Brazil seizing Flipper Zero shipments to prevent use in crime | Hacker News Reader

Brazil seizing Flipper Zero shipments to prevent use in crime

bleepingcomputer.com

93 pointsrobbiet48067 comments

Jeez, I have a flipper zero and it’s amazingly boring. I use it as a sensor for WiFi to determine strength and other metrics to improve my home WiFi. I used it once to fix a tire sensor, or rather to determine which one was bad. It’s not some hacker tool, it has a bright white case with a fluorescent orange wrap and only useful for debugging and testing things. It’s great, but not dangerous.

https://github.com/DarkFlippers/unleashed-firmware

> It’s not some hacker tool, it has a bright white case with a fluorescent orange wrap...

Sorry, but how do these aesthetics prevent it from being a hacking tool? Some cool history rebuts the notion: https://telephone-museum.org/telephone-collections/capn-crun...

Just because you aren't clever enough to use it as a hacking tool doesn't also mean that others aren't. You can easily do basic things like snatch NFC data. Or duplicate the RF transmit signal for someone else's garage doors. I think if you exercise a little imagination you can see how it could be used nefariously.

And even still I would never support banning the device.

Don't garage doors use rotating keys, like car fobs?

yes they do

It depends on the garage door opener.

Sure but most use rolling codes. Y'all can downvote all you like, it's still true, and downvotes won't change that.

The parent's comment was reasonably stated, and you haven't challenged its factuality. Also, you don't know that they downvoted you.

Regardless, what you said implies that no more than a negligible amount of garage doors don't use rolling codes, since the reason for my question was security related. If that's not true, I therefore wouldn't say your comment was strictly true.

All this is to say, votes up or down aren't that important. The attitude seems unwarranted.

There is alternative firmware that allows you to do some things with rolling codes. Most of the cool stuff the flipperzero can do can be found here - https://github.com/djsime1/awesome-flipperzero

Modern ones do, old ones do not

you could say the same for RPis, arduinos, or even just 555 timers -- it's still ridiculous to ban something that provides functionality that is trivial to replicate elsewhere.

the gimmick of the flipper is that it does a lot of things in one unit -- every one of those singular functions is easy to do elsewhere, and often less hobbled by the intrinsically low-power nature of the flipper.

That’s an unhelpfully overly-reductive position. Nobody is hacking garage doors with a 555.

In the same vein - AirTags are considerably easier to covertly place on someone else than other asset tracking systems. Yes you can accomplish something similar with either but the likelihood of it being used for unintended purposes increases with the convenience and ease of doing so.

> Nobody is hacking garage doors with a 555.

I'd honestly be surprised if no one has made a device to open garage doors with a 555 timer in it somewhere.

First, a flipper zero doesn't even have built-in wifi. Only the dev board has that, and it's sketchy as well.

An android phone running Wigle or WIFIAnalyzer is plenty good for wifi.

As to "dangerous", it is unequivocally a hacker tool. Or are you arguing that this is a "testing tool"? https://github.com/UberGuidoZ/Flipper/tree/main/Sub-GHz/Gas_...

You can use a phone app for measuring WiFi strength.

Some unofficial firmware forks allow replaying signals that shouldn't be replayed like signals from medical devices. You can also desync some car fobs in some cases causing someone a bit of pain to get it fixed

It's pretty easy to use it for naughty things like brute forcing gates/garages, cloning NFC/RFID badges, turning off other people's TVs/aircons, messing with car key fobs, cloning iButton keys, etc

I'm going to disagree with current comments here, I think the rationale for banning here is not far-fetched. It is analog to the guns vs knives argument in my opinion: of course you can kill people with any tool, but guns just make it too easy, and thus should be more tightly controlled. Before Brazil figures out how to contain the damage from such tools that ultimately facilitate crime, their sales can wait.

