Hubbry Logo
search
logo
2525295

Flipper Zero

logo
Community Hub0 Subscribers
Read side by side
from Wikipedia

Flipper Zero
Flipper Zero running Sub-GHz radio scanning mode
ManufacturerFlipper Devices Inc.
Release dateAugust 2020
Operating systemFreeRTOS
CPUSTMicroelectronics STM32WB55
Memory
  • 256 KB RAM
  • 1024 KB Flash
Removable storageMicro SD (up to 256 GB)
Display
  • Monochrome LCD
  • 1.4-inch, 128 × 64 pixels
SoundBuzzer (100–2,500 Hz): 87 dB
Connectivity
PowerLiPo 2,000 mAh
Dimensions100 x 40 x 25 mm
Weight104 grams (3.7 oz)
Websiteflipperzero.one

The Flipper Zero is a portable multi-functional hacking device developed for interaction with access control systems.[1] The device is able to read, copy, and emulate RFID and NFC tags, radio remotes, iButtons, and digital access keys. It also has a GPIO interface.[2] It was first announced in August 2020 through the Kickstarter crowdfunding campaign, which raised $4.8 million.[3] The first devices were delivered to backers 18 months after completion of the crowdfunding campaign. The device's user interface embodies a pixel-art dolphin virtual pet. The interaction with the virtual pet is the device's core game mechanic. The usage of the device's functions defines the appearance and emotions of the pet.[4]

In the built-in game, the main mechanism to "upgrade" the dolphin is to use the various hacking tools. While harmless uses (like as a remote control for a television, or carbon dioxide sensor) exist, some of the built-in tools have potential criminal uses, including RFID skimming, Bluetooth spamming (spamming a Bluetooth connection, crashing a person's phone), and emulation of RFID chips such as those found in identification badges, using the built-in radio cloner to open garage doors, unlocking cars, and functioning as a wireless BadUSB.

Origin

[edit]

The device was developed by Alex Kulagin and Pavel Zhovner in 2019.[5] They started raising funds on Kickstarter.[5]

Overview

[edit]

Flipper Zero is designed for interaction with various types of access control systems, radio protocols, RFID, near-field communication (NFC), and infrared signals.[6][7] To operate the device, a computer or a smartphone is not required; it can be controlled via a 5-position D-pad and a separate back button. Flipper Zero has a monochrome orange backlight LCD screen with a resolution of 128 × 64 pixels. For connection with external modules, the device has general-purpose input/output (GPIO) pinholes on the top side. User data and firmware updates are stored on a microSD card. Some actions, such as firmware or user data update, require a connection to a computer or a smartphone with the developer's software installed.

In July 2023, an app store was opened for the device.[8]

Technical specification

[edit]

The electronic schematics[9] and firmware[10] of the Flipper Zero project are open sourced under the GNU General Public License. At the same time, the device does not fit into the open-source hardware category because the printed circuit boards are not open-sourced, which does not allow enthusiasts to make their own copies of the device without knowledge of electrical engineering.[citation needed]

Hardware

[edit]

Flipper Zero's hardware consists of four PCB modules connected by flexible cables. The battery is positioned in the center of the device between three of the PCBs.

  • Main PCB (motherboard) – contains core components, including the main processor (STM32WB55), GPIO breakout pins, LCD display, Sub-GHz chip and its antenna, Bluetooth antenna, microSD card slot, battery controller, USB Type-C port, and membrane switches for the D-pad. All additional PCBs connect to the main PCB via flexible cables.
  • Infrared and iButton PCB – a small board equipped with an infrared receiver (TSOP-75338) and three infrared LEDs for transmitting infrared signals. Includes three pogo pins for iButton (1-Wire) tags and a piezo buzzer (BCE-MX8530A) for audio feedback.
  • NFC PCB – contains the NFC chip (STM ST25R3916) along with analog circuitry for 125 kHz RFID.
  • Dual-Band RFID Antenna PCB – features two passive coil antennas: one for 13.56 MHz NFC communication and another for 125 kHz RFID systems.

Microcontroller (MCU)

[edit]
Flipper Zero main board
Infrared board and iButton pogo pins
NFC PCB and dual-band RFID antenna

Flipper Zero is based on a dual-core ARM architecture STM32WB55 microcontroller, which has 256 KB of RAM and 1 MB of Flash storage. The first core is a 64 MHz Cortex-M4 which runs the main firmware. The second core is a 32 MHz Cortex-M0 which runs STMicroelectronics proprietary firmware that implements the Bluetooth Low Energy protocol. Secret keys stored in the Secure Enclave of STM32WB55 are used to decrypt cryptographic keys on the fly, which are then applied to decode Sub-GHz protocols. This mechanism allows the device to handle encrypted communication for Sub-GHz protocols. However, the encryption used is not entirely secure and primarily serves as a form of obfuscation rather than robust protection. Its purpose is to make reverse engineering more challenging, but it does not provide absolute security.

Sub-GHz radio

[edit]

For radio transmitting and receiving in the 300–900 MHz radio frequency range, a Texas Instruments CC1101[11] chip is used, which supports amplitude-shift keying (ASK) and frequency-shift keying (FSK) modulations. Unlike software-defined radio, the CC1101 chip cannot capture raw radio signals. This limitation requires the user to pre-configure the modulation parameters before receiving a radio signal, otherwise the signal will be received incorrectly.

Infrared

[edit]

The infrared transceiver in Flipper Zero consists of a digital receiver and an LED circuit. The receiver, based on the TSOP-75338 module, decodes incoming infrared signals. Infrared transmission is managed by three LEDs directly connected to the MCU, which controls the signal output.

