Canada to ban the Flipper Zero to stop surge in car thefts::The Canadian government plans to ban the Flipper Zero and similar devices after tagging them as tools thieves can use to steal cars.

  • Lettuce eat lettuce@lemmy.ml
    link
    fedilink
    English
    arrow-up
    56
    ·
    10 months ago

    Classic response, don’t hold the billion dollar corpos who actually design and manufacture the cars responsible. Ban the little device that exposes the flaws in their designs.

    • 7heo@lemmy.ml
      link
      fedilink
      English
      arrow-up
      29
      ·
      edit-2
      10 months ago

      Yeah, let’s entirely outlaw pentesting while we’re at it. What could possibly go wrong? 🙈

      • fluxion@lemmy.world
        link
        fedilink
        English
        arrow-up
        15
        ·
        10 months ago

        Lets outlaw devices that could be used for pentesting while we’re at it. PCs, laptops, phones, etc.

        • twack@lemmy.world
          link
          fedilink
          English
          arrow-up
          7
          ·
          10 months ago

          Don’t forget paperclips, string, and aerosol cans. Hell, we should probably just ban wire altogether.

        • 7heo@lemmy.ml
          link
          fedilink
          English
          arrow-up
          5
          ·
          10 months ago

          Brains. Technically that is the most useful device when pentesting. Along with curiosity. Altho on the former, I believe we, as a society, have actually started to…

        • coffeebiscuit@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          7
          ·
          10 months ago

          He/she stated that you can’t steal a car with a flipper. But you can. That it isn’t a go to tool is something else.

          Besides this, you can use a flipper as a butter knife…

          Snow fucking white.

          • agent_flounder@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            edit-2
            10 months ago

            Yes it can be used to steal some cars.

            Banning it because it can be used to steal cars doesn’t make sense

            Btw… Some folks may not realize it is a go to tool for many things.

            Flipper Zero - Wikipedia Flipper Zero is a portable Tamagotchi-like multi-functional device developed for interaction with access control systems. The device is able to read, copy, and emulate RFID and NFC tags, radio remotes, iButton, and digital access keys, along with a GPIO interface.

            It is a swiss army knife for RF access control systems as well as harmless, related things like remote controls.

            It is used by penetration testers (information security professionals) to do myriad kinds of legit, legal work in their field.

            Like any tool it can be used for good or evil. The problem isn’t the tool but the vulnerabilities in cars demonstrating shocking negligence on the part of manufacturers.

            Banning the tools just gives us a false sense of security. The vulnerability still exists. It isn’t that difficult for someone to either get the tool, reproduce the tool, or make a new tool with existing parts. Meanwhile law abiding people cannot find the vulnerabilities as easily.

            This mostly only serves to penalize a smallish company and protect large car manufacturers from the consequences of their negligence.

            It is already illegal to steal cars. Why would criminals risking felony jail time care about whether their tools are suddenly illegal, too?

  • febra@lemmy.world
    link
    fedilink
    English
    arrow-up
    19
    ·
    10 months ago

    Next, ban radio waves, because car companies are too damn dense to create a proper product lol

    • sebinspace@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      ·
      10 months ago

      I’m surprised no fobs use a time-based token to prevent replay attacks. Would make it a bit of a bitch to replace the battery, but hey-ho, tradeoffs.

      • ikidd@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        10 months ago

        They use rolling codes that aren’t susceptible to FlipperZero anyway. This is a dog and pony show.

          • ikidd@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            10 months ago

            It’s been that way for a long time, it’s just kinda the accepted way. The vehicle builders had seen what garage door systems problems came about from hard-switched or dip-switched codes and just went that way from the start.

            https://en.wikipedia.org/wiki/Remote_keyless_system#Security

            The newer vehicles have these always-on systems now, the owner doesn’t have to press a specific button. So theives can amplify the fob signal that’s constantly being emitted in the house and get the car to open, then program new keys once they’re in the vehicle and drive away. But that has nothing to do with the Flipper, that’s just a radio repeater.

      • Chriswild@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        10 months ago

        Instead of a time based token they should have authentication. To start the car you need biometric or passcode or Bluetooth to connect and the fob.

        For the life of me I don’t understand why my phone has better security than my car.

      • KairuByte@lemmy.dbzer0.com
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        1
        ·
        10 months ago

        More of an issue with the fob being to connect to a service to get the current time. Technically possible, but would add cost. And if that time is ever out of sync it just won’t work.

        • sebinspace@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          10 months ago

          I can put an RTC in an Arduino for about $8. It keeps time accurately. If it gets out of sync, maybe a Bluetooth connection to let it do an NTP request through another device.

          Cellular connectivity is not required.

          • KairuByte@lemmy.dbzer0.com
            link
            fedilink
            English
            arrow-up
            1
            ·
            10 months ago

            RTC’s are not inherently accurate. You have an RTC in your computer, but disconnect it from the internet for a year and it’s extremely unlikely it will be able to pass an OTP check.

