Is The Flipper Zero Useful For Anything?
ฝัง
- เผยแพร่เมื่อ 1 พ.ค. 2024
- I've been hearing about this little gadget for a while and decided to try it out. This is NOT a sponsored review by the way, I bought this myself to see if it would be useful for any of my projects.
So far I'm kind of disappointed with the thing. It does a bunch of stuff... sort of... but I already have single-purpose gadgets like a frequency counter, microchip scanner, and RFID reader/writer that work better. The radio module also seems inaccurate and somewhat restricted.
For all the hype around this thing, I can't really think of a practical use for it! Let me know in the comments if you have any ideas (legal please :-) ).
Saveitforparts t-shirts and other merch at saveitforparts.myspreadshop.com/
Join this channel to get access to perks:
/ @saveitforparts
Or support me via Patreon at / saveitforparts - วิทยาศาสตร์และเทคโนโลยี
"To use this tool as a hacking tool, you must first hack this tool"
consider it as a litmus test
You need to run custom firmware on there. This will open a whole bunch more.
Which custom firmware? Or are you suggesting he write his own?
@@3nertiaroguemaster seems good. But it depends on the actual usecase.
@@tripplefives1402 That knowledge is a bit intricate for such a device lol
@@jboomhauer Thank you!
@@3nertia RougeMaster
I work as a general contractor, my Flipper has been one of my favorite tools I have ever owned. A lot of my clients live in gated communities, apartment complexes, etc. Being able to get in and out of these communities with a pushbutton is one of the most pleasant feelings in the world, that is all. No memorizing codes, don't have to do shit, I can even open some of my customers garages if they ever need me to. Of course, I have to program it first, but it takes seconds
Yeah I use my flipper more for convenience than some Project Mayhem type of stuff. Save a lot of day to day/ week to week key fobs and what not to it. Instead of having to keep up with the office key, the gym key, the parking garage key, the gate code, etc. I just pull out the flipper and use it. Also, flipper nerfed a lot of their features so this thing wouldn't get banned in more places. You can somewhat 'jailbreak it' to access a lot of these gate codes, and even get a full library of remotes without having to program any.
Additionally, I think the BadUSB is cool, but that can definitely be where the real hacker stuff comes in. I played around with a few scripts, and stopped. You can download scripts to brute force laptop passwords, and a bunch of other things. I really think the makers wanted to downplay it's capabilities to avoid getting banned. Still more powerful tools out there, but it was limited to what it can do out of the box.
T
I'm a contractor/electrician. My job is similar to yours any tips or can you point me in the right direction as far as what could be useful? I just purchased one based on your advice.
Hey man, I use my flipper for opening my gated community gate, but I cannot for the life of me figure out how to program it as a garage remote. What steps did you take? I have the Rougemaster CFW if that helps
@@TummySausage the problem is most garages have "rolling codes" which you should look up, its probably why you cant do it on yours
Quick note about recording the car fob: If your car was close enough to receive your keyfob at time of recording then when you replayed the keyfob signal the car will reject receiving that signal a second time. This is thankfully due to most cars having a "rolling code" that changes with each button press which prevent replays... usually.
my car has a rolling feature. you insert a piece of brass in to a specially shaped hole and roll the brass forward via it's attached miniature handle.
@saveitforparts - You might retry recording the fob activation when you're a far enough distance away from the car.
Or if you can put the fob and the Flipper in the equivalent of a Faraday Cage / metal box when you activate the fob, that could work too.
Or you could use another radio very close to your car that would jam reception of the signal, but not trip up the Flipper.
It's called a "rolling code" system and lots of RF-based systems use it. Every time you use the fob it moves to the next code in a pre-programmes set. The car remembers which code you used last time and only opens if the code you send is in the next X codes in that list. If not, it doesn't open. In fact if you play with your keyfob too much you may move the fob to a code outside of the expected set of codes of your car and you'll have to re-sync the fob to the car.
So yeah, moist RF systems have ptotection against these simple replay attacks.
This can be used for a denial of service attack because if the car computer reads the same (cloned) signal/code coming in a second time, it assumes it is an attack, and locks the remote fob with that ID out. The physical key will still work, but the owner will have to get the key fob re-synched at the dealership. This can get annoying fast for obvious reasons.