Figures that someone who is against the personal right of self defense would also be against citizens having access to basic tech that may be used in a nefarious way

The comparison between knives and guns is especially funny, darkly though, in light of the "knife crime" narrative in the UK where the subjects of the crown have already been completely disarmed of guns, so now the state has moved on to taking away knives as much as possible

I bet you're against encryption, too. That can facilitate crime, you know.

Guns have only one purpose: physical combat. Either commit it, or, hopefully, prevent it.

Blades and encryption main purposes are not physical combat. Blades are mostly use for cutting material we use in our daily life, encryption is mainly use to hide communications.

I don't agree with Brazil move, mind you. Flippers are not dangerous to the point I would consider seizing them a priority.

> Guns have only one purpose

Not a fan of biathlon? Although I guess competitive shooting could be seen as a form of combat the same way competitive chess could be.

I use my keys to open my amazon packages.

But keys are still made to open doors.

But you wouldn't say keys have only one purpose.

Yes I would.

Purpose has a very specific definition.

>Guns have only one purpose: physical combat.

This premise is not true. But I agree, it's generally ignorance about a tool, weather it's firearms or radio, that leads to people and so governments, making false claims and so taking stupid regulatory actions.

It is really. You can use a gun as a doorstop or a paperweight, but it wasn't designed to that end. It's designed to deliver massive force to a small target at range and though that could be an object (eg in a target shooting competition), the intended target is usually an animal or person. Please don't insult people's intelligence with semantic games.

It's understandable that most people don't have the lived experience to realize that firearms are mostly for recreation. Most people live in high population density areas where firearms discharge is not allowed or feasible. But for most firearms uses the vast majority of use, and indeed the marketing by the companies that manufacture them, is about the recreational aspect, not shooting people or animals. There's certainly marketing and intent towards hunting but those are .308 rifles and larger calibres explicitly designed for it and they are not the majority of the market.

It's not the 1800s anymore.

Many people use firearms for recreation, and I agree that they are great fun. They are designed to put force on a target at range. If you only care about the recreation aspects, you'll be equally happy with a paintball or BB gun.

I have paintball and pellet guns and I can assure you while they are fun it is not the same. Although high calibre (.30) precompressed pneumatic air rifles are approaching the capabilities and fun of combustion propellant firearms pretty rapidly these days. And as a plus you can fire them full auto and with noise mitigation attachments without the legal worries of combustion firearms.

None of this obviates my point about what guns are designed to do. I don't have time for more of this semantic quibbling.

> Guns have only one purpose: physical combat.

I'm pretty sure the vast majority of gun owners have never actually shot anyone. More common uses are: training, hunting, collecting, and plain old having fun shooting things.

I used to be pretty anti-gun, but the 2020 home protests and Ukrainians initially training with wood guns changed that.

>I'm pretty sure the vast majority of gun owners have never actually shot anyone. More common uses are: training, hunting, collecting, and plain old having fun shooting things.

You're confusing use with purpose as if to imply the utility of firearms as tools to commit violence is merely arbitrary, rather than specific to their design. Which is weird because your second sentence makes it clear you know otherwise.

Setting aside that hunting is physical combat, the purpose of guns is not to be collected, or to shoot inanimate targets. The founding fathers didn't create the Second Amendment to protect the right of the people to keep and bear arms against watermelons on stumps. Guns may have multiple uses, but their purpose is combat.

It's a form of insurance. You don't get a car insurance to crash your car, just like the US doesn't have nuclear weapons to use them.

The problem is, as with firearms, criminals always have access to them.

In this Flipper Zero case, dissemination of such tool can actually improve common people awareness on tech security.

improve common people awareness on tech security

Not really. Nerds think this is true because they imagine everyone else is similarly interested in technology; they're not. You would have to spend 5 or 10 minutes explaining to an average non-tech person what the F0 does and then they would probably throw up their hands or mention the police rather than learn security stuff themselves. Very few people want to know about security, they just want to buy it. Learning has a high and unpredictable time cost.

