The Canadian government plans to ban the Flipper Zero and similar devices after tagging them as tools thieves can use to steal cars.

The Canadian government plans to ban the Flipper Zero and similar devices after tagging them as tools thieves can use to steal cars.

  • atx_aquarian@lemmy.worldEnglish
    0·
    9 months ago

    “Flipper Zero can’t be used to hijack any car, specifically the ones produced after the 1990s, since their security systems have rolling codes,” Flipper Devices COO Alex Kulagin told BleepingComputer.

    "Also, it’d require actively blocking the signal from the owner to catch the original signal, which Flipper Zero’s hardware is incapable of doing.

    Just politicians trying to appear to be doing something so they can keep their jobs.

    • AutistoMephisto@lemmy.worldEnglish
      0·
      9 months ago

      Yes, but even if the base model hardware is incapable of doing something, someone savvy enough could modify it. It’s the same logic they use to ban AR-15s in some states in the US. By default, all civilian ARs are built to fire in semi-auto only, BUT, a knowledgeable individual can make it fire in full auto if they drill a hole in the lower receiver in just the right spot.

      • atx_aquarian@lemmy.worldEnglish
        0·
        9 months ago

        Good point in general, but, what they’re specifically talking about here (rolling codes), perhaps what they should have said is that no one can (feasibly) do it, not just that their hardware isn’t capable.

        Edit: Oh, for the blocking signal, that part might be functionality that could be added, I see what I think you’re saying there. Still, that would be a step towards it, but it would still require serious hardware to crack a private key, as I understand.

      • gian @lemmy.grys.itEnglish
        0·
        9 months ago

        Yes, but even if the base model hardware is incapable of doing something, someone savvy enough could modify it.

        Which negate the whole point of the discussion.

        If someone can modify it, the same someone does not need it.

    • umbrella@lemmy.mlEnglish
      0·
      9 months ago

      hell yea holy shit, i must have read this same headline at least 10 times now

  • Treczoks@lemmy.worldEnglish
    0·
    9 months ago

    If you can steal a car with a Flipper Zero, then this is definitely not the fault of the Flipper Zero.

  • Shdwdrgn@mander.xyzEnglish
    0·
    9 months ago

    I saw this on Mastodon the other day and started digging into it. Seems like a really cool project although the chip they used appears inferior to the ESP32? I found a few similar projects based on the ESP32 but they seem to be limited to wifi/bluetooth captures only with the possibility of other options if you swap out the firmware. This makes me question why the ESP32 with 4MB of flash cannot do much more than the Flipper Zero with its 1MB of flash and a CPU that runs at 1/3 the speed (or less) and only a single core? Anyone have some ideas, and/or have seen other open projects based on the ESP32 that do all and more that the Flipper Zero can do?

    • zik@lemmy.worldEnglish
      0·
      9 months ago

      The ESP32s are nice chips, but the STM32s are also really nice to work with and will work fine for this task. Changing to an ESP32 wouldn’t make any real difference to the user so the choice is moot really.

      I’ve designed products around both CPUs and they’re both pretty nice. The STM32 has somewhat better documentation, has cleaner low power modes and is a bit simpler when delving into the nitty gritty details. The ESP is more powerful and has some nice if complex features buy I don’t like its low power handling as much.

      Overall I think I’d choose the STM32 for this task since it’s a little easier to make small, battery powered devices with it.

      • Shdwdrgn@mander.xyzEnglish
        0·
        9 months ago

        From the limited reading I’ve done on the subject, it seemed like a lot of power in the Flipper was based around wireless testing (both wifi and bluetooth) although I also saw a number of things based around other bands. I guess I’m just not following why this was considered an add-on when the ESP32 has all that stuff built in already (and you can certainly shut down the radios to save power when you’re not using them)? Plus it also includes native support for other popular busses like I2C, I2S, and CAN so it seems like it could be useful for sniffing out what’s attached to a lot of different types of connections. Maybe I’m just straying outside the realm of basic pentesting, the idea just caught my attention about how handy it might be to have a small device that could work with a lot of different types of electronics.

        • zik@lemmy.worldEnglish
          0·
          9 months ago

          The STM32WB55 in the flipper has a versatile wireless peripheral built in which can be used to implement various protocols including Bluetooth, zigbee, etc… Support for I2C, I2S and CAN is pretty standard stuff - the ESP32 is nothing special in these respects.

          Maybe they chose the STM32WB55 because its wireless support is more flexible than the ESP32 and allows them to implement a wider variety of protocols? Or possibly just better documented, giving them the chance to do things they can’t on the ESP32? I haven’t compared the inner workings of the two chips’ wireless support so I can’t say for sure.

    • stoy@lemmy.zipEnglish
      0·
      9 months ago

      Meshtastic commes to mind, it allows you to set up an offgrid communications network that can mesh with other devices and allow you to send messages through the netork.

    • carzian@lemmy.mlEnglish
      0·
      9 months ago

      You’re comparing a microcontroller to a purpose built device. Its apples and oranges.

      There are add ons to the flipper that incoporate an esp running maurader firmware for wifi tools

      • Shdwdrgn@mander.xyzEnglish
        0·
        9 months ago

        Yeah I saw there was the add-on board for wifi testing, but it seemed like this plugs in externally and isn’t a normal part of the toolkit? So if the Flipper itself isn’t performing the wifi test then I guess I don’t see why the ESP32 couldn’t just add in everything else the Flipper does? All the other hardware I saw, for IR, NFC, RFID, and one-wire connections… that could all easily also be added to the ESP32 with pins to spare, so what am I missing?

