Decoding Flipper Zero: The Swiss-Army Knife of Hacking Tools

WEBVTT
00:00:04.910 --> 00:00:18.126
You are listening to the audit presented by IT Audit Labs, where we offer a well-designed framework, tailored to your specific security needs, that will reduce organizational risk and improve security posture.
00:00:18.126 --> 00:00:24.272
I'm Eric Brown, managing partner at IT Audit Labs, joined by security engineer Nick Mellum.
00:00:24.272 --> 00:00:42.871
Today, we will be speaking with Cameron Berkland to learn more about Flipper Zero, a portable Tamagotchi-like tool developed for interacting or hacking control systems like RFID and NFC tags, radio remotes, eye button and digital access keys.
00:00:42.871 --> 00:00:50.207
Okay, hey, cam, how you doing?
00:00:50.207 --> 00:00:51.823
Doing good?
00:00:51.823 --> 00:00:54.939
Thanks for having me, absolutely so.
00:00:54.939 --> 00:00:57.064
You and I know each other here.
00:00:57.064 --> 00:00:58.908
Going back, has it been what?
00:00:58.908 --> 00:00:59.811
Three years, cam?
00:01:00.740 --> 00:01:02.207
Yeah, it's been about three years now.
00:01:02.899 --> 00:01:21.180
Yeah, so Cam and I worked together at a couple of clients and I met Cam there and while Cam was in college as an intern, and then Cam came over and joined us full time at IT Audit Labs.
00:01:21.180 --> 00:01:24.329
Has it been about four months now, cam, maybe longer?
00:01:25.341 --> 00:01:28.090
Yeah, it's been since about May.
00:01:28.762 --> 00:01:29.766
May okay yeah.
00:01:29.766 --> 00:01:30.921
Awesome.
00:01:30.921 --> 00:01:40.271
So going on five months and Cam and I are actually headed to Wild West Hack and Fest in South Dakota next month.
00:01:40.271 --> 00:01:42.447
That'll be fun, really looking forward to that.
00:01:42.560 --> 00:01:43.844
Yeah, so I did for that one.
00:01:44.500 --> 00:01:49.412
Yeah, might be fun too to bring the tool we're talking about today, the Flipper.
00:01:49.820 --> 00:01:52.319
Oh, definitely so.
00:01:52.319 --> 00:02:01.971
We're talking about the Flipper Zero today, so this is a powerful little device centered around a friendly dolphin character.
00:02:01.971 --> 00:02:29.229
So this might be advice that maybe not everybody has heard of, but, as of 2023, it's gained a lot of popularity around the internet, prompting a lot of people with maybe a little interest, or maybe not a lot of knowledge of hacking, whether that's physical or not, to pick one up and dive into it and Cam weren't these hard to come by for quite some time?
00:02:31.283 --> 00:02:43.811
Yeah, so I think the supply is getting better, but this was a device that's been constantly out of stock since it gained popularity, so it was actually introduced to Kickstarter in 2020.
00:02:43.811 --> 00:02:45.825
So that's when they started getting the funding.
00:02:45.825 --> 00:02:49.748
The first device is shipped in January of 2022.
00:02:49.748 --> 00:02:55.009
I'd say about this time is when the supply issues are finally coming to an end.
00:02:55.009 --> 00:03:00.010
I think it really gained popularity in 2023, though.
00:03:00.010 --> 00:03:04.510
So while it started in 2022, it took about a year for it to really catch on.
00:03:04.510 --> 00:03:13.125
It was actually banned from sale from Amazon earlier this year, in April, because it's considered a credit card skimming tool.
00:03:13.125 --> 00:03:23.171
That's because a lot of cards are enabled with NFC, so this can read cards and grab the card number and the expiration date.
00:03:23.171 --> 00:03:29.003
I can't get that little number on the back, though, because that's not part of the NFC data that's on cards.
00:03:29.740 --> 00:03:32.689
You'd have to socially engineer them to get that, Nick.
00:03:33.723 --> 00:03:34.645
Cameras available on.
00:03:34.645 --> 00:03:36.150
Amazon now, or is it still?
00:03:36.760 --> 00:03:39.479
I'm not aware of it being available on Amazon.
00:03:40.262 --> 00:03:41.907
Okay, so you've got it on the website.
00:03:42.769 --> 00:03:43.069
Yeah.
00:03:43.069 --> 00:03:46.628
So you can pretty much get it off of the Flipper Zero website.
00:03:47.270 --> 00:03:48.943
Sure, I have one in front of me too.
00:03:48.943 --> 00:03:51.811
Very nice tool.
00:03:51.811 --> 00:03:53.645
I'm not professional with it like you are.
00:03:55.219 --> 00:03:59.389
I don't know if I'd call myself a professional, but yeah, I've had a lot of fun with it.
00:04:00.270 --> 00:04:00.992
Yeah, absolutely.
00:04:00.992 --> 00:04:03.508
There's a funny little topic.
00:04:03.508 --> 00:04:16.608
I got a 3D printer a couple of weeks ago and I was looking at the Flipper Zero and I was on those printables and a bunch of people are making cases and stands and accessories for the Wi-Fi adapter on it.
00:04:16.608 --> 00:04:23.172
So I thought that was pretty cool that that ecosystem is tapping into security tools like this.
00:04:23.172 --> 00:04:24.944
So just a fun little fact.
00:04:25.867 --> 00:04:30.870
Oh yeah, I actually have one of those attachments that goes right onto it.
00:04:30.870 --> 00:04:35.747
I don't have a case for it, though that's one thing I would probably do if I had a 3D printer.
00:04:36.819 --> 00:04:37.964
Now you can get one from Nick.
00:04:38.940 --> 00:04:39.523
Yeah, we can.
00:04:39.523 --> 00:04:41.201
We'll work on that, can?
00:04:41.201 --> 00:04:42.076
That actually sounds really fun.
00:04:42.076 --> 00:04:47.302
So I'm diving into, I guess a little bit For people that don't know what this is.
00:04:47.302 --> 00:04:50.370
What are a couple of the top items that you use this for?
