15 ms·
Flipper Zero dark web firmware bypasses rolling code security
flipper zero implementation of a variant [1] of the rolljam [2] attack
[1] https://arxiv.org/abs/2210.11923 https://arxiv.org/abs/2210.11923
[2] https://news.ycombinator.com/item?id=10018934 https://news.ycombinator.com/item?id=10018934
- cakealert 1y agoWhy are so many car manufacturers incapable of using cryptography properly?
- the_mitsuhiko 1y agoTo some degree customers love it. It allows you to program your own replacement key without having to go through the manufacturer or an official dealer.
- j1elo 1y agoNo doubt they would charge $100 or more for just clicking a button and having the equivalent of an NFC writer.
- colechristensen 1y agoWhen my favorite quadruped knocked my keys into the trash I had to get my car towed to the dealer for them to program me a new key. One one hand, top notch security as it was impossible to do any other way. On the other hand the total to get this done was something like $500 after everything.
- dylan604 1y agoI did this to myself by placing my keys in a pocket of a bag that I've never used before when returning to the airport parking. I found the keys in the bag after paying to have it re-keyed after paying for the tow from the airport to the closest dealer.
- mh- 1y agoThis is totally something I'd do. I'm very organized when I travel for work and everything has a place. If I absentmindedly slip something into the wrong part of my bag, it might as well be invisible..
- dylan604 1y agoI'm a great example of "for someone supposed to be smart, you do the dumbest things"
- mh- 1y agoHaha, I heard this a lot growing up. And now I have kids of my own..
- imp0cat 1y agoGet a bluetooth tracker (Apple Air Tag, Samsung Smart Tag or the generic Google Find My compatible one for other Android devices), set it up with your phone and attach it to your car keys. Then anytime you misplace your keys, you can look at a map on your phone and it will show you where to go.
- mh- 1y agoYeah, big +1 on this tip. I have AirTags on my bags themselves as well as some other things. Don't have them on my key fob, but you may have inspired me to attach one haha. The map thing when you're nearby and it goes into the sonar-like mode is super cool. Especially combined with the ping noise.
- colechristensen 1y agoAirtag in the glove compartment of your car.
- mh- 1y ago
- pkaye 1y agoI wonder who make more money on this. The car dealer or the manufacturer.
- hungmung 1y agoWell they don't call them stealerships for nothing.
- IshKebab 1y agoWhat does? The article is very unclear about what exactly this does.
- the_mitsuhiko 1y agoThe attacks to rolling code keys are well known but these keys continue to exist. They allow you to pair a key yourself to the car that you buy online. Particularly in the US it's quite common that people buy used cars and then another key online that they pair themselves. You won't be able to do this for instance with VAG cars that have KESSY. First of all the immobilizer is paired to the key, secondly the only way to pair a new key to it is via the manufacturer or a licensed dealership because you need a blob from their central server. But the consequence is that people feel like they are being fleeced when they need another key, because it can cost you hundreds of dollars to pair one. In general these types of attacks are much harder in Europe where immobilizers have a legal minimum standard that manufacturers have to meet. On the other hand in the US immobilizer are entirely optional, which has famously led to KIA and Hyundai cars shipping without them and the Kia Boys TikTok phenomenon.
- fc417fc802 1y ago> But the consequence is that people feel like they are being fleeced when they need another key, because it can cost you hundreds of dollars to pair one. Because the ARE being fleeced. It's an artificial dependency on the vendor on the one hand versus a blatantly insecure approach on the other. Secure pairing that can be done by the end user isn't rocket science.
- the_mitsuhiko 1y agoIt is a bit rocket science because cars stand around. The CAN bus can even be externally accessed if you pop open the right part of the car (common fault are adaptive headlights). It is not as trivial as people make it out to be because cars violate one of the most important principles of having good security: no physical access.
- theamk 1y agoYou can have strong cryptography + ability to self-pair. See bluetooth or wifi or zigbee or many other technologies..
- fc417fc802 1y agoMaybe the car manufacturers should just give up and adopt BTLE. Proper security, and you could unlock with your phone.
