Feds want to ban the Flipper Zero – Experts say it's a scapegoat
vice.com
vice.com
The flipper is just some common off-the-shelf radios and microcontroller, albiet in a nice package. That's it. Like common radios found in your everyday stuff, like say a garage door remote.
Would regulations affect every product using these? I assume they'd have to in order to have any teeth? Would this impact a developer who wants to buy an cc1101 evaluation board for development?
Also, banning it is not going to actually make it unavailable to bad actors obviously. It will just hamper white hat security researchers.
But maybe discussion about banning it will push creation of some alternatives?
https://www.kickstarter.com/projects/monstatek/the-m1-a-comp...
What do we know about the company behind this?
And deter at least some script kiddies.
I'd wager far more script kiddies would be turned away by this move than white hat security researchers.
it's the classic "we must do something" problem, where the definition of "something" isn't the important bit.
We must do something
This is something
Therefore, we must do this
I also love the touching naivety of legislators who seem to think that to stop bad people doing things all you need to do is pass laws making the bad things they do illegal.
This is something that always frustrated me for hot button political issues. One side wants to make the thing everyone already agrees is bad double illegal, and the other side wants enforcement of existing options.
Or if we're talking about something that ought to be done. One side wants to throw money at the problem; the other side suggests that people should just try to not have bad things happen to them.
Ultimately, the refrain endlessly repeated is that people who want something to happen or don't want something to happen both want someone else to fix it. Somehow.
Lets make flipper zero illegal. Huh, someone stole the car again. Using a (now illegal) flipper zero (I mean technically it sounds like this isn't being facilitated by flipper zero, but use some imagination for a sec). Now what are you going to do. Make flipper zero MORE illegal? Stealing a car is already pretty high up there in terms of things that people don't want you to do.
The neat thing about automation and consumer electronics is that I can fix things myself. I don't have to influence a policy that is going to harness the efforts of potentially millions of other people (taxes, more laws, enforcement).
This is the core flaw in laws like this and DMCA 1201.
You have something which is already illegal, people are breaking the law, so you pass a law to make it illegal to have shoes because the criminals were wearing shoes while breaking the law. Obviously this needs to be prohibited because it helps them to run away.
Then criminals continue to both commit crimes and wear shoes and all you've really done is force people who obey the law to go barefoot.
The real problem isn't that you can't make things harder (certainly we could cross the threshold "can't sell off-the-shelf products that make car theft easy"), it's how far you get into making things harder before you hit tradeoffs making entirely innocent things harder.
And where that tradeoff stops being worth it isn't always clear. Personally I'd like the convenience of a device like Flipper Zero but it's hard for me to say that my right to have someone else make me something turnkey trumps people's rights to maybe not have it quite so easy to have their cars stolen.
And yes, I absolutely get it that people will still make/have them. That's not the point. The point is that fewer people would, the fruit gets higher hanging and that changes the statistics. Worth it? Maybe, maybe not, but it's not a ridiculous position.
My frustration is that this is just kicking the can down the road for someone else to handle.
In the case of the Flipper, this is asking manufacturers to stop making the Flipper. It's asking Retailers to stop selling the Flipper. It's asking the producers to end their Flipper product line. It's asking regulatory entities to checkup on all of the above to make sure they're complying. It's asking police to keep an eye out for these devices. And it's asking the public to surrender their property.
In short, someone has a problem and their solution is for EVERYONE else to do all the work.
In this instance, if you hold an important government position and your car keeps getting stolen, maybe you could pay to have someone watch your car. Or pay to have a better security system installed.
If think that if you want the world to change, then you should put in the effort to make it different. However, very often what I've been seeing is that people want the world to change and their contribution is to figure out how to compel other people to do the work for them.
https://www.reuters.com/business/environment/eu-commission-p...
https://www.theguardian.com/environment/2024/jan/27/a-wolf-k...