00:04:50.370 --> 00:04:52.064
What are you doing with it?
00:04:54.543 --> 00:04:55.505
For myself.
00:04:55.505 --> 00:05:02.870
It's about messing around with those sub gigahertz frequencies, the things that we usually don't have access to.
00:05:02.870 --> 00:05:16.012
Or there's devices out there that can access those frequencies but they're not so easy to work with, or you have to have a deep technical understanding of all of that in order to use it.
00:05:16.012 --> 00:05:21.211
So this is like one of the big things I did with it was breaking into my own garage.
00:05:21.211 --> 00:05:28.927
That's one of those things that the Flipper Zero is able to read the frequencies that the garage door opener operates on.
00:05:28.927 --> 00:05:31.005
That's one of the most exciting parts of it.
00:05:31.005 --> 00:05:36.125
That's kind of the thing that hit the news like oh, people are using the Flipper Zero to break into their garages.
00:05:37.019 --> 00:05:39.901
So it's kind of scary in that sense, right, oh yeah.
00:05:41.019 --> 00:05:41.220
Absolutely.
00:05:41.220 --> 00:05:43.345
For people with older garage door openers.
00:05:43.345 --> 00:05:46.052
They're absolutely vulnerable to this thing.
00:05:46.052 --> 00:05:48.326
Obviously, there's a limitation of range.
00:05:48.326 --> 00:05:55.245
Maybe you might have to be close enough that somebody might see you hiding in the bushes trying to grab their signal.
00:05:55.245 --> 00:05:59.964
But that's not to say that you can't extend the range of it one way or another.
00:06:00.286 --> 00:06:01.600
Oh, sure Is that.
00:06:01.600 --> 00:06:04.302
Maybe like an attachment, there's a range extender.
00:06:05.004 --> 00:06:05.607
Oh cool, Exactly.
00:06:05.607 --> 00:06:07.879
Well, I mean, look at the antenna on this thing.
00:06:08.000 --> 00:06:08.843
Yeah, no absolutely.
00:06:09.180 --> 00:06:16.434
This operates on 2.4 gigahertz, so it's not going to be looking at the garage door opener aspect of it.
00:06:17.483 --> 00:06:19.970
So I guess that's where the social engineering aspect would come in.
00:06:19.970 --> 00:06:23.987
You dress up as an Amazon driver or something like that and you wait for them to open their garage door.
00:06:23.987 --> 00:06:25.350
Oh, I was just going to your front door.
00:06:25.350 --> 00:06:29.668
Here's your package, you know, and you're getting to go under the garage door.
00:06:29.668 --> 00:06:30.790
Frequency there Exactly.
00:06:31.639 --> 00:06:46.404
It used to be that garage door openers 20 some years ago, I think, even longer they didn't have very good security in them where they didn't have the changing codes.
00:06:46.404 --> 00:06:48.771
Nowadays I think they do.
00:06:48.771 --> 00:06:55.225
Is this able to bypass even the garage door openers that do change codes?
00:06:56.247 --> 00:06:59.261
Yep, so the really old garage door openers.
00:06:59.261 --> 00:07:04.985
You have little dip switches on the opener and the remote to set the code that you would be communicating on.
00:07:04.985 --> 00:07:06.769
That's obviously cracked.
00:07:06.769 --> 00:07:11.920
You can just figure out what code they're using with the Flipper Zero, just brute force it.
00:07:11.920 --> 00:07:15.468
But now for the rolling codes, the more modern ones.
00:07:15.468 --> 00:07:30.591
The Flipper Zero can be programmed with how much the code increments each time, and so that's how it opened my garage door opener, because it captures the code off of the remote and then it knows how much it's going to increment each time.
00:07:30.591 --> 00:07:41.002
So, like, if I capture the code, use the garage door a few times with the remote, I'll have to press the button on the Flipper Zero a few times so that the code catches up with where it's at.
00:07:41.322 --> 00:07:49.026
So presumably that communication between the remote and the garage door opener isn't encrypted?
00:07:49.509 --> 00:07:50.271
No, it is.
00:07:50.271 --> 00:07:51.396
It's not really.
00:07:51.396 --> 00:07:52.639
It's just a rolling code.
00:07:52.639 --> 00:07:59.608
So ideally somebody wouldn't be able to capture the code and just replay it to open the garage door as often as they want.
00:07:59.608 --> 00:08:06.355
But if you know how much that code increments each time you press the button, then it's essentially cracked.
00:08:07.439 --> 00:08:14.031
What other security bypass areas can it be used for?
00:08:14.632 --> 00:08:21.485
Well, and this is one of the fun parts of the Flipper Zero, you know just all the different antennas, the different things you can do with it.
00:08:21.485 --> 00:08:24.721
One thing you can do is use it as a USB keyboard.
00:08:24.721 --> 00:08:27.728
So you know, we've probably all heard of the rubber ducky.
00:08:27.728 --> 00:08:39.899
Well, the Flipper Zero, with its USB port on the side here, can do essentially the same thing as a rubber ducky and they've made it so that it actually runs ducky script.
00:08:39.899 --> 00:08:46.268
So if you want to throw a rubber ducky script on this thing and use it like a rubber ducky, you absolutely can.
00:08:46.589 --> 00:08:49.703
And just to refresh our memory, what does the rubber ducky do?
00:08:50.025 --> 00:08:52.938
So the rubber ducky, looks kind of like a flash drive.
00:08:52.938 --> 00:08:55.568
I don't have one out right now but it looks like a flash drive.
00:08:55.568 --> 00:09:03.844
But it, you know, to the computer it appears as a keyboard and it can just use keystrokes to interact with the computer.
00:09:03.844 --> 00:09:13.807
So you plug the rubber ducky in and as fast as it possibly can just run keystrokes and run things, so like you could have it run a PowerShell script that it types out for you.
00:09:13.807 --> 00:09:17.544
And that's just because the computer thinks that it's a keyboard.
00:09:17.544 --> 00:09:21.524
It thinks that somebody entering keystrokes into the computer and that's a hack.
00:09:21.604 --> 00:09:24.331
five tool, I believe H-A-K-A-5.