- tamimio 1y agoCar manufacturers are like automation/control manufacturers; they existed before cybersecurity and never caught up to the pace. If you ever audited any SCADA system, you will see nightmares. For cars, some new models of popular brands (not specifying any), you can access the CANbus from the headlight where you can reprogram the ECM to your new key. It's that simple to "own" a modern car.
- b112 1y agoI've seen one-manufacturer, 2024 models at least, which requires two keys in range, before a third key may be programmed. Good idea, don't know how effective it is in reality.
- bayindirh 1y agoNeeding two keys for a third one is not new. My 25 year old car needs two keys for adding the third, old Fiats has “red master” keys which are also required during adding keys.
- serf 1y agoHonda/Acura/Toyota have used similar systems for years; this is one of the reasons why cloning a key costs less flagged hours than making a new one for an owner that lost all of them : when you lose all of them you need to get the actual computer out and pair it with the ecm directly, when you clone them there is a ritual that can be done with the other keys+ the new one.
- tonyarkles 1y ago> ritual I cannot think of a better word to describe the process. The ritual may involve some chanting. Thank you for that :D
- pastage 1y agoCeremony like what is done for the DNS root signing.
- sneak 1y agoThey're not. There is AFAIK an ssh key infrastructure for OnStar that's modern and well-run, for example. Things like key fobs are most likely very incremental changes on "this is the way we've always done it". These organizations are behemoths and steer with all of the inertia of a containership.
- VoidWhisperer 1y agoAnd tend to get stuck in their ways like a container ship stuck in the suez canal
- cindyllm 1y ago[dead]
- dylan604 1y agoProper security is a total pain in the ass, and makes things nigh impossible to use in the manner people want to use them. This naturally makes things more expensive to recover from oopsies. This is why YubiKeys will only ever work for people technical enough to understand them. Normies will loose it at the first chance, and then be locked out of everything. At that point, YubiKeys will be banned by Congress from all of the people writing in demanding something be done about their own inabilities to not be an ID10T
- theamk 1y agoAs far as car security is affected, "normies" really don't care what the algorithm is. The entire UX is "press button to open car, go to dealership if you need new key" and it allows a wide variety of choices re algorithms. The only reason they use KeeLoq (with whopping 32 bits of security!) instead of something normal, like I dunno, AES-128 or something, is because they are trying to save $0.50 in parts on the item they sell for $100. Oh, and because they don't like any change and don't have organizational ability to use anything recent, like other poster says.
- dylan604 1y ago> (with whopping 32 bits of security!) Ha! DVDs at least had 48 bits. /s
- fc417fc802 1y ago> The entire UX is "press button to open car, go to dealership if you need new key" Ironically proper security in this case would likely improve the user experience as well. The car provides a 64 bit (or larger) secret value and you manually program a standardized fob with it. No need for custom parts that are only available from the dealer.
- Terr_ 1y agoI wonder if it's less about the cost of silicon, and more about the energy budget for a device that uses a button-cell battery. Even if it's a problem with off-the-shelf stuff, I imagine a car-manufacturer could easily get something all nice and tiny and special-purpose.
- kube-system 1y agoThe reason these vulnerabilities affect many brands is because they don’t use cryptography. They buy these electronics from other suppliers.
- nullc 1y agoCryptography is actually difficult for the requirements of a key fob. The principle issue is that requiring two way communication greatly increases hardware cost and lowers range/reliability. You also would prefer to minimize or eliminate any volitile storage on the devices. Also you very much want to absolutely minimize the data sent, both for battery life and range/reliability reasons. And whatever volatile storage the devices have you need to have some way of handling it being reset when its lost due to a dead battery or replaced device. So standard replay resistant protocols like "door sends a random challenge, fob signs/decrypts/encrypts it and sends the result" are excluded due to the two-way requirement. The next obvious set is along the lines of "device sends an encrypted counter, door enforces that the counter only goes up" requires nonvol storage in both devices, and then gets tripped up when the fobs counter goes back down due to being reset. (also harder to implement multiple fobs, as they each need unique state).
