Flipper Zero: what this hacker tool can do

Marketed as "your cyber buddy", the Flipper Zero tool is Tamagotchi-like: yet don't be fooled by the innocent looks that make it seem reminiscent of the electronic children’s toy, because in the wrong hands it could be used to mess with a broad spectrum of radio and wireless signals.

Flipper Zero went viral at the end of last year after a successful Kickstarter campaign. However, this hacking tool has been around for around three years – Pavel Zhovner, of Moscow, started an active communication campaign in July 2020.

By the end of that year, he had finished developing the hardware, and the device was ready to be manufactured at scale and shipped.

"Flipper Zero is a tiny piece of hardware with a curious personality of a cyber-dolphin. [...] Flipper Zero is a portable multi-tool for pentesters and geeks in a toy-like body. It loves hacking digital stuff, such as radio protocols, access control systems, hardware, and more. It's fully open-source and customizable, so you can extend it in whatever way you like," its website reads.

It all sounds cheeky and fun, something of a Tamagotchi toy for grown-ups. However, security pundits are not fooled by playful marketing. The device can reportedly be used to change traffic lights, as well as take over a Tesla electric car's controls, among other things.

Adam Kohne, a cybersecurity researcher, believes Flipper Zero is an excellent way to up the pen testing game.

"From a cybersecurity perspective, the Flipper Zero excels at cloning and replaying access badges, capturing, replaying, or abusing wireless network signals, and leveraging semi-sophisticated scripts to attack enterprise devices like laptops or wireless access points," he writes.

The infographic below illustrates the technologies that Flipper Zero can interact with and potentially abuse.

“The Flipper Zero can fit into penetration-testing exercises in a variety of ways. While this device can assess or manipulate wireless network traffic from a distance, it excels at nearby interactions such as script execution via USB, credential theft, and brute-forcing a variety of other devices such as safes, badge access readers, or even garage door openers,” Kohne said.

By using a Flipper Zero device, a pentester (hopefully not a malicious hacker) could obtain access to a client facility and test network security.

In an attempt to help defenders up their security game with Flipper Zero, before threat actors find a way into their networks, Kohne walks readers through pointed examples, demonstrating how to use the cyber-dolphin directly and effectively.

He describes in detail how pentesters could use the device for access badge cloning, run the Wi-Fi Marauder application for wireless assessments, and execute the BadUSB feature.

“There are several competing products on the market offering similar features. Still, many are hyper-focused on a lesser selection of capabilities compared to the Flipper Zero, are more costly, and lack general flexibility regarding firmware modifications or expanding the solution's capabilities,” Kohne writes.