00:09:25.254 --> 00:09:46.807
Yep, and this, actually the Flipper Zero, can extend that functionality a little bit to Bluetooth so you can get Bluetooth, you can get a Bluetooth connection with this thing and then use the keyboard that way, oh that was that was my question is how are you using the keyboard with it so that that answers that?
00:09:47.990 --> 00:09:49.394
Are we Cameron?
00:09:49.394 --> 00:09:50.783
So, like I know, you're using it?
00:09:50.783 --> 00:09:53.222
There's a lot, probably a lot, of nefarious ways to be using this.
00:09:53.222 --> 00:10:02.591
Obviously, as we were just talking, have you come across or thought about any, like you know, white hat hackers, how to use this for good, or like penetration testing, or what are your thoughts there?
00:10:02.611 --> 00:10:03.677
Well, absolutely.
00:10:03.677 --> 00:10:03.979
So.
00:10:03.979 --> 00:10:04.541
You know what?
00:10:04.541 --> 00:10:08.442
I guess, when it comes to devices like this, it kind of comes with the territory.
00:10:08.442 --> 00:10:13.563
You know, there's so many good things you can do and so many bad things as well.
00:10:13.563 --> 00:10:20.976
It's really up to the individual who owns it to see what they can do with it or, you know, determine what they want to do with it.
00:10:20.976 --> 00:10:30.591
So you know, somebody could use this to maybe get into a parking lot, like, maybe they're hired by the company to see whether they're able to get in.
00:10:30.591 --> 00:10:37.966
Well, that's a white hat application, but at the same time, somebody can use it to break into a parking lot and get parking for free.
00:10:38.889 --> 00:11:11.524
So a friend of mine works for one of the three letter agencies where they have to go around and chase around bad people and one of the things that he's mentioned in his agency car he has the ability to go into different parking garages and it just opens up the gate automatically for them so they can go in if they, you know, need to pursue somebody.
00:11:11.524 --> 00:11:15.198
They're not fiddling around getting a card or whatever.
00:11:15.198 --> 00:11:16.240
It is right to get in.
00:11:16.240 --> 00:11:30.375
So would the rubber ducky have the ability to copy that, that code somehow, that communication between the thing in his vehicle and the parking garage?
00:11:30.375 --> 00:11:36.878
Because if it is, we're gonna go over to his house this weekend with that rubber ducky and we're all getting into the garage free next week.
00:11:38.191 --> 00:11:54.004
Yeah, so with the flipper zero, I guess it it all depends on what frequencies they're using and what protocols that it's operating on, right so like, if it's a, if it's a very modern protocol, the flipper zero is probably not going to be able to get into that.
00:11:54.004 --> 00:12:04.062
But if it's older, you know, even maybe early 2010s, early 2000s this can probably capture it and replay it as much as you want.
00:12:04.910 --> 00:12:20.995
Have you done any research on some of the other things that people are doing, and maybe it's kind of in that gray area of the taking over of the construction signs or changing Gas pump prices, different things like that?
00:12:20.995 --> 00:12:23.681
That might be kind of interesting that you know.
00:12:23.681 --> 00:12:27.535
Maybe you've not Tested personally, but have read about.
00:12:27.556 --> 00:12:29.421
Oh, so, absolutely so.
00:12:29.421 --> 00:12:36.649
You know, in our in in the modern day, a lot of things operate on the frequencies that the flipper zero can look at.
00:12:36.649 --> 00:12:46.914
You know, I just running down a list car key fobs, you know, like smart lighting, sometimes you have smart light bulbs that maybe have a little remote that it's operated with.
00:12:46.914 --> 00:12:54.042
You know, wireless doorbells, gates, so that kind of falls under the same as garage door openers.
00:12:54.042 --> 00:13:01.727
It, the flipper zero, also has the ability to read proximity cards.
00:13:01.748 --> 00:13:16.464
You know I did, and not necessarily every single protocol, like I won't say that it's cracked everything, but if somebody's using an older card, the flipper zero has it, definitely has the ability to copy that.
00:13:16.464 --> 00:13:21.157
And you know I could go over every protocol.
00:13:21.157 --> 00:13:22.941
There's quite a few actually.
00:13:22.941 --> 00:13:32.839
But you know some of the other things that use RFID Might be, you know, sometimes wristbands, people have RFID chips in them to get access to things.
00:13:32.839 --> 00:13:38.354
Some transit passes use RFID pet microchips as well.
00:13:38.354 --> 00:13:44.044
So in some cases the flipper zero you can put it wherever the microchip is on your pet and it can read the name.
00:13:44.931 --> 00:13:47.438
So, nick, do you have all of your cats chipped?
00:13:47.438 --> 00:14:40.015
I wonder if you could do something with the, the cats a microchip, or dogs microchip, where if you had a pet door, you could almost create kind of like a Pet door opener, like a garage door opener where it's locked, but then when the pet approaches and it reads their microchip, then then it would let them in and maybe the, the microchip and the pet is Not transmitting it out at a far enough frequency for that to work, but kind of a cool concept to make those a little bit more secure so you don't have the home alone scenario where the, the malicious actors, coming in through the pet door.
00:14:40.717 --> 00:14:43.932
Yeah, and, and I've seen Devices like those.
00:14:43.932 --> 00:14:55.519
Actually they have collars that you can use to do Exactly what you mentioned, but I'm sure the flipper zero Probably operates on the same frequency as those devices and you could probably emulate them.
00:14:56.081 --> 00:15:18.669
Nick, when you were doing some of the physical pen tests before into I think it was a Hospital that you had been working on where you were able to clone the frequency from from a Distance, to clone the card to get into the secure areas, was that?
00:15:18.669 --> 00:15:19.793
Do you?
00:15:19.793 --> 00:15:22.461
Do you recall anything about how you had done that?
00:15:23.672 --> 00:15:25.530
Yes, we Basically.
00:15:25.530 --> 00:15:51.413
Well, we could turn this into a whole nother episode, probably, but what we did was basically reverse engineer one of the HID, the carburetor's like on the wall, so we put that and put it on a battery pack and put it in a backpack and we Me and my partner walked around the hospital and pretend to bump into people in the lunchroom or go around and, you know, catch the badges.