- SoftTalker 1y agoIf only almost everyone carried a computer with a radio and local storage and a good battery with them almost everywhere
- nullc 1y agowith a battery life of two years? and durable against going through the washing machine?
- SoftTalker 1y agoIf you want simplicity and ruggedness we should never have moved away from steel keys.
- hollerith 1y agoVery few keys are made of steel. Brass is the most common material.
- 1y ago
- brk 1y agoIt's not like the systems they used for physical keys were ever very robust either.
- downrightmike 1y agoLike when just putting in a usb-A anything into the steering column and letting the car drive away? Nah man, no one will figure it out. We're good. Our backdoors are the best
- ronsor 1y agoYou can ask this question about almost every non-software company. Hell, you can ask this question about most software companies. The real question is "why are most people and companies incapable of using cryptography properly?"; and the answer is that doing cryptography right is hard, especially if your use case isn't a common one.
- deleted 1y ago[deleted]
- palata 1y ago> A consequence of this is that the original keyfob gets out of sync, and will no longer function. I always wonder about this: what is the consequence of that? Can the user reset it, or does it have to be done by a retailer or something?
- brk 1y agoDepends on the implementation. Most times you just have to click it a few times in a row. The receiver then realizes it missed a few button presses and it re-syncs. I’m not sure what that window is though, at some point it might get so out of sync that the receiver ignores it and assumes it is a wrong fob.
- siffin 1y agoIf I remember correctly the size of the rolling window differs, more modern vehicles may allow about 100 code discrepancy before ignoring the transmitter, while old models might have been 5 to 10.
- tamimio 1y agoCool, I was planning to get a spare car key, not anymore! Also, glad I have one before they would ban it. It’s a neat tool that I have everything I want there, instead of having 4 fobs, one garage remote, plenty of IR remotes, it’s AIO. Plus I don’t have to pay fees to replace my lost fobs
- imzadi 1y agoSadly, it won't work as an extra key, because it causes the original key to stop working.
- tamimio 1y agoWelp, that’s a bummer! Have you tried it?
- Alejandro9R 1y agoIt says in the article
- hsbauauvhabzb 1y agoWhat practical use does this have? From my reading if I capture an unlock signal, the car will not unlock for the owner, so they’ll press their remote a few times. If I capture a lock signal, presumably I can instead prevent it from locking. The only real world malicious action I can see is being viable is to block the car lock, meaning the car is still in an unlocked state, open the boot (which I’m guessing can be done from the car dash anyway) then locking it afterwards?
- theChaparral 1y agoThis attack lets you use all the functions of the key fob, and not just the action captured.
- hsbauauvhabzb 1y agoIt makes no suggestion that it’s possible to start a push-to-start car. Someone looking to break into your car will probably use a brick, not a flipper zero.
- protocolture 1y agoIts flipper zero performing this https://i.blackhat.com/USA-22/Thursday/US-22-Csikor-RollBack-A-New-Time-Agnostic-Replay-Attack.pdf https://i.blackhat.com/USA-22/Thursday/US-22-Csikor-RollBack... Suggests that it can be used to start a car. Whether it was a fob start or push start isnt specified.
- usmannk 1y agowhich slide suggests this? i didnt find anything suggesting you could start a car with rollback
- kube-system 1y ago> Whether it was a fob start or push start isnt specified. ... It's literally in the title on the first slide. It is only an attack on keyless entry. Keyless start systems all use a different short-range radio system. An attack on keyless entry might let someone trigger a remote starter if supported, but this doesn't enable anyone to drive the vehicle, because you will need to authenticate with the keyless start system after entering the vehicle before you can put it in drive (and to keep the engine running for longer than the predetermined timeout).
- IshKebab 1y agoKind of insane that this works... Surely whoever implemented this knew it was insecure? I honestly wouldn't have thought to check for this vulnerability because... who would do that??
- dylan604 1y agoI don't think the word "secure" was ever part of the discussion on keyless entry for cars. They would have used something like "convenience". Secure would maybe be considered in that the car doors are now locked from the keyless. But as far as "secure" being used in regards to the transmission/receiving of the wireless signal? I doubt if it was ever mentioned by anyone other than PR.