People who want to develop defensive security awareness can do it anyway, same as criminals. Common people absolutely do not.

>Not really. Nerds think this is true because they imagine everyone else is similarly interested in technology; they're not.

opening up a car door or a garage door is an EASY sell to a laymen. It affects their personal security.

I showed my elderly father some tricks with the flipper, he's not technical in the least -- his first reply was : "Well how do we prevent people from ... "

Awareness is bought with information. Had my father not been shown a demonstration it's unlikely that he'd try to protect himself with just the mention of a verbal warning.

In fact, given that an entire country is moving towards legislation on such devices I am not sure how anyone could argue that 'everyone else' isn't interested in technology -- an entire country just announced laws against the thing; surely this isn't some kind of mass collective hallucination and indicates that the general pedestrian sector is at least considering the danger, no?

I'm not arguing that 'everyone else' is 'disinterested in technology, but that they're not similarly interested, that is they are not going to invest the same time as you would in learning about it. As I said, their default response to a demonstrated security failure is to either express dismay or refer to the police. Most people want to just buy security.

Now, if you see a commercial opportunity in being a security salesman and using a F0 as a demonstration tool, have at it. But if you expect this to lead to some mass upgrade of security consciousness, you're fooling yourself. Look at lock picking/hacking videos on Twitter and realize how in the US, a rich and technologically advanced country, even the police default to laughably bad security measures. People prioritize convenience, and showing them the error of their ways will just result in most of them choosing to pay more money for a more secure-seeming solution while still prioritizing convenience.

You could show people two different-sized padlocks with identical bad locking mechanisms, and people would still assume the larger one offers better protection. In a way they're right, because causal/opportunist criminals are also lazy and while they might use force to pop a small lock, they might not consider the effort and time to pop the big one worth the increased risk of being spotted. Smart criminals that know how to pick or finesse a lock (perhaps even putting it back afterwards) are much less common.

https://www.cbc.ca/player/play/1703503427818

Imagine if government officials in any red state in America tried welding doors shut to keep people trapped.

They wouldn’t because people with guns can only be pushed so far. Never trust anyone that wants to take guns away from law abiding citizens.

With action this severe I don't think party allegiance would have much to do with it, unless you're purely referring to ownership statistics.

Party has nothing to do with it. If government has no fear of abusing it citizens. Eventually it will.

Yeah. I don't think it should be banned, but what you're referring to is a common example of the tendency of people, especially engineers, toward binary thought. You see the same thing with AirTag concerns - people say, "there have always been small GPS trackers available", without elaborating. By itself, it's such a weak argument. Ironically, the more "human" a variable is, the more humans tend to ignore it when asserting, "X is no different than Y."

There are laws that regulate guns: acquisition, registration, carrying, etc. Do you know what all those laws have in common in all territories?

1) Criminals give absolutely zero fucks about your any laws, regulations, rules, ordinances or any form of compliance with authorities. Many of them see the law as a challenge, not as something to comply with. They are set out to compete against the system, not collaborate with it.

2) Pre-industrial humans without power tools could manufacture guns. Now, virtually anyone has more than enough resources to make a gun if so they wanted, or a ballistic knife, crossbow, sword, etc. Or a fucking trebuchet or a cannon. This means that any regulations about acquisition, registration, carrying, etc. are worth shit.

3) Firearm regulations also apply to law enforcement. But guess what happens when organized crime acquires more firepower than law enforcement? Then law enforcement is fucked and they lose territorial control. Because if you have a fucking squirt gun and criminals have fully automatic weapons you will think twice before attending a dispatcher call.

Go to Mexico, they have very comprehensive laws that you will love. They also have narcos executing policemen on the streets on video. And organized crime armies with uniforms, insignia, marked vehicles and a war arsenal including anti-aircraft weapons.

The system you live in is facilitated by gun ownership. A system that does scale well. Gun control doesn't fucking scale, it never has, unless you live in a police state that you also hate. But extortion and organized crime does scale once gun control is in effect, and can take over a country very quickly.