My kit can easily do a LOT of naughty stuff. JUst because I can, doesn't mean I do. But again, this won't just be a flipper zero ban, but a SDR RX/TX ban.
(Im aware the flipper0 is not a SDR, but using the chip Texas Instruments CC1101 chip, but is functionally able to record/playback IQ-ish data.)
Writing like this is one of many reasons I despise "journalism" now.
Edit: it's also a little funny to see people who work in tech throwing stones at journalists
But it's so insane when people act like we didn't go to war with spain in 1890s over a supposed attack on our warship that DID NOT HAPPEN, and then didn't increase our involvement in war with vietnam over a supposed attack on our warship that DID NOT HAPPEN, and then we didn't go bomb the desert for two decades because they were full of supposed WMDs that DID NOT EXIST. Yellow journalism is older than your grandparents.
Context is very important, and the context implies US so it is important to specify.
Wait, that doesn't follow. All squares are rectangles but not all rectangles are squares. In fact, most rectangles aren't squares.
"Canada wants to ban the Flipper Zero" would have been the same word count and infinitely more descriptive.
Also, I'm not going to read the contents of every bloody article. Especially if the contents don't particularly interest me. Headlines exist for easy and reasonably accurate summarization, which this one fails to do.
The least you could do is refrain from commenting on articles that you haven’t even clicked on.
But then they wouldn't get clicks that are ultimately worthless to literally everyone involved except for them!
And I mean it's not the only stupid thing that journalists do. I just so happen to live near the capital of the country. I'll see articles that say Ottawa wants to ban single-use plastic bags. The city of Ottawa, or the federal government by using the capital city name as shorthand? Then you read the article and it is often impossible to find clues to indicate which organization wants to do the thing.
This seems like a picayune complaint, especially when the article has one the most responsible observations possible.
where the Canadian government claims, without any evidenceHere's their top (place-specific) headlines right now: Tucker Carlson+Putin (US/RU); Alejandro Mayorkas (US); Trump/Taylor Swift (US); Neo-Nazi concerts (EU)
GP is surprised the article doesn't confirm their implicit bias.
and then GP misattributes the surprise to "today's despicable journalism"??
nono. tons of quality journalism is fine. please go and think about your implicit bias.
just to be sure we talk about the same thing
Why is it bad to assume that a US-centric site is writing a US-centric article when they put "feds" in the title?
Why does there being an implicit bias towards expecting a US-centric site to produce US-centric articles, mean that the journalism is not misleading?
It doesn't. It is misleading. It is clickbait. You are defending the indefensible.
The Kia one maybe just because it is so well known, but in most cases it probably has no effect at all.
I think you're talking about the same thing.
Getting better at identifying and shutting down these chop shops is a good idea obviously, but that's also hard. On the other hand, forcing companies who didn't give a shit about security for years to pay for retrofitting the shitty cars they put out is actually a lot easier.
/s
You're not even emitting radio -- you're detecting it when it's being shot at you, and that's illegal?!
It may be described as a signals concern but that’s simply window dressing.
(Background: many pre-2023 or so Hyundai, Kia, and Genesis models have a catastrophic security flaw that allows thieves to open, start, and drive affected vehicles without needing any access to the key fob at all. This is far worse than a signal cloning or relay attack and has resulted in skyrocketing theft rates and spiralling insurance costs in many countries…)
Funnily enough, Canada DID require immobilizers, so I think they're not subject to the same BS my car is subject to.
It’s a wireless attack that affects late model cars with proximity-based keyfobs (ie: ones that do not require a button to be pressed on the fob for the car to detect it), including 2022 and 2023 models such as the Ioniq 5 EV:
https://www.reddit.com/r/Ioniq5/comments/17lksic/increase_in...
All countries seem to be affected, not just US models.
The folks who suggested or agreed on this ban ignored how tech moves faster than law creation and enforcement.
This move is really akin to banning a Hello Kitty Lockpick set after discovering most locks are snake oil, instead of demanding reasonably secure locks be sold instead.