- IshKebab 1y agoIt definitely was because they used to not even use rolling codes. Rolling codes were specifically created to prevent replay attacks, and then they somehow thought "oh but if you replay two keys we'll accept them". Insane. They must have just hoped nobody would even think to try that because it's so ludicrous.
- xyst 1y agocool, I needed a new car, thanks
- jeffbee 1y agoPretty sure you want an old car to avoid this one. A bicycle would also avoid it.
- self_awareness 1y agoWalking also would avoid it. Bicycles produce brake dust!
- withinboredom 1y agoUnless you're my son who has to buy a new bicycle lock every month because he loses his bike keys.
- egypturnash 1y agoGet your son a key ring with a chain and make him attach it to his bag or his pants somewhere.
- arcanemachiner 1y agoCombo lock
- burnt-resistor 1y agoTile Pro and AirTag on the keys, and probably on the bike too.
- withinboredom 1y agoAirTags require people having iphones. Tile requires people with the app. I've lost things with both these items on them and never saw a ping from them ever again.
- 1y ago
- Terr_ 1y agoI sometimes imagine how much of this could be avoided if the communication signals weren't (a) broadcast or (b) a imperceptible to humans. If it an electrical contact in the door handle, it would be very difficult for anyone to monitor or inject other signals. If the signals were audible sound, you'd know when someone was jamming it. In practice, my number one use of a fob from a remote distance is locking, rather than unlocking, and those two operations don't have the equivalent security risk.
- misswaterfairy 1y ago> In practice, my number one use of a fob from a remote distance is locking, rather than unlocking, and those two operations don't have the equivalent security risk. Wouldn't the risk be the same if the same rolling code keys was used for both locking and unlocking? I would be surprised if automotive manufacturers used separate rolling code keys for locking and unlocking.
- Terr_ 1y ago> Wouldn't the risk be the same if the same rolling code keys was used for both locking and unlocking? Yes, what I meant is that such symmetry is not strictly required, and breaking the symmetry opens up ways to enhance security (of unlocking when you arrive) while keeping most of the convenience (of locking while leaving.) For example, imagine "Lock" is a typical broadcast from anywhere within X meters, but "Unlock" requires touching the fob to an infrared port, and they use independent codes.
- a96 1y agoPeugeot used to have infrared keys. Several people who thought their central locking was glitchy have been surprised to learn that pointing the key at the side window makes it work every time.
- meindnoch 1y ago>If the signals were audible sound, you'd know when someone was jamming it. This would be very popular in East Asia. They love everything that beeps. Rice cookers play a melody, pedestrian crossings play a melody, garbage trucks play a melody. Japan is the country of beeps.
- deleted 1y ago[deleted]
- antirez 1y agoI guess this attack is against the keeloq protocol. There are no known total breakage of this kind AFAIK, against the cryptography implemented in the chip. This will be interesting to understand, I mean: what they are exactly doing here.
- doctorpangloss 1y agoA protocol that makes sense would be: mTLS. But. Guess what these fobs do not do? Something that makes sense.
- hulitu 1y agoAnd passkeys. Don't forget passkeys. Trivially to implement in some kB of ROM. /s
- jeroenhd 1y agoYou jest but there's no reason to stick with twenty year old component restrictions in a car that costs forty grand. The real cost will be in the software validation and road safety hardening, but there's no reason why the ROM size should be limited to kilobytes. You can implement full passkey cryptography on a basic esp32 (https://github.com/polhenarejos/pico-fido https://github.com/polhenarejos/pico-fido). Cut out the cruft and you can definitely get a similarly secure algorithm on an actual car key or key receiver. And honestly, with cars now unlocking over Bluetooth and WiFi, standardising that process to something like FIDO wouldn't even be that awful of an idea. It certainly beats the "we can do cryptography at home" many car manufacturers seem to be going for.
- vbezhenar 1y agoESP32 won't work 5 years from cell battery. My Dacia key does. Embedded hardware is limited not just because someone wants to save bytes, but because someone wants to save joules (and PCB size).
