(static buzzing)
(upbeat music) (static buzzing)
(upbeat music) (static buzzing)
- Started life on Kickstarter. (static buzzing)
(upbeat music) The biggest problem at the
moment with this device is trying to get hold of one. (static buzzing)
This is a Flipper Zero. (static buzzing) (static buzzing)
(upbeat music) This video is for
educational purposes only. I own all the equipment that I'm gonna be
demonstrating in this video. I own the safe, as an example. I am using my own money and my own passports
for this demonstration. I'm using my own cards. Be really careful putting your
valuables in a hotel safe. Be careful with your credit cards. You probably wanna use an RFID blocker. Let's put it to the test in this video and see if they actually work. Let's see how powerful
this Flipper Zero is and what it can do and make you
aware of the vulnerabilities with technologies that we use every day. (static buzzing)
I really wanna thank Lab401 for sending me, not only a Flipper Zero, but a bunch of other really
cool toys to demonstrate. So just to be clear, this
is not a sponsored video, but Lab401 sent me products
from their Pentester Pack. They have these Pentester Packs, so we've got the standard,
basic and advanced that give you access to a whole
bunch of interesting tools as well as the Flipper Zero. I'm not gonna show you how
to mess around with a Tesla. There're a bunch of videos online showing you how to do that. (driver laughing) One of the cool things
about this Flipper Zero, is I can plug it in to my computer and see the screen using
the qFlipper software. That will allow you to see
more clearly what I'm doing. You can also update the Flipper
Zero using the software. Okay, but that's enough talking. Let's get started. (static buzzing)
(bright upbeat music) In a previous video,
which I've linked below, I show you how you can
open a safe like this within, like, two seconds. Let's see how long it
takes to open the safe. Now, let's say you make
the mistake of believing that a hotel safe such
as this is actually safe. As an example, let's say
I've got my passports, I put them in, you put
your money in the safe, so I'll put my money in. Maybe I've got some credit cards that I wanna leave in the safe. I might put other devices in
the safe such as a camera. And let's say because
you believe in security, you've got a YubiKey or something that you put into your
safe for safekeeping. Safekeeping. What I'm gonna do is something
that I suggest you never do. because this safe supports RFID. So that safe is locked. What I can do with a Flipper
Zero is copy RFID cards. In my Flipper Zero, I'm gonna
press the middle button. I'm gonna go to NFC and then
I'm gonna read the card. So literally just read it. And then what I can do
is press the right key and then I'll save this. Just for the sake of time,
I'm just gonna call this M. You could obviously use
a more descriptive name. And in my list of cards I'll select that, and then I'll press Emulate
to emulate the card. (safe beeping) And notice there, the safe is open and I can get to all the
valuables in the safe. Okay, so just to make the point, I'll use a different card here. Here I've got a Barclays Visa credit card. In the Flipper Zero, I'll go to NFC, select that
and I'll read the card. (Flipper Zero beeping)
So there you go. It's been read. I'll go More, and I'll save
that as B for Barclays. So I'll emulate the card and then let's see if it opens the safe. (safe beeping) There you go. Safe is now opened. So I've been able to open this RFID safe with two credit cards,
which I've now emulated. Now do RFID NFC blocking
cards actually work? Let's put this to the test. And I'll try and read the card. Notice it's not working at all. So that RFID blocker is working. You wanna have that in your wallet. If I move it away, notice it
reads the card straight away. Let's do a retry and we'll
use the Barclays card. Try to read the card,
not working at the moment because the RFID blocker is blocking that. If I move this away,
notice it reads the card. In this case it just says unknown card, but let's see if we
can simply emulate that without doing anything else. So I'll lock the safe again, (safe lock beeping)
I'll emulate it directly. And there you go. I was
able to open the safe. You want to, in the real world, have this in your wallet. (static buzzing)
(bright upbeat music) Here I've got a lock that you would put in a
drawer, as an example. (lock beeping)
And you can see there that this tag opens this lock. Let's take a different card. This card doesn't work, but if
I take the card that did work and I go to 125 Kilohertz
RFID, and I read that card, (Flipper Zero beeping) so I'll go Write and save this. And I'll just call this door. Okay, so door's been saved. And I can immediately emulate that card. (door lock beeping) And there you go, that opened. Now you may not wanna do it that way. So what you can do is
you can just do a write. So again, this tag doesn't work. (card reader beeping) And I should say tag rather than card because here's a card. But I'll write it using the Flipper Zero. Okay, so sometimes I've had
problems getting it to write. Often you have to reboot it, but I have got this saved previously so I'll write it again using that. (Flipper Zero beeping) And there you go. So that's been successfully written. And now
(card reader beeping) notice it works. (static buzzing)
(bright upbeat music) Okay, another thing that
the Flipper Zero supports is infrared. You can download a whole bunch of pre-configured infrared settings. I've got some saved that
I've manually saved. One of them is the light shelf behind me. Hopefully you can see that the
shelf is changing in color. I'll use green. To set this up, all you need
to do is go to infrared. In this example, I'm
not using a saved one. I'm gonna learn a new one. So Learn New Remote. And here's the remote that
actually changes those colors. You can see it's actually got
five samples at the moment, but actually what I wanna do is I wanna get a different color. Let's take yellow as an example. So I'll press the yellow button (Flipper Zero beeping)
and it's found it. So I'll just say Raw_7. So that's a new remote. Hopefully what'll happen now is you can see that the
color's changing to yellow. And actually the one on my
