Flipper Zero vs "Proper" Hacking Tools

Key Takeaways

I'm very thankful that the flipper zero came out at the same time I have to say that it has limited capabilities it's it it works good it does some things very well but it has a very limited frequency spectrum it has limited software we're seeing the signals given off by all of the aircraft in the area and it's refreshed every couple of seconds you can watch these planes take off and land I I mean it varies country to Country right but what what's like the legality of what you're doing here have you ever noticed how some developers just seem to have that extra Edge well a lot of it comes down to one key skill logic and Brilliant logic courses are here to give you that edge in 18 Hands-On lessons brilliant first logic course takes you on a journey from the very basics of logic to advanced concepts that can set you apart in the tech world you'll begin with practical order logic learning to organize thoughts and processes in a way that's clear and efficient it's the foundation of logical thinking then it's on to strategic order logic here's where you start to see things differently learning techniques to strategize and solve problems more effectively by practicing seeking the truth you'll develop the ability to discern and extrapolate answers from the information you have it's about sharpening your mind to cut through the complexity a really important skill in today's world by the end of the first course you won't just be following logic you'll be creating it you'll stand out not just as a developer but as a problem solver a critical thinker and a real asset in any team and as they say there's more in the logic 2 course and much much more in brilliant's catalog so are you ready to upgrade your logical thinking join me on brilliant and unlock your potential visit brilliant.org David bomble to start your journey the first 200 signups get a special offer let's Master logic together hey everyone it's David Bumble back with the amazing occupy the web OTW welcome thank you David it's always an honor to be back on the best it and cyber security Channel on YouTube thank you for having me it's great to have you back and I will say just for everyone who hasn't seen our previous videos I'll link them below you should know who occupy the web is but if you don't amazing person to listen to in the cyber security space occupy the web you are part of the reason that my channel does well get so much feedback about people complaining that you don't come on often enough so it's great to have you back so just for everyone who hasn't seen our previous videos occupy the web is the author of this book Linux basics for hackers we also have a video series so I've link that below if you want to follow along with our videos and the book and occupy the web I love the books that you write getting started becoming a master hacker and I'd say this is my favorite network basics for hackers just because of my background I always say this I love the way you write because course you take it from a hacker's mindset but I got to ask you this question right these little devices really really famous but some people would say flipper zeros are not actually that good they're just toys and they dumb toys some people would even say What's your opinion of these and hopefully you can you know take us on a journey about SDR well my opinion about flipper zero I have one of course I got one early on when they first came out and one of the things that I love about the flipper zero is that it has made millions of people aware of essentially software defined radio of hacking radio signals it has raised awareness I've been doing SDR for hackers for a while and most people had no idea what I was talking about or what I was pursuing and all of a sudden now everybody millions of people around the world are saying wow you can do that and with a simple you know device and so I'm very thankful that the flipper zero came out at the same time I have to say that it has limited capabilities it's it it works good it does some things very well but it has a very limited frequency spectrum it has limited software um so there's a lot more things that you can do with SDR softwar defined radios which software defined radios been around for a while they've you know they are basically a hardware device that simply converts the analog signals or radio signals into a digital signal and it used to be not too long ago that to do these types of things you would have to have multiple pieces of hardware and software to be able to pick up okay and transmit signals in the radio spectrum now you can get a inexpensive device like the rtlsdr which we'll be using here today which is the least one of the least expensive it's about $30 to $40 depending upon where you buy it from and it's a good receiver it's not a transceiver it's not a transmitter it just can receive signals but for $35 or so it's it's a powerful little device and then if you team it up with some really powerful software there's a lot of things that you can do with it and so what I'd like to do is to talk about some of the software that we can use to be able to use these devices because in that that's thought I wouldn't say that the Clipper zero is a toy I might say it's a gimmick you know it's but it's I'm really thankful about how much awareness it has raised about radio C hack in so this is in my opinion radio hacking is one of the Leading Edge fields of hacking and cyber security and there's so many things that are run by radio signals including your cell phone your Bluetooth your WiFi satellite signals which we have a class coming up in later this year on