        • sleepmode@lemmy.worldEnglish
          0·
          9 months ago

          …the same reason you don’t see Sony releasing every PS5 with a dev board. Of course you can extend the ESP32 or whatever microcontroller to do anything the Flipper can. That’s obvious. Go search around on GitHub there are thousands of projects you can do with the ESP32 that will have the FBI making a personal visit to your house. The whole point of the Flipper is it’s turnkey and makes it easy for people that are less skilled or don’t have the patience to do all that.

    • anlumo@lemmy.worldEnglish
      0·
      9 months ago

      Probably just a matter of writing the right firmware and building the right hardware. I don’t think anything is stopping you from doing that.

      The problem with microcontrollers is that code isn’t easily portable, so this device is stuck with its hardware.

      • Shdwdrgn@mander.xyzEnglish
        0·
        9 months ago

        Yeah I wasn’t too concerned about the hardware side of things, I was just curious about finding software because I don’t really know anything about pentesting. Guess I’ll keep looking around.

  • ryannathans@aussie.zoneEnglish
    0·
    9 months ago

    Lmao how are they gonna word that bill? Sorry guys, if you play with electronics you’re a hacker!

  • just_another_person@lemmy.worldEnglish
    0·
    9 months ago

    Lol. You better just ban all programmable boards then, because the Flipper doesn’t have any special proprietary or differential tech in it. It’s just a clever collection of already existing hardware and software. Someone will just make another immediately. Idiots.

    • Hobo@lemmy.worldEnglish
      0·
      9 months ago

      I don’t disagree with your point, but the flipper zero for sure lowers the bar of entry. Before the flipper came out the, “You must be this tall to ride” required some pretty good knowledge of microcontrollers, hardware peripherals, and software engineering. The people that had that sort of knowledge tended to actually have paying jobs, which is like the biggest factor in not being a street criminal.

      The flipper made the barrier of entry at about the level of being able to operate a TV remote which any dipshit can do. However, the fact that the flipper exists at all means that the cat is out of the bag. As you said, someone else is just going to come along and release a similar product. You can’t just ban the flipper and expect it to have any impact. My concern is they will decided to make certain code illegal, which gets really stupid.

      • ikidd@lemmy.worldEnglish
        0·
        9 months ago

        Barrier to entry to do what? They can’t be used for vehicle theft because you can’t replay attack a rolling code, which is what all vehicles use.

        The current attack is to use a repeater to amplify a fob that’s close enough to an outside wall to hijack and open these “get close enough and the doors open” locks.

      • just_another_person@lemmy.worldEnglish
        0·
        9 months ago

        The Flipper is literally just an ends to a means. An easily accessible action for hardware. Nobody is stopping any random person from buying a number of $3 dongles for their laptop and using it in the exact same way.

        • Hobo@lemmy.worldEnglish
          0·
          9 months ago

          Yes but the flipper requires zero base knowledge to use it whereas setting up the hardware, installing the software, and troubleshooting any issues takes about the same amount knowledge as a helpdesk gig in IT. Again, I don’t think making them illegal does shit. I do think it’s rather obstinate to not acknowledge that the barrier for entry to execute those attacks was lowered substantially by the flipper though.

      • KairuByte@lemmy.dbzer0.comEnglish
        0·
        9 months ago

        Bar for entry wasn’t really that high to begin with. There were already a collection of tools that did the same thing, and could be had for a couple thousand bucks. Yeah, a price point 1/10th the older option is more accessible, but it’s not like criminals are hurting for money just because they are criminals.

        • Hobo@lemmy.worldEnglish
          0·
          9 months ago

          I’m onboard with that but putting it at the level of operating a tv remote really casts a wider net. You essentially have to be barely literate to use the thing, where before you had to at least be able to read and execute some walkthroughs. Also you had to kind of be in the security/tech scene to even understand that it was an option, where the flipper has, for a lack of a better word, popularized the attack.

          There’s a reason that when you go on sites like exploit db well over half of the exploits require some fiddling to make work. Metasploit is similar as well because it requires you to actually be able to use a cli on some level. While that isn’t a huge bar of entry, it’s still keeps the riff raff out for the most part. The flipper pretty much said fuck it, and let not only the skiddies in, but any dipshit with $80 buy a car stealing autopwn.

          • KairuByte@lemmy.dbzer0.comEnglish
            0·
            9 months ago

            I get what you’re saying, but it’s like arguing that hammers should be complicated and/or expensive because they can be used by anyone to break a window.

            These tools are exposing security issues, that’s not an issue with the tool. That’s an issue with the things using the shit security.

            Banning the tool fixes nothing, it’s like painting a rotting fence. The problem is still there, still getting worse, you can just pretend everything’s fine for a short while before it comes crashing down.

            • Hobo@lemmy.worldEnglish
              0·
              9 months ago

              Your response really highlights that you do not get what I’m saying. I’m not arguing it should be banned. I’m saying that acknowledging that the barrier of entry was lowered is at least somewhat of an important factor to consider. Doing it the way flipper did is irresponsible at best, and more realistically ethically corrupt. It’s been done though and you can’t put the cat back in the bag.

              Now governments are trying to ban them, but when 100s of new clones come out I can almost guarantee governments are going to start doing increasingly silly shit to stop it. Do you think that giving every joker a key to any kia/Hyundai is going to lead to governments cracking down on security on the manufacturing side? Or do you think it’ll just give them a bigger excuse to make invasive laws? I’m pretty sure I know where it’ll lead and I seriously doubt it will be leveling laws against the poor old car manufacturers that donate to campaign funds…

    • MakunaHatata@lemmy.mlOPEnglish
      0·
      9 months ago

      If they knew that, they wouldn’t be banning the device instead of going after the car makers to make the cars more secure