Flipper Zero is reading your NFC security key.
Adrian Kingsley-Hughes/ZDNET
I’ve been using it for over a year now and I love my Flipper Zero and am still discovering cool things I can do with it.
Are they using it to steal cars, clone credit cards, or change the prices on gas station displays? Of course not! It’s like all the fake garbage people upload to TikTok to look cool, and you can’t do that.
But that doesn’t mean you can’t do some very cool and useful things with Flipper Zero. Over the past year, I’ve been exploring the suite of tools built into Flipper Zero and installing custom firmware to extend its capabilities. It’s a groundbreaking product in many ways.
The Flipper Zero may be small, but it packs a lot of hardware into a small space.
Firstly, there are sub-GHz radio antennas that can capture and transmit radio codes to operate wireless devices and access control systems such as garage door remote controls, boom barriers, IoT sensors and even remote keyless systems.
RFID support allows you to read, store and emulate a wide range of RFID cards.
Also: Do RFID blocking cards really work? Flipper Zero reveals the truth
It can also read, write, store and emulate NFC tags.
On the front there is a 1-Wire connector that can read and emulate the contact keys of an iButton (aka DS1990A, CYFRAL, touch memory, or Dallas key).
It also has a built-in infrared transceiver that can capture and transmit IR codes to control things like your TV.
Finally, there’s a GPIO connector on the top that lets you connect the Flipper Zero to other gadgets in the real world.
Also: How to unleash the true power of Flipper Zero
That’s a lot of functionality packed into a small $169 device.
Yet every week we hear from buyers who are frustrated and disappointed by the Flipper Zero’s seemingly infeasible nature based on fake social media videos.
Here’s some of the things I’ve been doing with Flipper Zero over the past few weeks.
Note: Nowadays, most people run third-party software on their Flipper Zero to access a wide range of extra features. But don’t worry, loading third-party software does not void your warranty and you can easily revert to the standard software at any time using the Flipper Zero app on your desktop, laptop or mobile device.
Sub-GHz radio antennas can pick up signals from devices such as wireless doorbells and car key fobs, making the Flipper Zero a useful tool for testing whether wireless transmitters are working properly. I use it to test whether my fobs are working and what their range is.
Also: The best security keys you can buy (and how they work)
Sure, the Flipper Zero can record codes sent from a car’s key fob, but resending those codes to a modern car won’t unlock it because they have a feature called “rolling codes” where the code changes with each use. For older cars that are over 20 years old, you can use the captured code to unlock the vehicle (but don’t do this unless it’s yours or you have permission), but you still won’t be able to drive the car.
Conversely, if you resend the code to a wireless doorbell, it will ring, as most systems have no mechanism to prevent such nuisance.
NFC is everywhere now, and Flipper Zero takes advantage of this wireless protocol. NFC is built into plastic cards and key fobs, and is used for a variety of purposes, from unlocking hotel room doors to controlling barriers.
But this doesn’t mean you can wreak havoc on the world, because to unlock it you often need access to an NFC key.
NFC signals can be read by Flipper Zero, and most NFC cards can too. Copied and cloned (This depends on the security used on the card, so we can’t give you any hard and fast rules about which NFC devices can be cloned.) I’ve used Flipper Zero to copy hotel room cards when the hotel only provided one card, or when I have multiple rooms and don’t want to carry around multiple cards.
Also: The Best VPN Services (And How to Choose the One That’s Right for You)
However, although the Flipper Zero can read NFC cards and fobs, it cannot decode the card’s encrypted security code used on credit and debit cards, and therefore cannot replicate them.
Flipper Zero cannot clone bank cards because it cannot decrypt the encrypted security code on the card.
Adrian Kingsley-Hughes/ZDNET
In addition to NFC, the Flipper Zero can read and clone RFID cards and fobs, including hotel cards as seen in the photo above.
Also: How RFID tags make in-person clothes shopping less stressful
While RFID cards and tags can be locked to prevent them from being overwritten or their security keys from being extracted, Flipper Zero can circumvent many of these mechanisms. For example, presenting the card to a valid reader (such as a lock that it is programmed to open) can unlock it. This allows someone to clone the card and use both the card and Flipper Zero to unlock the door.
Flipper Zero can unlock some RFID cards and tags.
Adrian Kingsley-Hughes/ZDNET
The Flipper Zero has a built-in infrared module that can be programmed to control a variety of devices, from TVs to air conditioners.
Nearly any consumer device with an IR remote control interface can be controlled using Flipper Zero.
Another handy use of this feature is to test if your infrared remote is working: just point the remote at the Flipper Zero in “IR Read” mode and it will detect the signal.
I use this feature all the time to test remotes I repair after a leaking battery damages the device – it’s a very handy feature.
Testing the disassembled infrared remote control.
Adrian Kingsley-Hughes/ZDNET
Yes, Flipper Zero can bypass the security of some Sentry Safe electronic safes using outputs from the GPIO.
This is something you should never do if it’s not your own safe or you don’t have permission, but it goes to show just how insecure the “free” safes at hotels, spas, and Airbnbs really are.
The Flipper Zero can act as a BadUSB device, meaning that when plugged into a port it will be recognized as a Human Interface Device (HID), such as a keyboard.
Also: The Best VPN Services for iPhone and iPad (Yes, You Should Use Them)
BadUSB devices can perform any action that can be performed with physical access, including modifying system settings, opening backdoors, exfiltrating data, launching reverse shells, etc. These tasks are performed using a series of commands written in the Rubber Ducky scripting language. Ducky Script.
Flipper Zero opens a browser and navigates to a web page without any user input.
Adrian Kingsley-Hughes/ZDNET
The Flipper Zero uses GPIO to output electrical signals, acting as a signal generator. I last used it to simulate a vehicle’s anti-lock braking system module to ensure all the wiring and computers in the car were working.
The video game module is powered by the RP2040 microcontroller developed by Raspberry Pi, which adds a host of gaming-related features.
Firstly, it adds a DVI video output port to the Flipper Zero, allowing you to send video to an external display. This is essential as the small LED panel built into the Flipper Zero isn’t ideal for gaming. However, this feature isn’t limited to gaming; the ability to send video output to a larger display makes it ideal for a variety of other applications, such as testing and training.
The video game module also includes an IMU (Inertial Measurement Unit) with a TDK ICM-42688-P sensor, adding a three-axis gyroscope and a three-axis accelerometer to the package, allowing it to sense tilt and sway.
If gaming isn’t your thing, that’s okay too: the RP2040 microcontroller can run applications programmed in C, C++ or MicroPython, making it a versatile addition to your Flipper Zero.