satellite hacking we also have an advanced SDR we just ran our SDR class last year we have an advanced SDR class coming up this summer so these are you know these are the areas that I'm very excited and enthusiastic about so hopefully I can convey that kind of enthusiasm to your listeners and they can see the the value in radio hacking because quite honestly there's just everything down near everything not everything but down near everything right has using some kind of radio signal and I think you and I did um an automobile hacking video a while ago yeah and one of the things we did there is that a lot of cars modern cars now have the the key fob that will automatically unlock the door and this is one of the things that you can do in radio hacking among other things which by the way the uh flipper zero I think just got banned in Canada it's going to a about that yeah because it's like can this actually do what they think it can do because from what I have tested it I have to be careful what I say but it doesn't sound like they actually understand what this can and can't do well sometimes the person the people who are making the rules and laws don't necessarily understand the technical side of it but it's uh it can unlock some of the older model vehicles and I think possibly the Canadian officials are making a connection between the car thefts and The Flipper zero that might not actually be there right might just be other reasons that cars are being stolen but in any case it The Flipper zero has been banned in Canada because of car theft but all the other devices which there are you know there's at least a dozen 20 other devices that are out there that can do the same thing and those are not banned so maybe that's what we should be looking at here and we'll talk about that and you know maybe David you and I should put together a series on software defined radio about that yeah that'd be great so if everyone is watching would you like OTW and I to do a series of videos I think hack RF might be one that a lot of people will be interested in so put your comments below but what do you think about hack RF and but I mean I'm assuming there's a whole journey here that you're thinking about um OTW yeah I think think about a whole journey starting from simple to Advanced the simple being just setting up a receiver uh picking up signals from various uh devices and vehicles and what have you and then getting eventually into like hacking satellite signals but but you're not going to hack satellite signals with an RTL SDR so there's at least you know there's there's about four or five very popular SDR devic of the probably the most popular is going to be the RTL SDR because it's so inexpensive it's about $35 then there's the hack rf1 all right that runs a about $350 so it's 10 times more expensive there's also the lime SDR and that's a a device that we recently used we did a a course on developing a a fto cell and setting up your own cell phone network so you can set up your own cell phone network and you can intercept and and manipulate calls on the cell system but you're not going to do that once again with an rtlsdr you're not going to do that with a flipper zero either right and there's the blade RF and there's a a number of them some of them get pretty pricey I mean you can spend thousands of dollars on these devices but still compared to what people used to spend on doing radio signal hacking it's still inexpensive so we we try to keep to the less expensive devices you know we try to keep it under uh we try to keep it under $1,000 of Hardware outside of the computer in in our classes just because you get more than that you're really getting outside of a lot of people's abilities to to buy it included in the whole Hardware is an antenna as well yeah so you should have a good antenna if you buy the rtlsdr you get a simple dipole antenna which is good it does you know it'll pick up like things that that are passing you by or you'll pick up radio signals almost any radio station pick up the signals from the aircraft flying overhead you can listen into the towers communication to airplanes with it you can pick up a lot of things but when you start talking about being able to do some more sophisticated work and when you especially when you're talking about doing things like satellite hacking you're going to need a specialized antenna for that but still these antennas you know they're going to run you from $50 to $500 in that range so but it's a it's amazing what you can do if you're willing to make the investment in the time and the skills and a little bit of hardware and you know the what's happening right now is that the whole world is beginning to see that this this area of hacking is largely unsecured and that's what you know it's probably part of what Canada is doing they go oh my gosh these cars are being stolen because they they're not secure against these type of radio attacks I doubt that there's that many cars being stolen in Canada with a flipper zero but to each their own right um but if you got if you have sophisticated hardware and software you can you can steal these cars and uh and so what I'd like to do is kind of talk about some of the software that's available to you I mean there's one of the things that you know as this field develops we're getting more and more software and each one of them has kind of a specific purpose but recently the last couple of years there's been an operating system that has come out that's specifically full SDR packing and it's called Dragon OS and it's amazing it has hundreds hundred hundreds yeah hundreds of tools for SDR packing and I'd like the kind of introduce