Flipper Zero banned by Amazon for being a ‘card skimming device’
bleepingcomputer.com
bleepingcomputer.com
In other words, all the listings were unofficial resellers, none belonged to the people behind the hardware.
Also, I can kind of see Amazon's point. Not that hardware like this shouldn't exist—I've been sorely tempted to buy one myself, because it looks like a lot of fun!—but if Amazon doesn't want to sell pentesting tools (just like they don't want to sell lock picks), that seems reasonable to me.
I am hopeful that this device gains enough of a following that it becomes more usable over time, because the concept is great. Even though the TVbgone has existed for decades it’s still a great party trick. And I don’t mind having a single device that can back up fobs, either.
people behind the hardware are in russia. I suspect there might be further problems sending money to russia.
https://www.amazon.com/s?k=lock+pick+set&crid=28MGQBDLXRA2J&...
One a side note; banning tools that reveal weak security is the stupidest security-through-obscurity ever.
I think you're misunderstanding the motive behind these rules. I don't think these bans are meant to make society safer, but instead they're meant to reduce the risk of "The Killer/Thief bought his tools and weapons off Amazon" headlines. Many of their rules are simply weird; for instance the rules permit selling a glock holster but not a glock magazine. I think this is all about balancing the risk of reputational harm with their desire to profit, not about security at all. Which explains why their enforcement of many of these rules is lackluster, having the rule officially is the most important part. If some newspaper does decide to blame Amazon for providing the tools for a crime, Amazon can at least claim to be the victim of a third party seller violating their rules.
I think this is probably because they often have edgy shit written on them: https://duckduckgo.com/?t=ffab&q=ejection+port+cover+&iax=im...
Such ejection port covers have been the subject of public controversy: https://www.aclu.org/news/criminal-law-reform/youre-fucked-a...
Also, they explicitly permit the sale of some items which have geographic restrictions, such as airsoft guns, replica and toy guns, and night vision or infrared scopes. I think these are probably all county wide restrictions rather than state specific (night vision cannot be exported due to ITAR, for instance), but I could be wrong.
Yep makes perfect sense. You cracked the case! We are all so much better to have people like you on the hunt for this stuff. Please indulge us with where you see other Russian conspiracies elsewhere, I'm sure it will help us all!
> our French lawyers (for a French company, and a French account)
> PayPal Luxembourg is now claiming that the CSSF has no jurisdiction over them, because the accounts are French / HK / Australia
How are they Russian?
[edit-to-add] that issue is orthogonal to Amazon yanking it for being a tool that could be used for potentially criminal activity. but maybe added to their decision..
So, not orthogonal?
How is this at all legal?
eta: As a non-US person, I honestly find this incomprehensible. If you've taken the customers' money and the goods have been supplied, then the middleman hanging on to that money is called theft in most parts of the world.
(well, the underlying problem is that the US takes an extremely caveat emptor attitude to consumer protection and almost everyone in politics would rather play high stakes culture war issues than deal with boring stuff like making sure that corps can't rip people off)
They say that the seller should check their other product listings and get rid of any others that violate policy. It's if the seller doesn't do that that Amazon says they might permanently hold the seller's funds.
As in steal the money that customers paid for products that were delivered?
Wonder if the customer can then just challenge this in a small claims court as a European (if your country has something like this.)
It's probably legal in that Amazon's seller terms already specify they can hold the money from any purchase for up to N days (say, net 30) and that they can suspend seller accounts for certain reasons. So they will have already paid the seller for orders more than 30 days in the past and the rest they can hold.
...for 30 days. Is what any reasonable human would assume.
You can still make a bank transfer to someone even though you banned them from your own platform.
I've kinda wanted one for a while, but the 3-4 times I've looked in the past, it was always sold out. And it was always listed at scalper-level prices on Amazon and ebay. I thought maybe they had stopped making the device.
… so why does the ui allow this order to be placed in the first place? Seems silly.
https://www.amazon.com/MSR90-Magnetic-Credit-Reader-Deftun/d...
Owning one of these or a Flipper Zero doesn’t make you a criminal.
How is that not a card skimmer?
You can buy gun-related items like magazines and such, and there are some things like knives that say "cannot be shipped to New York" and similar.
There are some air rifles that could incapacitate small animals: https://www.amazon.com/Benjamin-Bulldog-Sportsmans-Pack-Rifl... (3000 psi!)
Magazines are banned. Some other accessories are permitted, like holsters, night vision scopes, devices to reload magazines except for those designed to reload magazines for these specific rifle cartriges: .223/5.56, 7.62x51, 308, 7.62x39, 5.45x39. Ejection port covers are banned, but butt plates are not.
You can read these arcane rules here: https://sellercentral.amazon.com/help/hub/reference/external...
Incidentally this is the rule set under which flipper was apparently banned: https://sellercentral.amazon.com/help/hub/reference/external...
Bans: Lockpicking devices, Devices designed to duplicate a key, Shoplifting devices, Card skimming devices, Code grabbing devices, Master keys or skeleton keys.
I'm pretty sure one of those could kill a human.
Just like miles per hour can be a speed or a battery recharging measurement.
Customary units, bleh :)
I'm incredibly glad there was no metric/customary split in electricity.
In many cases--like the vendors in Instagram--you don't get a device at all! You'll get a fake letter saying that your device was "seized by customs." (I imagine people who order from Amazon will receive some sort of actual device.)
https://www.reddit.com/r/flipperzero/comments/y27qi4/importa...
