Let’s ban a product instead of solving the issue at hand… Seriously? I hate my country more and more as each day passes
What does blackface Trudeau have to say on the matter I wonder.
Who gives a shit? He prob doesn’t know what it is or what it is used for either, and neither does his party apparently
The device only gives easy access to already extremely weak/non existent security systems. That’s literally it.
It’s just something that’s existed forever, but put into a convenient package and marketed well enough that suddenly normal people are realising how insecure their electronic systems actually are.
Kinda like how they used to make pacemakers hackable because they never thought to add any security at all. I bet many of them still don’t.
Anyway, the issue lies not with this device, which can’t “hack” anything with any actual security, the issue is with manufacturers making devices that literally leave the door wide open to anybody with an extremely basic electronic sniffer/cloner device.
Yep you can do the same operations with a RTLSDR (20-40$) and a signal repeater (20ish) and raspberry pi/netbook. It’s somewhat harder to do if you don’t know the software but it really just exposes very insecure hardware. Companies should put a semblance of security and it would take care of things. These kind of devices are everywhere not just the flipper. Flipper just made it a tiny bit more friendly.
So, rather than hold automakers accountable for not having proper and effective security practices you focus on a tool designed for security professionals.
This take is so unbelievably brain dead I’m surprised these people are able to breathe without machine assistance
Auto makers are really bad about it. CAN Injection has been a thing for a while now. Cars are going IoT, and a flipper will be the least of the vulnerabilities as things progress.
I’ve just had premonitions of cars crashing into each other in car parks when the ‘self parking’ mode is hacked…
Removed by mod
As things progress, security should improve. Keyword SHOULD. But they don’t because good security ain’t cheap.
Removed by mod
Direct quote from https://flipperzero.one/:
Flipper Zero Multi-tool Device for Geeks Flipper Zero is a portable multi-tool for pentesters and geeks in a toy-like body. It loves hacking digital stuff, such as radio protocols, access control systems, hardware, and more. It’s fully open-source and customizable, so you can extend it in whatever way you like.
Flipper Zero is a portable multi-tool for pentesters and geeks
multi-tool for pentesters
pentesters
Pentester or penetration tester is a cybersecurity professional that can be located on red team (offence) or blue team (defence) and works to determine potential vectors for attack that need to be rectified or exploited, depending on who they’re working for and what their goals are for their employer.
I mean of course the official website isn’t going to say “it’s a great tool for hackers and car thieves”
A tool is just that, a tool.
Just because what you consider immoral or moral individuals use it doesn’t change the inherent nature of the tool to be used for specific circumstances. You’ll also notice I didn’t put any deterministic language when describing a penetration tester, because regardless of what side of the law they’re on they’re still cybersecurity professionals, it’s just that one side happens to pay better.
A knife can be used to dissect as well as it can be used to mutilate or even vivisect. How a tool is used is determined by the user not the creator.
Complaining that a few people use the item for nefarious purposes when the majority of problematic cases are issues at the developer level for the items being affected (i.e. vehicles) is extremely short sighted. Are you going to restrict all PC’s because they can be used for network intrusion?
Are you going to limit access to the internet because the freely available information can teach anyone to create a dirty bomb?
The premise of your outlook is inherently erroneous in my opinion.
I’m not talking about the uses for the tool, I’m talking about how you used the company’s own website as a point of reference for the tool’s capabilities. They have a profit motive so of course they’re not going to advertise unsavory uses for their product, just like your knife companies aren’t going to advertise that their product can be used for mutilation.
But go on with your pedantry I guess.
The irony of you saying I am the one being pedantic is seriously hilarious.
You should probably work on your reading comprehension and critical thinking skills.
The entire premise of your argument is ‘only criminals use this tool’ or ‘the majority of users of this tool are criminals’ when that is fundamentally and objectively incorrect.
You clearly lack any serious experience in computer science, let alone cybersecurity, and it shows.
If the flipper can help you stealing a car, the flipper is not the problem, but the neglect and incompetence of the car company is.
Removed by mod
Maybe cars should not be so easy to steal… I thought we came to an agreement on this.
Sure, go ahead and blame the tool.
Then blame the science.
Then blame the scientists who developed it.Blame everything but the thief.
\s
Then blame free will for all crime in the world and all wars waged.
Removed by mod
I remember one of my seniors at work asking me how open source software manages to develop so much without a direct monetary incentive.
“There’s no lack of resources to give everyone everything they want.” <- is the point.Our civilisation has enough people who like coding, willing to put their spare time into OSS, to be able to get good quality tools for use in all fields. Now all we need is for all of those people to be given enough spare time without having to worry about things like mortgages, loan payments and basic survival in some cases and everyone can profit (including the companies who would be giving them the spare time).
Removed by mod
First blame the thief. But then in the same breath blame the manufacturers that refuse to sell cars with meaningfully working locks. If you understand the tech many car companies keep selling cars that have locks that are about as secure as a zip tie.
Removed by mod
The companies will just go around blaming some random engineer for it and then go on throwing money for PR stuff.
I see how that might make sense to lawmakers. It does present itself as a problem. But the fact that it is a symptom of a security issue is the reason it shouldn’t be outright banned. I haven’t used the thing, but it has looked to me like a pretty snazzy multitool.
It’s like banning swiss army knives. I can see why it looks like it makes sense, but it really doesn’t.