your viewers to it today and do a do a simple a simple attack a simple interception let call it that rather call it a we're going to intercept some signals and and show you kind of the power of some of these tools it's interesting in London Land Rovers or or owners of Land Rovers are being refused Insurance because of how many have been stolen really yeah it's um something about one of the CEO one of the CEO or some high ranking person within a Land Rover said um this is not true it's not the most stolen car in the UK but um from you know stuff that you've seen out there like people complaining can't get insurance because it's stolen so often and um it's a it's a problem right um so I'm glad that you're going to do what you often do and just for everyone watching we've done a whole bunch of videos with Mr Robot or about Mr Robot and like you know Truth versus fiction and OTW it's great to have you here talking about you know what's actually real and what's just hype or fantasy or you know the movies and the same you know for cars most the vehicles since 2014 have made it more difficult to use a flipper zero or radio hacking it doesn't it still can be done it's just more difficult right that's always the case yeah in information security you you somebody puts in some type of measure or countermeasure against the hack doesn't mean you can't still hack it just means you got to work a little harder which goes to what I've been saying on your show many times is that hacking is not 30 seconds or less like a Tik Tock video real hacking some sometimes can take years like something like stucks net or some of the others where very Advanced individuals spend years developing the hack if the target is insecure like somebody you basically did not do anything to secure the devices to secure the particular resource then yeah you might be able to take it down to 30 seconds or Liv but if you're talking about a very secure environment you might have to spend years of research to be able to do it and that's part of what we try to teach at hackers rise we're not trying to teach the gimmicks that get get all the views on Tik Tok because that's not really that's not real right what's real in at least in a penetration testing intelligence cyber War environment is some of those hacks will take years to actually bear food so we try to we try to raise the level and try to show people you know give them the background knowledge to be able to do that type of hacking but in any case what we what we have here today is we have a a operating system system called Dragon OS and this is Dragon OS and it's been designed just for radio hacking and the beauty of it is that most of the radio hacking tools have a lot of dependencies they have libraries and what have you that need to be installed to be able to function properly and this can take especially somebody who's new to Linux or new to radio hacking sometimes lots of time to be able to all all the dependencies and get it all set up whereas this operating system has not only the tools but there all and all the dependencies set up so you're ready to roll when you download it it's free right so you can f and it's free of course yes I it'sit free so here's Here's the the the source okay it's on Source Forge seut cmax secter cmax secter is the developer of it and uh he's done a really good job all right and it works with a number of different devices RTL SDR hack rf1 lime SDR blade RF and many others in our classes we use RTL SDR the hack rf1 and lime SDR lime being the priciest and maybe the most powerful of these and it runs about $500 okay whereas the rtlsdr costs about I say $35 heck rf1 is a is an excellent device for somebody getting started about $350 the only drawback to the hack rf1 is a couple things one is that it's has a has a wide spectrum of radio signals that it can send and receive that so that's a good thing but it's it it's not full duplex it's half duplex means that it can either send or receive but not both at the same time and you can see where that might have some issues where you know if you're trying say for instance to replicate a cellular phone system you got to both be able to send and receive at the same time right y y otherwise otherwise it's going to be it's going to not work smoothly the blade RF will work both full duplex and it's very fast hack RF has another limitation in that it's a USB 2 and not USB 3 so it makes it a slow connection to your system so here's where you can get it at um I would recommend that you download it it's uh I don't know three gigs or something like that of operating system might be more uh but it's pretty big and you know you can create a virtual machine of it or you can put it on barrier metal and get started in radio hacking so with that having been said let's take a look at this operating system and it's actually luntu okay so for those people who are familiar with Ubuntu it's going to look and feel similar but here's the menu system down here and you can see it has a lot of really good pieces of software built into it right so here's the accessories here's the educational here's the graphics some good stuff then we have ham radio and we've got all a bunch of ham radio tools here but most of the tools all right let just go to internet all right office so Libra office is all installed here's the other so in under other we've got a lot of powerful tools all right so GSM evil for the GSM uh networks let me see if I can get all of this on the screen uh let's see we have osmo Network in a box right here yat okay these are all cell they're they're cell network applications like tools for hacking or creating your own cellular