Canada to ban the Flipper Zero to stop surge in car thefts::The Canadian government plans to ban the Flipper Zero and similar devices after tagging them as tools thieves can use to steal cars.

    • @WhatAmLemmy@lemmy.world
      link
      fedilink
      English
      46
      edit-2
      1 year ago

      But at least they can persecute tinkerers and cyber security professionals while the criminals continue to steal cars.

      It’s win-win for the POS in law enforcement. They create more crime stats for themselves to ensure their increased funding, and the criminals continue stealing cars.

      • @orclev@lemmy.world
        link
        fedilink
        English
        161 year ago

        Even better, tinkerers and cyber security professionals are easy to find and there’s a much lower chance of them fighting back compared to actual car thieves so it’s very low risk for the police. They get to be lazy and safe while padding their numbers, all their favorite things at once.

        • @FireRetardant@lemmy.world
          link
          fedilink
          English
          -2
          edit-2
          1 year ago

          I do think its a factor, i dont think the solution is just letting car theives walk away because they are in a tough spot. That thief will just keep stealing cars and they will get better at it the more they steal and more confident the more they know they won’t be prosecuted.

            • Dadd Volante
              link
              fedilink
              English
              3
              edit-2
              1 year ago

              This person who is insisting we punish low level criminals because they all will turn into high level criminals needs to stop playing GTA, pay a bill or two in life, and realize that poverty creates desperation, and in fact, locking up “low level” criminals actually exposes them to the more hardened ones who have turned it into a lifestyle.

              If you don’t get thrown in a cage with dangerous people and treated like an animal, your odds of rehabilitation skyrocket.

              Exposing people to violence, punishment and harder criminals is the least productive way to rehabilitation.

      • @gamermanh@lemmy.dbzer0.com
        link
        fedilink
        English
        21 year ago

        Them: if someone’s getting caught stealing their third car then clearly jail doesn’t work to stop them from doing that and maybe we should think of trying something else?

        You: they want to just let car thieves walk free!

        See what makes you look silly?

      • CommunityLinkFixerBotB
        link
        fedilink
        English
        21 year ago

        Hi there! Looks like you linked to a Lemmy community using a URL instead of its name, which doesn’t work well for people on different instances. Try fixing it like this: !canada@lemmy.ca

        • @4am@lemm.ee
          link
          fedilink
          English
          211 year ago

          “Trudeau to ban coat hangers, other clothing care items, after rash of thefts of ancient vehicles”

        • @coffeebiscuit@lemmy.world
          link
          fedilink
          English
          -51 year ago

          Who are you fooling? Tech savvy people don’t know how to handle coat hangers.

          Plus videos show you that it also works on newer cars. To much Hassle though, but thatch’s also mentioned in the article.

          • Q*Bert Reynolds
            link
            fedilink
            English
            61 year ago

            Those videos are staged. The signal playback trick doesn’t work on newer cars because the code changes every time you lock or unlock your car. You could probably replicate the functionality of a key fob on your Flipper, but it would need to be registered with the car’s computer the same as any other key fob, which means you’d already have to have to access to the car.

            • @Socsa@sh.itjust.works
              link
              fedilink
              English
              31 year ago

              There are definitely some basic attacks that you can do with a flipper. They are quite a bit more limited than what you can do with an SDR though, and I’m skeptical that they are widely deployed by anyone. You definitely can’t steal a car like this, you can possibly unlock one. But hammers are much more useful in that regard and have a significantly lower skill floor.

          • @Restaldt@lemm.ee
            link
            fedilink
            English
            41 year ago

            No the world just ran out of coat hanger bones and is trying to hide it with plastic replacements

        • @Fapper_McFapper@lemmy.world
          link
          fedilink
          English
          61 year ago

          And you need additional hardware and custom firmware. Then you have to GitHub that shit into the flipper.

          Most people think it works like Dr. Who’s sonic screwdriver. Just press a button, wave it around and voila! You’re in the NSA database.

            • @twack@lemmy.world
              link
              fedilink
              English
              61 year ago

              Isn’t that because it can desync the actual keyfob?

              Nvm… Clicked the link. That’s exactly why you shouldn’t do that.

              • @Buddahriffic@lemmy.world
                link
                fedilink
                English
                11 year ago

                Ah, so the cars still have shitty security implementations, only now it’s in the direction of “car needs service if someone tries to playback a previous signal”.

                Though how does it work when you hit the button while out of range of the car?

                It should be each fob has a private key that is used to generate a cryptographic hash of a random challenge string. Or hell, even give a rolling code a sequence number so they the car and fob can resync if necessary (I don’t think this would break the security, since the sequence could be started at a number other than 0).