Having a simple nice form-factor for something that can do under 1GHz am/fm, BTLE, IR, dallas 1wire, and pinouts for expansion in a simple smaller-than-cellphone device is pretty sweet.
Sure, script kiddies will be script kiddies. And sure, they shouldn't do bad shit, but they will. It's also your responsibility to run reasonably secure stuff.
And no, the FCC won't help you. You're not big money like cell, digital TV, or avionics.
------------------------
EDIT cause of too many comments bullshit:
This conversation chain is sure sounding like https://news.ycombinator.com/item?id=9224 , the whole "dropbox is inferior to FTP". We all know how that worked out.
Having done actual RF, electronic, software, and encasement design - it's nowhere as simple as "cobble it and 3d print a case and done". If it was, we would have seen a Flipper Zero like thing ages ago.
Prove me wrong. If it's that simple, point me to a blog or github that you execute on all the assets within a week. (because it aint)
For the kind of person who does that putting it in a 'ok' case is not that much work...
This is likely @pierat's point: sure, it's possible, but your diy version will be objectively worse in a variety of ways while also taking you a pretty long time to put together.
I've already done basically this level of stuff for my own custom bluetooth mechanical keyboard projects (a keyboard is larger overall, for obvious reasons, but the space beneath it where you can fit electronics is quite limited) and I've made a few resin cases for other electronic hobby projects. The software side of the Flipper is much more time investment but still something I could do if I was fully motivated and had no other obligations getting in the way. Or I would just cheat and specifically use the same STM32WB55 microcontroller and re-use the existing Flipper's firmware directly. Designing a case and a PCB for something of the Flipper's complexity is really not that hard. A day or two each.
Honestly, I find the Flipper's case to be pretty poorly designed for actual usability, it's mostly just directly exposing hardware externally in as small of a space they could get away with, it's a complete pocket brick otherwise. It's a striking visual design with the angles but actually kind of terrible at slipping in and out of your pocket and is awkward and clumsy to use one handed or subtly. Cell phones (at least up until very recently) carried similar radios, IR blaster, SD slots and ports in much better and smaller form factors, and are so normalized in public use that it might have flown under the radar both in consumer's eyes and regulator attention if it wasn't actually so visually distinctive.
If you have the skills to build a GHz SDR from components, and write some C to attack a car starter, you probably have better ways to make $2k than stealing a car. Evilduck obviously has better things to do.
Releasing a Hello Kitty SDR makes these attacks practical for a much less capable population who actually will go steal a car.
I can testify that the bike theft industry in Toronto was driven by one mad genius for a generation. Igor Kenk was like a spiderman villain. He ran a vertically integrated business: providing specialized tools for cracking locks; training on their use; and then providing coke/crack directly for stolen bikes eliminating the cash-handling risks of the business. Just a total mad Chad.
If Flipper enables another guy like Kenk to build an empire of idiot car thieves, I can understand the butt-hurt.
Is there a used market place for them?
Yes, that was a Ron Swanson reference.
Side note, if you/anyone in the Netherlands is trying to sell one I'm interested.
I got mine in the mail, it sat on my desk for a few weeks because I was busy with other stuff, and it made me sad to just have it sit there unused. I wasn't completely sold on getting rid of it, so I put it on ebay for what I assumed to be an outrageous price, and it was gone within an hour. I shoulda bought 2!
Organized criminals can get bespoke hardware simply by hiring skilled labor overlooked or outcast by industry. Skilled tech-based criminals can build their own kit.
This hurts mostly people who want to get into some form of security or hacking and at best maybe stops high school antics but threatens to upend the entire way hackers have always honed their skills by doing and tinkering and also upending the small industries that support them and the security professionals who use the gear in production.
Edit: typo
Edit: typo... Again
Seems like the focus should be on who is allowing and enabling this type of usage. Manufacturers, since they do not act of their own free will, need to be compelled to actually release secure software.