NFC and 125 kHz RFID

[edit]

The NFC subsystem is based on the STM ST25R3916 chip, which is responsible for reading and emulating high-frequency cards.[12] The 125 kHz low-frequency RFID functionality in Flipper Zero is implemented primarily through software running on the MCU, without a dedicated RFID chip.[citation needed] It also supports reading RFID tags in the 110–140 kHz range, albeit with a reduced reading distance.[citation needed]

Hardware expansion

[edit]

In February 2024, a video game module was released for the Flipper Zero by its makers.[13] The device allows the Flipper to be used as a game controller or connected to a TV and is based around the Raspberry Pi Pico.[13]

Firmware

[edit]
Flipper Zero firmware architecture

The Flipper Zero firmware is based on the FreeRTOS operating system, with its own software abstraction over the hardware layer. The firmware is mostly written in the C programming language, with occasional use of C++ in third-party modules. The system uses multitasking in combination with an event-driven architecture to organize the interaction of applications and services executed in a single address space and communicating through a system of queues and events. The system can be executed from both random-access memory (RAM) and read-only memory (ROM). Execution from RAM is used to deliver over-the-air (OTA) firmware updates.

The firmware consists of the following components:

  • FuriCore – provides an API for interaction with the scheduler and multithreading. FuriCore abstracts and extends the functionality of the FreeRTOS scheduler and adds additional system primitives.
  • FuriHal – provides an API for interaction with hardware.
  • Services and applications – the main functionality of the device. Sub-GHz, Infrared, RFID, NFC, etc are applications for user interaction. Graphical user interface (GUI), command-line interface (CLI), Notification, Storage, etc are additional APIs for applications development.
  • A set of libraries and drivers – covers various communication protocols, device drivers, file system drivers, and developer tools.

User and system data is stored in built-in flash memory, which is based on the LittleFS library. Interaction with the file system on the SD card is implemented using the FatFs library.

The build system is based on the SCons tool with additional tooling written in Python. For compilation, the system uses its own open toolchain based on GNU Compiler Collection.

Applications

[edit]

Sub-GHz

[edit]

Flipper Zero has a built-in module that can read, store, and emulate remote controls, allowing it to receive and send radio frequencies between 300 and 928 MHz. These switches, radio locks, wireless doorbells, remote controls, barriers, gates, smart lighting, and other devices can all be operated with these controls. Using Sub-GHz Flipper Zero can also receive and decode the data from many weather stations.

125 kHz RFID

[edit]

Flipper Zero is compatible with low-frequency (LF) radio frequency identification (RFID), which is used in supply chain tracking systems, animal chips, and access control systems. LF RFID cards typically don't offer high levels of security, in contrast to NFC cards. Numerous form factors of this technology are available, including plastic cards, key fobs, tags, wristbands, and animal microchips. A low-frequency RFID module in the Flipper Zero can read, save, simulate, and write LF RFID cards.

NFC

[edit]

NFC technology, which is used in smart cards for access control and cards, and digital business cards, is compatible with Flipper Zero. The 13.56 MHz NFC module has the ability to imitate, read, and store these cards. An NFC card is a transponder with a unique identification (UID), and rewritable memory for data storage. When placed close to a reader, NFC cards transmit the needed data.

Infrared

[edit]

Flipper Zero can read and transmit signals that use infrared light (IR) such as TVs, air conditioners, or audio devices. It can learn and save infrared remote controls or use its own Universal remotes.

GPIO and modules

[edit]

Flipper Zero explores hardware, flash firmware, debugging, and fuzz. It is able to function as a USB converter for UART, SPI, or I2C. The built-in GPIO pins connect to hardware, operate by buttons, send out code, and display messages on the LCD screen.

iButton

[edit]

The Flipper Zero has an iButton connector to allow it to read and emulate iButton contact keys.[14]

BadUSB

[edit]

BadUSB devices have the ability to alter system settings, unlock backdoors, recover data, launch reverse shells, and do any other physical access-based actions. Flipper Zero can function as a BadUSB and, when connected to an insecure computing device, acts as a keyboard-like Human interface device (HID). Commands (the payload) are injected and executed using DuckyScript (the macro scripting language developed as part of the 'USB Rubber Ducky' BadUSB project).[15]

U2F (Universal 2nd Factor)

[edit]
  • Use the flipper as a second authentication factor for your Google account and others

HID controllers

[edit]

Flipper Zero can replace certain HID (human interface device) controllers. This allows it to interact with your phone or computer. It can remotely control media players, computer keyboards or mouse, presentations, and more.

  • Keynote: Presentations remote
  • Keyboard: Double as a keyboard for a computer
  • Media: Controls media on a computer, camera remote control for a phone
  • Mouse: Double as a mouse for a computer
  • TikTok Controller: Control TikTok app on a phone
  • Mouse Jiggler: Duplicate mouse movements on a computer to keep computer showing as active at all times
  • PTT : use the flipper as a PTT (push to talk) controller / wireless PTT remote

Bans, seizure, police bulletin and other incidents

[edit]

U.S. Customs seizure and release

[edit]

In late 2022, U.S. Customs and Border Protection seized a shipment of 15,000 devices, but they were eventually released.[16][17]

Amazon ban

[edit]

On 7 April 2023, Amazon banned sales of the Flipper Zero via their site for being a "card skimming device".[18]

Brazil seizures

[edit]

In 2023 people in Brazil who ordered Flipper Zeros reported that their orders had been seized by Anatel.[19] According to the Electronic Frontier Foundation, Anatel has flagged the devices as being a tool for criminal purposes, making the certification process complicated.[19] Users have tried getting their devices certified, but to no avail.[19] The EFF has said that the seizures would limit the ability of Brazilian cybersecurity researchers to conduct research, as they have legitimate uses for the device.[19]

Police bulletin on Flipper Zero

[edit]

In August 2023, The Daily Dot published an article on a bulletin for police officers published by the South Dakota Fusion Centre.[16] The document suggested that extremists might use the device to bypass access control systems controls, particularly on power stations.[16] The bulletin admitted there was no concrete evidence of plans by said extremists to use the device, though interest had been expressed on online forums.[16]

Flipper CEO Pavel Zhovner was shown a copy of the bulletin and said that the Flipper Zero had been deliberately designed to not affect modern access control systems.[16] He also pointed out that the bulletin itself said that gates at power stations were not inherently vulnerable to the device but that older gates might be.[16]

Gatwick seizure

[edit]