@@vinny142 Its probably less of a list and more an algorithm that manipulates an initial seed value in a programmatic fashion. All the car needs is the same seed value, and with unique seed values your fob wont unlock someone elses car.
iButton is not actually some Apple nonsense! It's a one-wire communication protocol used in a lot of older security keys and even as a transit pass in some cities! It also goes by the names "touchmemory" or "dallas keys".
We use iButton to identify drivers and road tankers at a fuel loading facility in Australia. I’ve been wanting to try storing all my iButton ID’s on the Flipper because every time I swap tanker trailers I need to use the associated iButton - if I have them all on my device they’re effectively a backup (or spare) of the original. The only problem being using the device while at the gantry goes against all the safety protocols for the safe loading of flammable liquids😢. I could probably use it at the automatic security gate at the entrance and exit of the facility though.
Yup, Dallas 1-Wire. That's what the contacts on the back are for.
@@inothome any idea if I can connect and read iButton thermometers? would be a great application in my science projects...
@@twocrowsdown good way to get fired and tossed in prison.
yes@@spot1401
The separate on and off buttons are quite helpful for professional A/V situations where you might not be able to immediately tell if the projector has turned on or not. Instead of just telling the projector to change to an ambiguous "the opposite of the current state", you can specify exactly which state you're looking for.
The result is that you can just spam the power button without needing to worry that you're turning it on and off and on and off and on....
A lot of people do not understand RFID. These devices do not transmit data unless they are in close proximity to a reading device. which briefly powers them just long enough to send a packet of data. I think you could probably do the same thing with NFC reader software installed on any modern cellphone.
I don’t think most cellphones do 125kHz rfid, only the 13 MHz “NFC” stuff
@@jeremyloveslinux Correct
My workplace uses NFC tags for security when they do rounds, and I can confirm my phone could easily read them, and likely could overwrite them rendering them useless. I use NFC tags at home so I had an app already for that.
@@theussmirage NFC is not RFID
Near field, though I suppose "near" can be relative
I want one largely to just use as a GREAT “universal remote”. No messing with button pressing/holding, just a nice GUI and it can control all the stuff not just IR devices.
There are *much* cheaper devices for that, like anything lilygo makes.
The flipper zero is kind of very overpriced for the features...
@@VynVdragon I agree but to be fair I have a flipper and the online repositories people upload of all the different IR brand and model controls for a big variety of equipment beyond just TVs and projectors or whatever. Sadly I live in the U.S. but Ive always wanted to mess with those A/Cs that are popular in Europe you know the white rectangular ones mounted indoors with the compressor mounted by the window outside. You could make everyone’s day by increasing the intensity of some AC in a very busy hot supermarket lol be a saint but yeah otherwise there are a slew of universal remotes that exist already including ones with much much stronger IR blasters than the flipper has (I have one myself obv I know it’s not that strong of a blaster) so you can do the actual funny stuff like turning off neighbors TV from two houses away or whatever I remember one was literally sold for that purpose I think it was called TV B Gone or something lol
For a good ir remote hardware buttons are a must.
@@Cowloverdude there's a bunch of software options to upload to esp32 and esp8266 for remote IR too
lol I just want to use it to pirate amiibos
In my time with owning a flipper, I have realised that it doesn't do anything that other devices can't do, the only advantage is the tint size. All of the issues thst you have mentioned can be avoided by downloading a custom firmware, I use flipper unleashed. The main downside of the flipper is the lack of power, it often struggles with range and suchlike. I plan on making some external modules for the most often used modes. I see it in the same way that you said, as a multitool. It does the same job as dedicated tools, in a more compact size profile but not as well
I look at this flipper thing and it reminds me of the bygone days of PSP hacking. Back then you had firmware, flashing and all the cool software people came up with on forums you could even access through the PSP's internet Tbrowser. The fat PSP came with an RFID sensor which made it ideal as a grabber for remotes; I had the AC remote hotkey'd in, as well as the school projector remote :D
IRshell?
@@fuchsia4326 kids arent playing with retro handhelds bro and powkiddy is one of the worst kinds you can get
I think you mean Infrared transmitter/receiver. Not RFID.
The fat psp was my drug😂 after it i started softmoded so many mp3 and phones. Work machines/cameras/networks/printers/vehicles/forklifts its considered geeky asfuk so no one cares if u do it…..all thanks to psp ❤
Unfortunately, I got into the hacking scene a little later, when the PSP 3000 was released.
