Flipper Zero Gets Major Firmware Update, Can Eavesdrop on Walkie-Talkies | Hacker News Reader

Flipper Zero Gets Major Firmware Update, Can Eavesdrop on Walkie-Talkies

pcmag.com

242 pointsCharlesW65 comments

I'm really happy about the firmware updates. When Flipper Zero was crowdfunded, the deal was that the tool will be available once the hardware is good enough to fulfill the promises. And so the software will be updated later.

I'm happy that they keep they promises.

Walkie-talkies can "eavesdrop" on walkie-talkies...

Seriously. People really need to understand that CTCSS and DCS aren't actually privacy features, but convenience features for filtering out _other_ people's transmissions a user isn't interested in. It's the exact opposite of privacy. I guess the marketing as "privacy codes" worsens the situation.

I just got my GPRS radio license and this was a really strange phenomenon to encounter. Apparently the FCC doesn't allow actual encrypted comms in this part of the spectrum, so the "privacy" codes, like you said, are really more just convenience codes, more noise cancelation than anything for privacy or security.

It was weird trying to explain this to my family, too. Basically just had to tell them "Nothing you say is private, and you should all say my call sign at the end of each transmission." We all felt like dorks, but it was super convenient in a place with no cell service.

Get an itinerant frequency -- $300, requires no coordination, and you can encrypt your comms.

One of the (ham) radio clubs that I'm a member of does this as a benefit for the group, and it's something that's nice to have: I can give my wife a radio and not worry about what she may or may not say if we have to take two separate cars when we road trip.

I've been meaning to do the process myself, but, I haven't had the time (and honestly, I'd want someone else to do the paperwork for me so I'm more likely to pay someone else to do it) recently, but, this might be the thing that prompts me to go and do it.

73 de K4IMW/WQZQ315

Cool!

What sort of radio do you use?

My friend and I tried to do -- the two of us in different cars driving down the same stretch of highway this with GPRS radios and very quickly we were not able to pick up the other's broadcast. We assumed it was that we didn't have big enough antennas and were not using a repeater.

Note - others were driving we were each a passenger in our respective cars.

Did you have car mounted external antennas? I'm totally new to the hobby so I might be wrong here, but I believe the handheld units are kinda trapped in a Faraday cage if you use them inside the car. If you have the 20W+ mobile (not handheld) kind and mount it to an external antenna though, there should be enough range even just with GMRS as long as you're not on the other side of the mountain or something?

Edit: Sorry, it's GMRS, not GPRS (facepalm)

We were not using car mounted antennas. We will try this next time!

Interesting! I was under the impression that the FCC was actually somewhat strict about part 90.35 eligibility, in that you have to provide fairly detailed specifics of your business use case or how you fall under the various educational/nonprofit exemptions, and that if you told them you wanted it for personal use or supplied a thinly veiled excuse they'd tell you to get lost. Maybe that understanding is outdated. I can imagine a HAM club having an easier time justifying that than you would as a random individual.

You dont have to provide detailed specifics of your business use case, usually just a sentence is fine.

But 90.35 does not allow for individuals to be licensed for personal communications. My guess is that if a ham club is offering this to members, it is doing so as an educational institution, or a public safety organization. If the license is granted that way, using it for personal communications would be impermissible.

I doubt that there are requirements on the number of members of a ham club, you could probably have a 1- or 2-member "club" for the adults in your household, right?

You can read the text of 90.35 here: https://www.law.cornell.edu/cfr/text/47/90.35

Could you get the FCC to grant you a license you if you say you have a 2 person organization in your house? Maybe, I'd even say its likely if you spent a few minutes to get an EIN before getting your FRN.

Does that make it legal to use a commercial license for personal use? No.

I'm using EFJ 5100's and have a full KVL, and software that can make Christmas Tree radios.

P25 Encryption is pretty good, in terms of quality.

While definitely better than the non-encryption of CTCSS etc, P25 encryption has some relatively concerning implementation problems. It's possible none of these actually matter for your usecase as many are related to UX around configuring and using encryption in an institutional setting, but the unauthenticated traffic injection, induced transmission and jamming issues are, well, not great no matter how you look at it.

https://www.mattblaze.org/blog/p25

https://www.mattblaze.org/papers/p25sec.pdf

I will grant that the open-source kfdtool keyloader boxes are neat.