network right this is creates your own cellular network y creates your own cellular network work um these are things that we've done in our class here's an imsi catcher right if we're catching the imsis if they come off the cell towers and a number of other things um so lots of interesting tools and there's some system tools here all of the tools you can see them and by going to user okay CD user source and all the tools should be there we still there look at them lots and lots of tools including gnu radio okay uh we have what else do we have here that might be interest gr satellites here there's the GSM evil we were talking about that allows you to hack um GSM signals here's dump 1090 which is what we're going to use today we're going to use dump 1090 a quick display of what we can do with the without a whole lot of skill and uh with just a rtlsdr and the dragon OS and so you get an idea of what's out there there's lots of things out there there is uh some LTE here it is LTE cell scanner okay for scanning cell towers LTE um cell towers we don't have a a 5G scanner yet that I'm aware of if anybody knows of one let me know but I'm not aware of one yet so we can scan for GSM we can scan for LTE fifth generation 5G I don't see it yet in any case if you're going to scan for those kinds of of 5G 5G some of the 5G is operating at as high frequency as 5 gigahertz so many of these devices won't operate at that higher frequency like for instance The Flipper zero won't even operate at 1 gigz it's all sub1 GHz uh something like hackr up I think goes up to 1.6 gigahertz the blade RF will go up to about three and a half gigahertz so none of these devices are going to operate these very high frequencies now that having been said we're not seeing much of the cell signals operating at those high frequencies right now most of the 5G is operating at lower frequency similar to LTE but the whole plan to get the speeds up that they promised us they're going to have to move up to the 5G 5 gig gz uh area so for right now we don't have something to really hack or to intercept those signals but we probably will very very soon that having been said all right what I have here is I've got an rtlsdr so the least expensive or one of the least expensive I guess there actually are some that are less expensive and I'm going to go ahead and just go [Music] lsusb right and this is will show me what is connected to my system system and you can see it's not connected oh okay so I've got to do something so let's go up here and connect it and let's go removable devices and you can see it right here here's the real Tech rtlsdr and connect it all right so if on a virtual machine I've got to go through this process of connecting it all right I should point out too that doing SDR through a virtual machine has some limitations as we found sometimes that us be connection between the physical machine and and the virtual machine can be problematic so just if you're new in this field and you're starting out and you're having problems it might be your USB right so let's go ahead and try lsusb again and now we see it real Tech semiconductor RTL okay that's it right there so now we're connected and what we can do with this now is to go ahead and well let's introduce a subject here airplanes and ships and other vehicles all send out a signal that gives their location okay and and speed and altitude in case of airplanes certainly not in ships well maybe they maybe on some ships you would have to give them and so this signal can be intercepted by your simple inexpense of RTL SDR and that's what we're going to be doing here so what we're going to do is we're going to say there's a a tool here I showed it to you up above it's called dump 1090 because it's called dump 1090 because 1090 is the frequency that these signals come this is all the airplanes we're going to look at just airplanes today all the aircraft have to send out this signal that gives the cell towers and others their position and speed and altitude of course you can also pick up their radio communications too but that's a different tool so to go ahead and run this right we go dot forward slash okay DP 1090 it says it's a directory so I have to go there first all right so I'm GNA think it's a dump 1090 that there we go let's take a look inside that directory and there's my executable or binary right there all right and it's already set to execute so I can go ahead then and just go dump 1090 and it goes and starts what it's doing is it's simply picking up the uh the signals from all the aircraft in the area all right and this is not really very useful information well it's useful but it's not in form that's easy to to use so what we're going to do is we're GNA go ahead and change some switches on it okay and we'll show you how you can actually use this got that more I'm G to stop it with control C all right so I should point out that this these types of signals okay are sent out on by almost every vehicle that's out there in our modern world it's a way for you know regulator and the the people who are in charge of making sure they don't crash into each other yeah to to to track their location and their information so let's go ahead and and try a different switch let's try let's take a look at the help screen first before we go any further go DP 10 1090 DH all right here we go there's a lot of stuff here okay so we've got a we've got a long series to to cover right go on well yeah but like anything there's lots of options right but in general you can you can reduce these tools to just a few switches to get it to do what you want all right lots of lots of options here so what we want to do is to