No Pandora battery, and basically had to wait for Pro CFW or others that were released, like Cold bird's (Thefl0w) stuff.
No infared on the 3000, but I did get a 1000 later on and gave it to a brother of mine. I don't remember if I was able to get IRshell to work. 😞
It did not lock the car because vehicles and keyfobs use a synchronous rolling code. The car and the key have a seed value stored in them, and whenever you send a command such as lock, unlock, etc, using the fob it uses that seed value and then they update the value internally. By recording the key fob you are replaying an old value. So the car wont listen to it. You need to do whats called a Rolljam attack which will prevent the car from hearing the keyfob while you record the value.
Buyer beware! This can disassociate the fob from your car and you need to manually reset the rolling code inside the vehicle in order to reassociate the key fob with your vehicle. If your car doesnt allow you to do this manually you might need to have it taken to a dealership. Its not such a problem if you have a metal key in addition to your fob. If you are entirely pushbutton though as many modern vehicles are...
You wont be able to drive your car. And thus you will have to have it towed to a dealership.
If it's push-to-start you can almost always hold the fob to the button and it will read it using NFC (or something similar, not sure) to allow you to start the car. This is mostly meant as a way to still be able to start the car if the fob battery dies.
You are correct and I just want to say that there is a workaround for this basically it's just an algorithm and a process of figuring out the hex table wildcards. But like a lot of things it wouldn't be responsible to post exactly how to do it.
it's amazing how many "keyless" fobs have keys hidden in them. I couldn't believe it the first time someone showed me my fob had a really stripped down tiny key inside it. Push button start just needed the key to be in car, even when dead.
@@samdunn717 those physical keys are for the door/glove box. There's no ignition to insert them into. It'd be cool if there was though.
I really appreciate your perspective on updates. On one hand, not updating some things has the potential to leave the user in a vulnerable state. On the other, it can (and often does) strip away features, or add things that benefit the manufacturer and not you. Even if it's just increased data collection that takes performance/battery life away from you. It's something worthy of consideration and discussion in my opinion.
RSSI = "receive signal strength indicator" in dB relative to 1 milliwatt (0 dB is 1 milliwatt on the antenna). Typical lower receiver sensitivity is going to be from -90 dB to -120 dB. It looks like you can set a threshold of when the device will start recording as sort of a squelch feature.
Thank you
If you ever decide to automate your home to manipulate your projector, you will be very grateful for its discreet On and Off signals. Toggling power is hard to program around since you have no guarantee of starting state.
Thanks for your videos.
I have the Xtreme firmware on mine and have tried it on multiple garage doors, at least two of them could be opened after capturing the signal once. They both had a vulnerable rolling key based protocol. The IR functionality can be both fun and useful. I've used it to turn on the TV when I can't find the remote in hotels etc. I was also able to clone some access cards, for a gym for example. Some of the GPIO apps are nice too. The signal generator and apps for testing various sensors. Bad USB is very nice in a penetration test scenario. If you get one of the WiFi addon boards you can also do de-authing and some other stuff. A lot of people (including my kid) have been lead to believe that this device can "hack" anything. Mostly because of fake TikTok clips. But it's a great device with lots of features. My girlfriend has played way too much Tetris on it as well. 😄
I remember one of my friends got one of these and started testing it out with Flipper Unleashed... he then proceeded to accidentally change his AC unit from Fahrenheit to Celsius, couldnt figure out how to change it back, and then sold it to one of his uncles friends 💀
Did you just do a CAT scan?
😂😂😂
Also badusb is keyboard emulation to inject a payload, for malicious or prank purposes. Custom firmware adds BadBT which does the same thing to affected devices without even needing to connect physically
Missed a lot of features and got a few wrong, but it's a fun tool and might take weeks to really discover its capabilities.
I use mine as a vault for all the RFID cards used to access different locations I service. If I visit a location and they loan me an access card I just clone it and give it back or generate one on fly and add to whatever system they use. It also came in handy to re-purpose some ioProx cards that we were originally going to throw out because we moved to an HID access based badge system.
Unleashed / Xtreme / Roguemaster... You wont be disappointed.
I haven't tried anything but the Xtreme firmware.
Most of the biggest names using the Flipper Zero seem to run Xtreme.
I don't think there's anything there others do that Xtreme doesn't.
They update it all the time to the latest abilities.
Fun fact : using an ESP32 you can transmit at 433 MHz, using the "LED controller" LEDC peripheral.