00:15:51.413 --> 00:16:01.067
It turns out we got about 12 of them and one of them happened to be a Maintenance worker, so that generally means keys of the kingdom, and we were in so real quickly on that.
00:16:01.067 --> 00:16:01.476
That was.
00:16:01.518 --> 00:16:09.376
That was a fun one, but the the flipper zero would be lights out for that kind of a Situation camera you had mentioned.
00:16:09.376 --> 00:16:26.001
This is like the Swiss Army knife right tool, so you're listing off all these different things that it can do Is can it do that right out of the box or do you need to Download different tools for it or software, and maybe you're getting to that.
00:16:27.010 --> 00:16:30.900
Yeah, so I'll actually just mention really quick the.
00:16:30.900 --> 00:16:50.681
The primary features of the flipper zero are the sub one gigahertz transceiver right, that's where a lot of that garage or opener parking ramp stuff comes in the RFID, 125 kilohertz, that's for those proximity tags, nfc so you know we use NFC for a lot of different things nowadays.
00:16:50.681 --> 00:16:52.216
It has Bluetooth.
00:16:52.216 --> 00:17:07.318
It has an infrared transceiver, which is something that we haven't quite touched on, but it has the ability to clone and and emulate like TV remote, so you can go somewhere and mess with TVs if you wanted to, or Generally, anything that operates using infrared.
00:17:07.318 --> 00:17:12.238
It also has the ability to read and clone eye buttons.
00:17:12.238 --> 00:17:15.203
A lot of people probably haven't heard of eye buttons.
00:17:15.203 --> 00:17:31.222
Those are little coin cell size devices that Store a little chunk of data and are usually used, you know, maybe to access a building, or they can be used to as like a license key for software, like a physical hardware license key.
00:17:31.222 --> 00:17:37.930
One other thing the flipper zero has is u2f, so that's universal second factor.
00:17:37.930 --> 00:17:43.796
So the flipper zero does have the ability to be used as a security key, kind of like a uB key.
00:17:43.796 --> 00:17:53.534
The difference, though, is that the flipper zero is all software based, so they wrote the u2f software, whereas, like, a uB key is hardware based.
00:17:53.534 --> 00:18:04.494
So For the highest level of security, it's not recommended to use the Flipper Zero as a security key, but the ability to do it is there.
00:18:05.857 --> 00:18:09.507
One of the best features of the Flipper Zero is actually the GPIO.
00:18:09.507 --> 00:18:13.515
So that's where attachments like this one can come in.
00:18:13.515 --> 00:18:19.428
That's where you can extend the capability of the Flipper Zero beyond what's just built in.
00:18:19.428 --> 00:18:24.454
The GPIO allows you to do just about anything you want with it.
00:18:24.454 --> 00:18:30.151
It can be kind of used like a Raspberry Pi where you can build projects with it.
00:18:30.151 --> 00:18:31.515
You can mess with things.
00:18:31.515 --> 00:18:33.281
It's pretty fun.
00:18:33.674 --> 00:18:34.778
So it's really open source.
00:18:34.778 --> 00:18:38.026
People are always creating new ways to use this.
00:18:39.096 --> 00:18:43.494
Absolutely, and that's kind of where the firmware comes in in this actually.
00:18:43.494 --> 00:18:46.059
So the firmware is obviously completely open source.
00:18:46.059 --> 00:18:54.763
You have the ability to remove the firmware, write your own firmware, install other people's firmware.
00:18:54.763 --> 00:18:58.141
I just wanted to mention a few custom firmware options.
00:18:58.141 --> 00:19:00.605
Of course, one of them I'm using.
00:19:00.605 --> 00:19:08.627
So the most popular ones that I know of are Unleashed, rogue, master, flipper Extreme.
00:19:08.627 --> 00:19:10.738
These are all built by different people.
00:19:10.738 --> 00:19:16.343
They all have different features in them, right up to the developer to decide what they want to put in the firmware.
00:19:17.515 --> 00:19:24.515
But these extend the capability of the Flipper Zero by removing regional restrictions on the Flipper Zero.
00:19:24.515 --> 00:19:37.489
So you can imagine the local governments aren't too happy about this device, so the manufacturer has to sort of dumb it down a little bit to make sure that people aren't using it for nefarious purposes.
00:19:37.489 --> 00:19:42.744
But by installing these custom firmwares you're completely removing those restrictions.
00:19:42.744 --> 00:19:54.241
And one important thing to note is that these firmwares also allow you to capture those rolling code protocols, like with garage door openers.
00:19:54.241 --> 00:20:01.885
So by default, obviously, when you get this right out of the box, it's not going to let you just open somebody's garage door.
00:20:01.885 --> 00:20:09.949
It has the capability to do that, but in order to help get the device through.
00:20:09.949 --> 00:20:17.708
You know, maybe governments and things like that they're going to restrict your ability to do that.
00:20:17.708 --> 00:20:32.365
And one other thing this comes with with the custom firmware are extra apps, games, plugins, things that you can do with this that you aren't able to do out of the box.
00:20:32.895 --> 00:20:36.465
Which one do you use, cameron, or have you tried them all?
00:20:37.798 --> 00:20:40.983
Yeah, the firmware I'm using is the Flipper Extreme.
00:20:40.983 --> 00:20:53.326
I've also used the Unleashed, but sometimes, when I'm messing with certain things, you have to install a certain firmware because those have the plugins or the apps that you're looking for.
00:20:53.326 --> 00:21:05.386
I'll be doing a few demonstrations here, and on each of these demonstrations I'm using a different firmware, because not every firmware has the ability to do the things I'm looking to do with it.
00:21:06.895 --> 00:21:08.880
So there's not like one rules them all.
00:21:08.880 --> 00:21:11.946
You have to use each one for different abilities.
00:21:13.239 --> 00:21:19.365
That's kind of the way it ends up working, and I think as time goes on, you know each firmware is adding different features.
00:21:19.365 --> 00:21:24.145
Maybe one will come out on top, sort of like this firmware has everything.
