Canadian government banning Flipper Zero to combat auto theft(canada.ca)
canada.ca
Canadian government banning Flipper Zero to combat auto theft
https://www.canada.ca/en/public-safety-canada/news/2024/02/federal-action-on-combatting-auto-theft.html
323 comments
The Flipper Zero is a general-purpose tool and STEM educational device. By banning the device, a country would be setting back their workforce of engineers and scientists a bit.
How can you use a Flipper Zero to steal a car? Flipper Zero can't crack hard encryption.
Is the real problem that cars were made with security that they already knew was negligently weak at the time? If so, is a recall of those cars more appropriate?
How can you use a Flipper Zero to steal a car? Flipper Zero can't crack hard encryption.
Is the real problem that cars were made with security that they already knew was negligently weak at the time? If so, is a recall of those cars more appropriate?
This is typical. All this stuff about people knowing where their cars are and the police, CBSA etc not doing anything about it*, the complicity of all the port and shipping people, but the government pretends banning some electronics will change something. I don't know what people expected from a "summit" or whatever they did, there are lots of clear steps we could take, but instead we get this.
*see https://www.cbc.ca/news/canada/toronto-man-finds-stolen-truc...
*see https://www.cbc.ca/news/canada/toronto-man-finds-stolen-truc...
In the grand scheme, these are remarkably unsophisticated devices. It's almost a meme in RF circles to excitedly buy one and then immediately realize it's just a Girl Tech IM-me with NFC.
If you want to do real damage there are portable SDRs that can jam GPS and transmit just about any arbitrary radio signal from DC to 6GHz for less than $500. This is a mildly powerful toy that has a large, intelligent and curious community around it.
The reality is RF stuff is wildly under-explored right now outside of military spaces. On the consumer side I'd guess we're somewhere around the early 2000s internet in terms of security posture. It's probably best to consider the flipper community to be a gift of minimally destructive pentesters relative to what they could be if someone wanted to actually dish out real electronic warfare.
If you want to do real damage there are portable SDRs that can jam GPS and transmit just about any arbitrary radio signal from DC to 6GHz for less than $500. This is a mildly powerful toy that has a large, intelligent and curious community around it.
The reality is RF stuff is wildly under-explored right now outside of military spaces. On the consumer side I'd guess we're somewhere around the early 2000s internet in terms of security posture. It's probably best to consider the flipper community to be a gift of minimally destructive pentesters relative to what they could be if someone wanted to actually dish out real electronic warfare.
Canada has totally lost its way.
Housing is a massive issue. Healthcare is under constant attack. Immigration is used to prop up a failing economy. We don’t really make anything. Wages are lower than the US just because. There’s no negotiating power. The dollar is weak. We can’t extract most of the available resources because of the weather and environmental concerns. The praries are being sold off to foreign investors. The smartest and most educated leave. Starting to feel like a fool for sticking around.
Never cared much about the Flipper Zero personally, but now that governments are banning them I guess it's time to buy one. Great unintentional marketing campaign, Canada!
This feels like a loud solution to assuage the outrage of the month.
None of the articles on this are actually showing the numbers. https://www150.statcan.gc.ca/n1/daily-quotidien/230727/cg-b0...
Car thefts have increased by a significant amount outside of their normal fluctuations, but they are still much much lower than they were before 2010. To call it a crisis is hyperbole. Canada's car thefts are the approximately the same rates as the US.
Flipper zero is a casualty of poor security practices, and the insurance companies need to be going after the car manufacturers for making it so easy. I would even say if it's so easy to bypass, then buttonless start should never have even been legal.
You can ban the flipper zero, but it does not seem that difficult to get them into the country nor does it seem difficult for criminals to make their own.
None of the articles on this are actually showing the numbers. https://www150.statcan.gc.ca/n1/daily-quotidien/230727/cg-b0...
Car thefts have increased by a significant amount outside of their normal fluctuations, but they are still much much lower than they were before 2010. To call it a crisis is hyperbole. Canada's car thefts are the approximately the same rates as the US.
Flipper zero is a casualty of poor security practices, and the insurance companies need to be going after the car manufacturers for making it so easy. I would even say if it's so easy to bypass, then buttonless start should never have even been legal.
You can ban the flipper zero, but it does not seem that difficult to get them into the country nor does it seem difficult for criminals to make their own.
Canadian government once again proving it is stupid. These are the same groups that had moral panics and tried to ban video games and rock and roll without any actual information.
