Flipper Zero: Hottest Hacking Device?

Key Takeaways

[Music] started life on Kickstarter. [Music] Biggest problem at the moment with this device is trying to get hold of one. This is a flipper zero. [Music] This video is for educational purposes only. I own all the equipment that I'm going to be demonstrating in this video. Let's see how powerful this flipper zero is and what it can do and make you aware of the vulnerabilities with technologies that we use every day. I really want to thank Lab 401 for sending me not only a flipper zero, but a bunch of other really cool toys to demonstrate. So, just to be clear, this is not a sponsored video, but Lab 401 sent me products from their pentester pack. They have these pentester packs. So, we've got the standard, basic, and advanced that give you access to a whole bunch of interesting tools, as well as the Flipper Zero. I'm not going to show you how to mess around with a Tesla. There are a bunch of videos online showing you how to do that. One of the cool things about this Flipper Zero is I can plug it in to my computer and see the screen using the Q Flipper software. That will allow you to see more clearly what I'm doing. You can also update the Flipper Zero using the software. Okay, but that's enough talking. Let's get started. [Music] Here I've got a lock that you would put in a drawer as an example. And you can see there that this tag opens this lock. Let's take a different card. This card doesn't work. But if I take the card that did work and I go to 125 kHz RFID and I read that card. So I'll go right and save this. And I'll just call this door. Okay. So door's been saved. And I can immediately emulate that card. And there you go. That opened. Now you may not want to do it that way. So what you can do is you can just do a right. So again, this tag doesn't work. And I should say tag rather than card because here's a card, but I'll write it using the flipper zero. Okay. So sometimes I've had problems getting it to write. Often you have to reboot it, but I have got the save previously. So I'll write it again using that. And there you go. So that's been successfully written. And now notice it works. [Music] Okay. Another thing that the Flipper Zero supports is infrared. You can download a whole bunch of preconfigured infrared settings. I've got some saved that I've manually saved. One of them is the light shelf behind me. Hopefully, you can see that the shelf is changing in color. I'll use green. To set this up, all you need to do is go to infrared. In this example, I'm not using a saved one. I'm going to learn a new one. So, learn new remote. And here's the remote that actually changes those colors. You can see it's actually got five samples at the moment. But actually what I want to do is I want to get a different color. Let's take yellow as an example. So I'll press the yellow button. And it's found it. So I'll just say raw 7. So that's a new remote. Hopefully what'll happen now is you can see that the color is changing to yellow. And actually the one on my desk, if I put it under my desk, if I go back and go to save remotes and let's go shelf lights and I'll set it to blue. And hopefully you can see that that's all gone blue again. This can work with all kinds of devices, can work with televisions, all kinds of things, lots of examples on YouTube. What I've done here actually is save a remote which is to turn my air conditioner on. So, what I'll do is take this camera and what I'll do here, don't know if you can see that, but I'm going to simply press the button and the air conditioner went on and now the air conditioner is off. All you need to do is take a remote like this. Learn new remote and it picks it up. What I can do is send that to the air conditioner to turn it on. So, air conditioner send. And there you go. It went on. [Music] Notice the mouse on this laptop. I'll put both hands here so you can see I'm not touching the laptop at all. Both my hands are on the flipper zero. But what I can do is control the mouse using the flipper zero. So as an example, I'll move it here and then I'll press enter to open the software. And then what I'll do is move the mouse to close the flipper zero. You can get it to emulate all kinds of devices. This is available under the main menu. So, just to show you the menus. If I press the middle button here, that gives me the different options. So, I've shown you NFC already. I've shown you 125 kHz RFID. Shown you applications. Under the applications, I went to tools. And in this case, I chose Bluetooth remote. And I specified mouse. You have to set up both sides to talk, but you can control a mouse or another device using Bluetooth. So once it's accepted, then you can control that device directly from the flipper zero. [Music] This allows you to run rubber ducky scripts. If I go to bad USB, it says disconnect PC or phone to use this function. What I'm going to do now is I'm going to have to close the flipper zero software and I'll press bad USB. In my example, I'm going to do the demo for Windows. So, if I press that and press to run the script, what you'll notice now is it starts sending keystrokes to the Windows computer. And there you go. Just to make it easier, I'll move the laptop here actually so you can see that directly. And let's do that again on the flipper zero. I'll press the button to run the Windows bad USB. And notice as soon as that's done, we should see it initiate something on the computer. There it goes. It's opened up Notepad and it starts writing something to Notepad. Now, that's just a basic example, but you can download many rubber ducky scripts and use them to do all kinds of things. So, for instance, open up a reverse shell or something else. Lots of options available with the bad USB. They've got a demo for Mac OS and Windows. So, that was an example with Windows. [Music] Now, another great thing about the Flipper Zero is you can control it from your phone. So, you can install an app on your Android phone or iOS device as an example and it will sync information from the Flipper Zero to your phone. You can see there it's synchronizing. It's now synced. If I go to archive, I can see a whole bunch of information including NFC. I can see infrared as an example, the different infrared options that are saved. RFID 125. I can see as an example there's door and then I can get it to emulate. So I can actually get it to run. So let's do door blue here. And then what that's going to do on the flipper zero is get it to run the commands that I've asked it to run. So as an example, I got it to emulate that key fob. I can do something similar with the NFC's. So as an example, let's go back to my safe. I'll lock it with the Barclay card. I'll select Barclay card and then press emulate on the phone. And notice I've got it to open the safe by commanding the Flipper Zero to do something from the phone. Just to make the point again, I'll lock the safe. I'm not going to do anything on the Flipper Zero except put it on its home screen. So, it's on the home screen. And then on the Barclay card, I'm going to tell it to emulate that card. And then if I hold it there, notice the safe opens up. From a demonstration point of view, you can also control it from your computer. So, as an example, I can tell it to get out of NFC. I can press the middle button and then I can use keystrokes on the computer to control the flipper zero. So, go back as an example. I'll go to NFC. Go to saved. I'll specify the Barclay card. Tell it to emulate. Notice safe is locked now. And then I'll use this Barclay card to actually open the safe. Let's do that again. Safe is open. Notice my stuff in the safe. And then I'll press the flip a zero against the safe to get it locked because it's emulating the card. And then if someone came back to the hotel room and did that, they wouldn't realize that I had opened the safe. So lock the safe again and then open the safe. All controlling that from my phone or from the computer. I'll demonstrate this probably in a different video, but notice here's a UB key used for two-factor authentication. I can use NFC to read the UB key and then I could save that and then emulate that if needed. So, as an example, when using NFC on your phone to get authorization from a UB key, I could perhaps give round authentication, but we'll leave that for another day. Okay. So, what do you think? Great product. I've only shown you a few examples of what's possible with this device. There are lots of videos on YouTube showing you stuff that I don't want to show you. You need to be careful as always with a device like this. You need to use it on devices that you own or have permission to use it on. In this case, I was using all my own devices. So, I've obviously given myself permission to attack my own devices as a demonstration. Okay, so I'm David Bombell. Hope you enjoyed this video. If you did, please like it. Please consider subscribing to my YouTube channel and clicking on the bell to get notifications. I want to wish you all the very best. [Music]