On 27 September 2023 a security staff member at Gatwick Airport confiscated a Flipper Zero from Vitor Domingos due to security concerns.[20] The device was then handed over to Sussex Police.[20]

Midwest FurFest Bluetooth Low Energy attack

[edit]

In September 2023 the ability to launch Bluetooth Low Energy spam attacks with a Flipper Zero was demonstrated by a security researcher known as 'Techryptic'.[21] A custom Flipper Zero firmware was developed shortly afterward that could launch spam attacks against Android devices and Microsoft Windows computers.[21] An Android app to launch BLE attacks was developed shortly afterwards.[21]

At the 2023 Midwest FurFest attendees reported severe disruption of Square payment readers and an insulin pump controller crashed due to the BLE spam.[21] A researcher known as Remy said to Bleeping Computer: "For BTLE enabled medical equipment, at minimum a disruption results in a degraded quality of life for those affected," adding "Some conditions may not be life threatening to have disruptions. Others may not be so lucky."[21]

As a result, a Python script was developed by the Wall of Flippers project for Linux and Windows to detect BLE spam attacks coming from Flipper and Android devices.[21][22]

Proposed Canadian ban

[edit]

In February 2024, Innovation, Science, and Economic Development Canada announced that they had the intention of banning the Flipper Zero and other devices that could be used to clone wireless signals for remote entry in response to a significant increase in auto thefts.[23]

On 20 March 2024, ISED announced that it would ban the use of the Flipper for illegal acts, but not ban it outright.[24]

References

[edit]
Revisions and contributorsEdit on WikipediaRead on Wikipedia
from Grokipedia
The Flipper Zero is a compact, portable multi-tool device engineered for penetration testing, hardware experimentation, and interaction with various wireless protocols, including sub-GHz radio frequencies, RFID at 125 kHz, NFC at 13.56 MHz, infrared signaling, and iButton emulation, all integrated into a durable, toy-like polycarbonate and ABS chassis measuring 100 mm by 40 mm by 25 mm and powered by a 2100 mAh LiPo battery.[1][2] It features a monochrome 1.4-inch LCD display with 128x64 resolution, a 5-way directional pad for navigation, and an STM32WB55 microcontroller with dual-core ARM Cortex-M4 processor at 64 MHz and Cortex-M0+ at 32 MHz, supporting expandable storage via microSD card and open-source firmware based on FreeRTOS.[2][3] Developed by Flipper Devices, a company founded by Russian engineers and later relocated to the United States, the Flipper Zero originated from a 2020 Kickstarter campaign that exceeded its funding goal, raising over $4.8 million from backers seeking an accessible platform for ethical hacking and geek-oriented projects.[4][5] The device emphasizes modularity with GPIO expansion headers, BadUSB functionality for scripted keyboard emulation, and a CC1101 transceiver enabling signal capture, analysis, and replay up to 50 meters in range, fostering a vibrant community for custom applications and firmware extensions.[1][6] While celebrated for democratizing access to radio and access control system testing—revealing vulnerabilities in real-world devices like key fobs and garage openers—the Flipper Zero has sparked controversies, including proposed import bans in Canada and sales restrictions by platforms like Amazon, attributed to fears of its use in signal replay attacks for vehicle theft, though the manufacturer counters that such exploits stem from inherent flaws in target systems rather than the tool itself, and no evidence links it directly to widespread crime without additional sophisticated methods.[7][8][9]

History and Development

Origins and Crowdfunding

The Flipper Zero originated as a project by Flipper Devices Inc., co-founded by Alex Kulagin and Pavel Zhovner, who sought to create an accessible, portable multi-tool for hardware debugging, penetration testing, and radio protocol analysis. Development began in 2019, evolving from earlier work on access control systems where the need arose for a unified device to simplify prototyping and signal interaction, replacing disparate tools like logic analyzers and RFID readers.[10][5] The concept drew inspiration from the pwnagotchi, a Tamagotchi-like Wi-Fi auditing device, incorporating a dolphin avatar to gamify hacking tasks and make technical operations more engaging for users.[4] This design emphasized open-source hardware and software, positioning it as a "Tamagotchi for hackers" rooted in DIY electronics and ethical security research.[11] To fund initial production, Flipper Devices launched a Kickstarter campaign on July 30, 2020, with a goal of $60,000 over a 30-day period ending August 29, 2020. The project quickly gained traction, securing $1 million in pledges within the first day and ultimately raising $4,882,784 from 37,987 backers, exceeding the target by 8,138%.[11][12] This overwhelming success reflected strong interest from the hacker and maker communities, validating the device's appeal as an affordable entry point for sub-GHz radio emulation, NFC/RFID interaction, and infrared control in a compact, toy-like form factor.[4] The campaign's backers received early units, with shipments commencing in late 2021 after prototype iterations addressed manufacturing challenges.[5]

Production and Milestones

The Flipper Zero crowdfunding campaign on Kickstarter, launched on August 27, 2020, concluded successfully on September 27, 2020, raising $4,888,312 from 17,463 backers, far exceeding the $10,000 goal and enabling initial production planning.[11] Production setup was completed by July 2021, with manufacturing commencing on a limited scale amid global semiconductor shortages that constrained component availability, particularly for microchips and display controllers like the ST7565, leading to a switch to the ST7567S variant.[13] Mass production ramped up in November 2021, transitioning from prototype batches to higher volumes, though initial output remained constrained by supply chain issues.[14] The first shipments to early backers began in January 2022, marking the transition from manufacturing to distribution, with gradual scaling to fulfill Kickstarter pledges.[15] By May 13, 2022, over 23,000 units had been shipped to backers, alongside the release of a quick-start guide to aid initial user onboarding amid ongoing production efforts.[16] Subsequent milestones included broader retail availability in 2022, with production lines achieving thousands of units per week by mid-2022, alleviating earlier delays and supporting expanded sales channels.[13]

