb! , that made me anxious! 😯🤣🤣
I want one of these now! Not for anything nefarious, mind you, but as a fun little device to mess with my family since I already love to hijack the devices my parents use to stream on when they fall asleep with my smartphone’s remote play feature so I can change whatever’s playing to a RUclips video of an alarm clock or EAS message to see what they do in response.
I would love to see a follow up video about putting custom firmware on that bad boy!
I keep hearing that the "other" firmware options are better, but also that RUclips gets twitchy about videos with that, so if I jailbreak it I might not be able to show much of that :-P
@@saveitforparts you don't have to say you jailbroke it, you just "updated the software". It would be nice to see all of the capabilities of the unit without restriction since its a pain that you payed for the device and cant use all of it. also I wonder what you can add to it through the gpio pins.
Yeah, but some Karen will get upset and then report the video. He doesn't want a take-down notice...
I think you were picking up your weather stations or other low powered transmitters. I use an sdr dongle for pc, and theres a 433 plugin to see all the stuff transmitting. Even tire pressure sensor data.
I got this primarily as a more convenient Proxmark alternative. Those alone are very expensive, the one I have has become increasingly finicky, and I’m left preferring older versions of the software. The antennas in the Flipper have generally been a lot more consistent than other hardware I’ve used in cases where I’ve wanted to clone a work badge to the 125kHz tag I implanted in my left hand, or some other seemingly simple operation.
I’ve also found some novel applications that I won’t share here c;
Novel like?
I’m honestly so curious how you got that tag implanted in your hand
what Implants do you have ? What do you use the flipper for with them? I have 9 of them all from DT .
i button is an authentication protocol that has nothing to do with Apple. It’s a round button style device. I have one for my company vehicle that needs to be authenticated every time you start the vehicle so that it lets the owner know when it’s being driven and also where it’s being driven. Edit… it looks like someone’s already answered this in a post already. Sorry for the redundancy. Enjoy your videos very much.
I suspect the whole Flipper branding is an homage to the Cyber-Dolphin in Johnny Mnemonic. (The cartoon even looks similar).
It goes back even further to a 60's tv show 'flipper' about a boy and his dolphin.
00:02 Flipper Zero is a versatile hacking and security tool disguised as an electronic pet.
02:11 Consider updating the firmware for potential useful features.
04:27 Microchipping pets for identification purposes
06:18 The Flipper Zero can detect and analyze radio frequencies.
08:49 Flipper Zero has limitations in hacking capabilities
11:01 Flipper Zero can read and copy security codes from RFID cards and fobs.
13:10 Flipper Zero can clone access cards and emulate card information.
15:26 The Flipper Zero has mixed usability and may be helpful for niche projects.
17:40 The Flipper Zero is considered more like a toy with limited practical use.
It didn't unlock your car because your car is using rolling codes. If your keyfob is near the car, the signal you recorded is burned and invalidated after the first use. You would need to jam at the same time. For a real test, record your fob in a daraday cage or far away from ypur car and then replay it. Chances are, if you fet the recording right, it will work. This attack is known as RollJam and I have a Python script I developed myself to do this on my own car and garage opener.
If you go to apartment complexes or gated communities, their gates usually do not use rolling codes. So, you could sit there and record when someone opens the gate and then have permanent access. You can do that very easily with a FlipperZero. A car requires a little more prep, but mot impossible with a FlipperZero.
The custom firmware will do the garage opening and counts on what your car uses if your car uses rolling code then you’ll have to record the remote being outta distance from the car
Who flinched when he almost chopped his thumb off?
I've used this to test the RFID blocking claims of wallets and be a backup/secondary remote for all kinds of things at home.
Interesting.
This is the entrance to a deep rabbit hole that will have to wait a bit because I have too many pots on the stove.
But, down the road yea, I'd like to experiment a bit which is where all the fun lay.
“Received Signal Strength Indicator,” is a measurement of how well your device can hear a signal. In other words, RSSI is a value for determining a good wireless connection.
The reason is didn't let you save and replay the first garage door code is that it recognised the protocol as being from a device that uses rolling codes.