Just root a phone and you have a far more powerful hacking platform.
Just root a phone and you have a far more powerful hacking platform.
Relevant part:
> Innovation, Science and Economic Development Canada (ISED) Innovation, Science and Economic Development Canada will work with Canadian companies, and the automotive industry, to develop new solutions to protect vehicles against theft and to assist with recovery of stolen vehicles.
> ISED will pursue all avenues to ban devices used to steal vehicles by copying the wireless signals for remote keyless entry, such as the Flipper Zero, which would allow for the removal of those devices from the Canadian marketplace through collaboration with law enforcement agencies.
The actual solution would be to force auto makers to have better security that can't be cracked by script kiddies. Banning a tool like the F0 is like banning hairpins or paperclips because they can be used to pick locks. Their primary "purpose" isn't that at all. What would be okay is to ban the use of an F0 to steal a car. Not ownership of an F0, or a screwdriver.
> Innovation, Science and Economic Development Canada (ISED) Innovation, Science and Economic Development Canada will work with Canadian companies, and the automotive industry, to develop new solutions to protect vehicles against theft and to assist with recovery of stolen vehicles.
> ISED will pursue all avenues to ban devices used to steal vehicles by copying the wireless signals for remote keyless entry, such as the Flipper Zero, which would allow for the removal of those devices from the Canadian marketplace through collaboration with law enforcement agencies.
The actual solution would be to force auto makers to have better security that can't be cracked by script kiddies. Banning a tool like the F0 is like banning hairpins or paperclips because they can be used to pick locks. Their primary "purpose" isn't that at all. What would be okay is to ban the use of an F0 to steal a car. Not ownership of an F0, or a screwdriver.
Like every other wide-spanning law the Canadian Government has passed lately (including the one on firearms and the soon-to-pass adult-content on the internet), I imagine they will ban swathes of legal products that use RF and do nothing to actually prevent crimes from occurring.
Thanks to our Parliament!
Thanks to our Parliament!
This is so misguided. If I can in any way steal a car with a Flipper Zero (regardless of firmware), that car should be recalled and fixed by the manufacturer.
This just means that only criminals will use Flipper Zero. And they were already stealing cars. I don’t think they will mind one additional illegal activity.
But how many previously law abiding citizens will be hurt by not having this technology, or becoming criminals now?
But how many previously law abiding citizens will be hurt by not having this technology, or becoming criminals now?
So after this law, the honest people cannot have Flipper Zeros, and the criminals will simply continue breaking the law and acquire one.
It not banned yet: might be worth to send comments to [email protected] the email address on that page.
> Office of the Honourable Dominic LeBlanc Minister of Public Safety, Democratic Institutions and Intergovernmental Affairs
> Office of the Honourable Dominic LeBlanc Minister of Public Safety, Democratic Institutions and Intergovernmental Affairs
It appears that Flipper Zero is virtually useless in almost all car thefts and is just being unfairly targeted by Trudeau. Also, the company didn't even get a heads up about being falsely blamed:
> Alex Kulagin, COO of Flipper Devices, said in an interview that his company received no communication from the Canadian government ahead of Thursday’s statements.
> Alex Kulagin, COO of Flipper Devices, said in an interview that his company received no communication from the Canadian government ahead of Thursday’s statements.
Ah, the irony... in the 90's you had to get your RF scanner FROM Canada or it would have analog cellular frequencies blocked!
So if I'm reading this right, they're banning something that is too underpowered to run the exploits people are using to steal cars (which are only possible in the first place because car companies' threat model is mostly about their customers rather than thieves) in order to pretend to do something about car theft
I've been pretty happy on balance with measures introduced through direct democracy in recent years (mostly happens at the municipal and state levels in the US), and it seems like most people are unhappy with measures introduced by the normal "democratic" means of governance in rich nations, where we elect people, who then make laws
Maybe we should do more of the former and less of the latter
I've been pretty happy on balance with measures introduced through direct democracy in recent years (mostly happens at the municipal and state levels in the US), and it seems like most people are unhappy with measures introduced by the normal "democratic" means of governance in rich nations, where we elect people, who then make laws
Maybe we should do more of the former and less of the latter
So if they ban the Flipper Zero are they going to ban the multitude of SDRs as well?
The issue isn't devices like the Flipper Zero as much as the weak standards of security (and perceived obscurity) being used to not use actual security to secure cars.
Auto manufacturers could .. create more secure devices for cars. Of course existing vehicles are a different problem. That was avoidable to some degree.