I have been meaning to see if I can repro the induced transmission via retransmission requests thing when the data packet stuff is fully disabled via CPS, but a friend permanently borrowed my hackrf so that project is on hold for now. I'm not optimistic, though, due to the comments in the paper about where in the stack the retransmission request is processed.

A lot of these issues if not all are specific P1 P25, which if you're on conventional you're using. I find it interesting they treat P1 as if it's different from normal FM, it is not, its C4FM - so all the normal capture effect stuff works fine.

In the end, the goal of P25 was to make it almost, but not completely possible to listen in - I'd also note the way they did their testing is not how these radios are typically deployed, which is not direct subscriber to subscriber on simplex, its either via a conventional repeated system or via a trunked system.

I do agree that frequent key changes are bad - but for entirely different reason, they're an operation nightmare. Most agencies who deploy it either use very long lived keys deployed by KVL, or deploy a UKEK and then change keys via OTAR on some cycle, which is not infrequently, never.

My belief is the theoretical risks on P25 are not well proven in reality, you're more likely to have some interference issue over say, intentional jamming.

Either way a radio for ~75 bucks plus supporting hardware that will do AES256 isnt bad - and DES-OFB/DES-XL is good enough to keep the casual listener out, which is more or less the point of the crypto here. Also I know they make a big deal about unit ID's, but they carry no meaningful info, its just a hex ID.

Is there an actual EASY guide to dealing with itinerant licensing? The FCC paperwork is beyond confusing to try to get a single itinerant freq.

I do these all the time for work, you can email me if you have a question. It takes about 15 minutes if you are familiar with the process.

Individuals using radios for personal use are not eligible for the types of licenses I am familiar with, though.

> Get an itinerant frequency -- $300

FCC fees are actually only $205. I do these all the time for work.

Also, you can get multiple frequencies on the same license, and you should if you are getting itinerants because there are so few and they are heavily shared.

The application takes around 15 mins if you're familiar with it and can be done completely online. If you've never done it before, it might take you an hour or more to figure out.

All that being said, the itinerants I am familiar with are in part 90 and that is only for commercial use. Its not clear to me that an individual would be eligible for this type of license for personal communications.

What about Meshtastic and CB? CB is kind of awful but it's cheap, and Meshtastic is text only but has amazing range.

I still can't believe any of this is even an issue though.

There's no technical reason we couldn't have cheap all digital bubble pack radios with miles of range and mesh support, running deep learning codecs on an ASIC or something....

Every time I'm on a project that needs radios it's an expensive hassle that seems like it should have been solved by now.

CB doesn't seem to solve anything that FRS (walkie talkies) or GMRS (nicer walkie talkies with call signs) doesn't already do better. Meshtastic is interesting but not for the use case of general use between family members (no way I want to build and support DIY hardware like that just to use as walkie talkies... GMRS radios are complicated enough already for the average non techie user).

It's so bizarre coming into the radio world from the tech/web/network protocols world. On one hand everything is so nicely defined and regulated and licensed and shared. On the other hand all the UX seems 20 years in the past.

I'm excited about things like DMR and handheld to handheld texting, but that's a harder license to get and there's only one expensive handheld that actually supports the texting, I think...

There's starting to be off the shelf Meshtastic hardware, otherwise I'd agree.

Actually using custom hardware or soft is not something I consider a reasonable choice, basically ever, unless there's no off the shelf alternative, or I'm specifically being paid to create said off the shelf alternative.

CB has a bit better range but otherwise I'd mostly agree.

In practice FRS is the only thing I ever actually use besides checking in at the weekly net with a Baofeng, it's just the standard everywhere, even for small scale commerical stuff, and it's what everyone I know already has.

Is there no license available for private (doesn't have to be encrypted per se, just don't want to spam the whole channel) comms for general individual/family use?

I'm not discussing anything secret, just making breakfast plans etc, but having to try to find a quiet channel every time is such a pain...

I got my hands on one of those cheap UV-K5 Radios and the first thing I did was try to listen in to one of my FRS Radios and discovering all their channels & sub channels/privacy codes.