                • @jkrtn@lemmy.ml
                  link
                  fedilink
                  English
                  31 year ago

                  That sounds dangerously close to an open standard that would prevent charging $500 for key fobs.

        • @coffeebiscuit@lemmy.world
          link
          fedilink
          English
          -121 year ago

          He/she stated that you can’t steal a car with a flipper. But you can. That it isn’t a go to tool is something else.

          Besides this, you can use a flipper as a butter knife…

          Snow fucking white.

          • @agent_flounder@lemmy.world
            link
            fedilink
            English
            3
            edit-2
            1 year ago

            Yes it can be used to steal some cars.

            Banning it because it can be used to steal cars doesn’t make sense

            Btw… Some folks may not realize it is a go to tool for many things.

            Flipper Zero - Wikipedia Flipper Zero is a portable Tamagotchi-like multi-functional device developed for interaction with access control systems. The device is able to read, copy, and emulate RFID and NFC tags, radio remotes, iButton, and digital access keys, along with a GPIO interface.

            It is a swiss army knife for RF access control systems as well as harmless, related things like remote controls.

            It is used by penetration testers (information security professionals) to do myriad kinds of legit, legal work in their field.

            Like any tool it can be used for good or evil. The problem isn’t the tool but the vulnerabilities in cars demonstrating shocking negligence on the part of manufacturers.

            Banning the tools just gives us a false sense of security. The vulnerability still exists. It isn’t that difficult for someone to either get the tool, reproduce the tool, or make a new tool with existing parts. Meanwhile law abiding people cannot find the vulnerabilities as easily.

            This mostly only serves to penalize a smallish company and protect large car manufacturers from the consequences of their negligence.

            It is already illegal to steal cars. Why would criminals risking felony jail time care about whether their tools are suddenly illegal, too?

  • @golden_zealot@lemmy.ml
    link
    fedilink
    English
    8
    edit-2
    1 year ago

    This is our government in a nutshell. Don’t like guns? Ban them from licensed owners instead of working against smuggling or changing the license requirement from a PAL to an RPAL. Don’t like gas cars? Ban them instead of working on public transit and infrastructure. Don’t like the flipper zero? Ban it instead of either licensing purchase and use like a billion other radio devices that exist, or holding car manufacturers responsible for ass security practices.

    Can’t wait to find out what they don’t like next, I wonder what they’ll do? /s

  • @BakerBagel@midwest.social
    link
    fedilink
    English
    111 year ago

    Personally, i would require car manufacturers to make their cars resistant to such trivial exploits, but this works too i guess

    • @SlopppyEngineer@lemmy.world
      link
      fedilink
      English
      21 year ago

      It’s the equivalent of banning paperclips because they saw a videoclip of somebody opening locks with a paper clip, and completely ignoring all other tools that can open a lock faster than using the key.

    • @finkrat@lemmy.world
      link
      fedilink
      English
      4
      edit-2
      1 year ago

      Eh it doesn’t really, there isn’t a surge in radio attacks on cars, it’s just a novel concept so people are feeling spooked

      But I’m with you on your first point, security needs to be hardened and the only one who can truly do that is the manufacturer

    • @Buddahriffic@lemmy.world
      link
      fedilink
      English
      11 year ago

      This, but apparently they already did this in 1990. Though it sounds like this might instead make the fob go out of sync and no longer work, but that’s also on the manufacturers.

      Also I wouldn’t be surprised if phones could be made to do radio signal recording and playback. You might need a USB ADC/DAC and antenna, but it’s not like this device is doing something really sophisticated for this particular attack.

  • @Shenanigore@lemm.ee
    link
    fedilink
    English
    8
    edit-2
    1 year ago

    That’s all Trudeau has been good for, for years, attempting to appear to do something about a problem but never, never, ever, actually fixing anything, but also inconveniencing/ removing rights or making criminals out of ancillary people to the actual issue.

  • Lettuce eat lettuce
    link
    fedilink
    English
    1041 year ago

    Classic response, don’t hold the billion dollar corpos who actually design and manufacture the cars responsible. Ban the little device that exposes the flaws in their designs.

    • 7heo
      link
      fedilink
      English
      50
      edit-2
      1 year ago

      Yeah, let’s entirely outlaw pentesting while we’re at it. What could possibly go wrong? 🙈

      • @fluxion@lemmy.world
        link
        fedilink
        English
        311 year ago

        Lets outlaw devices that could be used for pentesting while we’re at it. PCs, laptops, phones, etc.

        • 7heo
          link
          fedilink
          English
          81 year ago

          Brains. Technically that is the most useful device when pentesting. Along with curiosity. Altho on the former, I believe we, as a society, have actually started to…

        • @twack@lemmy.world
          link
          fedilink
          English
          161 year ago

          Don’t forget paperclips, string, and aerosol cans. Hell, we should probably just ban wire altogether.