- servis 1y ago[dead]
- theoreticalmal 1y agoIf the attack causes the original key to no longer work, imo the major threat vector is someone sitting in a parking lot, capturing key presses, performing the attack, and forcing the user to tow+re-program the key as a nuisance, rather than stealing the vehicle
- summermusic 1y agoIn addition to being able to break in and steal anything that’s kept in the car
- ponector 1y agoOne don't need any keys or other equipment for that. Glass is really fragile unless armored with foil.
- kube-system 1y agoAnd still most thieves don't even bother with doing that, they simply walk around and find a car that was inadvertently left unlocked.
- protocolture 1y agoCapture the lock as they walk into a store. Take the car while they are in the store.
- boudin 1y agoI'm not sure this attack allows starting the car itself.
- protocolture 1y agohttps://i.blackhat.com/USA-22/Thursday/US-22-Csikor-RollBack-A-New-Time-Agnostic-Replay-Attack.pdf https://i.blackhat.com/USA-22/Thursday/US-22-Csikor-RollBack...
- waltbosz 1y agoJokes on them, I lost my key fob years ago.
- radicaldreamer 1y agoYou can be sure that this attack has been well known to intelligence agencies for a while.
- arcanemachiner 1y agoWho needs an attack when you've got backdoors and secret courts?
- jondwillis 1y ago¿Por que no los dos?
- radicaldreamer 1y agoEven a secret court requires probable cause... evidentiary chain of custody etc.
- seany 1y agoWhy isn't a link to the repo/firmware the first link in the article?
- a96 1y agoMost likely because it's made up.
- RachelF 1y agoThis is why keyless "start button" functions on cars is a bad idea. The old approach of keyfob to unlock the car and a real key for the ignition is safer. Having multiple levels of security is good. However, having worked in the car security industry many years ago, I discovered that car manufacturers actually like it when their customer's cars are stolen - Insurance payouts often result in another sale.
- someothherguyy 1y agoAs a DIY option, there are definitely ways you could add MFA-like security with a simple switch/relay (attached to said authentication factor) in most ignition systems. However, that wouldn't help with the "desyncing" or unlocking aspects of this attack.
- _kb 1y agoA physical steering wheel lock works too. Not every problem needs a tech solution.
- arcanemachiner 1y agoThey're basically describing a hidden kill switch/toggle, which is just as much of a tech solution as the one you're describing. Of course, they wrapped it in some nerdy terminology, which IMO obscures the intent of their suggestion.
- bitexploder 1y agoRemovable steering wheel. Most thieves do not carry a steering wheel with them.
- _kb 1y agoRowan Atkinson approves. https://youtube.com/watch?v=yns_DhYrOpY&t=19m30s https://youtube.com/watch?v=yns_DhYrOpY&t=19m30s
- acomjean 1y ago
- kj4ips 1y agoTons of the rolling key systems on the market are based on KeyLoq, and keyloq is a fairly well designed system with a big lynch pin. It has something called a 'manufacturer key', which needs to be available to any device that allows field pairing of remotes. If that manufacturer key is known, it only takes two samples from an authenticator to determine the sequence key. Absent the manufacturer key, jamming+replay attacks work, but brute forcing a sequence key is generally prohibitively costly. However, since any receiver that supports field programming needs the magic "manufacturer key", one could purchase such a unit, and may be able to extract said key.
- deleted 1y ago[deleted]
- userbinator 1y agoThey could've designed a system that doesn't require a fixed secret master key, but instead generates a unique random key for each receiver and requires a physical connection between the fob and the receiver (located inside the locked part of the car) to pair them. Of course such a generic system would be against manufacturer's interests in controlling the repair and aftermarket industry.
- phire 1y agoYou don't even need a physical connection. As long as you have two-way wireless communication (which any keyless entry/start system does), then you can simply do a Diffie-Hellman key exchange during the pairing process. Diffie-Hellman is designed for exactly this usecase, allowing two parties to derive a shared secret key over a public channel without exposing it.
