Canada Bans Flipper Zero Over What It Imagines It Does

February 12, 2024 by Donald Papp 104 Comments

Canada’s intent to ban the Flipper Zero wireless tool over car thefts is, on the one hand, an everyday example of poorly researched government action. But it may also be a not-so-subtle peek into the harm misinformation online can cause by leading to said government action.

The Government of Canada recently hosted a national summit on combatting vehicle theft, and Minister of Innovation, Science and Industry François-Philippe Champagne proudly declared immediate actions being taken to ban devices used to steal vehicles by wirelessly bypassing keyless entry, the Flipper Zero being specifically named as one such device.

And yet, defeating a rolling code keyless entry system is a trick a device like the Flipper Zero simply cannot pull off. (What cars have such a system? Any car made in roughly the last thirty years, for a start.)

Continue reading “Canada Bans Flipper Zero Over What It Imagines It Does” →

IoT Air Purifier Makes A Great Case Study In Reverse Engineering

February 6, 2024 by Dan Maloney 10 Comments

Here at Hackaday, about the only thing we like more than writing up tales of reverse engineering heroics is writing up tales of reverse engineering heroics that succeed in jailbreaking expensive widgets from their needless IoT dependency. It’s got a real “stick it to the man” vibe that’s hard to resist.

The thing is, we rarely see a reverse engineering write-up as thorough as the one [James Warner] did while integrating an IoT air purifier into Home Assistant, so we just had to make sure we called this one out. Buckle up; it’s a long, detailed post that really gets down into the weeds, but not unnecessarily so. [James] doesn’t cloud-shame the appliance manufacturer, so we can’t be sure who built this, but it’s someone who thought it’d be a swell idea to make the thing completely dependent on their servers for remote control via smartphone. The reverse engineering effort started with a quick look at the phone app, but when that didn’t pay off in any useful way, [James] started snooping on what the device was talking about using Wireshark.

One thing led to another, wires were soldered to the serial pins on the ESP32 on the purifier’s main board, and with the help of a FlipperZero as a UART bridge, the firmware was soon in hand. This gave [James] clues about the filesystem, which led to a whole Ghidra side quest into learning how to flash the firmware. [James] then dug into the meat of the problem: figuring out the packet structure used to talk to the server, and getting the private key used to encrypt the packets. This allowed a classic man-in-the-middle attack to figure out the contents of each packet and eventually, an MQTT bridge to let Home Assistant control the purifier.

If it sounds like we glossed over a lot, we know — this article is like a master class on reverse engineering. [James] pulled a lot of tools out of his kit for this, and the write-up is clear and concise. You may not have the same mystery fan to work with, but this would be a great place to start reverse engineering just about anything.

Thanks to [ThoriumBR] for the tip.

Flipper Zero “Smoking” A Smart Meter Is A Bad Look For Hardware Hackers

June 14, 2023 by Dan Maloney 126 Comments

Alright, we’re calling it — we need a pejorative equivalent to “script kiddie” to describe someone using a Flipper Zero for annoyingly malign purposes. If you need an example, check out the apparent smart meter snuff video below.

The video was posted by [Peter Fairlie], who we assume is the operator of the Flipper Zero pictured. The hapless target smart meter is repeatedly switched on and off with the Flipper — some smart meters have contactors built in so that service can be disconnected remotely for non-payment or in emergencies — which rapidly starts and stops a nearby AC compressor. Eventually, the meter releases a puff of Magic Smoke, filling its transparent enclosure and obscuring the display. The Flipper’s operator mutters a few expletives at the results, but continues turning the meter on and off even more rapidly before eventually running away from the scene of the crime.

We qualify this as “apparent” because the minute we saw this over on RTL-SDR.com, we reached out to reverse engineer par excellence and smart meter aficionado [Hash] for an opinion. Spoiler alert: [Hash] thinks it’s an elaborate hoax; the debunking starts at the 4:32 mark in the second video below. The most damning evidence is that the model of smart meter shown in the video doesn’t even have a disconnect, so whatever [Peter] is controlling with the Flipper, it ain’t the meter. Also, [Hash] figured out where [Peter] lives — he doxxed himself in a previous video — and not only does the meter shown in the video not belong to the Canadian power company serving the house, StreetView shows that there’s a second meter, suggesting that this meter may have been set up specifically for the lulz.

It should go without saying that Hackaday is about as supportive of hardware experimentation as an organization can be. But there have to be some boundaries, and even if this particular video turns out to be a hoax, it clearly steps over the line. Stuff like this paints a poor picture of what hardware hacking is all about, and leads to unintended consequences that make it harder for all of us to get the tools we need.

Continue reading “Flipper Zero “Smoking” A Smart Meter Is A Bad Look For Hardware Hackers” →

Flipper Zero Mayhem Hat Adds Camera, More Radios

March 12, 2023 by Tom Nardi 28 Comments

For a device advertised as the “Multi-tool Device for Hackers”, the Flipper Zero already offers a considerable list of onboard capabilities. But some hard decisions had to be made to get the retail price down, so features like WiFi and Bluetooth had to be left off. Luckily, there’s an expansion interface along the top of the device which makes it possible to plug in additional hardware.

One of those expansions is the “Mayhem Hat” from [Erwin Ried]. This board adds many requested features to the Flipper Zero, as well as some that might not seem as obvious. The addition of an ESP32-CAM brings WiFi and Bluetooth to the party, while also unlocking access to the highly-capable ESP32Marauder firmware and the plethora of security research tools therein.