Recent Updates and Expansions

In September 2024, Flipper Devices released the stable version 1.0 of the official Flipper Zero firmware after three years of development in beta and release candidate stages, introducing enhanced stability, new applications for Sub-GHz signal analysis, a rewritten NFC subsystem enabling significantly faster card reading including 2.7 times faster dictionary key matching, an event-driven FreeRTOS-compatible architecture replacing polling methods, support for new card types such as ICODE SLIX and FeliCa Lite-S, dynamic FAL parsers to reduce RAM usage, improved protocol layering for easier expansion, and refined infrared remote control features.[17] Subsequent updates in the 1.x series followed, including version 1.1.2 in November 2024 with optimizations for low-level NFC interactions, FeliCa and MIFARE Ultralight C support, and additional card parsers for better RFID handling.[18] By October 2025, development builds reached version 1.4.0 release candidate status, incorporating further refinements to wireless protocols and GPIO expansions for custom hardware integration.[18] Hardware expansions have centered on modular add-ons to extend core functionalities. The official Video Game Module, featuring a Raspberry Pi RP2040 microcontroller, VGA output, and compatibility with retro gaming emulators, was introduced via the Flipper Devices shop to enable video signal generation and interactive projects beyond pentesting applications.[19] This builds on prior expansions like the 2023 WiFi Dev Board, which added ESP32-based wireless scanning and deauthentication capabilities, but recent community-driven third-party modules—such as multi-function boards integrating nRF24 transceivers, CC1101 sub-GHz chips, and ESP32 WiFi—have proliferated, offering plug-and-play enhancements for mouse jacking and signal replay without official endorsement.[20][21] These developments reflect ongoing iteration driven by user feedback and open-source contributions, with firmware updates distributed via qFlipper desktop software or mobile apps for over-the-air installation, ensuring compatibility with expanding hardware ecosystems while maintaining the device's core open-hardware ethos.[22] No major hardware revisions to the base Flipper Zero unit have been announced as of October 2025, though forum discussions speculate on potential future models like "Flipper One" for advanced debugging.[23]

Technical Specifications

Hardware Components

The Flipper Zero is built around the STM32WB55RG microcontroller unit (MCU), which integrates an ARM Cortex-M4 application processor running at 64 MHz and an ARM Cortex-M0+ radio processor at 32 MHz, providing 1024 KB of flash memory and 256 KB of SRAM for efficient operation in embedded tasks.[1] This dual-core architecture enables concurrent handling of application logic and wireless protocols, supporting Bluetooth Low Energy (BLE) version 5.4 with 4 dBm transmit power and -96 dBm receive sensitivity.[1] The device features a 1.4-inch monochrome LCD display with 128x64 pixel resolution, driven by an ST7567 controller via SPI interface, allowing clear visibility of interface elements in various lighting conditions due to its backlit design.[1] User input is managed through a 5-way directional pad and a select button, complemented by additional tactile controls for navigation and function activation.[3] Power is supplied by a 2100 mAh LiPo battery, offering up to 28 days of standby time depending on usage patterns such as radio transmissions and display activity.[1] The enclosure measures 100 mm x 40 mm x 25 mm and weighs 102 grams, constructed from durable polycarbonate, ABS, and PMMA materials for portability and impact resistance.[1] [2] Key radio components include a CC1101 transceiver for sub-GHz operations across 315, 433, 868, and 915 MHz bands with a range up to 50 meters, an ST25R3916 chip for 13.56 MHz NFC supporting protocols like ISO-14443A/B, MIFARE, and FeliCa, and a 125 kHz RFID reader compatible with EM400x, HID, and Indala tags.[1] Infrared capabilities consist of a 940 nm transmitter at 300 mW output and a 950 nm receiver tuned to 38 kHz for remote control emulation and capture.[1] Expansion interfaces feature GPIO pins exposed via a dedicated header for hardware prototyping, a USB-C port for charging and data transfer in BadUSB mode, and support for iButton (1-Wire) emulation through integrated contacts.[1] The hardware comprises four interconnected PCB modules linked by flexible cables, facilitating compact assembly and modularity for maintenance or upgrades.

Firmware Architecture

The Flipper Zero firmware is an open-source codebase primarily implemented in the C programming language, supplemented by select components in C++ and ARMv7-M assembly for low-level operations. This structure enables efficient embedded system performance on the device's STM32WB55 microcontroller, which features a dual-core architecture with an ARM Cortex-M4 for application processing and a Cortex-M0+ for radio handling. The firmware's modular design facilitates maintenance, extensibility, and adaptation to hardware variations through distinct directories for core components: the furi directory houses OS-level primitives and utilities; lib contains drivers and third-party libraries; applications organizes built-in and user applications alongside services; and targets encapsulates hardware-specific configurations.[24] At the foundation lies the Furi core, a custom framework providing essential abstractions for task scheduling, inter-process communication, memory management, and event handling, effectively serving as the firmware's runtime environment. Furi builds upon FreeRTOS primitives, adapted for the Flipper Zero's requirements, to manage real-time operations without a full-fledged traditional RTOS overhead, ensuring deterministic behavior critical for radio protocols and peripheral interactions. Hardware access is abstracted via the Furi Hardware Abstraction Layer (furi_hal), which isolates platform-dependent code, allowing seamless integration of peripherals like Sub-GHz transceivers, NFC readers, and GPIO interfaces. This layering promotes portability across firmware targets, where differences in board initialization, linker scripts, and SDK data are defined in JSON-based target files, enabling compilation for variants such as the standard Flipper Zero or module-extended setups via inheritance and exclusion rules.[24][25] Applications operate within a plugin-like model, with built-in firmware apps compiled directly into the binary and external Flipper Application Packages (FAPs) loaded dynamically from the microSD card, supporting rapid prototyping and community contributions. The build process relies on the Flipper Build Tool (fbt), a SCons-based system that automates dependency resolution, cross-compilation with ARM GCC, and flashing, configurable via site_scons for custom targets. Services run as persistent threads managing system resources, such as power regulation and storage, while drivers in lib handle protocol stacks for RFID, infrared, and iButton emulation, ensuring isolation from application logic to prevent crashes from propagating. This architecture balances compactness—total firmware size typically under 1 MB—with functionality, as evidenced by release binaries around 800 KB for version 1.0 as of September 2024.[24][25]