- tux1968 1y agoThat allows the conversation to proceed in secret from listeners, but it provides no authentication to ensure that only legitimate parties are involved. The reason for physical contact is to "prove" that you are legitimately in control of the vehicle, not a random passerby.
- geekamongus 1y agoThis seems difficult when you can order a Ford fleet key off Amazon and get access to most Ford trucks and vans for about $15.
- jrm4 1y agoAm I the only one that just hates push to start in every way? Sure, I don't need to have the "insert key and crank" to be real, but physical key seems so superior. Feels like getting rid of the light switches in your house in favor of "smart home" stuff.
- arcanemachiner 1y agoI also dislike it when people "fix" things that are not broken.
- cam_l 1y agoI liked my old 'rolla that I could start with any key at all.. or even a paddlepop stick. Every time I start thinking about these little modern inconveniences, I re-arrive at the idea that this is yet another example of the difference between a product and a tool. A product ideally works the same for everyone, with as little friction to the immediate function as possible. All other functions are hidden or deleted. Trying to use a product as a tool is slow and frustrating, because the experience never gets better than the first time you use it. A tool on the other hand needs learning. Sometimes that learning curve is shallow and long, like a hammer, or steep and long like CAD. Smart home stuff can be pretty great if you treat it like a tool, and only use it where it is the right tool for the job (so, not light switches). Anyway, I prefer tools.
- Lord_Zero 1y agoI mean, keep using your key if you like it. I for one love never having to touch my car keys. I touch my door handle the car unlocks, I touch the start button the car starts.
- cchance 1y agoYou mean the key and crank that could be started with a screwdriver and some elbow grease?
- burnt-resistor 1y agoI guess you have a Kia. Most cars made in the past 20 years have keys with immobilizer chips.
- gblargg 1y agoSo I guess it's back to locking the door manually before I close it, and being absolutely sure I don't leave the keys in the car.
- kube-system 1y agoIf you're leaving your keys in the car, you have worse vulnerabilities to worry about.
- 2Gkashmiri 1y agoIs there a cheap device you can make yourself or buy from India? Flipper zero is not easy if not impossible to buy. For this project let's say
- tzs 1y ago> For this new attack to work, all that is needed is a single button-press capture from the keyfob, without any jamming. Just from that single capture, it is able to emulate all the keyfob's functions, including lock, unlock, and unlock trunk. If I don't press the buttons on my keyfob am I safe from this? The only keyfob functionality I normally use is that when it is outside the car but within about a meter of the door handle the door can be locked or unlocked by pressing a button on the door handle.
- ethagnawl 1y agoThat's an interesting question. Unless that feature uses NFC or some other protocol, I'd think you're still susceptible.
- Gare 1y agoAFAIK it should be a different system because the car asks the key first (same system as Keyless GO).
- waste_monk 1y agoAs I understand there's still challenge/response stuff going on when you use a physical key or similar means to unlock the car or start the ignition (as that is how the alarm system and immobiliser distinguish a real key from someone picking the lock or hotwiring the car). I don't know the details of the attack in the article, but my speculation would be that it would be vulnerable.
- panki27 1y agoIf you keep your car key close enough to your front door, it's possible to relay the signal that the key is constantly broadcasting closer to the car, allowing an attacker to hit the button on the handle and unlock it without posesssing the key.
- deleted 1y ago[deleted]
- beagle3 1y agoFor the past 20 or 30 years, my insurer made car theft insurance conditional on having an immobilizer device installed that requires code entry through a physical keyboard. And there were a few years this seemed onerous, but most of the time, there were popular attack in use by car thieves that were prevented (or at least made much longer and more complicated) by this.
- joelthelion 1y agoWhy don't cars use public key crypto? Is it too expensive to run on a key?
- Hamuko 1y agoProbably power-wise, yeah. Most keys only have little coin batteries and people want those to last for years. I have a "smart" BMW car key and it inhales the battery. I don't think it can go more than a couple of weeks without having to be charged.
- anticrymactic 1y agoCould charging in the ignition be good enough to keep it full? Or a secondary dock at home? I don't really like the idea of short term key batteries, but it sounds like bmw can improve the current system a lot.
