Hacker News Reader

Comment by felixnm | Hacker News Reader

Can anyone provide examples on how to use this? The FAQ and Blog have a ton of info on what it is and how to get it, but I don't see anything on why.

View on HN

I use mine as a remote for a lot of things:

My front gate, my parents front gate, and any other front gate (check your local laws before doing this).

Controlling a lamp I have (works with any device I've tried that uses 433mhz)

Backup remote for my TV (the Flipper infrared UI is kinda clunky but it works)

Backing copies of NFC cards

And most importantly, you can use it to turn the pages during a PowerPoint presentation

> And most importantly, you can use it to turn the pages during a PowerPoint presentation

Ah, so it's a business expense!

Would it be hard to get my neighbor's garage door to respond ?

Probably not, but it depends on the garage door. I used to be able to open my neighbor's garage door with the remote for my own garage door. There's also the opensesame attack (replay attack, search for it). You can perform such with a YTS-0 (Yard Stick One). I still ordered a Flipper Zero. Its cute as hell, probably has a neat community, and its more portable than my PortaPack + HackRF or Proxmark + Blueshark.

Samy Kamkar who did Opensesame on the Radica Girltech also did a DefCon presentation about attacking rolling code remotes as well: http://samy.pl/defcon2015/

How do you get the details of the remotes you're replacing with it? Scanning through frequencies? Don't they have "secrets" for the actual ACK that lets your in and garage doors rotate through codes do they not? Just curious.

> Don't they have "secrets" for the actual ACK that lets your in and garage doors rotate through codes do they not?

Remote door controls are painfully dumb and relied on the absence of affordable software-defined receivers and especially transmitters. With most of them you can set the code via binary DIP switches at the back and that's it. No replay protection, no nothing, if you're lucky the receiver has a brute-force detection.

There's a few tools for figuring out radio stuff. The first is super simple, it just scans through the frequencies and tells you which is the strongest. Most devices will put this in their manual but it's nice to not need to have to look it up.

Once you know the frequency one option is to just take a raw sample at ____megahertz and play it back on demand. This doesn't work for some radio signals because they use rolling codes and it's also a bit inefficient (be VERY VERY careful using a Flipper with a car key fob, because they can sometimes go out of sync and you can't open your car afterwards)

The good news is, for many types of radio signals, the flipper can also determine the protocol and what digital data is being sent- so instead of playing back a 2 second sample of me holding down the "power" button on my lamp's remote, it knows it can just broadcast 0x1234 using protocol XYZ.

NFC and RFID devices are basically plug & play, although only a subset are supposed.

Googling the FCC ID is usually a really fast way of working out what frequency a device operates on.

(Except for that suspiciously cheap gadget you got from AliExpress which shows up in the FCC database as an iPhone 4S...)

> (be VERY VERY careful using a Flipper with a car key fob, because they can sometimes go out of sync and you can't open your car afterwards)

FYI many cars with "keyless" entry have a traditional keyhole hidden under a piece of trim around the door handle and a key (sometimes plastic) hidden inside the fob; sometimes the key is part of the ring for a keyring, and can be released by pressing on the manufacturer's logo or inserting a paperclip in a hole.

Thanks, TIL

Hm, feels like I could have used this with my Gen 1 Phillips Hue, shouldn't have thrown that away I guess.

Weren't these already using ZigBee? Does anyone know whether the Flipper can handle those frequencies as well?

ZigBee, Thread and a few others use IEEE 802.15.4 which allows three bands: 868/915/2450 MHz. According to the FlipperZero homepage, it supports two out these three bands: 868 and 915 MHz. So depending on your device, it might work with them too.

I saw this 24 minute exhaustive review before ordering one last week: https://youtu.be/1qp78fiDD5M

yikes that guy has sub dermal implants - is this common in your country?

Why "yikes"? I don't think that's common anywhere, but the intersection between "hardware hackers who uses Flipper Zero" and "people with subdermal implants" is probably bigger than the intersection of "people not being hardware hackers" and "people with subdermal implants"

It's not common in any country, it's a fringe biohacker kind of thing.

There's a small group in the US that does this kind of thing: https://en.wikipedia.org/wiki/Grindhouse_Wetware

It's not exactly common in the US, but enough people have them that it isn't surprising to see.

Perhaps we run in very different circles, but I would be pretty surprised to see them!

“Move along, clank” indeed.

the lighting on this gives an ominous/mysterious feel to the video. like being under a blanket with a flashlight so nobody can see what you're doing.

adds to the hacker vibe "am I supposed to be watching this?"

This was streamed a little bit ago: https://youtu.be/dvFXWGomZzA Unfortunately, I don't speak Russian. :(

i use it to clone my work badge onto the chip in my hand... and to have all my amiibos in a nice easy portable package for switch gaming on the go.

haven't explored anything else

Wait, back up there: "chip in my hand?"

A colleague I worked with did the same a few years back https://twitter.com/danhett/status/888390099066642432

This front page seems to include a lot of info - it had a ‘Sub-1 GHz Transceiver’, then it has ‘125kHz RFID’:

> Low-frequency proximity cardsThis type of card is widely used in old access control systems around the world. It's pretty dumb, stores only an N-byte ID and has no authentication mechanism, allowing it to be read, cloned and emulated by anyone. A 125 kHz antenna is located on the bottom of Flipper — it can read EM-4100 and HID Prox cards, save them to memory to emulate later.

And

> Flipper Zero has a built-in NFC module (13.56 MHz). Along with the 125kHz module, it turns Flipper into an ultimate RFID device operating in both Low Frequency (LF) and High Frequency (HF) ranges. The NFC module supports all the major standards, such as NXP Mifare.

Reply on news.ycombinator.com