The dev team are paranoid about causing desynchronization issues between existing keyfob and reader (both for cars and garage doors) so they've made the choice to block the send. It's definitely not a government imposed decision. On the plus side this means your garage door is immune to replay attacks.
The second garage door is FCC regulations - in the US there are some garage door openers that operate on a licensed band. Only devices made by the license holder can transmit there, so the Flipper isn't legally allowed to. Unfortunately, this isn't respected by chinese equipment manufacturers, so many of them work in the same licensed band. Flipper is under a lot of scrutiny, so has to really follow the letter of the law.
Nothing is respected by Chinese manufacturers lol
Is there a custom firmware that can unlock the ability to receive & transmit on those licensed frequencies?
@@Corn0nTheCobb The stock firmware can receive on the frequencies already (it does detect the garage door opener after all). Transmitting would be breaking the law - the license to transmit on those frequencies is attached to the device, not the operator. I won't help you break the law, sorry. Lobby your representative or the FCC to open up those frequencies.
@@HaralHeisto I know, but it's not a law I care about. I understand though. Thanks!
rouge master still works though right?
it would be good for an IT team for small orgs needing to test physical security.
If this guy can hijack a russian satellite's images with an antena made of literally trash i'm worried about what he can do with a flipper
Luckily he only uses his powers for good not evil.....
He didn't hijack anything the Russian sat was transmitting for all to see. :)
@@johnblanchard8601 as far as we know
Freedom>metric....I trust him 💯
I can tell that this is not a sponsored review because you got the right answer.
6:25 I have a problem with spurious emissions too 😢
7:38 there’s no point in trying to unlock a modem car as the key changes at random, older cars older than 2008 or 2006 will unlock.
9:04 stock firmware is locked down, Unleashed firmware is the best IMHO
This thing is pretty neat as and idea at least, kinda reminds me of something a punk anarchic netrunner from Cyberpunk would pull out and hack into a secure corpo van full of tech
You can use the Ir remote with your camera. Upgrade to one of the non hindered firmware for a bunch more features.
Restricted defaults are good for calming down regulators, open source is good for anything else.
The way you sliced through the tape to open the box toward your thumb compelled me to share a screenshot of 0:33 with my kid's scout troop as a scary example of knife usage. 😲
oh i know exactly what those spurios signals were lol. thats what got me started on this whole path is when i hooked up a receiver and found out we are all getting bathed in these signals. 1 is going to be your power most likely. 2 is going to be some other company meter. If you have any weather stations about that was also one of those range of signals. I can track everyone in my areas water and gas as its all wide open and being broadcast.
minor point of clarification - RFID cards are usually kHZ, not the mHZ range.
A bad usb is where a hacker can hack a computer or anything with usb, it make it think its a wired mouse or keyboard
Guys i have had the Flipper Zero for a while now. I managed to find the WiFi Developer board, C1101 and NRF24 addon modules but there does not seam to be any boards about and at a reasonable price. Is there somewhere where i can buy the bare boards and assemble them myself ? Maybe someone here can make a lot of money supplying kits. The boards i bought component wise would probably cost less that £5.00. I would like to see modular boards kind of like an Arduino module.
I think it allowed you to clone the keyfob because you need to have it very close to read it, and it is NFC like device, so it will not work at distance (at least not with very specialized equipment). But garage remote could be picked far away quiet easily, even without extra antenna.
2:45 yes!! So true. Mega corps almost always intentionally make their products worse via updates, which is why I update most things very rarely. My thought is, if I have a perfectly working version, why risk an update.
Security vulnerabilities. That's the biggest reason why you should update. It's unrelated to the fact that mega corps do often load up bloatware and tracking features to show you more ads, but without those security updates, you're leaving yourself vulnerable to recently reported zero-days and malware.
It is a bit scary, but I think it is a good thing. A lot of devices, like door key fobs, garage doors, etc, are super insecure, and poorly implemented. This device will force most manufacturers to finally do some proper handshake and cryptography, do tof ranging, etc, not just fixed signals or ID, which were always easy to spoof or duplicate.