Core Capabilities

Sub-GHz and Radio Protocols

The Flipper Zero's sub-GHz radio module utilizes the Texas Instruments CC1101 low-power transceiver, supporting frequencies in the 300–348 MHz, 387–464 MHz, and 779–928 MHz bands, which encompass common unlicensed ISM allocations for devices like key fobs and wireless sensors.[26][27] These bands exclude VHF frequencies such as 162.400–162.550 MHz used for NOAA Weather Radio broadcasts; consequently, the Flipper Zero cannot receive NOAA Weather Radio signals, and there is no official or reliable method to extend reception to these frequencies without risking hardware damage.[28] The CC1101 operates with modulations including on-off keying (OOK), amplitude shift keying (ASK), and 2-frequency shift keying (2-FSK) in asynchronous mode, with data rates up to 500 kbps and receiver sensitivity reaching -111 dBm at low rates.[29][27] Transmission output is capped at +10 dBm, yielding an effective range of approximately 50 meters in open air, aided by an integrated multi-band PCB antenna.[1] Core functions enable signal capture in "read" mode, where the device demodulates incoming transmissions after user selection of frequency, modulation, and bitrate parameters; captured data is stored in .sub files for later analysis or replay.[30] Replay and emulation modes transmit saved or generated signals, facilitating testing of compatible remotes, while a frequency analyzer tool sweeps bands to detect active carriers and estimate modulations.[30] Static presets target fixed frequencies like 433.92 MHz (prevalent in Europe and North America for consumer remotes), and dynamic scanning hops across channels to log emissions.[26] Firmware integrates decoders for proprietary protocols from vendors including Linear, Princeton Technologies, and Doitrand, parsing unencrypted rolling codes or static signals into human-readable formats like button states and serial numbers.[31] Encrypted variants, such as KeeLoq, require pre-known keys for successful emulation, limiting utility against modern implementations without additional reverse-engineering.[31] Community extensions via custom firmware expand support to niche protocols, but the hardware's non-software-defined nature precludes raw IQ sampling or arbitrary waveform generation, necessitating preset configurations for reliable operation.[29] Regional frequency restrictions, such as FCC limits in the US, are configurable through user settings to ensure compliance.[30] In the Sub-GHz application, captured signals saved as .sub files can be analyzed directly on the device. With custom firmwares such as Momentum, which provide enhanced protocol decoding and rolling-code support, the interface displays key details upon opening a saved file. Fixed-code (static) signals are typically identified by protocol labels such as "Fixed", "Static", or simple protocols (e.g., CAME, Nice FLO) without rolling indicators, and the key or data field shows the same unchanging value across multiple captures of the same button press. Rolling-code signals often feature a lock icon and display changing key values with each transmission. A reliable confirmation method is the replay test: transmitting the saved signal multiple times toward the target receiver results in repeated successful activations for fixed codes, whereas rolling codes generally activate only once before the receiver advances its counter and rejects subsequent identical replays. These indicators assist users in assessing replay attack vulnerabilities in systems like garage door openers or key fobs, highlighting weaknesses in static-code implementations versus more secure rolling-code designs.

RFID and NFC Emulation

The Flipper Zero incorporates hardware for emulating low-frequency (125 kHz) RFID tags, primarily used in legacy access control systems, animal identification, and key fobs.[32] It supports reading, saving, and emulating protocols such as EM-Marin (EM4100/EM4102), which feature a 5-byte unique identifier readable up to 1 meter; HID Prox II (HID26), utilizing a 26-bit format with 3-byte ID and parity bits; and Indala (I40134), an older proprietary 3-byte ID system.[33] Emulation extends to manually entered card data without requiring the physical tag, and the device can write emulated data to compatible blank tags like T5577 for cloning purposes.[34][35] For high-frequency operations, the Flipper Zero employs a 13.56 MHz NFC module based on the ST25R3916 chip with a dedicated antenna, enabling interaction with ISO/IEC 14443-compliant cards common in contactless payments, public transport, and modern access systems.[36] This module facilitates reading unique identifiers (UID), select application identifier (SAK), answer to request (ATQA), and stored data from tags like MIFARE Classic and Ultralight, with emulation of saved cards after detection.[36] Firmware 1.0 introduced a rewritten NFC subsystem for significantly faster card reading, an event-driven FreeRTOS-compatible library, restructured protocols, and dynamic FAL parsers supporting new card types including ICODE SLIX and FeliCa Lite-S.[37] Advanced features include MIFARE key extraction via the MFKey32 attack on collected nonces, with 2.7x faster key matching in firmware 1.0, and manual generation of virtual cards for testing; MIFARE Classic dumps can now be edited via the mobile app.[36][37] However, emulation is constrained by hardware and protocol specifications; for instance, full replication of encrypted or proprietary implementations, such as certain EMV bank cards or NFC-B modes, often fails due to the chip's limitations in handling non-standard frequencies or advanced authentication.[38] All operations require a microSD card for data storage and updated official firmware.[36]

Infrared and Universal Remote Functions

The Flipper Zero features an integrated infrared (IR) transceiver consisting of an IR LED for transmission and a receiver for signal capture, enabling interaction with consumer electronics that rely on IR remote controls. This allows the device to record signals from standard remotes used for televisions, air conditioners, projectors, multimedia systems, and similar appliances by aligning the original remote with the Flipper Zero's receiver and saving the captured data to its SD card.[39][40][41] Once captured, signals can be analyzed, replayed, or emulated through the device's IR application, which supports common protocols such as NEC, Sony SIRC, and RC-5, as well as raw signal handling for less standardized transmissions. Users can learn and store multiple remotes, organize them into files, and transmit commands via the IR LED to mimic the original remote's functions, effectively turning the Flipper Zero into a programmable universal remote replacement. The firmware also includes tools for brute-forcing unknown protocols by systematically sending pre-defined code sequences from integrated databases of popular device commands.[39][41][42] The universal remotes feature extends this capability by allowing control of devices without initial signal capture, leveraging built-in code libraries or mobile app integration for selecting and sending manufacturer-specific IR sequences to TVs, fans, and other IR-dependent hardware. This is facilitated through the Flipper Mobile App, which provides a interface for browsing, editing, and transmitting IR remotes remotely via Bluetooth Low Energy. However, IR functionality is limited to line-of-sight operation within approximately 10 meters and does not support encrypted or proprietary rolling-code protocols, as most consumer IR systems transmit unencrypted, static commands.[43][44][1]

