News for hackers. Stuff that matters.
Re:Insecure vehicles should be banned, not security tools li... by GuB-42 on Wednesday February 21, 2024 @03:13PM (#39458872)
> Security tools like Flipper Zero are essentially programmable radios, known as Software Defined Radios (SDRs)

The Flipper Zero is not a SDR, it is less capable than that.

That's the ironic part, the Flipper Zero is a rather weak hacking tool.

It can open car doors, but it is so impractical that it is not much more than a party trick. You have to record the code by pressing the button on the keyfob out of range of the car and in range of the Flipper. You can then open the door to the car, once, and only if the owner didn't open it first. There is a more advanced and maybe practical attack called rolljam, but I don't think the Flipper is capable enough to do that.

The only thing is that the Flipper Zero is fun, cheap(ish), and popular, but real thieves already have better tools for their job.

Re:Insecure vehicles should be banned, not security tools li... by happytiger on Wednesday February 21, 2024 @04:36PM (#39459902)
The idea of banning the flipper is like banning legos because you can build lockpicks out of them — it’s just nonsensical politician logic.
Re:Insecure vehicles should be banned, not security tools li... by dymk on Wednesday February 21, 2024 @07:53PM (#39461718)
What kind of lockpick can you build out of legos?
Re:Insecure vehicles should be banned, not security tools li... by sgerenser on Wednesday February 21, 2024 @08:06PM (#39461819)
That’s the joke
Re:Insecure vehicles should be banned, not security tools li... by happytiger on Wednesday February 21, 2024 @10:18PM (#39462782)
A very, very bad one that might only work with Lego locks.

Let me double down…

https://ideas.lego.com/projects/40434532-eaa1-4926-8621-3629...

Re:Insecure vehicles should be banned, not security tools li... by 0xEF on Thursday February 22, 2024 @05:12AM (#39465218)
I suspect, in part, that this article and people pushing for a ban wouldn't have even noticed the Flipper Zero if it didn't look like a toy. The case design looks like some advanced Tamagotchi and places in a more accessible part of the lowest-common-denominator mind. If it looked like a raw PCB and wires, or some rats nest jumble of little components, it wouldn't catch their attention as much. There is a lot to be said about how we package our hack tools, and the second you move into "magic box go brrrrr" territory, suddenly it gets real to those outside technical circles.
Re:Insecure vehicles should be banned, not security tools li... by bbarnett on Thursday February 22, 2024 @05:25AM (#39465274)
Actually, there may be something here. Politicians seem to be blathering on about "prepackaged" hacking tools, and similar terms. They obviously aren't going to ban ICs, or breadboards, so in their minds I think it's all about "Tools that are designed for non-hackers to use, in ways we don't like".

Right or wrong re: Flipper's uses, the "just take this and go" is part of it.

I do wonder, right now lockpick tools are banned, unless you are a locksmith. I wonder if one day, you'll be charged with "hacking tools", because you have some hobby project in your backpack.

Re:Insecure vehicles should be banned, not security tools li... by dylan604 on Wednesday February 21, 2024 @03:55PM (#39459430)
> but real thieves already have better tools for their job.

there you go, letting logic get in the way of a politician looking to score points

Re:Insecure vehicles should be banned, not security tools li... by antirez on Wednesday February 21, 2024 @06:00PM (#39460844)
The Flipper Zero is not certainly the problem here, and it is not a proper SDR tool as said. But I believe it's technically interesting that the Flipper Zero uses the CC1101 inside the Flipper in a more powerful way. The chip can be configured to just report in a given pin the actual OOK/FSK state (logic high/low). The same can be done while transmitting. So the Flipper is not limited to the protocols/formats supported by the CC1101 during normal operations, but can do any protocol as long as it is within the frequency range and uses OOK or FSK modulation (or the FSK variants supported).
Re:Insecure vehicles should be banned, not security tools li... by strangattractor on Wednesday February 21, 2024 @07:20PM (#39461512)
At one time is was possible to open car doors with a coat hanger. Nobody suggested banning coat hangers. They fixed the doors.
Re:Insecure vehicles should be banned, not security tools li... by noduerme on Wednesday February 21, 2024 @07:49PM (#39461690)
This came in handy for me once when I locked myself out of a u-haul in what used to be a rough neighborhood in New York. I was standing there fishing with a coat hanger trying to figure it out when a gangster looking dude came up and was like "here, let me help you with that," and 3 seconds later had the door open.
Re:Insecure vehicles should be banned, not security tools li... by jasonladuke0311 on Thursday February 22, 2024 @10:16AM (#39468299)
Haha similar story. I used to deliver pizzas and worked with a pretty rough crowd. Once I locked my car while it was running and had a bunch of deliveries. One of the cooks unlocked it in about five seconds.
Re:Insecure vehicles should be banned, not security tools li... by timoxley on Friday February 23, 2024 @06:51AM (#39479468)
I have a similar story! Locked out of my car. Bikers park next to me.

"You locked out? Hang on a moment"

Goes into a Subway, comes back with a coat hanger.

Less than a minute later the car is unlocked.

"Wow you're pretty good at that"

"I literally just got out of prison today... for car theft."