- Hamuko 1y agoThere's no ignition in BMWs anymore. Even if you don't go for the full keyless package, the start is still keyless. You just pay extra to have the doors be keyless too.
- flowerthoughts 1y agoPerhaps I should start using Bluetooth and the mobile app instead...
- finaard 1y agoUnfortunately that video is lots of talking and little substance, so it's hard to properly evaluate it. From the little info shown there it just looks like a nice repackaging of the old rolling flaws (https://github.com/jamisonderek/flipper-zero-tutorials/tree/main/subghz/apps/rolling-flaws https://github.com/jamisonderek/flipper-zero-tutorials/tree/...)
- rootsudo 1y agoWhy is it "dark web" nothing is wrong about posting it online, using it in general may be USC 18 1029/30 in USA but Why is there so much politicatization and bait click of dark web stuff, it's still internet.
- whimsicalism 1y agogovernments are not so enamored with the “just posting code” defense, especially anymore. look at the recent Roman Storm case or what happened with decss back in the day
- rafram 1y agoRoman Storm didn't "just post code." He created, and profited from, a service used by criminals (including the North Korean government!) to launder stolen money. Of course Storm argues that Tornado Cash is decentralized, but you can't just start a mafia branch, hand out free shares at the mall, and then claim that you actually didn't commit any crimes because you have 10,000 other voting shareholders.
- whimsicalism 1y agoPublishing a contract is basically just posting code. You are saying the primary distinction is the governance token and thus financial benefits accruing to the dev?
- Perz1val 1y agoI'd guess that the original firmware author posted in on some hidden onion forum (aka darkweb), because they are actually stealing from cars.
- rootsudo 1y agoI doubt it, most flipper dev is done on the discord that offer unspectrum/noncertified radio manipulation like iceman, etc.
- 1y ago
- piyuv 1y agoCan’t wait for ignorant politicians to ban flipper zero completely instead of accepting the reality that car keyfobs are insecure
- vbezhenar 1y agoAFAIK Flipper Zero is open source, so anyone with tiny bit of electronics experience can recreate it. There's no way to ban it from criminals.
- piyuv 1y agoExactly, but this reality doesn’t stop politicians stop blame flipper zero itself. See this link for Canadian government’s ban: https://blog.flipper.net/response-to-canadian-government/ https://blog.flipper.net/response-to-canadian-government/
- TacticalCoder 1y agoAnybody knows of a simple non-destructive anti-theft mode like a fuse-switch one can easily install himself on basically any modern car? I need something I can remove and the manufacturer/dealership cannot then see I used it (otherwise they may try to whine about me having broken the car manufacturer warranty). One of my older (collectible) car has various anti-theft helpers, including trackers. I also remove its steering wheel (easy, no airbag). Then I disconnect the battery. But then my favorite on that car is a kill-switch I had installed on the fuel pump: it's hidden and you flip the switch, car stops instantly. That one if thieves want to steal it they either have to come with a steering wheel, find the trackers, find the switch, hook up the battery or come with a tow truck (they'd still need to get rid of the trackers though). But yup I'd like to know if there's a simple fuse-switch DIY that's non destructive: basically something I can remove and put back the regular fuse and the car dealership would be none the wiser that I used one. Anyone know of such a thing?
- markus_zhang 1y agoJust use a physical key whenever in public. That should solve part of the issue. I still do that whenever the car is parked in a public parking lot.
- move-on-by 1y agoThe article mentions these manufacturers as being vulnerable: Chrysler, Dodge, Fiat, Ford, Hyundai, Jeep, Kia, Mitsubishi and Subaru I’m curious why these and not some other major manufacturers like: * Chevrolet * Toyota * Honda * Nissan * GMC Does anyone have additional insights? Perhaps they just haven’t tested enough manufacturers yet? Or perhaps some manufacturers use a different technology that isn’t vulnerable to this type of attack?
- kube-system 1y agoAutomakers typically buy keyless entry systems from third party automotive electronics suppliers. The list in this article is likely all using the same system from the same supplier.
- bccc 1y ago2222