Auto manufacturers could .. create more secure devices for cars. Of course existing vehicles are a different problem. That was avoidable to some degree.
This is the equivalent of banning the import of balaclavas to stop robberies.
So all those people with FZs I met at Bsides were car thieves.
Just how many thefts are linked to its use.
Criminals will be add FZs to their gun and drug shipments to Canada
Just how many thefts are linked to its use.
Criminals will be add FZs to their gun and drug shipments to Canada
What's the legal instrument they intend to use? Or are they planning to pass a new law? The way this is worded seems to suggest its already in the authority of ISED to ban these, if so, does anyone know what law would give them that right?
If your car key can be copied using a simple replay attack, it is not a key.
Is it even possible to use a flipper zero to steal a car? I thought modern cars have rotating keys which would prevent a replay attack unless you had access to the fob long enough to figure out the seed in which case you may as well just use the key to open the car.
They steal cars by either breaking a window or by getting to the CAN bus through the bumper and hijacking the car by programming a new key using the car's VIN. Ban Toyota and Honda from selling cars with shitty security if you want to do anything about this problem without having to ask the police to be useful.
They steal cars by either breaking a window or by getting to the CAN bus through the bumper and hijacking the car by programming a new key using the car's VIN. Ban Toyota and Honda from selling cars with shitty security if you want to do anything about this problem without having to ask the police to be useful.
Has anyone else described how a Flipper Zero can be used to aid in car theft? My understanding is since the 1990s car have used rolling codes for keyless entry, making it improbable for a Flipper to replay captured signals to unlock vehicles¹. But surely Canada has at least a modicum of evidence that thieves are using Flippers?
¹ Caveat: Some cars will accept rolling code signals with a counter only 1-3 values off. So a Flipper recorded unlock message could be replayed successfully if the owner hasn't used their fob again. Plus, replaying codes can desynchronize the car's system from the fob, leading to non-functional keyfobs. You can find online reports where Flipper users did this to themselves: https://www.reddit.com/r/flipperzero/comments/yxgn60/flipper...
edit: A deeper dive makes me think a the Flipper could help with some attacks. On some cars recording multiple successive unlocks and replaying them in order will make the car resynchronize its counter to the messages on your Flipper and the next one will unlock the car. It seems this attack relies on the first signal being jammed, but you could do that with two Flippers. One next to the car jamming, and a 2nd closer to the keyfob recording. Lots of info here: https://i.blackhat.com/USA-22/Thursday/US-22-Csikor-RollBack...
¹ Caveat: Some cars will accept rolling code signals with a counter only 1-3 values off. So a Flipper recorded unlock message could be replayed successfully if the owner hasn't used their fob again. Plus, replaying codes can desynchronize the car's system from the fob, leading to non-functional keyfobs. You can find online reports where Flipper users did this to themselves: https://www.reddit.com/r/flipperzero/comments/yxgn60/flipper...
edit: A deeper dive makes me think a the Flipper could help with some attacks. On some cars recording multiple successive unlocks and replaying them in order will make the car resynchronize its counter to the messages on your Flipper and the next one will unlock the car. It seems this attack relies on the first signal being jammed, but you could do that with two Flippers. One next to the car jamming, and a 2nd closer to the keyfob recording. Lots of info here: https://i.blackhat.com/USA-22/Thursday/US-22-Csikor-RollBack...
A CBC article (edited since then) also mentioned the Raspberry Pi. Hopefully it's just bad journalism.
If anyone has a business impacted by this, I would absolutely love to talk to you. [email protected] - I'm quite sure I can help (not looking for $$, just think this is insane).
Every day this incompetent government gets more ridiculous than I ever thought imaginable.
Hah. I knew this would happen. The Flipper is basically marketed as a hacking tool.
Wait, so I can use my Flipper as a backup key for my car (mid 2010s Mazda)?
I thought the rolling code thing prevented this. If anyone has a doc on how to use the Flipper for a car, please send it! I promise it's for legit use. I bought it originally to dupe the NFC key fob for my apartment and the RF fob for the garage door.
I thought the rolling code thing prevented this. If anyone has a doc on how to use the Flipper for a car, please send it! I promise it's for legit use. I bought it originally to dupe the NFC key fob for my apartment and the RF fob for the garage door.
https://arstechnica.com/security/2024/02/canada-vows-to-ban-...
https://www.bleepingcomputer.com/news/security/canada-to-ban...