Feel free to downvote now, I don't care. Gun control sucks. If you love it so much go live to a country with strict gun control (in this continent).

If you are lucky and make it to age 80, you will find yourself outliving your closest family members, living alone on some shitty retirement money that is now worth shit due to inflation, without health insurance, having to rent the house you once lived in and living in a cheaper neighborhood where people will know you are an old, slow, harmless person. You cannot afford a dog because you spend all your money on meds. So you will be crying for a gun to protect yourself. But you won't have a gun because you spent your life arguing against them, and after several consecutive administrations with your favorite political party in power, gun control is a reality. Your last moments in this world will be some criminal causing you to lose your balance, fall and die as he escapes with all your valuable shit, thanking you for supporting gun control. He is loving that shit. It is cruise control for crime. In an alternate universe, you opposed gun control, you deterred the crime using your the gun you bought in the supermarket without registration or permits, and smiled as you pulled the trigger ending the criminal's attempt to rob you. Then you went back to your living room, put on some chill music and continued solving your Sunday sudoku.

Excellent post! 100% agree.

I'm in Australia and it's a pretty chill place and most criminals don't have guns. Of course there's some that do but it isn't anything like the lawless wasteland you describe.

My feeling is that most criminals that have guns use them against other criminals, like bikies to control drug territory or whatever, not for stealing random stuff from 80 year olds huddled in their house.

I don't want more people to have guns here.

I do sort of understand how US citizens could feel different though, there are SO many guns everywhere that definitely every bad guy has a gun. But I also think that those people vastly underestimate how successful laws can be to get rid of the guns. It would take some time but it could definitely work. How many automatic weapons do you see used now they have been made illegal?

People get up in arms even to make the suggestion that you don't need semiautomatic rifles for target shooting, like it's the biggest burden ever to have to use a bolt-action, which might actually slow down today's school shooter a bit...

Australia consolidated a society with certain quality attributes, then removed guns.

That has not yet happened here. There are still a large portion of the population catching up due to former "structural violence" policies.

Australia is an island continent that does not have a large land border with countries with substantial organized crime syndicates.

It is a different reality.

But if extortion became a thing in Australia it would expand very quickly.

Curious why they are focusing on this gadget when every hacking function in it has a related item for sale. Are they also blocking Hak5 Wifi Pineapples, or the micro voice activated recorders, or the key-chain sized security card cloning devices, or the myriad of gps tracking gadgets? Do they block downloads of Kali Linux?

Weak RFID infrastructure. Better to attempt to ban the tool than fix the root cause. Usual optics around “we’re solving the problem!”

You are probably right. It's funny though as there are literally hundreds of these RFID cloning devices [1] on Amazon, Ali, ebay and other places. I think trying to block the sale of them would be an endless game of whack-a-mole.

I am just linking the first one I found. There are more advanced and expensive cloning devices [2] that can clone anything.

[1] - https://www.amazon.com/Keysy-RFID-Duplicator-keycards-keyfob...

[2] - https://www.youtube.com/watch?v=VkHArCMPDCk

Infrastructure problems are never easily and cheaply solved. For example when the Meltdown exploit was discovered it was internally embargoed to distribute knowledge of it for some time as how to fix the problem was discovered and the multitude of vendors that needed to issue firmware fixes and kernel fixes were brought up to speed.

In theory the best course of actions is to issue mandates that infrastructure gets fixed while the stem of tools to hack said infrastructure is reduced for some time.

Probably because those devices are certified with the appropriate agency, while this one is not. At least according to the article.

> Multiple people in Brazil who purchased the Flipper Zero hacking tool have reported that their shipments are being redirected to Brazil's telecommunications agency, Anatel, due to a lack of certification with the country's Radio Frequencies department.

> Because Flipper Devices INC is not certified in Brazil according to this standard, it's not allowed to circulate freely in the Brazilian market.

