Flipper Zero Car Hacks Exposed: What’s Real and What’s Hype
www.carsandhorsepower.com
Criminals are marketing custom Flipper Zero firmware to unlock cars from Ford, VW, Hyundai, and more. Here’s what’s real, what’s hype, and how automakers are responding.

Underground developers are selling Flipper Zero “car unlock” packages for hundreds of dollars, complete with a PDF listing targeted makes and models and whether the hack enables only door unlocks or full start/drive.

  • panda_abyss@lemmy.caEnglish
    82·
    2 days ago

    None of this needs to happen. Frankly insurance companies need to be holding the car manufacturer’s feet to the fire by not insuring cars that can be trivially stolen like this. If a Flipper Zero can steal a car that is 100% on the car manufacturer.

    If a tiny yubikey can generate cryptographically unique keys so can a car key fob.

    It would not be that difficult to design a key fob which pairs with the car wirelessly (just like Apple uses for AppleTV and Apple Watch).

    Literally all you need is:

    1. Car has private/public key pair (which can be reset by technicians, but requires physically opening up the car)
    2. Sync keyfob to car – keyfob generates unique key pair, keyfob shares public key with car.
    3. When the keyfob communicates with the car, all signals to unlock or start are cryptographically signed, then the car sends a token to authenticate and confirm the instruction.

    If anyone complains about battery life just make the fob rechargable instead of the annoying shitty battery change process. You can even make a charging port in the car (where they keyhole used to be, or in the wireless charging tray).

    Plus this can be extended to phones with zero trust and no need for external infrastructure or violating user privacy.

    • Broken@lemmy.mlEnglish
      15·
      2 days ago

      insurance companies need to be holding the car manufacturer’s feet to the fire by not insuring cars

      I agree with the sentiment, but unfortunately that screws over the owners far more and for far longer before it even impacts the car manufacturers.

      Maybe a better attack (aside from government regulations) would be banks to not provide financing for loans to buy those cars. In the end, if the car is stolen they are at a loss so that makes sense.

      People can’t get loans, so don’t buy the risky vehicle. It hurts a little in the now to direct them towards cars that will not be a problem in the future. And the car companies feel the sting of lost sales right away.

    • pivot_root@lemmy.worldEnglish
      24·
      2 days ago

      Frankly insurance companies need to be holding the car manufacturer’s feet to the fire by not insuring cars that can be trivially stolen like this.

      The governments should be, too.

      Instead, some countries are taking the approach of banning Flipper Zeros or restricting their sale instead. That’s like outlawing flathead screwdrivers because you can use them to pop improperly-installed doors off of their hinges.

      It’s on the car manufacturers to fix their poor security, not on tool suppliers to not make tools.

      • SaveTheTuaHawk@lemmy.caEnglish
        3·
        23 hours ago

        car manufacturers to fix their poor security

        “oh no, your car got stolen…here’s another car for you to buy”

        We need a global system of digital ID that simply bricks any car reported stolen.

        • JcbAzPx@lemmy.worldEnglish
          4·
          19 hours ago

          Yeah, because there’s no way remotely brickable cars could ever be abused by the manufacturers.

      • panda_abyss@lemmy.caEnglish
        14·
        2 days ago

        Yeah, you can ban flipper, but then someone is going to use a raspberry pi zero with a SDR hat, or an arduino, or an old android phone, or a wifi router and battery pack.