00:21:24.145 --> 00:21:34.481
But generally everybody's got different goals when they're building their firmwares, so it's just dependent on what you're doing, like what firmware has the features that you need.
00:21:36.957 --> 00:21:38.442
I'm looking forward to seeing these demos.
00:21:39.398 --> 00:21:39.961
Absolutely.
00:21:39.961 --> 00:21:42.515
So, yeah, this seems like as good of a time as any.
00:21:42.515 --> 00:21:47.565
So I want to run through how I got my garage door open with it.
00:21:47.565 --> 00:21:57.249
So, starting off here, you see, I have the garage door remote as well as the Flipper Zero.
00:21:57.249 --> 00:22:00.144
So what I'm running here is the frequency analyzer.
00:22:00.144 --> 00:22:06.515
So this was just telling me what frequency the remote is operating on.
00:22:06.515 --> 00:22:16.105
So you know, the first thing you need to know is like what frequency do I need to be monitoring in order for the Flipper Zero to capture it?
00:22:16.105 --> 00:22:19.564
And now that I know the frequency, I can go ahead and set it.
00:22:19.564 --> 00:22:37.701
And now it's scanning, so I press the garage door button, instantly captures it, and so with that I can go and save it on the Flipper Zero and the Flipper Zero will be able to increment the rolling code.
00:22:39.557 --> 00:22:47.128
So for our audio listeners, here, cameron has his Flipper Zero and then the one button garage door opener.
00:22:47.128 --> 00:22:51.846
Here, I believe it's just a chamber link and he's syncing the two, getting the code.
00:22:51.846 --> 00:22:58.301
Cameron, you can probably explain it better than me, but we're seeing it in action here that he's going to actually open the garage door with it now.
00:22:58.535 --> 00:22:59.416
Yep, I've saved it.
00:22:59.416 --> 00:23:08.945
And now that has the code saved, it knows what protocol it's operating off of it's security plus 1.0 on 315 megahertz.
00:23:08.945 --> 00:23:13.503
So now that I've captured it, it's as easy as pressing the button.
00:23:15.575 --> 00:23:20.515
It looked like it also knew what button on the remote was being opened.
00:23:20.515 --> 00:23:22.982
It said like it was a two button and it was middle.
00:23:23.796 --> 00:23:39.474
So yeah, I'm you know that might be as more of the intricacies of the protocol, but yeah, it's, you know, up to someone who's done the research into the protocol and has a deep understanding of it, the Flipper Zero has, you know, all of those capabilities programmed into it.
00:23:40.076 --> 00:23:41.942
So it did successfully open the garage door.
00:23:41.942 --> 00:23:47.166
That seems like a very alarmingly easy process.
00:23:48.923 --> 00:23:50.394
It is, and that's the whole thing about the Flipper Zero.
00:23:50.394 --> 00:24:03.048
Right Like before, there's devices out there that can do that other than the Flipper Zero, but it's not just like a you know plug and play kind of thing.
00:24:03.048 --> 00:24:12.128
Exactly Like you couldn't just install a piece of firmware on it and suddenly have the ability to do it right.
00:24:12.128 --> 00:24:14.380
Like you had to have a knowledge of like.
00:24:14.380 --> 00:24:16.726
How do I, how do these frequencies work?
00:24:16.726 --> 00:24:20.904
What are the protocols that this thing is operating on?
00:24:20.904 --> 00:24:23.263
And the Flipper Zero does all of that automatically.
00:24:24.715 --> 00:24:28.365
So I guess we're just going to assume that everybody that has a Flipper Zero is only using this for good.
00:24:29.377 --> 00:24:33.213
Exactly so I have another demonstration that I'd like to do.
00:24:33.213 --> 00:24:42.848
So this kind of goes into that bad keyboard thing with being able to have the computer think that the Flipper Zero is a keyboard.
00:24:42.848 --> 00:24:49.067
This is one of the additional capabilities of the Flipper Zero, using custom firmware.
00:24:49.067 --> 00:24:50.616
I believe it's extreme.
00:24:50.616 --> 00:24:54.246
It gives you the ability to do the bad keyboard over Bluetooth.
00:24:54.246 --> 00:24:57.157
So this is like the rubber ducky.
00:24:57.157 --> 00:25:03.718
We might have gone over this before, but this is over Bluetooth rather than USB, so it's completely wireless.
00:25:03.718 --> 00:25:07.346
The only thing you need to do is get somebody to connect to it.
00:25:07.346 --> 00:25:14.347
So I'll show here In the Flipper Zero it has storage on an SD card.
00:25:14.515 --> 00:25:18.325
You can store all the scripts that you want to use.
00:25:18.325 --> 00:25:31.521
So on this particular firmware, all I have to do is select the script I'm looking to run, as well as the protocol, and in this case I'm going to be using Bluetooth.
00:25:31.521 --> 00:25:34.541
So now I've got the Flipper Zero running.
00:25:34.541 --> 00:25:47.833
All I have to do is go on my computer, go to Bluetooth and hit connect and once it's connected, just hit start and, as you can see, it starts running.
00:25:47.833 --> 00:25:53.265
Through this, this script is just a like Hello World type of script.
00:25:53.265 --> 00:25:56.510
So the flipper zero just opens up.
00:25:56.731 --> 00:26:03.575
Run on windows, enters in notepad, hits enter and then starts typing stuff into notepad.
00:26:03.575 --> 00:26:10.575
But, as you might be able to imagine, this is as wide open as a keyboard.
00:26:10.575 --> 00:26:13.685
Anything you can do with the keyboard, you can do with these scripts.
00:26:13.685 --> 00:26:16.877
So you want to run PowerShell scripts, you can do that.
00:26:16.877 --> 00:26:19.326
You want to type out a PowerShell script, save it and run it?
00:26:19.326 --> 00:26:20.970
You can absolutely do that.
00:26:20.970 --> 00:26:32.061
And I'd say the advantage of using Bluetooth over USB is that it's actually faster, so this thing can run faster than a rubber ducky can.
00:26:33.125 --> 00:26:38.299
Oh my gosh, cameron, do you have any examples of how this has been used in cyber attacks?
