Flipper Zero

The Flipper Zero is a portable multi-functional security device developed for interaction with access control systems. The device is able to read, copy, and emulate RFID and NFC tags, radio remotes, , and digital access keys. It also has a GPIO interface. It was first announced in August 2020 through the Kickstarter crowdfunding campaign, which raised $4.8 million. The first devices were delivered to backers 18 months after completion of the crowdfunding campaign. The device's user interface embodies a pixel art dolphin virtual pet. The interaction with the virtual pet is the device's core game mechanic. The usage of the device's functions defines the appearance and emotions of the pet. In the built-in game, the main mechanism to "upgrade" the dolphin is to use the various hacking tools. While harmless uses (like as a remote control for a television, or carbon dioxide sensor) exist, some of the built-in tools have potential criminal uses, including RFID skimming, Bluetooth spamming (spamming a Bluetooth connection, crashing a person's phone), and emulation of RFID chips such as those found in identification badges, using the built-in radio cloner to open garage doors, unlocking cars, and functioning as a wireless BadUSB.

The Flipper Zero is a portable multi-functional security device developed for interaction with access control systems. The device is able to read, copy, and emulate RFID and NFC tags, radio remotes, , and digital access keys. It also has a GPIO interface. It was first announced in August 2020 through the Kickstarter crowdfunding campaign, which raised $4.8 million. The first devices were delivered to backers 18 months after completion of the crowdfunding campaign. The device's user interface embodies a pixel art dolphin virtual pet. The interaction with the virtual pet is the device's core game mechanic. The usage of the device's functions defines the appearance and emotions of the pet. In the built-in game, the main mechanism to "upgrade" the dolphin is to use the various hacking tools. While harmless uses (like as a remote control for a television, or carbon dioxide sensor) exist, some of the built-in tools have potential criminal uses, including RFID skimming, Bluetooth spamming (spamming a Bluetooth connection, crashing a person's phone), and emulation of RFID chips such as those found in identification badges, using the built-in radio cloner to open garage doors, unlocking cars, and functioning as a wireless BadUSB. ==Bans, seizure, police bulletin and other incidents== ===U.S. Customs seizure and release=== In late 2022, U.S. Customs and Border Protection seized a shipment of 15,000 devices, but they were eventually released. ===Amazon ban=== On 7 April 2023, Amazon banned sales of the Flipper Zero via their site for being a "card skimming device". ===Brazil seizures=== In 2023 people in Brazil who ordered Flipper Zeros reported that their orders had been seized by Anatel. According to the Electronic Frontier Foundation, Anatel has flagged the devices as being a tool for criminal purposes, making the certification process complicated. Users have tried getting their devices certified, but to no avail. The EFF has said that the seizures would limit the ability of Brazilian cybersecurity researchers to conduct research, as they have legitimate uses for the device. ===Police bulletin on Flipper Zero=== In August 2023, The Daily Dot published an article on a bulletin for police officers published by the South Dakota Fusion Centre. The document suggested that extremists might use the device to bypass access control systems controls, particularly on power stations. The bulletin admitted there was no concrete evidence of plans by said extremists to use the device, though interest had been expressed on online forums. Flipper CEO Pavel Zhovner was shown a copy of the bulletin and said that the Flipper Zero had been deliberately designed to not affect modern access control systems. He also pointed out that the bulletin itself said that gates at power stations were not inherently vulnerable to the device but that older gates might be. ===Gatwick seizure=== On 27 September 2023 a security staff member at Gatwick Airport confiscated a Flipper Zero from Vitor Domingos due to security concerns. The device was then handed over to Sussex Police. ===Midwest FurFest Bluetooth Low Energy attack=== In September 2023 the ability to launch Bluetooth Low Energy spam attacks with a Flipper Zero was demonstrated by a security researcher known as 'Techryptic'. A custom Flipper Zero firmware was developed shortly afterward that could launch spam attacks against Android devices and Microsoft Windows computers. An Android app to launch BLE attacks was developed shortly afterwards. At the 2023 Midwest FurFest attendees reported severe disruption of Square payment readers and an insulin pump controller crashed due to the BLE spam. A researcher known as Remy said to Bleeping Computer: "For BTLE enabled medical equipment, at minimum a disruption results in a degraded quality of life for those affected," adding "Some conditions may not be life threatening to have disruptions. Others may not be so lucky." As a result, a Python script was developed, called the Wall of Flippers project for Linux and Windows to detect BLE spam attacks coming from Flipper and Android devices. ===Proposed Canadian ban=== In February 2024, Innovation, Science, and Economic Development Canada announced that they had the intention of banning the Flipper Zero and other devices that could be used to clone wireless signals for remote entry in response to a significant increase in auto thefts. On 20 March 2024, ISED announced that it would seek to restrict use of the device by illegitimate actors, but not ban it outright.

Text derived from https://en.wikipedia.org/w/index.php?oldid=1375361951 under CC BY-SA 4.0; modifications have been made.