If anything, I love that the Flipper Zero is revealing how vulnerable a lot of this technology is. It hasn't been this easy before to execute radio hacks while mobile, nor in such a game-like/product format. Consequently, I think many people have not realized how secure their devices actually are.
It seems that people are finally becoming aware of how unsafe many of these products are. Unfortunately, they are mistakenly focusing the blame on the wrong party.
Fixing the security holes also protects everything against truly "evil malicious" actors, not just "fun malicious" actors, so it has its benefits to force manufacturers to up their game.
RF spectrum inherently requires rules and cooperation -- if it were a free for all, user beware type of situation, it just wouldn't work.
A lot about order in society relies on most mischievants being actors of opportunity.
I think the brick and window analogy fails here. Thing is, the real bad guys generally already know about the best weaknesses to exploit. I think a better analogy would be pointing out that a storefront in a high-crime area doesn’t actually have glass in its windows. Robbers already knew that. Now the locals are telling the shop owner that they need to install some windows, quickly.
Who are "the real bad guys"? Highly motivated, highly intelligent attackers? That's a valid concern if you're a high value target, but most people aren't. The vast majority of crime is the result of ease and opportunity, not expertise.
I live in a place with high rates of vehicle thefts. Essentially all of them are performed by low skill attackers who use low skill attacks at the physical layer. Carjackers don't care about anyone's rolling code implementation.
I don't think Flipper Zero is anything to worry about, most abuse is probably just going to be edgy kids who are doing annoying things, unsyncing their friend's car keys, etc. But I disagree with the general sentiment that any proliferation of tools that escalates the need for security is always a good thing. Generally, increasing the opportunity and ease of crime is a bad thing.
I genuinely believe that the makers have such devices have coasted way too long on security through obscurity. These weaknesses need to be highlighted so that there's political pressure to fix them. If someone users a Flipper Zero or the like to attack a cochlear implant, they should be punished for it. So should the manufacturer of the implant who released an insecure medical device into the wild. If the Flipper's popularity is what draws attention to the broken medical device, then good for Flipper! Maybe they'll patch the problem before North Korea can use it to launch cyberattacks.
Bad actors are not a monolith. There are many different types of attackers with different means and motivations who will take different actions against different targets and different types of technologies. Threat profiling is a thing for a reason, and it absolutely does matter whether or not a particular threat has the means and/or motivation to exploit a vulnerability. It is the only thing that does matter, outside of a technical academic context.
Yes, security through obscurity is not an rigorous approach to implementing a cryptography system, but it is a completely valid approach in other security disciplines outside of cryptography or digital security. Too many people make the mistake of incorrectly assuming that cryptography security principles apply to the broader practice of security as a whole. Digital security is only as useful as it is to support a holistic model of security. Digital security in isolation is just an academic exercise. It has to be implemented to be useful, and when implemented, operational security and threat modeling are very relevant.
> If a vulnerability is patched, it doesn't matter if there are 1 or 1,000 tools targeting it.
It does matter what the real-world observed rate of patch compliance is, the cost to patch, and whether or not those tools will be used nefariously. If you have an academically obscure remote exploit for a pacemaker, that requires a hardware patch, please don't write a script that makes it easy for non technical people to exploit, and post it on GitHub. While this will certainly encourage a fix to future pacemakers, the cost may not be worth it.
IIRC this is in Canada, but in US (and probably Canada too), FCC has rules against creating harmful interference. Fine + punish the people creating the interference, rather than the tools that people can use to learn, debug + protect these devices that are vulnerable.
For another example of similar politician behavior just look at how LA is handling the graffiti towers. They're driven by concern about being on the national stage and the corruption of the whole system being put on display, not about the graffiti.
This isn't a realistic solution because the difficulty of identifying people abusing these devices is high. The usual US approach is to jack penalties up way high to offset the low probability of capture, which inevitably leads to disproportionate sentences and an even greater erosion of respect for the legal system.