00:26:38.299 --> 00:26:41.567
That, or have you seen, seen it in the news or in action at all?
00:26:42.749 --> 00:26:53.233
So for if we're talking this particular feature I haven't, but, but so you can imagine like anywhere a rubber ducky would be used.
00:26:53.233 --> 00:26:55.103
This could be used.
00:26:55.103 --> 00:27:01.881
And one thing that's important to note is that you can rename the Bluetooth device Right.
00:27:01.881 --> 00:27:18.284
So when you go to do an attack on somebody, you could name the flipper zero like Bose headset, and somebody who's looking to connect their Bose headset to their computer might be like OK, click on it, boom, you're connected.
00:27:18.284 --> 00:27:25.693
Now you can run your scripts over Bluetooth and you don't have to be anywhere near the computer, just as long as you're within range of the Bluetooth.
00:27:26.435 --> 00:27:38.772
Wow, I could really see that on an airplane, when people are connecting their their headsets, maybe their laptop, to listen to some music or do a little work, that could be a pretty good attack.
00:27:39.855 --> 00:27:40.376
Absolutely.
00:27:40.376 --> 00:27:51.784
That would be a great place for it, actually, because there's going to be Bluetooth enabled devices everywhere and I'm sure with the flippers zero you could reach pretty much every single one on the plane.
00:27:51.784 --> 00:28:00.634
And no guarantees.
00:28:00.634 --> 00:28:04.502
The flipper zero will be on hand, I'll say that much.
00:28:04.502 --> 00:28:09.911
And this actually leads in well to the next demonstration.
00:28:10.330 --> 00:28:18.973
So the newest piece news that came out about the flipper zero is actually the iOS Bluetooth low energy vulnerability.
00:28:18.973 --> 00:28:29.098
So this isn't so much of maybe like a huge security vulnerability as it is like a denial of service attack.
00:28:29.098 --> 00:28:36.233
It's just something that Apple, I guess, didn't account for when they set up these protocols.
00:28:36.233 --> 00:28:43.006
So, moving ahead here, you can see I'm putting the iPhone in airplane mode first.
00:28:43.006 --> 00:29:03.538
This is to demonstrate that you can actually perform this attack in airplane mode, and that's because, by default, the iPhone doesn't shut off Bluetooth completely when you put it in airplane mode, so the Bluetooth stays on and it still stays vulnerable to this attack.
00:29:03.538 --> 00:29:18.884
And so with the iPhone in airplane mode on the extreme firmware, it's as easy as going into the apps list on the flipper zero and hitting start, and all of a sudden you're being spammed with all of these messages and they just keep popping up and popping up.
00:29:18.884 --> 00:29:20.170
You can't get them to go away.
00:29:20.170 --> 00:29:26.166
You can't even use the phone while this is going on because they just keep popping up over and over again.
00:29:26.929 --> 00:29:35.205
So that's where it's a denial of service attack and this splits off into actually two separate areas.
00:29:35.205 --> 00:29:43.240
So there's the pairing requests as well as the actions for this.
00:29:43.240 --> 00:29:47.768
So you might have seen them pop up there before.
00:29:47.768 --> 00:29:50.452
It's like do you want to transfer a phone number?
00:29:50.452 --> 00:29:52.141
Do you want to set up this Apple TV?
00:29:52.141 --> 00:30:04.248
Those are examples of actions and those are things that can only be ran once while the phone is unlocked.
00:30:04.248 --> 00:30:08.493
So when you run actions, you won't be able to do it again until they lock the phone and unlock it.
00:30:08.493 --> 00:30:13.873
But pair requests, on the other hand, they can be ran an infinite number of times.
00:30:13.873 --> 00:30:22.932
So these will just keep popping up over and over and over again and in this case it says not your AirPods, not your AirPods Max.
00:30:22.932 --> 00:30:25.763
That's coded into the app.
00:30:25.763 --> 00:30:36.733
So if you had some knowledge of how to mess with those kind of things, you could definitely set the name to somebody's AirPods or somebody's Beats headphones.
00:30:37.256 --> 00:30:38.419
Another good one for an airplane.
00:30:39.702 --> 00:30:40.345
Absolutely so.
00:30:40.345 --> 00:30:46.041
That's actually one that'll annoy a lot of people because I don't know the range of it.
00:30:46.041 --> 00:30:53.571
It's not huge because it's Bluetooth, low energy but anybody in the immediate vicinity of you is going to be very upset.
00:30:53.571 --> 00:30:56.806
They're not going to be able to use their iPhones while that's going on.
00:30:57.601 --> 00:31:03.888
So when it's actually happening, cameron, can it only do it to one phone at a single time, or is it every Bluetooth device right in its proximity?
00:31:04.520 --> 00:31:04.682
Yep.
00:31:04.682 --> 00:31:14.828
So it's just, it's putting out that signal everywhere and every iPhone iOS device is going to pick it up, and that's how they operate by default.
00:31:14.828 --> 00:31:18.782
You can turn off the Bluetooth If you go into the settings.
00:31:18.782 --> 00:31:19.925
Turn off the Bluetooth.
00:31:19.925 --> 00:31:28.609
You're not going to see that, but you know, when you get a brand new iPhone, you set it up, Bluetooth is going to be on and most people aren't going to mess with that.
00:31:28.609 --> 00:31:36.432
Like you know, even if you put your phone in airplane mode to be on a plane, Bluetooth is still on, so you can do this while you're up in the air.
00:31:37.561 --> 00:31:40.628
Cam, you and I are taking different flights over to Wild West.
00:31:43.785 --> 00:31:48.025
All right, that leads us into a good question.
00:31:48.025 --> 00:31:54.647
You know, if you are, if, since we know about this stuff, right, we're all security professionals here to the listener, that's not.
00:31:54.647 --> 00:31:57.525
You know, what can you do to protect yourself against this?
00:31:57.525 --> 00:31:57.705
Right?
00:31:57.705 --> 00:31:58.990
You're taking a flight tomorrow.
00:31:58.990 --> 00:32:02.607
You know what are you going to tell your family member to do because you know about these items.