GPIO, BadUSB, and Expansion Interfaces

The Flipper Zero provides a general-purpose input/output (GPIO) interface via an 18-pin 2.54 mm header on the top edge, comprising power supply pins and 13 I/O pins for hardware interfacing.[45] The I/O pins operate at 3.3 V CMOS logic levels and tolerate up to 5 V inputs, though outputs remain limited to 3.3 V to prevent damage.[2] Each I/O pin supports sourcing or sinking up to 20 mA, with an aggregate power constraint of 5 W across the header.[45] Power pins deliver +3.3 V (up to 1.2 A, enabled by default) and +5 V (up to 1.2 A, activatable via software), facilitating operation of external sensors, LEDs, or microcontrollers.[45] GPIO capabilities encompass digital read/write operations and support for serial protocols including UART, SPI, and I2C, often bridged through USB for advanced debugging.[2] The onboard STM32WB55 microcontroller handles pin multiplexing for these functions, as detailed in its datasheet.[46] Users access configuration through the GPIO application in the main menu, which permits pin testing (e.g., via PA7/PA6 for UART loops), enabling/disabling 5 V output, and USB-to-UART bridging for serial console interaction with connected devices.[45] Modules connect by fully inserting into the header without offsets, though caution is advised against high-capacitance loads on the +3.3 V pin during power-up to avoid instability.[45] BadUSB mode transforms the Flipper Zero into a malicious USB device by emulating Human Interface Devices (HID) such as keyboards or mice, allowing scripted command injection on connected hosts.[47] Payloads, authored in an extended DuckyScript language (version 1.0 compatible with Hak5 Rubber Ducky tools), execute keystroke sequences to automate actions like launching applications, altering settings, or initiating network connections, requiring only physical USB access.[47] Scripts reside as plain ASCII .txt files on the microSD card, with the device switching to HID mode upon payload selection and execution via the BadUSB app.[47] Bluetooth Low Energy (BLE) extends this wirelessly post-pairing, though USB remains primary for reliability.[47] Limitations include mandatory microSD formatting for storage, overwrites on duplicate filenames without alerts, and dependency on host keyboard layout matching (US English default), potentially causing script failures on non-standard configurations.[47] The USB 2.0 Type-C interface, rated at 12 Mbps data transfer, underpins this functionality alongside standard device charging at up to 1 A.[2] Expansion interfaces leverage the GPIO header for modular add-ons, supporting protocols like UART for automatic peripheral discovery via the Expansion Module Protocol.[48] Official expansions include the Video Game Module, featuring a Raspberry Pi RP2040 for gaming emulation and extended GPIO access, and the Wi-Fi Developer Board with ESP32 for wireless capabilities.[19] These modules plug directly into the header, drawing power from GPIO pins while communicating over designated UART channels selectable in device settings.[49] The firmware's RTOS facilitates plug-and-play integration, though community modules may require custom configuration.[48] Additional interfaces encompass microSD (SPI, up to 256 GB at 5 Mbps) for data expansion and USB-C for host connectivity.[2]

Community and Ecosystem

Official and Custom Firmware Variants

The official firmware for the Flipper Zero, developed and maintained by Flipper Devices, serves as the primary software layer enabling the device's core hardware interactions, including Sub-GHz radio, NFC, infrared, and GPIO functionalities.[24] Released under an open-source license, it undergoes regular updates via the qFlipper desktop application or mobile companion app, with users advised to install the latest version for security patches, bug fixes, and new features such as dynamic third-party app loading introduced in version 1.0 on September 10, 2024.[50][17] Version 1.0 also featured a complete rewrite of the NFC subsystem for improved emulation and detection accuracy, alongside enhancements to the infrared protocol support and power management.[17] Subsequent releases, such as 1.1 and beyond, have focused on refining app ecosystem integration and hardware optimizations, with build artifacts available directly from the official update server.[51] Custom firmware variants, forked from the official repository, extend or modify the base capabilities to include experimental features not present in the stock build, often driven by community developers to address perceived limitations in protocol support or user interface customization.[52] These variants maintain compatibility with the device's STM32WB55 microcontroller architecture but introduce risks such as potential device bricking during flashing, voided warranties, and unvetted code that could introduce vulnerabilities or instability.[53] Popular examples include Unleashed, RogueMaster, and Momentum, which build on the official firmware and unlock features such as removal of regional Sub-GHz restrictions, rolling code support, BLE spam, and enhanced BadUSB capabilities.[52][54][55] As of 2025, key differences among these variants include: Unleashed emphasizing stability and core functional enhancements such as extended Sub-GHz/RF tools and community plugins, with minimal UI changes and no advanced customization like BadBT, making it suitable for RF/pentesting focused on Sub-GHz;[52] RogueMaster being feature-packed with many preinstalled apps (421 as of April 2025), animations, interface customization, asset packs, and strong BadUSB support—no prominent user reports indicate performance issues, stability problems, or crashes from having too many apps on the SD card, as users frequently employ large SD cards (e.g., 32GB+) filled with numerous apps and files without slowdowns or instability related to app quantity, with such issues more typically linked to SD card compatibility (e.g., certain brands failing), firmware bugs, specific app memory consumption, or hardware factors—serving as a versatile all-rounder for broad use including USB attacks;[54] and Momentum offering advanced features like BadBT, Subdriving (GPS coordinates for Sub-GHz), enhanced security (lock on boot, false PIN reset), extensive BLE tools, UI customization, a management app, and asset packs, with fewer preinstalled apps (183) but high stability, excelling in Bluetooth security and diverse attack vectors.[55] No single firmware is superior; selection depends on user needs, such as RF stability for Unleashed, versatility for RogueMaster, or advanced Bluetooth tools for Momentum.[56] These variants, including Unleashed with expanded Sub-GHz frequency ranges and additional animation packs, position themselves as enhancements over the official version, while Momentum provides enhanced customization via asset packs for animations and icons, Bluetooth tools including FindMy and BLE Spam, and advanced JavaScript scripting,[55] and RogueMaster offers plugins for games like Doom and Tetris, expanded Sub-GHz protocols, NFC enhancements, and community-driven dynamic animations.[54] They vary in update frequency and feature sets, with some prioritizing pentesting tools like enhanced BadUSB scripting at the expense of official app store integration.[56] While custom firmwares enable broader experimentation—such as modified radio transmission parameters—they lack the rigorous testing of official releases, potentially amplifying misuse risks in unauthorized signal emulation scenarios.[57] Developers recommend reverting to official firmware for production use or regulatory compliance, as custom builds may conflict with regional frequency restrictions enforced in the stock software.[58] Community resources, including GitHub forks, facilitate easy installation via DFU mode, but users must verify checksums to mitigate tampering concerns inherent in unofficial distributions.[59]

