RFID and NFC: The Key Issue

 Some of the more popular demonstrations of the Flipper Zero's capabilities are of the RFID and NFC functions. Viral videos showed the Flipper instantly bypassing electronic locks on hotel rooms, homes, businesses, and even cars. Others showed it copying and emulating credit card information. These videos earned the Flipper Zero a nation-wide sales ban in Canada as well as a sales ban on Amazon. 

But is there any truth to videos? It's a bit complicated. The Flipper comes with built in RFID and NFC readers, writers, and emulators. Using this function, something like a business key card can be scanned, cloned, and emulated. To the lock, there is no difference between the emulated code from the Flipper and the actual key card. It's a neat little function, but without having physical access to a card, there's not much you can do. In most of the door unlocking videos, that's all that's happening -- they've cloned a card and are emulating its signature.

I said most, but not all. The Flipper does have one more trick up its sleeve -- the RFID and NFC fuzzer. Basically, a fuzzer emulates many different codes, cycling through them many times per second. So can this unlock doors like you see in the videos. Well, no, not really. You see, the codes used on doors are long. Even at maximum speed, there's no way a fuzzer is finding the exact code among an almost unfathomable number of possibilities. The one time the fuzzer may have some utility is in what is essentially a dictionary attack. The Flipper can be loaded with a set of default codes which it then emulates in quick succession. If the lock in question in loaded with one of these known factory default codes, the Flipper can unlock it in short order.

However, it should be noted that almost no one would trust the security of their home or business on default codes. Changing the codes regularly is standard procedure for many businesses. Hotels are required to change the codes on their locks after every use of a room.

That just leaves cars. While the issue is related, the car unlocking potential is a function of the built-in radio rather than the RFID or NFC, so I'll address it another time.

You may be wondering what these functions are useful for if most of the viral videos twist the truth. Well, once I've written on the Flipper's main functions and addressed some of the main issues and misconceptions, I'll write a dedicated section on real-world uses for them, including penetration testing.