You need to set the frequency to 33.875 MHz and the resolution to 1 bit using the ledcSetup function.
You can then transmit by toggling the PWM between 0 and 1 using ledcWrite.
Of course it transmits a whole bunch of harmonics at frequencies it's not supposed to, and one of them falls close to 433.92 MHz.
Using a short piece of wire it can transmit up to 10 meters.
Fresh out the box flipper software is very minimal but when you install either of the 2 popular custom firmwares then all those restrictions are gone and the world is your to mess with
How would someone do that?
I've got this device on my wish list, for no reason other than it seems fun and cool. I'm no criminal. I have researched it somewhat (watched youTube vids). You are going to get tons of great advice from actual users, so let me just ask that you please do an update soon!!!!! It was frustrating to see your results when I had seen others do some spooky, cool stuff! I have never seen weather satellite photos from junk before, so I have complete confidence in you, dude! I really love your channel!
I keep hearing that the "other" firmware options are better, but also that TH-cam gets twitchy about videos with that, so if I jailbreak it I might not be able to show much of that :-P
@@saveitforparts without update your review feels unfair.
Of course, you may not have known how to use this device correctly before.
But now you know.
Yeah roger that.@@saveitforparts
@@sdjhgfkshfswdfhskljh3360 it's his video! like who tf are you to tell him it's unfair? how about you make your own "fair" review and publish on your own channel..
@@dagfinissocool He's a guy with an opinion. Like you, obviously. Now quit being a dik.
I'm a A/V technician, I mostly use the flipper to emulate different IR remotes so I can have all the remotes I need in my pocket. I also think the rubber ducky USB scripts are immensly powerful and usefull. Imagine having to change say the network config like ip and submask on 5 different machines or download a bunch of software that you need on multiple machines. Even tho the option is called bad usb, for me it's a really neat timesaver
If this guy can hijack a russian satellite's images with an antena made of literally trash i'm worried about what he can do with a flipper
Luckily he only uses his powers for good not evil.....
He didn't hijack anything the Russian sat was transmitting for all to see. :)
@@johnblanchard8601 as far as we know
Freedom>metric....I trust him 💯
I sense a new era of Save It For Parts on the horizon 🌙
The reason is didn't let you save and replay the first garage door code is that it recognised the protocol as being from a device that uses rolling codes.
The dev team are paranoid about causing desynchronization issues between existing keyfob and reader (both for cars and garage doors) so they've made the choice to block the send. It's definitely not a government imposed decision. On the plus side this means your garage door is immune to replay attacks.
The second garage door is FCC regulations - in the US there are some garage door openers that operate on a licensed band. Only devices made by the license holder can transmit there, so the Flipper isn't legally allowed to. Unfortunately, this isn't respected by chinese equipment manufacturers, so many of them work in the same licensed band. Flipper is under a lot of scrutiny, so has to really follow the letter of the law.
Nothing is respected by Chinese manufacturers lol
Is there a custom firmware that can unlock the ability to receive & transmit on those licensed frequencies?
@@Corn0nTheCobb The stock firmware can receive on the frequencies already (it does detect the garage door opener after all). Transmitting would be breaking the law - the license to transmit on those frequencies is attached to the device, not the operator. I won't help you break the law, sorry. Lobby your representative or the FCC to open up those frequencies.
@@HaralHeisto I know, but it's not a law I care about. I understand though. Thanks!
Use the dark firmware. It gets updates almost weekly, and opens up a lot.
Better than Xtreme?
@@CowloverdudeI recommend rogue master
RM is a joke @@ObedianceClearlyWins
ibutton is like a coin cell looking thing that runs Java, I believe. Used in apartment complexes as door keys, sometimes. inside the ibutton is a small computer and when you press the button up against a receptacle there's a challenge/response thing over a 1-wire protocol and if each half gives the right answers to things then (in the case of an apartment complex) unlocks the door. Sun Microsystems even made rings with built-in iButtons. Still commonly used, I believe. Definitely not apple.
Back when I was a steeley-eyed security dev, I had an iButton ring. It was too small for me, though, so I wasn't in the habit of wearing it. I remember McDonalds used iButton fobs for employees logging-in to the sales terminals, back when iButtons were popular.