Applications in Pentesting and Education

The Flipper Zero facilitates penetration testing by allowing ethical hackers to capture, analyze, and replay signals across multiple protocols, aiding in the identification of vulnerabilities in physical and wireless access systems. Its Sub-GHz transceiver enables the interception and emulation of remote control signals, such as those used in garage doors or key fobs, which pentesters employ to assess replay attack risks in real-world environments.[1][60] Similarly, the device's RFID and NFC modules support reading, cloning, and emulating low-frequency and high-frequency tags, useful for evaluating the security of proximity-based access controls like employee badges or hotel keycards, provided the target systems lack encryption.[1][61] Through its GPIO pins and BadUSB functionality, it simulates HID devices to inject keystroke payloads, enabling tests of social engineering defenses or endpoint security in scenarios mimicking USB-based attacks.[60] With optional modules like the WiFi Development Board, pentesters can conduct network reconnaissance, deauthentication attacks, and packet capture, extending its utility to Wi-Fi vulnerability assessments.[62] These capabilities are constrained by the device's hardware limits, such as lacking support for encrypted or rolling-code protocols without custom firmware modifications.[63] In educational contexts, the Flipper Zero introduces learners to cybersecurity principles through hands-on interaction with embedded systems and signal processing, fostering skills in hardware reverse engineering and vulnerability exploitation. Cybersecurity programs utilize it for project-based learning, where students measure its signal capture range—typically up to 50 meters for Sub-GHz—and explore ethical applications like emulating IR remotes to understand universal control protocols.[64][65] Educators praise its toy-like interface for demystifying complex topics such as RFID cloning, which demonstrates weak authentication in legacy systems, while encouraging critical analysis of device limitations to avoid overhyping its offensive potential.[65][66] Community resources, including official documentation and GitHub repositories, provide tutorials for beginners to script custom apps via its C-based SDK, promoting self-directed learning in firmware development and protocol dissection without requiring advanced programming knowledge.[67][68] This approach has been integrated into outreach initiatives, where it teaches mechatronics alongside security, emphasizing defensive countermeasures like signal encryption over misuse.[65]

User Innovations and Accessories

Third-party accessories have significantly expanded the Flipper Zero's functionality, with popular modules including WiFi development boards equipped with ESP32 chips and Marauder firmware for wireless auditing tasks such as packet capture and deauthentication.[69] The Lab404 External Module, a third-party expansion priced at $59.90 USD (on sale from $89.90 USD), adds an OLED display for real-time status updates, Wi-Fi connectivity, 433 MHz sub-GHz radio, GPS tracking, and network testing features including Ethernet cable continuity checks, DHCP allocation, and custom IP settings; it connects seamlessly via GPIO pins and includes accessories such as a hard carry case, soft pouch, silicone protective cover, Type-C cable, screen protector, and USB data cable.[70] These boards connect via GPIO pins, enabling features like network scanning that are absent in the base device.[71] Other modules, such as CC1101 upgrades for 433 MHz sub-GHz operations and NRF24 transceivers for enhanced low-power wireless emulation, provide improved range and protocol support over stock hardware.[72] Prototyping kits and GPIO expansion boards allow users to integrate sensors, actuators, and custom circuits, facilitating projects in IoT security and hardware hacking.[73] Protective cases, often 3D-printed with slots for multiple modules like dual WiFi boards, have become common, with designs shared in community repositories for easy replication.[68] Silicone cases and battery replacements from vendors like Rabbit-Labs offer durability and extended runtime for field use, though battery replacements constitute unauthorized hardware modifications that void the official warranty.[72][74] User innovations extend to software, with custom firmware forks such as RogueMaster integrating community plugins for unlocked features like rolling code support, additional games, and experimental tweaks not present in official releases.[54] Momentum firmware emphasizes stability and customization, incorporating user-submitted apps for tasks like advanced NFC cloning and infrared protocol extensions.[56] Hardware modifications include DIY attachments for specialized scripting, such as automated key fob testers, often prototyped via open-source designs on GitHub.[68] These developments, driven by enthusiast communities, prioritize practical enhancements while adhering to the device's open-source ethos, though users must verify compatibility to avoid bricking risks.[75]