00:32:04.319 --> 00:32:12.476
So the unfortunate thing is that you know this is how Apple has iOS set up.
00:32:12.476 --> 00:32:19.971
So as far as like the proximity pairs go, there's not much you can do about it.
00:32:19.971 --> 00:32:23.867
Like, if you're, if you're using Bluetooth headphones, you've got to have Bluetooth on.
00:32:24.930 --> 00:32:25.191
Right.
00:32:25.961 --> 00:32:31.221
It's too bad, but if you're not using Bluetooth devices, then definitely have Bluetooth shut off.
00:32:31.221 --> 00:32:34.948
That that'll keep you from getting annoyed by this.
00:32:34.948 --> 00:32:44.288
And and one important thing to add is, this is not a compromise of security for iOS.
00:32:44.288 --> 00:32:45.451
Like it's not.
00:32:45.451 --> 00:32:48.761
It's not imitating that, it's some other device.
00:32:48.761 --> 00:32:52.250
It's not actually able to make a connection with the device.
00:32:52.250 --> 00:32:58.452
It's just really annoying because it can just keep popping up those little notifications.
00:32:58.452 --> 00:33:06.691
You know, connect to these earbuds, connect to these headphones, connect to this and that, and the Flipper Zero is just able to cycle through them at lightning speed.
00:33:06.691 --> 00:33:08.423
You know, boom, boom, boom, boom, boom.
00:33:08.423 --> 00:33:12.211
Send them out in every direction to every phone that can receive it.
00:33:13.240 --> 00:33:18.971
And you said it could only do it once, each time that the phone was powered on right.
00:33:19.960 --> 00:33:26.605
As for the actions part of it, so there's certain there's kind of two categories there's actions and there's proximity pairs.
00:33:26.605 --> 00:33:36.503
So actions is like things like you know, you want to connect to this Apple TV, you want to connect to or do you want to transfer a phone number over to a new phone.
00:33:36.503 --> 00:33:46.983
Those are the type of popups that can only happen once, whereas proximity pairs those are, you know, headphones, other Bluetooth devices those can happen in an infinite number of times.
00:33:46.983 --> 00:33:48.769
There's nothing you can do to stop them.
00:33:49.839 --> 00:33:53.851
You can do that a little bit with the photo sharing.
00:33:53.851 --> 00:34:05.272
I believe on an iPhone It'll look for other Apple devices in the vicinity and then you can share a photo with those devices.
00:34:05.272 --> 00:34:11.130
Makes it easy to transfer between, say, an iPhone and a Mac computer.
00:34:11.130 --> 00:34:26.246
But I've seen it in at conferences before where people share maybe unwanted cat pics with other folks in the vicinity and that's kind of annoying as well.
00:34:26.246 --> 00:34:29.134
So this kind of seems like that, but to the extreme.
00:34:29.942 --> 00:34:30.545
Oh, absolutely.
00:34:30.545 --> 00:34:30.744
So.
00:34:30.744 --> 00:34:33.815
This is along the exact same lines, because it's a.
00:34:33.815 --> 00:34:38.070
You know, it's one of those things that's meant for ease of use.
00:34:38.070 --> 00:34:45.012
Like you want to be able to just turn your headphones on, brand new out of the box, and boom, right there on your phone connect.
00:34:45.012 --> 00:34:47.286
You don't have to do anything extra.
00:34:47.286 --> 00:34:49.673
Well, that's the trade off.
00:34:49.673 --> 00:35:00.851
Like, so now, anytime you send out this, you know Bluetooth signal, every phone's going to pick it up, thinking that there's a new device out of the box, and that's how Apple has it set up.
00:35:01.539 --> 00:35:03.530
So it sounds like you know we're talking about.
00:35:03.530 --> 00:35:07.266
You know other ways to protect ourselves and mitigate the risk from this.
00:35:07.266 --> 00:35:09.353
Unless I'm missing something here.
00:35:09.353 --> 00:35:19.692
Our hands are somewhat tied because the only pieces here is education from, like a social engineering aspect of somebody's in the bushes next year how it's trying to get your garage code or something of the nature.
00:35:19.692 --> 00:35:21.947
Right it's, we know it's relatively harmless here.
00:35:21.947 --> 00:35:24.822
It's just a pain in the butt that you keep getting these notifications.
00:35:24.822 --> 00:35:37.791
But from an actual security standpoint, it sounds like our only mitigating factor is look out for the guy you know, or gal, whoever's using this you know, creeping around your office space or wherever, trying to get those codes.
00:35:37.791 --> 00:35:38.784
Cameron, is that?
00:35:38.784 --> 00:35:42.800
Is that true, or is there other ways that we can look to mitigate the risk?
00:35:43.844 --> 00:35:45.628
Yeah, so obviously there's.
00:35:45.628 --> 00:35:53.733
You know, like in the case of garage door openers, some are going to be better than others, right, like some.
00:35:53.733 --> 00:36:04.045
Maybe some that are even on the shelf are going to be using older protocols, and it's really a matter of like with your existing garage door opener.
00:36:04.045 --> 00:36:14.615
You just have to understand what it is and is it vulnerable to these things and don't consider your garage a safe place anymore.
00:36:14.615 --> 00:36:22.452
If it is, you know like, you have to keep in mind that somebody could have one of these devices and grab it.
00:36:22.452 --> 00:36:51.090
The likelihood of that happening is maybe, you know, sort of small, especially if you can visually see the area around your garage, but it's one of those things that I guess, without maybe replacing your entire garage door opener and buying a new one that uses a protocol that's not cracked, there's not a ton that you can do, honestly.
00:36:51.539 --> 00:36:57.090
Yeah, it's a little worrisome because I think about most of our newer vehicles now.
00:36:57.090 --> 00:37:02.929
Right, they're using this similar technology to enter and exit that vehicle or lock and unlock.
00:37:02.929 --> 00:37:16.246
So I'm thinking you're at a gas station and a bad actor is getting that code when you come back right and then maybe you follow them home or you come back in a later that night and you take the vehicle right.