My local driving range uses a iButton fob to get balls from the machine
iButton uses the 1-wire protocol and is based on the javachip/javacard API, the same chipset and APi that still powers billions of smartcards. At JavaOne 1998 Sun introduced the JavaRing, the original setup provided in the SWAG bag that plugged into a reader that sent a REST request to a server that lit a pixel that represented you in a giant mosaic that was supposed to gradually appear in a large overhead screen. I remember hacking those requests so they had to shut it down and actually implement the security protocols built into the ring. Still have that ring somewhere. Ah, memories.
Its actually an embedded subset version of Java called the JavaCard API that runs on the JavaChip architecture. The iButton implements security protocols in JavaCard and also includes tamper resistance that zeros the stored data if physical or electromagnetic tampering is detected.
Dude! I've had mine for a few months now and I love it!
But I'm also the guy who bought a Cat S61 for the upgrade.
As an old Radiohead, this thing has got all kinds of abilities.
I use the IR for my window shaker!
Great for figuring out what your transmitting at too.
It can't spoof rolling code systems and other high security.
That was purposeful in the design.
The GPIO can control any small device similar to PLC.
I didn't know it did pets!
You were looking at every BT, Cell or other wireless device around.
It will save a list over time for you.
You can physically hunt them with RSSI. Fox and hound style.
I'm sure one of your little parabolics will do the trick.
RSSi is the line at the bottom. You raise it to filter out nosier/weak signals.
You played the noise back to the car!
You need to hack the region settings. If you want play that way.
The reason why it didn't work on your car is because of the implementation of security on modern car remotes. When remote locking first started appearing replay attacks where very real and a huge problem, someone would sit in a parking lot wait for you to lock or unlock your vehicle then modify and or replay that message gaining access to your vehicle. These days however there is a small security algorithm running on the fob and on the vehicles computer creating a rolling encryption key that keeps changing every time you use that fob, it has to match with the vehicle computer, otherwise it just ignores it.
Its still possible to "replay" but it requires you to reverse engineer that algorithm, and run it at the same point as it is currently in the vehicle you are attacking.
You can use the Ir remote with your camera. Upgrade to one of the non hindered firmware for a bunch more features.
It didn't unlock your car because your car is using rolling codes. If your keyfob is near the car, the signal you recorded is burned and invalidated after the first use. You would need to jam at the same time. For a real test, record your fob in a daraday cage or far away from ypur car and then replay it. Chances are, if you fet the recording right, it will work. This attack is known as RollJam and I have a Python script I developed myself to do this on my own car and garage opener.
If you go to apartment complexes or gated communities, their gates usually do not use rolling codes. So, you could sit there and record when someone opens the gate and then have permanent access. You can do that very easily with a FlipperZero. A car requires a little more prep, but mot impossible with a FlipperZero.
The RF "core" of this device is a TI CC1101 multi-mode RF transceiver chip that "understands" several different modulation standards and (I think) protocol/coding standards. It has an RSSI output, and can scan the tuner fairly quickly, so you can use that as a scanning spectrum analyser with a fixed RBW. It's not really an SDR in any meaningful way.
This is like the script kiddy version of an SDR. Great for emulating stuff someone else has already figured out, but a real SDR and a full fledged suite like GNU Radio is a million times more powerful, but you need to know what you're doing, not just press a few buttons on your tomogachi dolphin
David Beckham's car was stolen i think 4 times using a key fob playback device lol. i love that the flipper is making RF hacking so easy because now manufacturers are being forced to upgrade their security
Highly recommend the unleashed firmware - one day at work this device saved me twice, first as a keyboard and mouse to interface with a headless computer and second when a TV I had to configure had a broken remote and I was able to download codes and even customize a page to quickly interface with it.
They ship them nerfed to appease regulators. Better firmware will enable more functionality.
Also: most cars and garage doors use rolling codes these days. It's much harder to crack than just playback.
This is a truly beautiful handy device; I haven't seen it described in such detail before; it's a Swiss Army knife.
The custom firmware will do the garage opening and counts on what your car uses if your car uses rolling code then you’ll have to record the remote being outta distance from the car
I would love to see a follow up video about putting custom firmware on that bad boy!
I keep hearing that the "other" firmware options are better, but also that TH-cam gets twitchy about videos with that, so if I jailbreak it I might not be able to show much of that :-P
@@saveitforparts you don't have to say you jailbroke it, you just "updated the software". It would be nice to see all of the capabilities of the unit without restriction since its a pain that you payed for the device and cant use all of it. also I wonder what you can add to it through the gpio pins.