            Add to that the fact that RTCs run off power, means that the fob would need to actively pull from the battery 24/7. What happens when that battery voltage drops below the required power level? The time goes out of sync. Not to mention you need to change the battery at some point.

            Adding Bluetooth would be a terrible idea. You’d then need to make sure the device can receive firmware updates, and we all know the reputation car companies have for updates to things.

            Better option would be to receive the date and time from a transmission, be it FM or cell. And no, you wouldn’t have to pay for cell.

            The problem comes when you’re in an area that doesn’t have these available, which is still quite possible in the US.

            So we loop back to these not really being that viable. They will work most of the time, in most instances. But they’d be shooting themselves in the foot in certain places and with certain users.

  • mods_are_assholes@lemmy.world
    link
    fedilink
    English
    arrow-up
    16
    ·
    10 months ago

    Might as well outlaw crowbars because they can be used to break into houses…

    Fucking idiots who’s microwaves blink midnight for decades think they can make meaningful decisions about tech.

  • Fades@lemmy.world
    link
    fedilink
    English
    arrow-up
    11
    ·
    10 months ago

    That’s fucking bullshit wtf. This is exactly like bad gun reform that comes from someone who doesn’t know shit about the thing they are trying to reform

    • ikidd@lemmy.world
      link
      fedilink
      English
      arrow-up
      5
      ·
      10 months ago

      Welcome to Canada. Turning dials that aren’t connected to anything is the specialty of our “leaders”.

    • moistclump@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      arrow-down
      2
      ·
      10 months ago

      I still don’t understand

      The Flipper Zero is a portable and programmable pen-testing tool that helps experiment with and debug various hardware and digital devices over multiple protocols, including RFID, radio, NFC, infrared, and Bluetooth.

      • wunami@lemmy.world
        link
        fedilink
        English
        arrow-up
        7
        ·
        edit-2
        10 months ago

        Pen-testing is short for penetration testing. Which is testing if you can break into the things. Like a locked office or a computer system, etc. Legally, it’s done to find flaws that need to be fixed before they get used nefariously.

        Pen testing techniques and tools are essentially break in tools. In this case, a tool for mimicking car key fobs and the wireless signals they send to the car.

      • Fondots@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        ·
        10 months ago

        Pen-testing: penetration testing, basically good guy hacking to find security vulnerabilities so that they can be fixed, basically finding out how easy a security system is to penetrate.

        Debugging: fixing problems in hardware and software

        RFID (Radio Frequency IDentification), radio, NFC (Near Field Communication,) infrared, Bluetooth: different forms of wireless communication.

        RFID is used for stuff like security tags on merchandise, car key fobs

        NFC is similar (you could probably make an argument that NFC is basically a type of RFID) with a very short range used for things like making payments with your phone

        Bluetooth you’re probably somewhat familiar with, in used for a lot of consumer electronics, wireless headphones, speakers, computer mice, etc.

        All of those use radio waves in some form to pass information from one device to another.

        Infrared uses a infrared light to send information, the most common use you’ve probably seen is for TV remotes, which is why you have to point the remote at the TV to work, you’re basically flashing an invisible flashlight at the sensor on the TV

        This device can basically mimic any of those kinds of signals allowing it access, control, or bypass devices and systems that use those protocols.

        This can be useful for people working on those kinds of systems, you don’t need to have the actual key card, remote, device, etc. to test it out, you can try a bunch of different configurations without needing to reprogram the card a bunch of times, and gives you a lot of options to test for different vulnerabilities and issues.

        But those same capabilities make it attractive to people who would use it maliciously. If they don’t have the right security measures in place, something like this device could be used to gain access to secure areas by spoofing a key card, unlock cars, interfere with cell phones, snoop on wireless communications, gain access to a someone’s devices, etc.

      • Psythik@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        edit-2
        10 months ago

        It’s basically a 2 way radio with tools for those who like to mess with the radio spectrum. That’s the most simple explanation I can make for such a device.

  • golden_zealot@lemmy.ml
    link
    fedilink
    English
    arrow-up
    7
    arrow-down
    2
    ·
    edit-2
    10 months ago

    This is our government in a nutshell. Don’t like guns? Ban them from licensed owners instead of working against smuggling or changing the license requirement from a PAL to an RPAL. Don’t like gas cars? Ban them instead of working on public transit and infrastructure. Don’t like the flipper zero? Ban it instead of either licensing purchase and use like a billion other radio devices that exist, or holding car manufacturers responsible for ass security practices.

    Can’t wait to find out what they don’t like next, I wonder what they’ll do? /s

  • quaddo@lemmy.world
    link
    fedilink
    English
    arrow-up
    3
    ·
    10 months ago

    “This here’s the Lockpocking Lawyer, and today we’re going to take a closer look at the Flipper Zero….”

  • badaboomxx@lemmy.world
    link
    fedilink
    English
    arrow-up
    2
    ·
    10 months ago

    One question, has the Canadian police actually arrested people using the flipper to steal cars?