00:37:16.246 --> 00:37:19.583
We've seen it used that way with air tags, the track of vehicle home.
00:37:19.583 --> 00:37:25.688
Well, if this can be used as a car key, it is pretty alarming what you can do with this.
00:37:25.688 --> 00:37:34.547
So it's almost gonna be up to the auto industry too to figure out other ways to lock and unlock, but we're so ingrained in what we're doing.
00:37:35.260 --> 00:37:37.809
Some of the things that you could do.
00:37:37.809 --> 00:37:39.724
And I saw Cam.
00:37:39.724 --> 00:37:47.768
You were using a Chamberlain remote and I believe some of the newer Chamberlains have a camera built into them.
00:37:47.768 --> 00:37:50.208
And of course there's third party cameras as well.
00:37:50.208 --> 00:37:51.764
They've got a built-in camera and mic.
00:37:51.764 --> 00:38:04.746
But you can set those alerts to get a notification on your phone, on your watch, anytime the garage door is opened, and it could also share a picture.
00:38:04.746 --> 00:38:10.329
So that way, nick, if there anytime the door opened, you'd get an alert.
00:38:10.329 --> 00:38:24.409
If that happens a lot, you might get alert fatigue, but at least you could see what was going on there Historically, you'd have a record of what happened and then potentially you'd have the video evidence as well.
00:38:24.409 --> 00:38:34.972
And if your home is protected by Smith and Wesson, then that might deter some would-be adversaries.
00:38:34.972 --> 00:38:36.945
Beware of dog sign.
00:38:36.945 --> 00:38:42.668
I think a 44 is better than a dog, but we could agree to disagree, I agree.
00:38:44.603 --> 00:38:45.505
I'm with you on that one.
00:38:45.505 --> 00:38:51.429
And one other thing that's coming up as we're going through this is hotel keys.
00:38:51.429 --> 00:38:58.427
Right, you check in your hotel and somebody's swiping the code and then they can get into the room.
00:38:58.427 --> 00:39:01.882
Is there any other uses that you're seeing or hearing about like that?
00:39:03.086 --> 00:39:06.166
Well, absolutely so as far as hotel rooms.
00:39:06.166 --> 00:39:11.224
As long as it's using the right frequency, the Flipper Zero is gonna be able to grab that.
00:39:11.224 --> 00:39:22.126
If there's any level of encryption on it, of course that's gonna need to be cracked, but I have a feeling that in some cases they're probably not going to be that great.
00:39:22.126 --> 00:39:26.849
But just on the idea of RFID.
00:39:26.849 --> 00:39:45.384
So one of the reason why this was banned off of Amazon is because it was considered a credit card scammer and it technically is right, because credit cards just have the number and the expiration date stored in an RFID chip inside of them.
00:39:45.384 --> 00:40:05.806
If you're trying to use it like online, it's not quite enough information to do anything with, because it doesn't have that three digit code on the back for you to be able to actually use the card, but it does get the vast majority of information right off of it.
00:40:05.980 --> 00:40:34.809
Just trying to remember the Darknet Diaries episode that talked about the individual who was playing online poker and was staying at a hotel and his room was broken into a few times and they tinkered with his computer and I forget the full details of the episode, but it sounded like it was a nation state attack.
00:40:34.809 --> 00:40:59.025
And this just seems to me a camera, in that the tools now that are making their way into the marketplace are the tools that nation state actors had for, if not decades, at least a half a decade worth of time, but now they're relatively available to the general public.
00:40:59.025 --> 00:41:08.547
So I wonder what tools the nation state actors are playing with that we haven't yet seen, but will maybe in a couple of years.
00:41:10.280 --> 00:41:12.322
Oh, definitely so I wouldn't.
00:41:12.322 --> 00:41:24.545
You know, the Flipper Zero is one of those devices that takes all of those you know different tools that they've been using for so long and just puts them in a compact, easy to use package.
00:41:24.545 --> 00:41:38.070
So obviously it's a little dumb down, like it's not going to be as advanced or have as many capabilities as these super advanced, highly technical, you know tools that are being used by highly knowledgeable people.
00:41:38.070 --> 00:41:51.407
But it puts some really strong capabilities into people's hands and I will be interested to see, like maybe there'll be a Flipper One someday Like what capabilities will that add?
00:41:51.407 --> 00:41:57.005
You know, it's very possible that we could see some additional things added to it that make it even more powerful.
00:41:57.481 --> 00:41:59.824
But it sounds like a lot of that stuff could be added through firmware.
00:41:59.824 --> 00:42:01.623
No, Absolutely.
00:42:02.927 --> 00:42:24.447
So just working with the hardware that the Flipper Zero already has on it I mean, your capabilities are pretty much unlimited as far as like working with the frequencies and things the Flipper Zero has the ability to read that stuff and then gives you the ability to do whatever you'd like with it.
00:42:24.447 --> 00:42:30.887
Like you know, the nice thing about this is it's all one platform, right, that you're interacting with all of these different things.
00:42:30.887 --> 00:42:38.606
So you're developing apps, you're developing firmware, you know anything you can do with this?
00:42:39.610 --> 00:42:43.829
sorry, Cameron, it was great having you on today.
00:42:43.829 --> 00:42:52.351
Thanks for hanging out with us on the audit, and certainly, nick, I always appreciate you being here as well.
00:42:52.351 --> 00:42:58.108
But great topic, cameron, and we look forward to future conversations about the Flipper.
00:42:59.090 --> 00:42:59.813
Thanks for having me.
00:42:59.813 --> 00:43:00.704
It's been a lot of fun.
00:43:02.980 --> 00:43:09.565
In the current technology landscape, managing risk, among other operations, can be incredibly challenging.
00:43:09.565 --> 00:43:17.007
Let IT audit labs experts provide a detailed, thorough examination in preparation for your upcoming audit.
00:43:17.007 --> 00:43:25.869
Contact us to learn more Thanks to our producer, joshua J Schmidt, and our audio video editor, cameron Troy Hill.
00:43:25.869 --> 00:43:27.668
Thank you for your time.
00:43:27.668 --> 00:43:28.833
Herox website.