Yeah, but some Karen will get upset and then report the video. He doesn't want a take-down notice...
Thank you for the video, If I had watched this sooner I may not have ordered one but i'm sure I will come up with some project to take advantage of it!
“Received Signal Strength Indicator,” is a measurement of how well your device can hear a signal. In other words, RSSI is a value for determining a good wireless connection.
I can tell that this is not a sponsored review because you got the right answer.
I got this primarily as a more convenient Proxmark alternative. Those alone are very expensive, the one I have has become increasingly finicky, and I’m left preferring older versions of the software. The antennas in the Flipper have generally been a lot more consistent than other hardware I’ve used in cases where I’ve wanted to clone a work badge to the 125kHz tag I implanted in my left hand, or some other seemingly simple operation.
I’ve also found some novel applications that I won’t share here c;
Novel like?
I’m honestly so curious how you got that tag implanted in your hand
what Implants do you have ? What do you use the flipper for with them? I have 9 of them all from DT .
So this would be a gr8 back up for personal back ups if you lock yourself out of a car , house, office. You can save all your personal info.
I've used this to test the RFID blocking claims of wallets and be a backup/secondary remote for all kinds of things at home.
You are very kind to go out and buy a microchip reading tool just to help pets get back home. You are now number 4 on my list of good people
who are the other 3 ?
@@ZVEKOfficial Bill Gates, Johnny Depp, and Hitler
Flipper definetly needs custom firmware, there's way too many restrictions (but you know gotta keep it legal by default)
Doing a replay attack on your garage door should have been the easiest thing ever
It's just a CC1101 chip inside for the radio, that's what you'd use on any micro controller based project that needs to transmit and receive below 1ghz
On a side note you can actually do NFC and IR stuff with any rooted android phone that has an ir blaster, so flipper is only good for RFID and SubGHz radio imo
Interesting.
This is the entrance to a deep rabbit hole that will have to wait a bit because I have too many pots on the stove.
But, down the road yea, I'd like to experiment a bit which is where all the fun lay.
5:32 you could've save the chip data and then emulate it back and use your halo reader to show if it shows the same thing.
I would bet the iButton feature is referring to the little fobs that use the 1-Wire protocol over physical contacts. It just sends a simple ID over the bus. Probably could use the GPIO to read one of them.
it would be good for an IT team for small orgs needing to test physical security.
I suspect the whole Flipper branding is an homage to the Cyber-Dolphin in Johnny Mnemonic. (The cartoon even looks similar).
It goes back even further to a 60's tv show 'flipper' about a boy and his dolphin.
I love the vibe of the flipper, too bad its very restricted
Restrictions are easily removed, that is not a problem.
12:33
"This one tells you not to do anything illegal with it. Yeah, Okay."
Can you tell if the spectrum analyzer feature would be at all useful for detecting/locating EMI problems?
probably not as well as a dedicated unit could
Yeah it didn't seem very accurate for the frequency, so IDK how good the receiver is.
The way you open boxes with knives, one would think you really don't like your Thumb! , that made me anxious! 😯🤣🤣
I use this device as my backup garage door opener as well as my IR remote for my TVs and my Xbox one.
i jusy purchased mines mainly for work so i can have gate access because it takes forever to get front desk to open the gate knowing they walk away from the computer. plus I'm definitely going to get the jailbreak firmwares to fully unlock what this thing can really do
I'm looking into buying a used one to save some money, thanks for the video!
Nah bro, the Flipper Zero is absolutely worthless - which is why you should send me YOURS 😎
amazon keeps recomending this device to me but i know next to nothing about any of this. thanks for the info in the video
This is what the internet was actually made for. Straight fax and no useless "MAKE SURE TO LIKE AND" that is 20% of the video.
Fax?
Who is more powerful in terms of hacking? I'm well-versed in Raspberry Pi 4 been wanting a Pi for the longest time. First time hearing about Flipper Zero.
You are right. These are good for those of us interested in ethical hacking.
used to have a xiaomi phone with ir... was super fun to mess around (it's fully controllable with java apis)
Do you think you could use it as a code scanner for the ecm/ecu on an automobile?
You wouldn't buy a 200$ device to check car codes.
@@garypinholster1962 Yeah, I looked it up. I thought it was like a tamagotchi or something around 15 bucks.