maybe go ahead and say dump 1090 and then go interact active see that was one of the options up above right let's go interactive right there interactive mode refreshing data on screen okay so let's go ahead and do this and here we go whoa look at all those look at all those planes so you can see here this is this is hex okay the mode the the flight the flight number the altitude the speed the heading the latitude the longitude and more all right so we're seeing the signals given off by all of the aircraft in the area and it's refreshed every couple of seconds you can watch these planes take off and land okay um I should point out that I've got a good antenna on this thing so I'm pick yeah I I've got I've got I'm picking up a lot more flights that you might at home I've got a a parabolic antenna so if you're not familiar it's kind of like those dishes if You' seen you've seen kind of like a um a TV DISH similar to that same shape all right and it picks up the signals from a much larger distance it costs I think I paid like under $200 for it and if you're you know if I was doing this with a regular dipole ant I'd see a fraction of these rights but this is picking up all the information so that I can see all of the flights in in the area quite for some miles actually so occupy the web a question a lot of people might have is you know I don't want to go to jail I just want to learn and I want to learn how to protect yeah so what's the I suppose I mean it varies country to Country right but what what's like the legality of what you're doing here well the legality of what I'm doing here is it's there's no problem with I don't want to go to jail either yeah by the way but this is simply you know this is would be similar to just picking up a local radio stations and these signals are given off by the aircraft and it's it's out there it's unencrypted it's anybody can see it there's nothing there's no laws against picking up this information and reading it now if you were to do something to manipulate it okay or to block it or in in sending out your own signal okay now that's when you're starting to get into some legal issues just reading this this similar to just like just turning on your radio and picking up the radio signals you're not manipulating it in many countries sending a signal at certain frequencies or is illegal yeah right but here all we're doing is we're listening in we're just picking up this de this information decoding and displaying it on the screen for us I will say this for everyone watching this is not legal advice this you have to look at your own country's rules and decide for yourself but think OCC the web the the great thing about what you're doing here and the great thing like you said about the little flip of zeros right is it raises awareness because we have all the stuff around us and people aren't aware how vulnerable some of the stuff is and I think the flip of zero is forcing manufacturers and governments to take action and improve the security on stuff because it's it's not the good people that are causing the trouble the bad a lot of bad people know about this stuff already anyway I agree with you 100% so the laws are going to vary by country so make sure that you check your your laws but I think in the case here of just receiving I don't think anybody has any laws against that but when you start manipulating the signals or blocking the signals or transmitting signals and the rtlsdr cannot transmit it can only receive so if you're doing the rtlsdr you're not probably going to get into any legal issues because you're not going ahead and sending any signals once you start sending signals yeah then you can possibly get yourself into some legal Jeopardy um yes the this type of work has been done by military intelligence and intell national security agencies around the world for decades the only thing that's different is that now the average user with a laptop and a few hundred dollars can do something very similar so yes the flipper zero has raised the awareness that hey we need to do something thing about the security of radio signals and one of the things that's happened in a very recent past is that the hacking of these satellites has started to take place as a matter of fact this is kind of in the news right now between nation states yeah and they have discovered surprise surprise that there's no security on the satellites right so and we're so dependent you know you might think well you know that's all you know the national government and Military satellites well you know almost all of us are using signals transmitted by those satellites whether it be starlink of course but also you know your your cell communications GPS um your your your GPS you know these things are all going through satellites and if somebody were to hack them we could all lose that capability and we're all so dependent upon it one of the things that we do in our SDR class is I show people how you can can actually spoof your GPS signal so that you appear to be someplace else than you actually are now as far as I know there's no there's no law against that but you can simply send out a GPS signal up to the satellite and and send inaccurate information so in the class we spoofed that I was actually sitting in the cremin and so my GPS signal said I was in the Kremlin sitting next to Putin and uh so obviously I'm not uh but that's the kind of thing that you can do it well you know we'll what we'll do is you know start off slow here let people get familiar with the SDR go out and buy a little bit of Hardware if you can only afford the rtlsdr we'll do a few cool hops with the rtlsdr and then we'll kind of