Flipper Zero vs Ford F150 (Key Fob Playback Attack)

all right cool well hanging out in my garage listen to some tunes and hacking around with my truck um this is my truck so I don't need permission to hack with it uh it's Ford F-150 uh 2015 model now the key bulbs on these you use a rolling code security every key press to this it sends the IDE plus another code that's incremented to some algorithm every time uh as long as the truck here is one that's more than the last one advanced in the last sequence it will unlock the door if it has playback protection terrific here's a code that's previously unlocked the door after it's received one that's been advanced in the sequence it will lock that remote out it won't recognize this remote anymore so I can create a denial of service to this by doing that but so this can little uh Gizmo The Flipper zero uh has a sub gigahertz transceiver on it it can read and play back 300 to 900 megahertz uh radio signals uh it can recognize uh various actual protocols for some commercial remotes out there that you can actually program into this thing anybody can read raw ones that doesn't recognize uh as long as you know that am referendum coding of the device and the frequency range of course you can find that by looking at the SEC ID this thing also has a little frequency scanner that you can press a fob button and it'll tell you what frequency it's being transmitted okay so let's create a denial of service to my truck so I got seven gigahertz we're gonna read this need Raw but before we do that let's make sure that this works period okay all right let's lock unlock now I'm gonna lock the door it's verified it's locked and it is locked okay now at the same time I need to configure this for the right frequency 315 315 megahertz snap prices gives you this nice little grab this little frequency range in the signal strength that it receives well it's recording it's really pretty cool so now I'm gonna unlock this and record that same sequence as I unlock it sure on 315 navigate and there's that sequence right there recorded I'm not sure how wide this band is but that's like three 315 Plus or so a little bit it's a little frequency hopping stuff in there okay so now the truck should be unlocked [Music] and it is I'm going to lock it back and unlock it one more time unlock it so it'll Advance the sequence now to advance the sequence past this one so I'm gonna lock it again [Music] double check verify all right it's locked again so now I'm going to play this sequence back I don't need to to save it to play it back so I'm just going to send it a couple of times just to make sure it reset it that seen the sequence several times now now it should yeah I've effectively denial of service the remote this one at least so now no worries I've got the second remote now I've recorded a series of sequences from this one earlier when it's in this lockout mode it will accept any other remote that it recognizes with the rolling code in any sequence so I recorded I'm gonna toss what I've done here I'm gonna bring up one I saved it's unlocked to my truck and there it is I save that signal from previous and hopefully if this works right it's gonna unlock my truck I'm gonna send it and it just unlocked my truck there you go The Flipper zero just unlocked the door on my truck a lot of steps to get there is this a valid Tech Vector no because I have to have both the remotes to do it so if I have remotes I don't really need this right now one practical use for this would be if you're out with buddies you've been drinking you know they got this kind of truck that does this uh and you take the remote you rig it or you can do denial of service on it hey they can't drive right so that's one practical purpose uh you're not going to use this to break into to Vehicles nowadays uh this Curry on some of those even more sophisticated than this uh some older car they were very simple it just transmitted an ID that matched the computer very easy to break into those days are in the past so I think you can feel safe that no one's going to use the flipper zero to break into your car

Channel: Major Mike

Views: 123,274

Keywords: Flipper Zero, Key fob, playback attack

Id: pCaZoOKUBVo

Length: 5min 20sec (320 seconds)

Published: Thu Oct 13 2022