11:33 - As someone who works in an ID card factory, I know ALL ABOUT these RFID fobs, cards etc. and I’ve programmed many MiFare cards in my time working there. It’s actually really cool stuff if you know what all those numbers mean! Obviously, I’ll leave the explaining to the pros (mostly because I do NOT want to be responsible for breaking any laws), but basically, most RFID chips have four different pieces of data stored on them. Those are the format, card number, facility code (marked as FC), and sometimes a few fixed fields (marked as F3 and F4 generally). And those are just the basic, everyday ones. MiFare chips are a whole different beast altogether. And don’t even get me started on UHF chips…
A lot of electronics over the last 20-30 years have gone to rolling codes to defeat these replay attacks. I have low confidence this can work on cars or garage doors.
right, this is more of a skid device for petty attacks
You can't do it on its own. You need another device to stop the receiver and then send the codes if captured correctly. It's not for the faint of heart and a beginner wouldn't be able to do it.
Honestly its primary use for pentesting in my opinion is to clone low frequency RFID access codes just as phase 1 of an intrusion. This obviously can be done with many other devices, but the flipper zero is just so cute and fun! I mean just look at the amber LCD.
@@olso8621 There's advantage in clandestine devices and low level attacks, but the window of insecure devices, specifically for replay attacks, is so small. IMO it's better to focus on things that are less entertaining but incredibly insecure. Like tracking specific vehicles using their tire pressure sensors.
Your car fobs, and garage door openers run rolling codes. If you aren't careful you can brick your car remote.
With custom firmware there's interesting things you can do. The kids like popping open Tesla charging ports on parked Tesla's.
We're also frequent Dave and Buster's visitors. The kids all have NFC armbands to play the games. I have cloned all of their wrist bands and I play games using their credits. An unethical person could also get close to a technician who is working on a machine and clone their NFC tag. While you wouldn't be able to use any won tickets/rewards you could play the pusher games that drop cards where you collect the full set for a nice bonus.
You should be able to play back the blocked frequencies with custom firmware
Which custom firmware?
@@3nertia another commenter said unleashed-firmware on github
@@3nertia unleashed firmware disables the regional frequency blocker
@@3nertia I run RougeMaster.
@@irontoe9001 Unleashed how?
This thing is a Leatherman, essentially. Doesn't work nearly as good as each single-use tool, but it's good enough and all in one package.
Your car uses a rolling code system, to prevent exactly what you were trying to do from happening. Basically, every time you press your keyfob's button, it transmits a different code, using an algorithm that matches the one the car expects. The flipper was retransmitting an old code that the car had already marked invalid. If you really want to try to open your car with a Flipper, the easiest way to do it is to record your keyfob's signal while it's out of range of your car, then replay it in range. Keep in mind that this may knock your regular keyfob out of sync with your car, though.
I just wanna go to a bar and shut off all the T.v's B-gone. Cheers Bro. Great video. I know what I'm getting my myself for Chrimbus.
Suspect any RF dongle uses a random number generator & any NFC uses public key cryptography, so it's not going to do much. The amber LCD looks neat though. Would be nice to interrogate a credit card with it. A lot of us are having our chip cards suddenly die with no way to diagnose it.
NFCtaginfo by nxp semiconductors installed on a cellphone is good for contactless bank cards. One of my old issue bank cards several years ago was allowing me to read the card number and my name with no security. Thankfully my bank has switched to a more secure card now.
the whole script kiddie thing is back again . that also raised awareness about how insecure everything in the OS world was. with my own research I found that the stuff that everyone is using wireless coms for is incredibly insecure and this exposes it
I'm looking into buying a used one to save some money, thanks for the video!
Disinfo to keep folks from getting one. I own 4.
amazon keeps recomending this device to me but i know next to nothing about any of this. thanks for the info in the video
It's a neat convenient tool, but it doesn't do anything new you couldn't have done before though.
I use this device as my backup garage door opener as well as my IR remote for my TVs and my Xbox one.
This is a truly beautiful handy device; I haven't seen it described in such detail before; it's a Swiss Army knife.
So this would be a gr8 back up for personal back ups if you lock yourself out of a car , house, office. You can save all your personal info.
Get unleashed firmware and some GPIO hats and you will find this tool far more useful. I use my flipper every day, at home, work, on the go, etc.