desk, if I put it under my desk, if I go back and go to Save Remotes and let's go shelf lights
and I'll set it to blue, and hopefully you can see that
that's all gone blue again. This can work with all kinds of devices. It can work with televisions,
all kinds of things, lots of examples on YouTube. What I've done here
actually is save a remote which is to turn my air conditioner on. So what I'll do is take this camera. And what I'll do here,
and if you can see that, but I'm gonna simply press the button (air conditioner beeping) and the air conditioner went on (air conditioner beeping) and now the air conditioner's off. All you need to do is
take a remote like this, Learn New Remote, and it picks it up. What I can do is send that
to the air conditioner to turn it on. So air conditioner set (air conditioner beeping) and there you go, it went on. (static buzzing)
(bright upbeat music) Notice the mouse on this laptop. I'll put both hands here. So you can see I'm not
touching the laptop at all. Both my hands are on the Flipper Zero. But what I can do is control the mouse using the Flipper Zero. So as an example, I'll move it here and then I'll press enter
to open the software. And then what I'll do is move the mouse to close the Flipper Zero. You can get it to emulate
all kinds of devices. This is available under the main menu. So just to show you the menus, if I press the middle button here, that gives me the different options. So I've shown you NFC already. I've shown you 125 Kilohertz RFID. Shown you applications. Under the applications, I went to Tools, and in this case I chose Bluetooth remote
and I specified Mouse. You have to set up both sides to talk, but you can control a mouse or another device using Bluetooth. So once it's accepted, then you can control that device directly from the Flipper Zero. (static buzzing)
(bright upbeat music) This allows you to run
Rubber Ducky scripts. If I go to Bad USB, it says Disconnect PC or
phone to use this function. What I'm gonna do now, is I'm gonna have to close
the Flipper Zero software, and I'll press Bad USB. In my example, I'm gonna
do the demo for Windows. So if I press that and
press to run the script, what you'll notice now is
it starts sending keystrokes to the Windows computer. And there you go. Just to make it easier, I'll
move the laptop here actually so you can see that directly. And let's do that again. On the Flipper Zero, I'll press the button to
run the Windows Bad USB. And notice, as soon as that's done, we should see it initiate
something on the computer. There it goes. It's opened up Notepad and it starts writing
something to Notepad. Now that's just a basic example, but you can download
many Rubber Ducky scripts and use them to do all kinds of things. So for instance, open up a
reverse shell or something else. Lots of options available
with the Bad USB. They've got a demo for macOS and Windows. So that was an example with Windows. (static buzzing)
(bright upbeat music) Now, another great thing
about the Flippers Zero is you can control it from your phone. So you can install an app on your Android phone or
iOS device, as an example, and it will sync information from the Flipper Zero to your phone. You can see there, it's
synchronizing, it's now synced. If I go to archive, I can see a whole bunch of
information including NFC. I can see infrared, as an example. The different infrared
options that I saved. RFID 125, I can see as an example. There's Door and then I
can get it to emulate, so I can actually get it to run. So let's do Door1blue here. And then what that's gonna
do on the Flipper Zero, is get it to run the commands
that I've asked it to run. So as an example, I got it
to emulate that key fob. I can do something similar with the NFCs. So as an example, let's
go back to my safe. I'll lock it with the Barclay card. I'll select Barclay card and then press Emulate on the phone. And notice, I've got it to open the safe by commanding the Flipper Zero to do something from the phone. Just to make the point
again, I'll lock the safe. I'm not gonna do anything
on the Flipper Zero except put it on its home screen. So it's on the home screen. And then on the Barclay card, I'm gonna tell it to emulate that card. And then if I hold it there,
notice the safe opens up. From a demonstration point of view, you can also control
it from your computer. So as an example, I can
tell it to get out of NFC. I can press the middle button,
and then I can use keystrokes on the computer to
control the Flipper Zero. So go back, as an example,
I'll go to NFC, go to Saved. I'll specify the Barclay
card, tell it to emulate. Notice safe is locked now. And then I'll use this Barclay card to actually open the safe. Let's do that again. Safe is open. Notice my stuff in the safe, and then I'll press the
Flipper Zero against the safe to get it locked because
it's emulating the card. And then if someone came back to the hotel room and did that, they wouldn't realize that
I had opened the safe. So locked the safe again. And then open the safe. All controlling that from my
phone or from the computer. I'll demonstrate this
probably in a different video. But notice here is a YubiKey used for two-factor authentication. I can use NFC to read the YubiKey. And then I could save that and
then emulate that if needed. So as an example, when
using NFC on your phone to get authorization from a YubiKey, I could perhaps get round
your authentication, but we'll leave that for another day. (static buzzing)
(upbeat music) Okay, so what do you think? Great product. I've only shown you a few examples of what's possible with this device. There are lots of videos on
YouTube showing you stuff that I don't wanna show you. You need to be careful, as
always, with a device like this. You need to use it on devices that you own or have
permission to use it on. In this case, I was
using all my own devices. Obviously given myself permission to attack my own devices
as a demonstration. Okay, So I'm David Bombal. Hope you enjoyed this video. If you did, please like it. Please consider subscribing
to my YouTube channel and clicking on the bell
to get notifications. I wanna wish you all the very best. (upbeat music) (static buzzing)
(card reader beeping)
Just as an FYI this is not my video, but i felt i had to post something here, so i guess this works fine.