Advance into the hack RF and some of the other devices that are more sophistic capabilities so occupy the way you're telling me offline and I can't remember the details so just correct me if I'm wrong but people from perhaps threel agencies or some people came to your courses because they were trying to find out what people like you can actually do against satellites right that's that's satellites and other radio communication so yes we have students from around the world from National governments and law enforcement so it's not just penetration testers we have a lot of people now come from agencies that are are have been given the task of securing National Assets and we have law enforcement from US and Canada and Belgium and Ukraine and Germany I think Finland as well um and so they are coming to our courses so they can learn what is possible and so by learning what's possible they can better secure those resources I think that's a really important thing to say because sometimes we get Flack right on YouTube about like how you how come you teaching people this stuff but the thing is it's awareness right if you don't have red teamers or hackers at the time of this recording I mean there's big development in AI where you can generate videos and it was interesting the people that have access to that are red teamers you know if you don't give the red teamers or the good guys who are trying to like test your security you know the bad guys are going to get access anyway exactly so part of you know our red teamer all right is to test the security of the system the network the resources so that they can find the holes and vulnerabilities before the bad guys do if you don't do that then the bad guys are going to get in right I mean the bad guys get in no matter what you know sometimes but they get in a lot more if there wasn't somebody testing the Security First and finding the vulnerabilities and then patching those vulnerabilities that's what we do is that we go ahead and we try to find it inform management here's the problem somebody's going to to get in this way you need to do something e you need to patch it or you need to have some kind of compensating control to keep the bad guys from getting in so yes that's what we're doing here we're not teaching people to steal your life savings out of your bank account occup by the web I really want to thank you for sharing it's fantastic to have someone like you you know sharing this information with all of us especially for the Next Generation you know enabling people to learn about this stuff protect companies protect their governments or whatever they're involved in or wherever they involved but you know also get jobs um this stuff is out there it's great that you're teaching and not keeping the knowledge to yourself so thanks so much for sharing you're welcome I always enjoy you're welcoming me on your show and having me here to discuss these things I I enjoy you know sharing this with the public and what I'd like to do is continue as I said this process of starting off simple and getting people into SDR and we'll we'll continue this process of going through simple to more complex SDR hacks and this is state-ofthe-art folks so you know if you want to make a career or you're already in the field and you want to advance your career this is something that you should be considering to learn how to do because it's going to separate you from all the other people you know who who don't understand what this field is about and how important it is for informational security okay by the way there's a lot of stuff that you and I talk about Offline that I wish we could put on YouTube but just for everyone watching I have to hold occupy the web back sometimes because he has these fantastic ideas and I say look I don't want my Channel stried or get a channel strike against my channel um or my channel just remove right so occupy the web where can people go um to learn a lot more like can they attend your classes stuff like that you know just tell us way people can go well we have a class in our subscriber Pro program which is the advanced classes where we do SDR hacking and then we have a advanced SDR hacking class coming up in uh I think it's in June or July and then we have a satellite hacking class coming up in the fall September I believe Advanced SDR is June 11th through 13th we've done a couple of the SDR hacking classes we're on like the third version of it this will be the first time we've done the advanc S strr June 11th through 13th and we have satellite hacking on September 10th through 12th and as we're sitting here right now there is a major issue about satellite hacking going on between National governments right now and it's because people are finally realized that these satellites their communication is not secure and not only can you intercept the signals and but you can also send signals up to these satellites that can manipulate them and control them so just for everyone watching I've put a link below and occupy the way I'm going to let you say this because you've been very kind to share a discount for people that use my link below right we do we uh we're everybody who's watching us here can use the discount code bble b o m b a l David's last name and get 20% off on anything at hackers arrives I really appreciate you doing that and for everyone watching please put your comments below stuff that you want to see that you you know really want us to cover occupy the webs got a whole bunch of content huge amount of knowledge so let us know the kinds of stuff that you want to see OTW as always thanks so much thanks Dave it's always good being being [Music] here