Discovered this list while learning & researching:

https://www.k0tfu.org/reference/frs-gmrs-privacy-codes-demys...

I was previously unaware of these particular radios.

You just inadvertently sent me down one hell of a rabbit hole.

It arrives Thursday.

And they keep improving - I think the latest revisions come with expanded flash for custom firmware.

I've got a few UV-K5(99)s right now, and I end up giving them away to friends (even if I replace the duckies and keep the tri-bands) when new models release. With the custom bandpass and filter mods, they're reignited a very old interest of mine.

Very interesting! Where did you get them?

Apologies if this has some sort of referral in it. I copied straight from the Amazon app.

https://a.co/d/gEGW5gr

wow, that's dirt cheap! Definitely a impulse purchase territory lol. Is this the best cheap one to plug into PC?

Caveat: I'm a ham, but not an expert.

The answer depends on what you want to do or explore. You have many different options, including RTL-SDR type USB dongles for use with software like SDR# and gqrx.

The new UV-5RM have a much better display and cool features like one-key frequency copy and USB-C charging.

Can you link me? The only 5RM I am pulling up is a Baofeng.

Is the 5RM as hackable as these?

The Baofeng is what the parent you're replying to is talking about. I own it as well and it does have a nice display and one button copy. But I prefer the TIDRADIO TD-H3. Not as cool as the Quansheng in terms of hackable - but a phenomenal radio for the money. I bought more radios in the last year than I've bought in the last decade. I've got both Ham and GMRS licensing in the US.

Thats TIDRADIO TD-H3 is pretty cool looking.

Yeah we live in an interesting time where you can get powerful HAM handhelds for a fraction of what they used to cost.

You're going to want to look into CHIRP: https://chirpmyradio.com/projects/chirp/wiki/Home

Those are really good radios for the money, have fun. I have nicer radios but still use my UVK5 just because it's easy to use and works well. Plus all the firmware mods are fun to play with.

FYI if you're not aware... not to be the no fun police, but you do need a license to transmit with one. And it's technically not legal to use them on FRS/GMRS/MURS frequencies even with a license, though that's probably the least enforced rule on the FCC books. Assuming you're in the US at least.

I found the UVMOD website that lets you make a patched Firmware to enable all sorts of hacks.

Since I don't have a license yet, the next time I'm playing with it, I am going to enable the TX block on all bands, so as to prevent any accidents.

Of course, much to the FCC's annoyance, in the "dangerous mods" list, you can also choose to disable the TX block on all bands. You really shouldn't do that, though. The folks that run this project are trying to do the right thing and warn anyone that goes down that path ...

https://whosmatt.github.io/uvmod/

I actually did install the frequency block disable mod. Mine lives in my car as an emergency radio, so I figured might as well have the ability in an emergency (which is allowed) and just stick to frequencies covered by my amateur license normally. Granted the mod isn't really very useful since the radio performs very poorly out of band and sprays out interference, so I should probably just take it back off.

I don't think the FCC cares too much about mods like that on hardware that's meant for licensed amateurs. Amateur license covers all sorts of radio modifications, you're supposed to police yourself and manage what you have the right to do. It's actually using the mod to transmit out of band they would fine you for (theoretically... you're unlikely to get caught), not just having the ability. The thing that they get pissed off about is when people without a license can buy hardware meant for amateurs and easily use it out of band without really needing to do anything. That's what they've cracked down on in the past, especially shady importers on Amazon marketing unlocked amateur radios for bands like FRS.

What would you call them, then? “Isolation codes” or “subchannels”, maybe? I’ve seen some use of the former, but both are imperfect terms. I’ve yet to hear a suggestion that’s particularly better. A term that’s only slightly better won’t gain any traction.

“Selector codes” would be more descriptive. They select which conversations you want to hear.

“Conversation codes” speaks to me (heh)

"squelch codes" probably conveys the meaning more correctly.

people understand the idiom that just because your radio has squelch set (too high, perhaps) that it doesn't mean someone else can't hear it.

otherwise, CTCSS codes works fine, that's the technical description of what it is. and actually they call them "squelch tones" there. it's only motorola that branded them as "private lines", that's their trademark for an adequately-described term. Much like Tesla "Full Self Driving"/"Autopilot", it's kind of a misnomer and definitely breeds (deserved) confusion.

https://en.wikipedia.org/wiki/Continuous_Tone-Coded_Squelch_...