It reminds me of a lawmaker in one of the flyover states that wanted to make it illegal to look at the source code of a website.
Think about this for a second.
And realize that this twat is writing laws.
I had not heard of that one. Was it the “internet is full of tubes” guy?
No, it was a few years back when a researcher found that there was a plain text file of county employee social security numbers just sitting inside the JavaScript of a government website.
There are too many Google results from the upcoming election for me to sort through but suffice it to say, the guy was a class A idiot.
I’ve been watching flipper since it was announced. I should probably buy one and play with it.
All this is going to do is increase sales of the thing and probably increase the number of “kids” trying to break into cars. Streisand effect ftw.
I have one.
Its fun.
But on the subject of rolling codes, I was able to get through a security gate that relies on, essentially, a garage door opener.
The exploit relied on the ridiculously low amount of rolling codes it cycled through.
Capture one, and try it a few times to get through.
Cars are more robust. Despite tinkering with it for about 8 hours, I wasn’t successful with defeating it. That being said, I picked up the device, in part, to start messing around with various signals as an educational tool.
I really should get one. I should also grab the latest version of kali (if that’s still around), I haven’t played with that in a long time.
Kali is still around, I last did an install ~6 months ago, I think?
That got put on the back burner though, not because of the flipper, just life.
It is: https://www.kali.org/get-kali/
I should add this and flipper to the list of things to play with at some point soon.
The real problem is Flipper Zero is just a nicely packaged tool that can also br easily assembled with other off the shelf parts. And those parts alone can do many other things that should not be made illegal. The real solution should be from car manufacturers and ensuring that they don’t use tech that can be so easily hacked.
Car security is horrible
I bought a copying remote from aliexpress thinking “no way my car has a static code and not a rolling one… right?”
Nope, fuck you Kia, any stupid cheap remote from aliexpress can be used to copy keys from a surprising amount of cars.
Car security should improve and I hope this becomes a big enough issue that it get’s better regulated
I would have expected an OTP type code to unlock a car… Considering how expensive cars are, this is really cheap to implement. Heck, I could buy a yubikey for €25, and I’m sure if a big company wants to buy a million of them, they can do it for a fraction of that cost… A brand new car costs tens of thousands…, it should’ve been a no brainer to include better security.
Yeah, but saving 1.50 per car improves some stupid business performance indicator, which respectively will get some manager a nice bonus.
I believe you, this world is so weird… For companies that make tens of billions in profit, saving a million dollars on chips is almost a rounding error compared to the benefit to their reputation when their cars are more secure.
Ever since I first met the insanity that are business indicator numbers, I lost my believe in humanity. People knowingly hurt their companies effectiveness and prosperity just to improve those numbers. And they get rewarded for it.
RollJam and RollBack are the exploits for bypassing rolling codes. These exploits are possible because you can replay captured codes at a later time.
What’s happening in most cases is the proximity-based fobs are simply amplified with a device to reach the person’s car in the driveway, since most people keep their keys by the door, and in some cases even within reach of the car without a device. It’s this low hanging fruit where the theft happens, or just a tow truck…
The Flipper is more of an enthusiast and pranking device. The devices used in actual thefts are like disposable $50 alibaba pieces of shit. Canada is effectively creating a clandestine market for simple radio amplifiers made from the most basic electronic components. As someone in Canada who used to build the classic cmoy Altoid-tin headphone amps to sell on etsy, this is tempting…
It seems like maybe the problem is that automakers were able to widely market vehicles that use wireless protocols that are relatively easy targets for attack. This was never properly secure.
Automakers should absolutely be held to higher standards (in general) than they are, and it’s not likely that banning specific devices is going to have any measurable outcome here. It’s pretty well known that people buy and sell malware, and people can just… make devices similar to a Flipper with cheaply and readily available hardware.
This is just dumb posturing to avoid holding automakers and tech companies accountable for yet another dumb, poorly thought out, design feature.
And obviously it doesn’t stop at cars. It seems pretty clear that snooping on any feature using RFID or NFC tech is only going to become more widespread. Novel idea: what about using… actual keys as the primary method of granting physical access? Lock picking is obviously possible but a properly laid out disc-detainer lock is pretty goddamn hard to bypass even with the proper tools, and that skill can’t just be acquired in the same way as with electronic methods of bypass.
Ah yes banning the tool will 100% take care of the problem.
That’s the main issue here, the flipper isn’t useful in car theft
Not only that, you can easily buy more advanced car stealing tools that are made for this purpose from Chinese websites.
Clearly criminals who steal cars will DEFINITELY listen to this new law banning their tools.
We just need to make crime illegal 👌
That said, this is the argument that gun-owning cowards use, so does it fall under the “How do we stop this happening, says only country in the world where this happens regularly” category?
Probably a wise move to nip it in the bud
Maybe, but guns are a very different problem.
A toddler won’t kill their sibling with this by accident.
Oh right, forgot about this little thing. Had my eye it long time ago, but forgot about it. Thanks for reminding me Canada. Should probably read up on Streisand effect.
They are a fun little tool for hardware hacking and teaching yourself more about what it can do. I bought one last year.
I think people need more visibility over the electromagnetic spectrum, not less, to catch car thieves. This needs to be white hat into a car theft attempt detection kit.
I absolutely love mine :)
I’ve got one and it’s a lot of fun. Can’t lock me out of anything now.
