Let’s ban a product instead of solving the issue at hand… Seriously? I hate my country more and more as each day passes
While this is seems a bit incompetent, it is easier for them to make technology less available than to fix the underlying issues here. They might set out to do both, but solving the underlying issues will take more time.
At least they’re trying to do the right thing, and they’re making an effort to deal with a problem that affects real people. Good on them.
This is like banning usb cables so Hyundai/Kia cars won’t be stolen, instead of forcing the car manufacturer to just install an actual immobilizer on affected vehicles. Seeing Hyundai/Kia do everything but install immobilizers is infuriating as well. They’re rolling out software updates, giving out wheel locks, installing cages on the ignition panel, etc. Literally everything but fix the problem.
This is like banning usb cables
If USB cables were used almost exclusively for illegal and just generally anti social behavior.
I’d never heard of this thing, and it does sound fun, but this was the use case list from the paragraph calling it a “humble hobbyist device” doesn’t come across as very defensible:
People can use them to change the channels of a TV at a bar covertly, clone simple hotel key cards, read the RFID chip implanted in pets, open and close some garage doors, and, until Apple issued a patch, send iPhones into a never-ending DoS loop.
But also agreed on fuck those car companies that just don’t care and would rather weaponize the government than try to fix anything (without a subscription fee of course). Anti social behavior forced Kia to change their shitty grift of a product so 🤷
exclusively for illegal and just generally anti social behavior.
Except they aren’t. These devices are used for various non-illegal purposes and are actually helpful for pentesters so we can learn about potential vulnerabilities on wireless systems before they can be exploited by bad actors. The same way a usb cable is useful for transferring data and at the same time can be used for illegal stuff (like literally any hack where you connect to a device via usb). The worst part (and the article mentions it), is that it doesn’t even work on security systems on cars built since the 90’s. So they’re banning something that isn’t even a problem in the first place.
I totally get and agree this is a dumbfuck response to the problem they allege to be fixing, and hopefully their committee it whatever concludes the same, but the article didn’t mention any redeeming values for the device as you did
So the article is biased, and you swallowed it whole sale.
How so
This device is probably not what a professional car thief would use. It may be used sometimes by someone messing around, but it’s a tool made for an introduction into different types of penetration (testing). It doesn’t do anything as well as a more dedicated device would, and it’s also not as customizable. If a car is vulnerable to this then it’s vulnerable to a lot more things. Also, if someone really wants to steal your car they don’t need this device specifically.
The road to hell is paved with good intentions.
More like hide the problem so no one knows about it. This is the entire locksmith ideology, security through obscurity and that has been working out great hasn’t it?
I don’t have any faith in our incompetent government to do anything right if it costs corporations money.
It won’t stop theives from being able to obtain them. And it’s a legit tool, should we ban all usb because they can be used to steal Hyundai and Kia cars?
It’s obvious there are flaws to car manufacturers theft protection. Shit watch LPL, lock noob, Bosnian Bill (hope you’re doing well brother) and you will see most locks are a fucking joke.
There are Defcon vids on YouTube that go over how cars can be hacked yet manufacturers are still using these systems
The problem is they are banning a device that doesn’t solve the issue at all except if you have a car from before the 90s. The tools being used for this are custom made with a much larger range. Maybe they should ban smartphones too since people are using them to detect laptops in cars to break into since they are being stupid about it.
How do you use a phone to detect a laptop in a car? If it’s on, sure I get it but if the laptop is asleep or off I can’t see how a phone will detect it?
Most MacBooks keep Bluetooth on when in sleep mode. There isn’t even a setting to stop it, the only option is to manually turn Bluetooth off before closing the lid or to use 3rd party software to automate turning it off.
Article said they were using Bluetooth and a app on play store / app store I assume the app measures the signal strength to determine the proximity to the devices. Maybe some laptops don’t turn off Bluetooth in their sleep state or people just weren’t putting their laptops to sleep? Could pickup tablets or phones forgotten in cars too.
As he said, that only works if the device is on, which would be really odd in a car. I’m not aware of any that keep comms on in sleep, since those are typically high power draw.
There are various sleep modes and it looks like Bluetooth can be active during some of them.
Read everyone, this is hype, and Canada is being dumb on this one.
The Flipper Zero is also incapable of defeating keyless systems that rely on rolling codes, a protection that’s been in place since the 1990s that essentially transmits a different electronic key signal each time a key is pressed to lock or unlock a door.
Most of this reaction is due to staged videos on TikTok and politicians not understanding technology. Maybe they’ll stop a few joyriding kids, but car thiefs aren’t using F0s.
Politicians passing laws based on things they don’t understand?
Quelle surprise.
But also:
a protection that’s been in place since the 1990s
That’s not necessarily a guarantee, c.f. Hyundai and Kia’s lack of ignition locks.
Politicians passing laws based on things they don’t understand?
aka virtue signaling
Another way of saying that is moral grandstanding, which I kind of like better. I like the imagery of grandstanding, especially when describing politicians.
Isn’t it possible for someone to code a code-roller onto the flipper zero app store?
Probably possible but the thing would be running for hours or days to crack the code. That’s not really useful for a quick hack.