In the case of trying to capture/emulate signals from specific frequencies you would want to raise the rssi to get rid of unwanted noise the biggest reason people can’t get these to work is because we live in a world of satellites and fm radios in every car you will almost always have some sort of egress, specifically in this video he demonstrated that his flipper was picking up stray signals definitely coming from a Bluetooth device. In all honesty it depends on the device: you won’t see a key fob putting out 8db of signal so it’s kinda hard to judge what levels something should be coming in. Also a great time to learn what frequencies are what so that you don’t go messing around the LTE bands or cause your neighbor to lose his direct tv channels. Clearly you won’t be blowing any telecom nodes with a flipper BUT a hackrf one maybe
My remote starter for my car works but car stopped responding recently. Key seems fine. Can this help?
"I'm gonna set this to freedom units"
@15:19 Can i find individual RC frequencies from a toy rc car with this device? Or what do you recommend for this? I have the original remote controller, i just want to find and duplicate the channels so i can program a different controller. Any advice helps
I'm not sure, I haven't tried that. The old RC cars were always on some CB radio frequency and used crystals, but I think the new ones are closer to Wifi.
Can you attach a larger antenna or dish to it?
You absolutely can, although its internal battery might not be big enough to actually drive the antenna to its full capacity.
I'm almost 50 and it is one of the coolest toys I own. I can do SOOOOOOO MUCH with it!!!! Think of it as a learning device. If you want to "get into something" you have to learn how it works (ie. codes, frequencies, types of communication, etc.). My flipper can control every IOT/smart device in my home, although I haven't tried my X!-C or my Phecda...yet. I have a new thing where all of these assholes in cars on their Iphones now have an endless amount of bluetooth spam courtesy of the latest IOS exploit. These things with the right GPIO boards have some serious potential for......
This "toy" as you call it, is a a very compact pin-testing tool, pretty much unlike any out there. Between just the Marauder or Evil Portal firmware options with the ESP32 GPIO, you can get wifi passwords, or even logon and passwords for many big name services like google, some airlines, etc., and that is just that. The BadKB/BadBT are both funny and frightening. Some of them can DESTROY your system, steal your info, etc.. Others are great if you like Rick Ashley.
You should be able to play back the blocked frequencies with custom firmware
Which custom firmware?
@@3nertia another commenter said unleashed-firmware on github
@@3nertia unleashed firmware disables the regional frequency blocker
@@3nertia I run RougeMaster.
@@irontoe9001 Unleashed how?
This thing is pretty neat as and idea at least, kinda reminds me of something a punk anarchic netrunner from Cyberpunk would pull out and hack into a secure corpo van full of tech
oh i know exactly what those spurios signals were lol. thats what got me started on this whole path is when i hooked up a receiver and found out we are all getting bathed in these signals. 1 is going to be your power most likely. 2 is going to be some other company meter. If you have any weather stations about that was also one of those range of signals. I can track everyone in my areas water and gas as its all wide open and being broadcast.
A lot of electronics over the last 20-30 years have gone to rolling codes to defeat these replay attacks. I have low confidence this can work on cars or garage doors.
right, this is more of a skid device for petty attacks
You can't do it on its own. You need another device to stop the receiver and then send the codes if captured correctly. It's not for the faint of heart and a beginner wouldn't be able to do it.
Honestly its primary use for pentesting in my opinion is to clone low frequency RFID access codes just as phase 1 of an intrusion. This obviously can be done with many other devices, but the flipper zero is just so cute and fun! I mean just look at the amber LCD.
@@olso8621 There's advantage in clandestine devices and low level attacks, but the window of insecure devices, specifically for replay attacks, is so small. IMO it's better to focus on things that are less entertaining but incredibly insecure. Like tracking specific vehicles using their tire pressure sensors.
Get unleashed firmware and some GPIO hats and you will find this tool far more useful. I use my flipper every day, at home, work, on the go, etc.
i button is an authentication protocol that has nothing to do with Apple. It’s a round button style device. I have one for my company vehicle that needs to be authenticated every time you start the vehicle so that it lets the owner know when it’s being driven and also where it’s being driven. Edit… it looks like someone’s already answered this in a post already. Sorry for the redundancy. Enjoy your videos very much.