  • @Fades@lemmy.world
    link
    fedilink
    English
    261 year ago

    That’s fucking bullshit wtf. This is exactly like bad gun reform that comes from someone who doesn’t know shit about the thing they are trying to reform

    • @ikidd@lemmy.world
      link
      fedilink
      English
      91 year ago

      Welcome to Canada. Turning dials that aren’t connected to anything is the specialty of our “leaders”.

  • @febra@lemmy.world
    link
    fedilink
    English
    421 year ago

    Next, ban radio waves, because car companies are too damn dense to create a proper product lol

    • sebinspace
      link
      fedilink
      English
      61 year ago

      I’m surprised no fobs use a time-based token to prevent replay attacks. Would make it a bit of a bitch to replace the battery, but hey-ho, tradeoffs.

      • @Chriswild@lemmy.world
        link
        fedilink
        English
        21 year ago

        Instead of a time based token they should have authentication. To start the car you need biometric or passcode or Bluetooth to connect and the fob.

        For the life of me I don’t understand why my phone has better security than my car.

        • @rottingleaf@lemmy.zip
          link
          fedilink
          English
          21 year ago

          Cause what’s in the title is normal news. That’s why. Dumbasses having power to decide for us that it’s the tools to blame.

      • Natanael
        link
        fedilink
        English
        21 year ago

        Challenges-reponse protocols are what’s needed

      • @ikidd@lemmy.world
        link
        fedilink
        English
        51 year ago

        They use rolling codes that aren’t susceptible to FlipperZero anyway. This is a dog and pony show.

          • @ikidd@lemmy.world
            link
            fedilink
            English
            41 year ago

            It’s been that way for a long time, it’s just kinda the accepted way. The vehicle builders had seen what garage door systems problems came about from hard-switched or dip-switched codes and just went that way from the start.

            https://en.wikipedia.org/wiki/Remote_keyless_system#Security

            The newer vehicles have these always-on systems now, the owner doesn’t have to press a specific button. So theives can amplify the fob signal that’s constantly being emitted in the house and get the car to open, then program new keys once they’re in the vehicle and drive away. But that has nothing to do with the Flipper, that’s just a radio repeater.

      • @KairuByte@lemmy.dbzer0.com
        link
        fedilink
        English
        31 year ago

        More of an issue with the fob being to connect to a service to get the current time. Technically possible, but would add cost. And if that time is ever out of sync it just won’t work.

        • sebinspace
          link
          fedilink
          English
          51 year ago

          I can put an RTC in an Arduino for about $8. It keeps time accurately. If it gets out of sync, maybe a Bluetooth connection to let it do an NTP request through another device.

          Cellular connectivity is not required.

          • @KairuByte@lemmy.dbzer0.com
            link
            fedilink
            English
            11 year ago

            RTC’s are not inherently accurate. You have an RTC in your computer, but disconnect it from the internet for a year and it’s extremely unlikely it will be able to pass an OTP check.

            Add to that the fact that RTCs run off power, means that the fob would need to actively pull from the battery 24/7. What happens when that battery voltage drops below the required power level? The time goes out of sync. Not to mention you need to change the battery at some point.

            Adding Bluetooth would be a terrible idea. You’d then need to make sure the device can receive firmware updates, and we all know the reputation car companies have for updates to things.

            Better option would be to receive the date and time from a transmission, be it FM or cell. And no, you wouldn’t have to pay for cell.

            The problem comes when you’re in an area that doesn’t have these available, which is still quite possible in the US.

            So we loop back to these not really being that viable. They will work most of the time, in most instances. But they’d be shooting themselves in the foot in certain places and with certain users.

  • RBG
    link
    fedilink
    English
    581 year ago

    “Flipper Zero can’t be used to hijack any car, specifically the ones produced after the 1990s, since their security systems have rolling codes,” Flipper Devices COO Alex Kulagin told BleepingComputer.

    I guess Canada must have a ton of old cars?

    • 7heo
      link
      fedilink
      English
      341 year ago

      Or the “rolling codes” have glaring implementation issues, but it is cheaper to ban the Flipper Zero than recall the cars, so the manufacturers made an executive decision… (⚠️ YouTube)

    • @grue@lemmy.world
      link
      fedilink
      English
      71 year ago

      It also can’t be used to hijack cars produced before the 1990s, since they mostly don’t have keyless entry in the first place.

    • @Socsa@sh.itjust.works
      link
      fedilink
      English
      31 year ago

      Rolljack attacks are absolutely not trivial to pull off and I am quite skeptical that a flipper can even do it reliably, if at all, since it requires reactively jamming the transmission after the attacker has already decoded it. I don’t believe these devices have enough power to reliably jam the key fob, much less the speed to do it reactively.