Controversies and Regulatory Responses

Misuse Allegations and Debunked Claims

Allegations that the Flipper Zero facilitates widespread car theft have circulated in media reports and government warnings, particularly citing its Sub-GHz radio replay capabilities as a tool for cloning key fobs.[76] [9] For instance, in March 2024, Queensland Police in Australia highlighted the device in connection with potential vehicle and home security breaches, while Canada's government proposed a ban in February 2024, claiming its use in auto theft.[76] [77] However, these claims have been debunked by the device's developers and security experts, who note that modern vehicles employ rolling code protocols and two-way authentication, rendering simple signal replay ineffective against systems like those using KeeLoq successors or advanced encryption.[7] [78] The Flipper Zero's official firmware supports capture and replay of fixed-code signals from legacy devices, but no verified incidents of car theft using the device have been documented as of 2024, with developers attributing hype to misunderstandings of its Sub-GHz limitations.[7] Similar misconceptions surround the device's NFC capabilities for cloning credit or debit cards, fueled by demonstrations of reading contactless data.[79] The Flipper Zero can detect and extract public unencrypted data such as the primary account number (PAN) and expiration date from EMV-compliant cards via NFC-A protocols, a feature that prompted Amazon to delist it in 2023 under policies against card skimming tools.[79] [80] Yet, full cloning for fraudulent transactions is impossible without the card's private cryptographic keys and dynamic authentication elements, which the device cannot generate or bypass due to lacking a secure element chip.[80] [81] Official firmware removed bank card emulation features in 2023 to address misuse concerns, though community apps may restore limited UID emulation; even then, EMV transaction validation by payment terminals requires server-side verification that emulated signals fail.[82] [83] Experts emphasize that while the device exposes static data vulnerabilities in card design, it does not enable "copy-and-go" fraud, as opposed to specialized skimmers.[80] [84] Claims of "secret" or dark web firmware unlocking advanced hacking, such as mass car breaches or unrestricted access, have also been refuted by developers, who state in August 2025 that such offerings merely automate publicly known exploits without novel capabilities.[85] These often originate from scams targeting enthusiasts, exaggerating the device's hardware constraints like its lack of support for NFC-B or full EMV emulation.[86] [87] In pentesting contexts, the Flipper Zero aids ethical vulnerability assessment but does not confer "master key" status to secure systems, as confirmed by independent tests showing failures against rolling codes and cryptographic protections.[88] [89] In April 2023, Amazon banned sales of the Flipper Zero, classifying it as a potential card-skimming device.[90] As of February 2026, genuine Flipper Zero devices are not officially available on Amazon, with no reliable indications that the ban has been lifted. Listings for the full device on Amazon are primarily counterfeits or scams, a recurring issue since 2023, while accessories like WiFi devboards and cases may be sold by third parties. Official purchases are available directly from the Flipper website (flipper.net) for $199 and through authorized resellers such as Micro Center in the US.[91] [92] In Brazil, the National Telecommunications Agency (Anatel) initiated seizures of incoming Flipper Zero shipments in March 2023, attributing the action to the device's potential involvement in criminal activities such as unauthorized signal interference.[93] Canada's government proposed banning Flipper Zero sales in February 2024, primarily citing its alleged role in vehicle thefts via signal amplification or jamming, though manufacturers contested this capability, asserting the device lacks the power for effective keyless entry relay attacks on modern automobiles.[94][7] By March 2024, officials revised the policy to target misuse rather than impose a outright prohibition on the hardware, aligning it with regulations on tools like lockpicks under Section 351 of the Criminal Code, which permits possession absent criminal intent.[94] Seizures by authorities have occurred sporadically. In September 2023, security personnel at London's Gatwick Airport confiscated a Flipper Zero from a passenger's carry-on luggage due to concerns over its radio transmission functions potentially disrupting aviation systems.[95] Australian police in Queensland seized one device during an operation in Boondall in March 2024, issuing public warnings about its theoretical application in scanning or emulating car key fobs and home security signals, despite acknowledging legitimate pentesting uses.[76] In the United States, U.S. Customs and Border Protection temporarily held a shipment of approximately 15,000 units in October 2022 for inspection but released them without formal restriction or ban.[79] Legal challenges remain limited, with no major court precedents establishing Flipper Zero possession as inherently unlawful in jurisdictions like the U.S. or EU, where it is classified as a general-purpose electronics tool akin to software-defined radios.[79] Isolated incidents, such as school investigations in Utah where students faced disciplinary or minor legal scrutiny for classroom use, highlight localized concerns over disruption but have not led to broader prohibitions.[96] Experts argue that regulatory responses often stem from overstated misuse risks, as the device's sub-GHz range and output power constrain real-world criminal efficacy compared to specialized equipment.[9]

Broader Security Implications

The Flipper Zero's capabilities in emulating and replaying signals from RFID, NFC, and sub-GHz protocols underscore fundamental vulnerabilities in many proximity-based authentication systems, which often rely on unencrypted or weakly protected identifiers rather than robust cryptographic challenges. Devices like hotel key cards, office badges, and campus IDs using legacy formats such as MIFARE Classic can be read, cloned, and replayed in seconds, enabling unauthorized physical access without sophisticated expertise or expensive equipment.[97][98] This exposes a causal gap in system design: many access controls assume possession of a token suffices for security, ignoring the ease of signal interception and duplication with portable, low-cost hardware.[99] In sub-GHz applications, such as garage door openers, remote keyless entry for vehicles, and tire pressure monitoring systems, the Flipper Zero demonstrates the prevalence of fixed-code or predictable rolling-code schemes susceptible to capture-and-replay attacks. Testing has shown that signals from these systems can be intercepted, stored, and retransmitted to trigger actions, bypassing intended one-time-use protections in outdated implementations.[100][101] These exploits reveal broader risks in IoT ecosystems, where interconnected physical devices inherit wireless protocol weaknesses, potentially amplifying threats like remote vehicle manipulation or facility breaches through chained vulnerabilities.[102] The device's utility in penetration testing highlights a positive implication: it democratizes vulnerability assessment, allowing organizations to proactively identify and remediate flaws in access controls, such as upgrading to encrypted NFC (e.g., DESFire) or challenge-response protocols.[103] However, widespread availability amplifies the attack surface for non-state actors, pressuring manufacturers to prioritize security-by-design over cost-driven legacy support, as evidenced by post-Flipper incidents prompting audits in sectors like education and automotive.[104] Ultimately, these capabilities enforce a first-principles reevaluation of physical-digital boundaries, emphasizing that true security demands layered defenses beyond signal obfuscation, including behavioral analytics and multi-factor verification, to counter tools that exploit inherent protocol limitations.[105]

References

User Avatar
No comments yet.