Makes sense, devices have to be properly certified, if they are not, they're illegal. Seems like it has nothing to do with the "hacking" abilities of the device.

The thing is that it's not certified because they don't want to certify it. That's really unusual. I'm pretty sure the reason for ANATEL to not certify the device is because they believe it has no legitimate use.

It's probably the 433mhz (and other sub-Ghz) functions connected to easy to use UX that really scare them. Brazil's aristocracy live and work in little walled compounds and 433mhz can open pretty much any of their gates or jam it so the owners can't open their gate and they get boxed in by a couple cars.

Modern remotes/receivers have encryption, via rolling keys or other ways. It's not super easy to unlock those. Easy to upgrade as well, if you want to.

Truth is, the device is not certified so the authorities are confiscating them. Makes more sense than some "aristocracy" conspiracy.

I mean, the authorities specifically called out it's potential use by criminals to deny the normal one off certification process for test equipment.

> Anatel's certification area informs that the equipment called FLIPPER ZERO has been used in the country by malicious users in facilitating a crime or criminal misdemeanor and, as provided for in item II of Art. 60 of the Regulation for Conformity Assessment and Homologation of Telecommunications Products (annex to Resolution No. 715, of October 23, 2019), Anatel has rejected all homologation requests for the product in question, in order to collaborate in the protection of Brazilian citizens against criminal actions.

Those 433mhz gate remotes/receivers tend to have very little in the way real security. Not even rolling codes but just transmitting the same code every time is still very common.

And in an extremely socially striated country like Brazil, the ruling class using bureaucracy against their common fears isn't a 'conspiracy' any more than, like, the whole of society is.

Don't disagree, but to clone 433mhz you can buy a 10$ device, on eBay or Amazon

The issue they have is primarily due to SDR functionality similar to HackRF, oppressive governments do not want their citizens to have unfettered internet access using satellite internet or be able to exploit weakly secured or conversely use highly secure communications

They are already being sold for at least US$600 online and I've seen it offered at more than US$1000.

It's going to make it worthwhile to build them here.

I love how these people think banning a hobbyist redteam tool will prevent real RF related crime.

Silly criminals thwarted again by not having access to legally purchased hobbyist tools!

Owners of Tesla charging port covers and garage door openers rejoice as their harassment is finally ended.

The audacity of such governments to stifle research & innovation is just atrocious, can you imagine how censored & sterile the global communication networks would have been if it were up to the governments in the 90s to decide what can & cannot be used.....

It's an unlicensed transmitter. This has been government regulated for over 100 years.

Its range is pretty short; traditionally such transmitters are nearly unregulated, especially in the ranges where they already massively exist, such as smart card readers.

I suppose it's the firmware that makes this device stand out, not the hardware. The hardware is very standard, unregulated, and inexpensive, AFAICT.

(This of course means that whoever needs a Flipper Zero-like device, can just build one cheaply, and flash the firmware from Github. It's the amateurs who wanted a cool-looking device who are burned.)

Devices that transmit on RF have been regulated since the early 20th century. Including early radio-based communications networks. This is nothing new.

Interesting - I searched to see about flipper zero, and this was one of the results:

https://www.cyber.nj.gov/alerts-advisories/flipper-zero/

FYI, core team of the company developing Flipper Zero is located in Moscow, Russia. I wouldn't trust russian company with making my devices.

Why not seize all incoming computers while you're at it since they can be used for crime?

don't be silly, how else would they be able to watch pr0n?

why not? for one, is there any single purpose other than "evilz" for the Flipper? is there anyone other than "haxorz" that will be interested in using the Flipper?

it doesn't really take much stretching of the ol' imagination muscles to understand why some moronic government official with pretty close to zero understanding of electronics, computers, programming, hacking, or anything cool and/or fun really, that would be easily convinced that computers are good with occasional bad actors vs tool meant specifically for "getting around things" with the occasional harmless inquisitive person using it.

Reply on news.ycombinator.com