Hello, World! The multi function hacking tool, otherwise known as the Flipper
Zero is in a bit of trouble, it’s pretty much been banned in Brazil, and is there
a danger of other countries doing the same? Brazil’s ban is confusing to say the least,
whilst the Flipper Zero is armed with an array of hacking capabilities including NFC, RFID,
bluetooth, infrared and more… none of this is new, this has all been possible for years,
with other more specialised pentesting tools for which no such ban exists. The Flipper Zero brings
no new capabilities to the table per se, though where it comes into its own is it combines a
subset of these capabilities, and ditches the scary looking command line interfaces of the
other tools - in favour of a more user friendly interface, with added dolphins for good measure.
The Brazilian ban was only discovered after Brazilians who bought a Flipper Zero via
perfectly legitimate sites, noticed on their order tracking that after their order arrived in Brazil,
it was marked as being “Audited” by “ANATEL”, Anatel is essentially Brazil’s
version of the FCC - a government organisation responsible for making sure that imports comply
with radio frequency regulations. Shortly after “ANATEL” started these audits, people’s Flipper
Zeros were flat seized by the Brazilian government altogether. And this isn’t an isolated incident,
a whole subreddit has popped up dedicated to Brazilians who just want to get their
hands on the Flipper Zeros they paid for. So, what’s going on here? The reasons for
these seizures were initially quite vague, with Anatel saying “This type of product cannot be
approved” - whatever that means… However eventually there was some clarification,
with buyers being told that the “FLIPPER ZERO has been used in the country by malicious
users in facilitation of a criminal offence or misdemeanour”, and so according Brazilian law,
importing them has been banned for the “protection of Brazilian citizens against criminal actions”.
Reading this I was surprised, I mean - I’m not aware of the Flipper Zero being
used to actually commit crimes, if I was - I probably would’ve made a video on it by now. So,
are there any documented cases of crimes being committed with the Flipper Zero?
If we head over to Flipper Zero’s breading grounds, TikTok, there are most definitely a
lot of videos of people using their flipper Zero to be very annoying, whether that’s turning off
TVs using the flipper’s universal remote feature, or opening a Tesla’s charging port - but these
aren’t crimes. However, there are more worrying videos of people completely unlocking cars with
a Flipper - which could understandably attract the attention of law enforcement, but these
videos are mostly fake. Because recording a key fob’s signal and then just replaying
it to unlock a car hasn’t been possible since the 90’s thanks to the introduction of rolling codes,
nowadays each time a key fob is used it generates a unique unlock code that just won’t work twice,
so recording and replaying it is useless. However, some car models do have vulnerabilities
in this system, as shown in a recent ‘Black Hat’ presentation, when researchers demonstrated
how they were able to unlock certain models. But, the researchers here are using a hackRF,
which isn’t the subject of a ban. And whilst this hack has been replicated on a Flipper,
it’s by no means unique to it. In fact, there are no documented
cases of crimes actually being committed with a Flipper Zero, even when we account for the
existence of ‘Flipper Zero Unleashed’ - a fork of the official firmware which removes the artificial
limitations baked into Flipper Zeros to ensure they comply with radio frequency laws, enabling
them to work on a wider range of the RF spectrum, and interface with a larger array of electronics.
Ok, so Flippers haven’t been used in crime yet, but surely there’s a decent risk of it
right? Well, let’s put the Flipper Zero to one side for a moment, and look at just how many
crimes have been committed with other physical hacking tools. Take the BadUSB as an example,
they’ve gained a ton of media attention, been featured on hacking TV shows and no doubt
tens of if not hundreds of thousands of these things have been sold across different variations,
the most famous of which being the USB Rubber Ducky. Since these things came onto the scene
roughly 10 years ago, just how many documented cases are there of BadUSBs being used for evil?
I counted 2, once in 2020 when a Russian cyber criminal gang mailed out ransomware
laden BadUSBs to companies, under the guise of them containing a $50 bestbuy gift card.
And again in 2022 when the same cyber criminals targeted defence firms in a similar plot. Whilst
no doubt there will of course be other instances of BadUSB enabled crime that
just haven’t been publicly disclosed, the fact there’s only a couple of known instances where
these things have been used maliciously is a symptom of the fact that cyber criminals just
prefer to work remotely. Physical cyber crime, whatever tools are used, is rare.
But anyway, back to the Flipper Zero - the reason for this Brazilian ban is
almost certainly just down to the one thing other hacking tools don’t have,
hundreds if not thousands of videos on social media of the Flipper Zero being used to mildly
annoy people. But the fake videos of car hacking definitely haven’t helped with this moral panic.
I also found a video which has half a million views of someone controlling traffic lights
with a flipper, but in this case the Flipper is just being used to control some LEDs which
themselves do the actual magic of mimicking the transmitters that emergency vehicles
use to change traffic lights. Whilst this video might spook some people,
the fact a Flipper Zero is being used to do this is irrelevant, pretty much any electronics
development board could have been used. But anyway, luckily for the Brazilians
affected by all of this, Anatel isn’t destroying seized Flippers,
but is rather returning them to the shop they were bought from so buyers can receive refunds.
And there’s no news of those trying to import them into Brazil being fined or charged with anything.
But the question remains, is there a danger of this anti-Flipper sentiment spreading? Well,
the only instance I could find of another government agency even mentioning the Flipper
Zero was from the ‘state of New Jersey’ - but that was warning Flipper customers themselves
about fake online stores claiming to sell the devices (something I covered in a previous video).
However a German version of ebay has reportedly banned the sale of Flipper Zeros on their site.
And I do have some experience of being penalised for selling pentesting tools. I operate a site
that sells a small selection of such tools, and in 2020 my PayPal account was suspended because
those tools, PayPal claims, go contrary to their terms of service, which is strange because the
terms of service mentions no such pentesting tools and other companies whose products have the exact
same capabilities continue to use and have been using PayPal for years, I of course pointed this
out to PayPal, but received no response. Oh and not only was my account suspended,
but PayPal dipped into my balance and took £2000, roughly $2500 USD for the apparent
violation of their “Acceptable Use Policy”. But hey ho, there’s not really much I can
do about, and I think when dealing with pentesting tools you kind of have to accept
that misunderstandings seems to be an occupational hazard, which Flipper Zero is now getting a little
taste of. Though it’s unlikely this’ll become more of a widespread issue, as Brazil does tend to be a
bit of an outlier when it comes to their import laws. I’m pretty sure they’re the only country
with an almost complete ban in the import of used consumer goods, and their import taxes are crazy,
with people having to pay a 60% import tax on their Flipper Zeros which never end up arriving.
This video was made possible by Linode, who are giving you a $100 60-day credit
just for signing up. Linode is essentially your swiss army knife for cloud computing,
if it runs on linux it'll run on Linode. One great feature of Linode is their app
marketplace which makes it super easy to spin up servers with preconfigured software. Use
Linode's Kali Linux app to quickly spin up a fresh instance of Kali, the installer makes it
easy to configure the basics, like VNC passwords, whether you want a desktop environment, and so on.
Linode can run almost anything, by providing all the tools a developer really needs at
competitive prices. Use the link in the description now to claim your free $100.
As always thanks for watching and I’ll see you in the next video, have a good one!