With a jammer it’s definitely possible to bypass rolling codes with Flipper, but it’s only temporary and has limited usefulness
That isn’t bypassing rolling codes, that’s capturing a single code while preventing it from reaching the car.
And once the code is used once, or the fob gets a new code to the car, the previously captured code is useless.
This isn’t the same thing as bypassing rolling codes.
It’s pretty difficult, you need to get the rolling code from the fob, but you also need to jam it so it doesn’t reach the car.
Then you have one opportunity to replay the code before the holder of the fob hits the button in range and rolls the code over.
So even if you manage to set that up that only gets you in the car, it doesn’t get it started.
The device only gives easy access to already extremely weak/non existent security systems. That’s literally it.
It’s just something that’s existed forever, but put into a convenient package and marketed well enough that suddenly normal people are realising how insecure their electronic systems actually are.
Kinda like how they used to make pacemakers hackable because they never thought to add any security at all. I bet many of them still don’t.
Anyway, the issue lies not with this device, which can’t “hack” anything with any actual security, the issue is with manufacturers making devices that literally leave the door wide open to anybody with an extremely basic electronic sniffer/cloner device.
Yep you can do the same operations with a RTLSDR (20-40$) and a signal repeater (20ish) and raspberry pi/netbook. It’s somewhat harder to do if you don’t know the software but it really just exposes very insecure hardware. Companies should put a semblance of security and it would take care of things. These kind of devices are everywhere not just the flipper. Flipper just made it a tiny bit more friendly.
Maybe cars should not be so easy to steal… I thought we came to an agreement on this.
I work for a company of under 100 employees in a small city. Our head IT guy bought a Flipper Zero with his own money so he could make sure our building key fobs couldn’t be easily copied.
If this guy can do it, I think the bajillion dollar auto industry can figure out a solution!
A single guy does not have 3 layers of managers and bosses above him, who have “better ideas”, costscutting policies and “i have no idea what you just explained to me, so lets just not do it!”.
If the flipper can help you stealing a car, the flipper is not the problem, but the neglect and incompetence of the car company is.
Removed by mod
Im a security professional who works to harden medical devices. I use the flipper zero to easily test many different protocols that would be a pain in the ass to do “manually”.
The flipper makes it easy for me to verify IR, sub GHz, USB, SPI, and many other protocols while being able to walk around the devices I test.
Without the flipper I could totally do these checks with homebrew tools, a pi and an rtlsdr (unless thats gonna be illegal too?) But it would take me writing new tools and procedures rather than the ease of the flipper.
Anybody in the know can tell you that the hardware isn’t anything special, and like many others have said, its like making a swiss army knife illegal cause the toothpick can be used to pick a lock.
This isn’t gonna stop anybody, if pentest tools are showing flaws in your product, maybe we should send flippers to the car manufacturers and tell them to fix their shit. You shouldn’t be allowed to sell a car that can be wirelessly hacked like this, just like how the FDA doesn’t let you sell medical devices that can be hacked like that.
You don’t just put the cat back in the bag…
Based on your description it sounds like banning the flipper would be encouraging security throigh obscurity
I remember when they had the same conversations about packet sniffers.
Turned out the answer was to use encryption and switches.
My girlfriend has a medical implant for her gastroparresis. How concerned should we be? If that device shuts off, she can’t eat, and there’s only a handful of doctors in the country that can work on it, and the one that sees her is often booked two weeks out
The thing is, if there’s a wireless exploit/hack that can cause “patient harm” the FDA+Health Canada would force a recall the sec its publicly known.
The flipper wouldn’t be the only thing able to exploit it, anybody with a radio and some software would be able to. It just so happens the flipper can also do it cause its a swiss army knife and has a general purpose radio.
Generally by the time an attack exists on the flipper, its already been mastered on laptops and raspberry pis and stuff, putting it on the flipper is more to make it available to test easily without having to lug out the laptop. Nobody is inventing new exploits for such underpowered hardware as the flipper. People are porting known exploits to it.
I can’t say how concerned you should be, but this won’t make her any safer than before, equal risk. Just as likely someone with a laptop in a backpack doing that. We don’t make laptops illegal tho.
What I would be concerned about is the idea that the company that makes the implant would not be able to easily test for issues in the implant with such an “illegal” device. Yes they could use a laptop, but you don’t use an xray machine to find a stud, you use a handheld studfinder cause its cheap and easy.
Hope that helps explain a bit
canada just streisanded me into obtaining one of these. i cant wait to play with it
even in its anger, canada helps. thanks!
"It is unacceptable that it is possible to buy tools that help car theft on major online shopping platforms.”
I can buy a hammer and screwdriver online, and those could be used for car theft. Does that make those also unacceptable?
They’re also really good at murder, a much more serious crime.
While we’re at it let’s just ban all metal cutlery, just to be on the safe side.
Go then champ
Removed by mod
I guess you haven’t seen all the TikTok videos of kids steeling Kia’s with nothing but a USB cable (used to turn the ignition, not anything digital).
To be fair, it doesn’t work in Canada because immobilizers are mandatory. They really love their cost cutting in the US though…
