Flipper Zero

In the ever-evolving landscape of cybersecurity, penetration testers and red team operators are constantly searching for tools that provide flexibility, portability, and effectiveness. The Flipper Zero, a compact, hacker-friendly multi-tool, has emerged as a favorite among professionals in the field. Combining a wide array of functionalities in a pocket-sized form factor, it is well-suited for a variety of operations, especially in non-permissive environments. Here’s why the Flipper Zero deserves a place in your arsenal.

Hailed as a ‘Swiss-army knife for geeks and pentesters,’ this handy little multi-tool is c

apable of assessing and compromising a broad spectrum of radio and wireless signals, this tool, developed by Pavel Zhovner, excels in performing a wide variety of security tasks that have not been commercially possible in a platform of this size until now.

What is Flipper Zero?

The Flipper Zero is a portable, open-source device designed for interacting with various types of digital systems. It features hardware capabilities such as a Sub-1 GHz transceiver, RFID/NFC, GPIO pins, an infrared transceiver, Bluetooth Low Energy (BLE), and more. Its user-friendly interface and hacker-friendly software architecture make it a powerful and versatile tool for security professionals.

From a cybersecurity perspective, the FlipperZero excels at cloning and replaying access badges, capturing, replaying, or abusing wireless network signals, and leveraging semi-sophisticated scripts to attack enterprise devices like laptops or wireless access points.

The Flipper Zero functions as a versatile tool capable of receiving, reading, storing, and transmitting a wide range of wireless signals. While other devices may offer some of these capabilities, the Flipper Zero combines them into one cohesive and user-friendly platform. Its intuitive design allows anyone to pick it up and quickly perform tasks like reading an NFC card, intercepting walkie-talkie transmissions, or even controlling a nearby TV.

However, it also places a powerful tool in the hands of users who may lack technical expertise, leaving its potential impact dependent entirely on how it is used—whether for exploration and learning or for more disruptive purposes.

This is a tool and as every tool can be use for good purposes or bad ones.

The FlipperZero firmware is open-source and highly extensible, allowing users to add or expand the core platform features, drastically increasing its effectiveness. Several evolutions of the FlipperZero firmware often referred to as ‘DarkFlippers,’ are available via various GitHub repositories, including the Unleashed, RogueMaster & X-treme firmware editions.

Is the Flipper Zero legal?

Yes, the Flipper Zero is legal in most countries, as it is marketed as a versatile, open-source tool designed for hobbyists, tinkerers, and cybersecurity professionals. However, its legality and usage depend on how it is used and where. But it seems to have made some people here nervous, too: A shipment of 15,000 Flippers was seized by customs in 2022, but later let through. In April 2023, South Dakota Fusion Center alerted authorities across the country about the potential use of the device by domestic terrorists, and Amazon banned sales of the Flipper Zero on their site for being a “card-skimming device.”

Illegal Uses: Misusing the device to exploit vulnerabilities, clone access cards without authorization, disrupt networks, or perform any unauthorized activity are be illegal. This includes:

• Unauthorized badge cloning.

• Wi-Fi jamming or de-authentication attacks.

• Running malicious BadUSB scripts.

  
  

Core Features

1. Sub-1 GHz Radio

The Flipper Zero supports frequencies commonly used in RF communication systems, including those employed by IoT devices, garage door openers, remote controls, and other systems. For penetration testers, this feature allows:

• Signal Analysis and Replay Attacks: The ability to record and replay RF signals can help uncover vulnerabilities in devices that use insecure wireless protocols.

• Frequency Hopping Detection: Analyze wireless communications that utilize frequency hopping to identify potential weaknesses.

2. RFID and NFC

Flipper Zero’s RFID and NFC capabilities enable interaction with access control systems, contactless payment terminals, and various identification devices. This is useful for:

• Cloning Access Cards: Identify and exploit poorly secured RFID-based access systems.

• Protocol Testing: Investigate vulnerabilities in NFC communication protocols.

3. GPIO Interface

The GPIO pins on the Flipper Zero make it possible to connect to and interact with various hardware devices. This feature is especially useful for:

• Hardware Hacking: Bypass protections on physical devices by manipulating GPIO pins.

• Custom Integrations: Create custom scripts and tools for interacting with proprietary systems.

4. Infrared Transceiver

Infrared capabilities allow interaction with IR-based devices such as TVs, air conditioners, and some older hardware systems. Red teamers can use this for:

• Device Control: Bypass physical access controls by manipulating IR-operated devices.

• Protocol Analysis: Analyze and exploit vulnerabilities in IR communication protocols.

5. Bluetooth Low Energy (BLE)

The BLE module provides a gateway to interacting with Bluetooth-enabled devices. For penetration testers, this can include:

• Scanning and Enumeration: Identify BLE devices in the vicinity.

• Testing Pairing Protocols: Assess vulnerabilities in pairing mechanisms and encryption schemes.

  
  

How Much of a Risk Is It?

This is where discussions about the Flipper Zero often encounter scrutiny—and even customs delays.

The Flipper Zero is undeniably a powerful tool, and in the wrong hands, it could be used maliciously. However, the same could be said for other devices like a Raspberry Pi configured as a Pwnagotchi, an ESP8266 board, or even a smartphone.

