The Flipper Zero went viral on TikTok, leading to misconceptions that it can "hack ATMs" or "change traffic lights". In reality, it is a multi-tool for radio protocols. It combines an NFC reader, RFID reader, Sub-GHz transceiver, and IR blaster into a cute package.
The Capabilities
- Sub-GHz: Captures and replays signals from car remotes (older ones) and garage doors using frequencies like 433MHz. - NFC/RFID: Can read and emulate access badges (125kHz and 13.56MHz). You can clone your office badge to the Flipper and enter the building. - BadUSB: Plugs into a PC and pretends to be a keyboard, typing malicious commands at 1000 WPM. - Infrared: Universal remote for TVs and ACs.
1. Rolling Codes (Why it can't steal your car)
Modern cars use "Rolling Codes".
When you press your key fob, it sends code `ABC`. The car accepts it and marks `ABC` as used.
The next time you press, it sends `DEF`.
If a Flipper Zero records `ABC` and tries to replay it later, the car ignores it because `ABC` is already "burned".
Exception: Some older garage doors and gates utilize fixed codes or vulnerable rolling code implementations (RollJam).
2. BadUSB Attacks
The Flipper can store scripts (DuckyScript).
1. Plug Flipper into victim's laptop.
2. Flipper says "I am a generic keyboard".
3. Flipper types: `Windows+R`, `cmd`, `Enter`, `powershell download_virus.ps1`.
This happens in 2 seconds. Never leave your USB ports exposed.