I submit that most non-technical people have no clue what “squelch” means. It’s not a commonly used word outside of electronics. And it makes it sound like your radio’s output is being suppressed, which is inaccurate in this case. I think some more appropriate terms could be “party”, “group”, “topic”, “line”, or “room”.

the radio literally has a squelch knob on it, and turning the knob is required if you want to not hear static constantly or if you want to hear your traffic when they call you, so if you somehow manage to own a radio without knowing what squelch is it’s kinda on you.

let’s give users at least a little bit of agency here

"Filter codes" would prob work

What prevents people from transmitting encrypted information? Isn’t that just like speech that might travel over the airwaves?

Technically nothing, but legally it's just not allowed in the US (neither for FRS/GMRS, nor for ham radio operators, with very few exceptions).

Interesting, is speaking in a language that nobody else understands counts as "encrypted transmission"?

That’s what I mean. Isn’t any data the same as speech in general?

The phrase "criminal intent" comes to mind. No idea if anyone actually cares whether a signal is clearly understandable or not unless you're targeted for some reason.

the content of the speech is protected. you can say "fuck this guy" where this guy could be anyone.

but you can't legally send encrypted over the radio, since those protocols are restricted by the FCC.

You won't catch a charge for what you said, but you might get fined for misuse of the radio band. its the same way you can't spray paint a slogan on the front of someone's business -- the content is fine, but the medium is not.

Indeed the opposite. For example, a party of us was on a mountaintop going through the FRS/GMRS channels with CTSS off and heard another party. We were curious to ask them where they were, but they couldn't hear us until, manually stepping through the CTSS options, we found the one that enabled their receiver to hear us. It's not a privacy filter, it's a "don't bother me" filter.

Is the Flipper Zero still legit? I know it’s only quasi legal in some places. I see a lot of ads for it to the point where I kind of suspect it’s some sort of FBI entrapment program. Maybe I’m just being paranoid.

It is an software defined radio with a nice interface built around it. Perhaps the nice interface has lowered the bar enough for it to now be in the crosshairs of the state, this has happened before, sometimes just making the tool easy enough for anybody to use is enough to make it illegal/controlled.

The point being the flipper does not do anything that is not possible with other tools, it just makes it easy.

It's not actually an SDR, it just has a discerning collection of hardware radio modules on it. If it was a self contained SDR you would expect a much beefier processor and power draw from the device from all the digital signal processing.

Not as small or sleek, but you can still get everything Flipper Zero is doing with Arduino or a small laptop with basic antenna hardware. Flipper Zero is the iPhone of radio pentest gadgets.

The device is worthwhile if you are exploring this kind of hardware security and also want to poke at other things while you're on the go to enhance your learning. The fact they added a Javascript engine so you don't have to program in C/C++ when you want to run something custom, I think will be a huge boon.

Don't undervalue getting all these features in a purpose-built device with a purpose-built OS.

Official release: https://news.ycombinator.com/item?id=41500279

Still looking for a cheaper alternative. All I need is a cheap portable SDR I can program. No need for a fancy enclosure or UI.

Are you not satisfied with the myriad of cheap baofeng/clone UHF/VHF handhelds that support CHIRP?

why not use a Raspberry Pi with every RTL-SDR Stick you can find? Or spluge on an HackRF :)

Anybody can eavesdrop on walkie talkies. I can do it with my baofeng. It's not that interesting.

What is interesting is everything else that that device can do.

>What is interesting is everything else that that device can do.

Leaving me hanging.

You were hanging when I got here.

I think this is undercutting the announcement. A baofeng is a specialized tool specifically for RX/TX 2m and 70cm analog audio radio waves. Of course it can listen to walkie talkies which are transmitting on 70cm.

I read your comment as someone posting about making toast with an iron and saying "Anyone can make toast. I can do it with my toaster. It's not that interesting"

All things that device can do is interesting because it is so many things, including this new ability.

UV5R with antenna upgrade works perfectly. I was able to listen to ISS from my backyard too. Hard to believe it is $20 for the quality of its hardware.

Reply on news.ycombinator.com