As with any technology, its impact is determined by the intent of the user. Tools capable of disruption exist, but leveraging them for harmful purposes requires intent, planning, and execution. Whether it’s cloning access cards, manipulating digital displays, or running scripts on unsuspecting devices, it ultimately comes down to personal choice. In most cases, these tools are used ethically—for testing security systems, identifying vulnerabilities, or personal experimentation.

Many users simply enjoy exploring wireless technology. A significant number of Flipper Zero owners use it for mundane or harmless tasks, like controlling their air conditioner or tinkering with NFC tags. On its own, the Flipper Zero isn’t going to transform every tech enthusiast into a skilled hacker from a cyber-thriller. Most people will use it for benign purposes, like managing their home devices, or mildly mischievous acts, such as cloning a condo key or playfully confusing other Tesla owners.

The discussion will now pivot to specific examples showcasing how to utilize a FlipperZero effectively, including badge cloning, BadUSB script demonstrations, and deploying the Wi-Fi-Marauder application for wireless evaluations. Beginning with access badge cloning, this method is relatively simple when badges are left unattended, dangling from lanyards, or are accessible through a single layer of clothing. From the 125 kHz RFID menu, select "Read" and position the Flipper's antenna over the badge as shown in the accompanying image.

Once a badge is successfully cloned, the "Emulate" function allows the replication of badge data at a reader, granting the same access as the original badge. Since replayed credentials are nearly indistinguishable from legitimate ones in security logs, this technique can enable large-scale impersonation of authorized users. However, the effectiveness of the FlipperZero's badge cloning capabilities diminishes significantly with measures like encrypted communication between readers and badges, the use of RFID-blocking sleeves for employee badges, and training employees on secure handling and storage of access credentials.

BadUSB is among the most exciting features of the FlipperZero, offering versatility for executing a range of traditional attacks through custom scripts. GitHub hosts numerous repositories with pre-built and tested BadUSB scripts, including notable contributions from Hak5, FalsePhilosopher, UNC0V3R3D, and I-Am-Jakoby. However, BadUSB attacks are less effective in well-secured environments that enforce robust User Access Control (UAC) policies through Microsoft Group Policy or employ advanced endpoint protections like Windows Defender or CrowdStrike Falcon—although many organizations still overlook these critical defenses.

Consider a scenario where an unattended administrator PC is found, and multiple BadUSB scripts are executed successfully. These scripts may disable essential security features such as the Windows Firewall or UAC prompts and extract all stored Wi-Fi credentials from the device. Additional BadUSB scripts include those for downloading and running Mimikatz to extract the SAM database, initiating reverse shells via Netcat, or installing persistent backdoors by modifying registry keys or creating additional administrator accounts.

BadUSB scripts are typically stored in the BadUSB folder on the device's onboard SD card, as shown below, and can be accessed, downloaded, or modified as needed. Security professionals and attackers alike often use these scripts to disable endpoint protections, facilitate lateral movement, or escalate privileges within a system. For instance, using the "disable_uac" script, the FlipperZero can suppress user notifications triggered when applications alter system settings or install new software, making it a powerful tool in the right hands—or the wrong ones.

A BadUSB script is executed by attaching the FlipperZero to a target machine via USB, navigating to the BadUSB menu option, selecting the script of choice, and running it by clicking the center button. Before execution of the “disable_uac” script, UAC on the target machine starts at the top-most “Always Notify” option and then ends at “Never Notify” following script execution.

Next, the “disable_firewall” BadUSB script is executed, turning off the various protection features offered by the Windows firewall, which assists devices in blocking internet-borne attacks and malicious software installation attempts.

When the Flipper Zero is customized with other gadgets like the Developer Wi-Fi board or special antennas his capabilities are more powerful.

The FlipperZero offers an exciting and versatile capability for conducting Wi-Fi assessments when paired with a Developer Wi-Fi board. By flashing the Marauder firmware onto the board, the FlipperZero transforms into a powerful Wi-Fi penetration testing tool. The Marauder firmware enables the device to detect nearby wireless networks, analyze connected clients, execute probing attacks, and perform de-authentication, delivering functionality comparable to traditional tools like Aircrack-ng.

The following example illustrates the process of identifying wireless networks, selecting a network for testing, and executing a "RickRoll" attack on a wireless client. Start by opening the “Wi-Fi Marauder” application from the GPIO menu, scanning for Wi-Fi access points, and selecting a target network. Next, the tool floods the target network with beacon frames advertising fake networks named after lyrics from Rick Astley's "Never Gonna Give You Up." These actions simulate potential risks associated with Adversary-in-the-Middle attacks, such as 'Evil Twin' scenarios, and aim to prompt employees to recognize and report unusual network activity.

This article only scratched the surface of the FlipperZero’s potential in signal analysis and security assessments. While there are other products on the market with similar features, many focus narrowly on fewer capabilities, come with a higher price tag, and lack the flexibility of firmware customization or expandability that the FlipperZero offers. By highlighting a few examples of how the device can enhance security assessment methodologies and toolsets, the goal was to inspire readers to explore its broader applications in future testing scenarios.

The only way to improve a compact and versatile device like the FlipperZero would be to integrate a full penetration testing platform, such as Kali Linux or ParrotOS, directly onboard. Interestingly, Flipper Devices Inc. appears to be addressing this very possibility with the FlipperOne, a new device currently in development.