Customs does seize stuff, and I've gotten those letters when buying drugs from abroad with no reason to question the seller's integrity-- they usually reshipped without incident, marking the package as something less honest the second time.
The "scam" is run by Customs themselves in that they want you to admit on record that you're importing something illegal before they release it ;)
Yes, I'm sure. People were getting letters on badly reproduced letterhead with mispellings
It's about the software inside + the community around it.
A random Amazon Choice Bezos Zero won't work.
Sometimes you'll find third party sellers selling lock-pick kits using weird terms in bizarre categories with zero reviews, because they're trying to get around the policy. The listings are usually taken down by Amazon pretty quickly.
Hopefully this HN comment thread doesn't tip them off and cause them to enforce the policy, that would be a shame.
Do you have an example of products they allow that violate this rule?
Flipper Zero isn't just a small handheld computer. How it's marketed makes a big difference in how it will be used, and it's explicitly intended for pentesters. That's great, and I'm glad it exists, but it's perfectly consistent for Amazon to decide they don't want to sell it.
I mean so can a lockpick, but just a lockpick won't start a car these days and if you just want to get into a car, a brick also works.
i.e. Selling air-duster to dust things is different to selling air-duster to get high, even if it's the same product you are selling.
The root problem here is sloppy security through obscurity practices. If you use proper security like RSA certificates on NFC cards then there is no way a simple clone and replay attack (like a flipper or Android phone with NFC can do) will work, it is 100% impossible without breaking RSA encryption (which would be a lifetime achievement/Nobel prize worthy feat).
As Flipper Zero is marketed as a 'hacking tool', discusses use-cases as cloning cards and acting as a 'bad USB' device, has a indie go-go page that implies that you could use it to break into car parks, I'm not entirely surprised that Amazon wouldn't want to stock it.
This doesn't mean I don't think it's a great product - I want one and I'm glad it exists. I'm just also not entirely sure I would want to sell it if I was a global retailer.
It's probably just not been flagged to them yet.
I'm no policy maker, but I'm sure the convenience is the deciding factor. This device allows amateurs to perform a wide range of sophisticated security breaching tasks, for example.
The TI CC series of wireless chips are _decades_ old and in use with thousand and thousands of devices. You almost certainly are surrounded by multiple CCxxxx chips _right now_ in any little wireless remote control or iot gadget. These are extremely common chips and banning the flipper because it's a hacking device or whatever is just silly since it's not any more problematic than the TI CC wireless dev boards and devices.
I've also been spending a lot less money.
The flipper is honestly amazing. I consistently use it to get into my friends apartment, he keeps changing the code and he thinks i'm a wizard. Maybe one day i'll show him flipper, but the running joke is too good.
Web site shows a Delaware address but all job ads are in Cyrillic.
Now all the money they get from selling in the USA may be stuck in the USA until such time as the sanctions end, but there are methods more or less legal to route around that.
This is an unencrypted interface supplied by the cards, which means it is readable by any NFC-enabled device (including any android device...)
This interface is different from the EMV (payment) interface, which is encrypted. The Flipper cannot clone EMV cards.
The problem here is that cards transmit their card info to anyone who asks, not that Flipper is a malicious device.
The EMV / payment interface is a different interface and fully encrypted.
I tried to sell a Flipper Zero on eBay twice. The second time that they canceled my sale, they explained it was banned because the Flipper Zero can be used to clone RFID tags.
I wonder whether someone in govt/business spoke to eBay and Amazon specifically about the Flipper Zero, or staff was proactively looking for SKUs to ban, or someone is reporting listings and then staff decides it's banned.
I see many Flipper Zero listings, both current and sold. <https://www.ebay.com/sch/i.html?_from=R40&_nkw=flipper+zero&...> Maybe the ban has been lifted?
Some listings might sell before whatever eBay mechanism cancels listings, at least initially. But I've heard of eBay canceling sales that have already happened, regardless of whether payment happened or shipment happened.
(I bet eBay would refund the buyer's money, but it could be at least a small headache for the buyer, and a bigger problem for the seller. The buyer headache could also get bigger, if the buyer is honest, and especially if there are bureaucratic mess-ups by others who are confused by the unusual situation and suspect that the honest buyer was defrauding. Never underestimate the power of incompetence/indifference to make a shocking amount of trouble for others.)
(Side note, as someone from a startup that intentionally used unclonable/cloning-resistant tags, because we knew we needed to defend against cloning, and which is why I bought a Flipper Zero multi-tool in the first place... I suppose that eBay trying to ban electronics that can, among other abilities, clone RFID tags, is a response to legacy systems that didn't have cloning in their threat model. And/or a response to various half-baked new projects that totally ignore threats that they should know about (which is almost the norm lately). Maybe banning tools in this case is a responsible mitigation for legacy systems that can't handle current threats, and I can't fault eBay for not wanting to get involved in that mess. But it's unfortunate for people who are trying to design and build systems responsibly, yet have trouble getting the tools they need for their work.)
Meanwhile...
https://www.ebay.com/itm/185771423356
https://www.ebay.com/itm/403393330921
And there are others, including multiple ways to build one using generic hardware that they have no way to block without harming their own business.
When testing with my own cards, I was able to read card number, expiry, and currency which is enough in many countries for it to be considered a card skimmer.
No cardholder data nor anything else that is sensitive will be presented over NFC without authentication.