Laughter all around

Re:Insecure vehicles should be banned, not security tools li... by noduerme on Saturday February 24, 2024 @12:00PM (#39493065)
Who knew there were so many Good Samaritan car thieves out there, huh? I guess everyone enjoys a chance to show off their skill set a little!
Re:Insecure vehicles should be banned, not security tools li... by technofiend on Wednesday February 21, 2024 @08:11PM (#39461849)
I locked myself out of my car so often I ended up wedging a coat hanger under the rear bumper. You're right: car doors used to be trivial to yank open when you knew the trick. These days I'd love to create a little side project that sets the alarm off on my car any time a relay attack is detected. I'm sure Mark Rober or someone will end up doing it.
Re:Insecure vehicles should be banned, not security tools li... by mulmen on Wednesday February 21, 2024 @08:17PM (#39461900)
Wouldn't it have been easier to put a second key under there?
Re:Insecure vehicles should be banned, not security tools li... by tourmalinetaco on Wednesday February 21, 2024 @11:37PM (#39463313)
Of course, but that takes time and money to get a new key made. And once you know the trick it’s trivial using a coat hanger.
Re:Insecure vehicles should be banned, not security tools li... by biosboiii on Thursday February 22, 2024 @02:07AM (#39464094)
sounds rather complicated. You would have to scan the entire spectrum (not the entire, but like certain bands) and detect if there is someone sending power on there.

But modern vehicles detect these relay attacks and drop your message when you are too far away (ToF Measurement), you could maybe instrument that. But then when you walk to your car on an open field, you may also trigger the alarm because your key is out of range for a short time.

Re:Insecure vehicles should be banned, not security tools li... by nox101 on Thursday February 22, 2024 @04:18AM (#39464903)
what would the alarm do other the annoy a few hundred people. It wouldn't save your car. car alarms should be banned imo. replace them with something that pings your phone maybe but the alarm does nothing
Re:Insecure vehicles should be banned, not security tools li... by neuralRiot on Thursday February 22, 2024 @05:10PM (#39474025)
There are alarms with phone messsaging, tracking, remote start and disable. Also relay attacks are easy to prevent, just put your smart key inside a faraday bag or remove the battery.
Re:Insecure vehicles should be banned, not security tools li... by ummonk on Wednesday February 21, 2024 @08:57PM (#39462186)
Not a great analogy though, since a coat hanger’s primary use is not to break into cars.

Note: I’m not advocating banning the flipper zero anymore than I’d advocate banning lock picks. I just don’t think the analogy is apt.

Re:Insecure vehicles should be banned, not security tools li... by deadbunny on Wednesday February 21, 2024 @09:16PM (#39462333)
And a Flipper Zeros main purpose isn't to break into cars either...
Re:Insecure vehicles should be banned, not security tools li... by bombcar on Thursday February 22, 2024 @08:29AM (#39466746)
It’s really hard to determine the primary use of an item, especially for legal purposes.
Re:Insecure vehicles should be banned, not security tools li... by numpad0 on Thursday February 22, 2024 @05:37AM (#39465330)
Intentions sometimes matter. There is a South African shotgun aspirationally named Street Sweeper, and it's famously classified as a Destructive Device in the US, which is two levels more strictly controlled category, AIUI, IANAL, than a manually operated Gatling gun.

FZ is intended to clone keys and bypass security, I suppose in significant part for users' lawful convenience, but is kind of intended to do what it should not.

Coat hangers aren't engineered with intent to be shoved into the weather seal on a door.

Re:Insecure vehicles should be banned, not security tools li... by romwell on Thursday February 22, 2024 @06:47AM (#39465779)
You can literally order lock picks on Amazon in Canada[1].

Which were absolutely engineered with Internet to be shoved into locks to open them without a key.

To be clear: purchasing ans owning lockpicks is perfectly legal in Canada [2].

I don't think your logic applies to why that legislation was introduced. They're treating Flipper as a lockpick, but legislate it differently nevertheless.

Cheap, misguided hype seems to be a more plausible explanation.

[1] https://www.amazon.ca/Professional-Accessories-Suitable-Hand...

[2] http://lockking.ca/can-i-buy-lock-picks-in-canada/

Re:Insecure vehicles should be banned, not security tools li... by Xelynega on Thursday February 22, 2024 @08:40PM (#39475842)
> FZ is intended to clone keys and bypass security

I'd say it's more of an educational/'hacker' toy than it is a useful security bypasser/key cloner.

Purpose built(and better aot their job) those things cost significantly less. The flipper zero is a toy that the Canadian government are about to misclasify.

Re:Insecure vehicles should be banned, not security tools li... by bombcar on Thursday February 22, 2024 @08:27AM (#39466716)
There is (was?) a tool called a slim Jim that was basically a purpose-built coathanger for unlocking doors.

There was some talk of banning them in some areas, because people love treating symptoms rather than causes.

Nowadays the tow truck drivers have a little inflatable bag they slide into the top of the door and inflate so they can press the unlock button from the inside. Quite effective!

Re:Insecure vehicles should be banned, not security tools li... by kristopolous on Thursday February 22, 2024 @03:17AM (#39464537)
All this will do is increase sales volume. Given that flipper is 95% just a marketing play, I wouldn't be surprised if they're already on this