I would bet the iButton feature is referring to the little fobs that use the 1-Wire protocol over physical contacts. It just sends a simple ID over the bus. Probably could use the GPIO to read one of them.
Have you tried custom firmware like Xtreme to unlock features like replay or add new features? It would be a neat follow-up video
I haven't tried that yet. It's on my to-do list but I don't think I can show it on RUclips!
@@saveitforparts aw man. You'd think it'd be no different than a Kali Linux video by Network Chuck or something
try looking up rolling codes. might help you understand why your car and garage dont work with this.
You don't need to say quote unquote hacking. Just because you're not doing something illegal or immoral doesn't mean you're not hacking.
Thank you for the video, If I had watched this sooner I may not have ordered one but i'm sure I will come up with some project to take advantage of it!
I'm almost 50 and it is one of the coolest toys I own. I can do SOOOOOOO MUCH with it!!!! Think of it as a learning device. If you want to "get into something" you have to learn how it works (ie. codes, frequencies, types of communication, etc.). My flipper can control every IOT/smart device in my home, although I haven't tried my X!-C or my Phecda...yet. I have a new thing where all of these assholes in cars on their Iphones now have an endless amount of bluetooth spam courtesy of the latest IOS exploit. These things with the right GPIO boards have some serious potential for......
This "toy" as you call it, is a a very compact pin-testing tool, pretty much unlike any out there. Between just the Marauder or Evil Portal firmware options with the ESP32 GPIO, you can get wifi passwords, or even logon and passwords for many big name services like google, some airlines, etc., and that is just that. The BadKB/BadBT are both funny and frightening. Some of them can DESTROY your system, steal your info, etc.. Others are great if you like Rick Ashley.
I am not a hacker or inclined to hack anyone i am a tech helper as such. Mostly i use Flipper and HackRF and other devices probably un relevant to mention I use my knowlage to to help others. Occationally someone locks their keys in the car, battery dies, failed fob then i can open pretty much any lock, worst case i spend a little more time and pick the lock. Electronic picking is easy but i am old school and i learn more everytime by doing it the hard way. I have helped people with permission to get back hijacked and ransomeware networks and track back and clean the system. I get great satisfaction from helping people and i never charge for any services. I am the kind of person that likes to study everything and learn knowlage of just about anything that interests me. The harder the better. I am not the best, i know someone that is though but that is not a lifestyle for me however i learn in my own way. But guys remember hacking without concent is another persons property and must not be abused in any way shape or form and not even as a prank. it can be very dangerous to the hacked and hacker. Being hacked can cause extreme anxiety and stress. I would say, learn hacking and how it works to protect yourself and others with your knowlage.
I agree with the video, but a very important thing about flipper is the custom firmware. Now to install custom firmware you do need some IT knowledge but once you do that the device has much more functions and no restrictions. For example Xtreme or Unleashed are very good choices. EDIT: BTW Flipper is made to be a Swiss army knife of cybersecurity and as someone whos profession is cybersec i can say that it does its job very well.
You can load custom firmware to unlock it, but I do not recommend you record yourself using it for things that are region locked.
I keep hearing that the "other" firmware options are better, but also that RUclips gets twitchy about videos with that, so if I jailbreak it I might not be able to show much of that :-P
@@saveitforparts Use code words and sarcasm...
@@saveitforpartsNot true.
By & large the best firmware is Xtreme.
There are dozens of videos with that firmware.
The latest "Apple hack" videos all have the Xtreme firmware on it.
I have Xtreme & they've unlocked so the shit that matters.
All I've gotten to work on this thing is the customer service announcements at Lowe's. I tried the gas station sign changer which didn't work. The garage door opener didn't work (rolling codes) That's all I've tried so far.
I was disappointed by it. Like others said, if you pick a custom firmware it works better, but the fact they nerfed it really annoys me.
I don't think you seem to understand, if they were not to nerve it it would not be available to the public in the first place..
@@Curtis.Carpenter True. I consider it a sad reality. Neither one of us are wrong. The fact is regulation is not going to stop anyone. People can still make these tools in an afternoon with the right hardware and software.
GPIO addons open up a whole other realm of possibility, i.e. wifi modules for creating rogue APs for sniffing passwords