Because such a flood is now easy to trigger, phones now implement rate limiting that effectively mitigates the attacks. After all, you're not legitimately going to see 1,000 Apple TVs trying to connect at once, so there's no need to give each one of them personal attention.
Technology will always develop, it's important to plan and regulate it, sure, but bans are need to be extremely carefully thought out to enforce well.
The people stealing cars are an international organized group that have managed to exploit holes in the federal government, the railroad companies, and the ports. The way they are stealing these cars is outside of the capabilities of a stock flipper, and requires custom hardware.
Banning the flipper is going to do precisely nothing to increase the friction on the problem they are trying to solve.
Banning the Flipper is a minimal effort way to minimize it as an election issue.
Sport shooters can insert a certain James Franco meme here.
So are you more forgiving of it now?
There is something about lowering the bar to disruption, and the possibility of this causing a bit of a reckoning for devices that don't do a good job of "Accepting any interference received"
I use netcat for legitimate things every day. If someone made an IP server that I could hack with netcat, they should be ashamed of themselves. It's not netcat's fault that their security sucks. Well, same with Flipper Zero.
And they would if it were not in a "bright plastic case"?
That's one of the situations where I'd feel justified in taking a device and stomping it to bits, and I'd support anyone else doing the same.
If anyone does encounter this in the wild with Apple devices, first, install your damn updates because I'm pretty positive this is now blocked, but in the meantime turn on Lockdown mode to keep this from interfering with you.
Apropos of anything else, the FCC regs around the 2.4GHz spectrum are pretty explicit, "Part 15 devices ... must accept any interference that may be received". In their eyes, the device that is flawed is the phone, not the Flipper.
As for courts, if this hadn't already been resolved (at least on iOS) I wonder if you could request that jurors and the judge turn their phones on for a demonstration. Given the state of Android updates in the general public, it'd probably still be effective on a significant percentage of people.
After the war there are going to exist a whole bunch of people who know how to deny GPS, defend against drones, build attack drones that bypass primitive countermeasures, spoof mobile networks, monitor the RF space for unencrypted signals, and set up actually secure comms. And not all of them are going to remain completely silent about all of this. Toys like Flipper are going to be the least problematic. Banning it achieves nothing.
BTW, wanna connect to the Apple TV? :D
I bought another a couple months later and if I can get over my ADHD, I still hope to make the radio chat useful.
My SO was like, "Wheres mine?"
On the first pass I read it as: "She cited having her tinfoil hat friend looking into it"..
Let me guess...via 5G?
It is absolutely a scapegoat. There's nothing magical about it, and it doesn't do anything that can't be done with other devices.
Also the article isn't wrong, it's cute!
There are plenty of automations you can do with a treadmill and a smart plug, but I can't think of a single use for a treadmill and any of the components in a flipper zero.
Are you just turning on the fan from the treadmill? That would be better served using a power reading from the treadmill and an IR blaster.
You can tie in other automations as well. I have mine setup to turn off a light that causes a TV glare visible only from the treadmill and to turn on an extra speaker next to the treadmill
BroadLink RM4 Mini IR Universal Remote Control, Smart Home Automation Wi-Fi Infrared Blaster https://a.co/d/8GnOVRU
If you can play with a flipper zero you can setup automation.
Of course I can set up automation. I have Home Assistant running in my house already.
I also happen to own a Flipper that does a great job at controlling these devices.
Why would I introduce complexity where simplicity is working great?
I'm done with this conversation, I'd say it's been fun, but..
https://www.reddit.com/r/Ioniq5/comments/17lksic/increase_in...
The dolphin was named Jones not Flipper. And Jones was also a part of the short story that predated the film adaptation by several years. Check out "Burning Chrome," William Gibson's collection of short stories, for this and others. Well worth the read.
Simple, cheap, ecological, durable – what's not to love?
At any point did you stop and ask yourself, "I wonder why they put that fence there?"
Simple, cheap, ecological, durable – what's not to love?