I think it allowed you to clone the keyfob because you need to have it very close to read it, and it is NFC like device, so it will not work at distance (at least not with very specialized equipment). But garage remote could be picked far away quiet easily, even without extra antenna.
maybe, you can use the gpio/usb (?) with raspberry to use the flipper as a "sensor unit" only ?
hey could you test out the iflipper ive been contemplating getting one but idk if it actually works
Looks like it is easy to upload a 3rd party firmware to these. Region lock out due to big brother. 3rd party unlocks a ton more options. You should update us once you have done that upgrade.
I would love one of these and might eventually get one, just for the pentesting value of it. I also hate having like 11 gadgets to have to haul around...
Have you tried custom firmware like Xtreme to unlock features like replay or add new features? It would be a neat follow-up video
I haven't tried that yet. It's on my to-do list but I don't think I can show it on TH-cam!
@@saveitforparts aw man. You'd think it'd be no different than a Kali Linux video by Network Chuck or something
How did you get the password generator and the DTMF stuff?
They were on the Flipper store on the Android app.
@@saveitforparts Oh. Thanks
A bad usb is where a hacker can hack a computer or anything with usb, it make it think its a wired mouse or keyboard
Can I scan radio frequencies (2m-70cm [144-148MHz and 420-450MHz respectively]) and their sub tones for UHF-VHF radio programming with this gadget?
Donny's cat hair around 6:40 made me think you cracked the screen for a second! I'm so glad you picked one of these up and I can't wait to see what all you do with it in the future. Picorder! Also, maybe change the region or spoof the region for the transmitting tests. Can it run some vpn or anything? Thanks for saving me the money!
Oh and , "hi" to @Dijitalpanda
A couple people have suggested alternative firmware, but also mentioned that it becomes... less TH-cam-able once it's no longer FCC-approved :-P
@@saveitforparts Dude get real. People make youtube videos all the time with custom firmware Flipper Zeros. I thought you were the guy who hacked a Russian satellite. Here's an example. th-cam.com/video/iBT37ZHMFRI/w-d-xo.html
All I've gotten to work on this thing is the customer service announcements at Lowe's. I tried the gas station sign changer which didn't work. The garage door opener didn't work (rolling codes) That's all I've tried so far.
the flipper is a collection of hacking tools it also has gpio, gpio is the pins its basically add-ons such as esp32 wifi devboard
I want one myself, I just don't have the funds - maybe in a couple months. Great channel btw
There was a good article about Flipper Zeros in 2600 magazine earlier this year. If you are ever in Anoka, I will buy you a beer.
What model of the phone do you use, and what brand is the case on it?
My regular phone is a Pixel 4, with an Otterbox case.
You can load custom firmware to unlock it, but I do not recommend you record yourself using it for things that are region locked.
I keep hearing that the "other" firmware options are better, but also that TH-cam gets twitchy about videos with that, so if I jailbreak it I might not be able to show much of that :-P
@@saveitforparts Use code words and sarcasm...
@@saveitforpartsNot true.
By & large the best firmware is Xtreme.
There are dozens of videos with that firmware.
The latest "Apple hack" videos all have the Xtreme firmware on it.
I have Xtreme & they've unlocked so the shit that matters.
Does your garage door use a rolling code? That might be why the flipper isn't willing to play it back
Also I got the technology mixed up- rolling codes are easy for systems to learn- then there's Homelink and one other system that may require programming or learning
6:25 I have a problem with spurious emissions too 😢
7:38 there’s no point in trying to unlock a modem car as the key changes at random, older cars older than 2008 or 2006 will unlock.
9:04 stock firmware is locked down, Unleashed firmware is the best IMHO
Suspect any RF dongle uses a random number generator & any NFC uses public key cryptography, so it's not going to do much. The amber LCD looks neat though. Would be nice to interrogate a credit card with it. A lot of us are having our chip cards suddenly die with no way to diagnose it.
NFCtaginfo by nxp semiconductors installed on a cellphone is good for contactless bank cards. One of my old issue bank cards several years ago was allowing me to read the card number and my name with no security. Thankfully my bank has switched to a more secure card now.
great review. thanks!
I think if you're a techie teenager this is a fantastic way to get you going, would've loved this when I was 14 haha
It is a bit scary, but I think it is a good thing. A lot of devices, like door key fobs, garage doors, etc, are super insecure, and poorly implemented. This device will force most manufacturers to finally do some proper handshake and cryptography, do tof ranging, etc, not just fixed signals or ID, which were always easy to spoof or duplicate.