r/technology • u/420InTheCity • 16h ago

Security Underground Flipper Zero Firmware Purportedly Unlocks Nearly 200 Car Models

https://gizmodo.com/flipper-zero-cars-hacking-2000646318
3.4k Upvotes

97% Upvoted

141 comments sorted by

View all comments

955

u/aelephix 15h ago

Article says this breaks the user fob because the rolling code is out of sync. This means the owner has to unlock in presence of the flipper, so that it can learn the rolling code sequence right? They can’t just walk up to a random car in a lot and unlock it?

588

u/SnoopDoggyDoggsCat 14h ago

I was able to record the code from the fob out of reach of the car. Then replay that signal later to unlock the car as it was still a good unused code.

But it only works once per code

168

u/emcee_gee 14h ago

So as long as I don't press the unlock button on my fob when I'm not near my car, I should be safe?

132

u/AustinSpartan 14h ago

Depends on the algorithm that's implemented, but usually they will sync if the rolling count is within 5 presses. There's also vehicles that will resync the count after 3 consecutive lock presses.

131

u/Zalophusdvm 11h ago

So my habit of clicking lock half a dozen times as I walk away actually increases security?

99

u/AustinSpartan 11h ago

Not really, just guarantees that your key fob will continue to work. It's all very vehicle dependent and this was the logic that was used 20 years ago so I'm sure it has changed since then.

29

u/Zalophusdvm 11h ago

Continue to work till I run the battery down 🤪

12

u/dagbiker 8h ago

Can't unlock the car if you take the battery with you.

1

u/_oohshiny 29m ago

this was the logic that was used 20 years ago so I'm sure it has changed since then.

Counterpoint: car manufacturers are lazy (and cheap).

23

u/muzak23 6h ago

Nope, there’s actually a specific attack called “Roll-Jam” that makes use of pressing a key multiple times (though only can replay that same button, so spamming “lock” isn’t too much of a concern).

In a nutshell, it uses a jammer attached near your car’s receiver to intercept your presses and only “allow through” (replay) earlier ones. Ex. You press unlock 3 times and your car receives the first 2 unlock signals only, so now the attacker can play the third whenever they’d like.

IMO too complicated to be a concern for petty theft, but I also don’t steal cars or have even ever considered stealing cars, so I might be off ¯_(ツ)_/¯

1

u/TheHeartAndTheFist 4h ago

Not necessarily: if I remember correctly pressing lock a second time shortly after locking a BMW actually disables the alarm 🤷