What's not to love is the part where even a random HN user who hasn't professionally worked on cars in over 30 years could probably be driving down the road in your car before your dog even barks. Go ask some (probably former) Kia and Hyundai owners.
Meanwhile, the wafer locks used for car keys to allow them to be used "upside down" unlike your house keys are super easy to pick, because wafers are inherently flexible and the tolerances have to be lax.
Rolling code key fobs and immobilizers are actually the most secure cars have ever been, and made it way harder to steal cars in general right up until two brands wanted to save 100$ per car and ALSO design them in the most stupid way possible (the raw key cylinder is easily accessible and manipulatible to anyone with a rock, compared to other brands that bury the cylinder itself deep into the steering column so it's protected).
We don't need any new law, we just need Kia and Hyundai punished for cheaping out on important security features.
If Ford tomorrow replaced all keys with a button with no security, would you want to ban fingers? The fingers aren't actually the problem here.
Canada also makes transponder keys mandatory, because it's just too easy otherwise.
I mean - why don't we just integrate the dongle signal being necessary to unlock the car into the existing process and still require a physical key. As a bonus the key could be designed to interface with the car to communicate any signing tokens over a wired connection in the key socket instead of having any radio/wireless capabilities at all.
The fact that you effectively need two keys to steal the car is more secure.
See Lockpicking Lawyer popping many car lock types in these videos. If he wasn't trying to show and tell on a video, most of these car locks would just take a few seconds in skilled hands.
https://www.youtube.com/watch?v=eVZ67dcY9_g https://www.youtube.com/watch?v=F8fbxN3Z5e8 https://www.youtube.com/watch?v=c1MMT08A9kY https://www.youtube.com/watch?v=FRZ2YXlZV-o https://www.youtube.com/watch?v=ZtkNQSk9xRU
Physical keys combined with [actually] secure electronic or radio combinations are still your best bet, though Kia and Hyundai felt like they could save a buck by not doing that. But even still, if the user can trivially or quickly unlock something, there's a good chance the design constraints will force a compromise that weakens security.
That's obviously the same for FOBs, except that you don't even need to hide yourself to fraudulently open the lock, as you can do everything hidden a couple meters away.
If you purchase a firearm from an FFL anywhere in the United States, you are required to fill out an ATF form 4473 and do a NICS background check. There isn't a giant database of all firearms in the US indexed by owner and serial number, but those 4473s do exist and are handed over to the Federal government pretty regularly by FFLs.
> licensing
In most places (eg those with "Constitutional Carry"), the only license you need is to not be a prohibited person (not mentally ill, a felon, no violent misdemeanors involving stalking or domestic violence) and old enough to purchase a gun in the relevant state. But if we just go by raw population, most people in the US would need to go through a more substantial process.
[1] - https://archive.is/0Hc1l
On the other hand there is a similar device that can spoof GPS. When I saw that I was more along the lines of OK that maybe we should ban.
But I can totally see how they're useful in other less developed countries.
It's RISC-V.
The current government of the Trudeau Liberals knows what actual steps it could take to combat car theft, involving dismantling organized crime controlling the ports, and does not want to do it. Instead, they create a scapegoat, ban it, and pretend that they're doing something.
What OP was looking for was more along the lines of the Arduino / ESP projects build much like the flipper.
The previous discussion title used "Canadian government" to refer to these particular Feds: https://news.ycombinator.com/item?id=39308731
But you're wrong, because the largest English-speaking country with a federal government is actually India.
It's made to operate like a non-certified radio device, is there even new laws needed to cover the case where you emit radio waves without licence ?
+ at risk of being coerced in following Russian laws: https://www.reddit.com/r/flipperclub/comments/13b6emd/flippe...
However, the operator is ultimately responsible for the emissions of their devices.
They appear to live in London, so silence isn't good enough in my book.
Though I've long ago stopped buying toys from China, so this is probably ruled out for me on that basis.