But the camera also enables some interesting features, such as motion detection and the ability to read QR codes. It even lets you use the Flipper as an impromptu digital camera, complete with an onscreen viewfinder reminiscent of the Game Boy Camera.

What’s more, the Mayhem Hat features its own expansion capabilities. There’s a spot to plug in either a CC1101 or NRF24l01 radio module, both of which are supported by community developed plugins that allow the user to sniff out and hijack signals. There are also extra pins for connecting your own sensors or hardware. In the demo video below you can see the device automatically detect the popular DHT11 environmental sensor and display the current temperature and humidity readings.

[Erwin] has the Mayhem Hat up for sale on Tindie, but as of this writing, is currently out of stock. Apparently, demand for the add-on boards is just as high as for the Flipper Zero itself — not a huge surprise, given the excitement we saw around this platform during its $4.8 million Kickstarter campaign.

Continue reading “Flipper Zero Mayhem Hat Adds Camera, More Radios” →

Flipper Zero Hacker Tool Gets UI Editor For Custom Apps

December 10, 2022 by Donald Papp 12 Comments

[Mikhail] released a handy GUI editor/generator tool for the Flipper Zero multipurpose hacker tool, making layouts and UI elements much easier and more intuitive to craft up.

Those who decide to delve into rolling their own applications or add-ons will find this a handy resource, especially as it generates the necessary code for the visual elements. It’s not limited to placing icons, either. Boxes, lines, dots, text, and more can be freely laid out to get things looking just right.

To use it, simply drag and drop icons of various sizes into the screen area. Non-icon UI elements like frames, lines, text, and others can be placed with a click using the buttons. To move elements around, click the SELECT button first, then drag things as needed. To fine-tune positioning (or change the text of a string) a selected element’s properties can be accessed and modified to the right of the simulated screen. When things look good, switch to the CODE tab and copy away to use it in your Flipper application.

Unfamiliar with the Flipper Zero? It’s a kind of wireless multitool; a deeply interesting device intended to make wireless exploration and experimentation as accessible as its dolphin mascot is adorable.

A family of PixMob bracelets being coltrolled by an ESP32 with an IR transmitter attached to it. All the bracelets are shining a blue-ish color

PixMob Wristband Protocol Reverse-Engineering Groundwork

August 6, 2022 by Arya Voronova 38 Comments

The idea behind the PixMob wristband is simple — at a concert, organizers hand these out to the concertgoers, and during the show, infrared projectors are used to transmit commands so they all light up in sync. Sometimes, attendees would be allowed to take these bracelets home after the event, and a few hackers have taken a shot at reusing them.

The protocol is proprietary, however, and we haven’t yet seen anyone reuse these wristbands without tearing them apart or reflashing the microcontroller. [Dani Weidman] tells us, how with [Zach Resmer], they have laid the groundwork for reverse-engineering the protocol of these wristbands.

Our pair of hackers started by obtaining a number of recordings from a helpful stranger online, and went onto replaying these IR recordings to their wristbands. Most of them caused no reaction – presumably, being configuration packets, but three of them caused the wristbands to flash in different colors. They translated these recordings into binary packets, and Dani went through different possible combinations, tweaking bits here and there, transmitting the packets and seeing which ones got accepted as valid. In the end, they had about 100 valid packets, and even figured out some protocol peculiarities like color animation bytes and motion sensitivity mode enable packets.

The GitHub repository provides some decent documentation and even a video, example code you can run on an Arduino with an IR transmitter, and even some packets you can send out with a Flipper Zero. If you’re interested in learning more about the internals of this device, check out the teardown we featured back in 2019.

How The Flipper Zero Hacker Multitool Gets Made And Tested

July 24, 2021 by Donald Papp 3 Comments

Flipper Zero is an open-source multitool for hackers, and [Pavel] recently shared details on what goes into the production and testing of these devices. Each unit contains four separate PCBs, and in high-volume production it is inevitable that some boards are faulty in some way. Not all faults are identical — some are not even obvious — but they all must be dealt with before they end up in a finished product.

One of several custom test jigs for Flipper Zero. Faults in high volume production are inevitable, and detecting them early is best.

Designing a process to effectively detect and deal with faults is a serious undertaking, one the Flipper Zero team addressed by designing a separate test station for each of the separate PCBs, allowing detection of defects as early as possible. Each board gets fitted into a custom test jig, then is subjected to an automated barrage of tests to ensure everything is as expected before being given the green light. A final test station gives a check to completed assemblies, and every test is logged into a database.

It may seem tempting to skip testing the individual boards and instead just do a single comprehensive test on finished units, but when dealing with production errors, it’s important to detect issues as early in the workflow as possible. The later a problem is detected, the more difficult and expensive it is to address. The worst possible outcome is to put a defective unit into a customer’s hands, where a issue is found only after all of the time and cost of assembly and shipping has already been spent. Another reason to detect issues early is that some faults become more difficult to address the later they are discovered. For example, a dim LED or poor antenna performance is much harder to troubleshoot when detected in a completely assembled unit, because the fault could be anywhere.

[Pavel] provides plenty of pictures and details about the production of Flipper Zero, and it’s nice to see how the project is progressing since its hyper-successful crowdfunding campaign.