this post was submitted on 11 Feb 2024
245 points (92.7% liked)
Technology
59436 readers
3748 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I don't disagree with your point, but the flipper zero for sure lowers the bar of entry. Before the flipper came out the, "You must be this tall to ride" required some pretty good knowledge of microcontrollers, hardware peripherals, and software engineering. The people that had that sort of knowledge tended to actually have paying jobs, which is like the biggest factor in not being a street criminal.
The flipper made the barrier of entry at about the level of being able to operate a TV remote which any dipshit can do. However, the fact that the flipper exists at all means that the cat is out of the bag. As you said, someone else is just going to come along and release a similar product. You can't just ban the flipper and expect it to have any impact. My concern is they will decided to make certain code illegal, which gets really stupid.
Barrier to entry to do what? They can't be used for vehicle theft because you can't replay attack a rolling code, which is what all vehicles use.
The current attack is to use a repeater to amplify a fob that's close enough to an outside wall to hijack and open these "get close enough and the doors open" locks.
Ask Kia/Hyundai owners how it can't be used. There's for sure cars that are susceptible to this attack still driving around, and the barrier to entry for executing the attack was lowered substantially. It's like if you made an out of the box pentesting tool that was highly effective at breaking into vpns, identifying high value targets, and downloaded those high value database's data at the click of a button.
https://nvd.nist.gov/vuln/detail/CVE-2022-37418
https://www.caranddriver.com/news/a43941743/hyundai-kia-vehicle-theft-settlement/
https://www.theverge.com/23742425/kia-boys-car-theft-steal-tiktok-hyundai-usb
The Flipper is literally just an ends to a means. An easily accessible action for hardware. Nobody is stopping any random person from buying a number of $3 dongles for their laptop and using it in the exact same way.
Yes but the flipper requires zero base knowledge to use it whereas setting up the hardware, installing the software, and troubleshooting any issues takes about the same amount knowledge as a helpdesk gig in IT. Again, I don't think making them illegal does shit. I do think it's rather obstinate to not acknowledge that the barrier for entry to execute those attacks was lowered substantially by the flipper though.
Bar for entry wasn’t really that high to begin with. There were already a collection of tools that did the same thing, and could be had for a couple thousand bucks. Yeah, a price point 1/10th the older option is more accessible, but it’s not like criminals are hurting for money just because they are criminals.
I'm onboard with that but putting it at the level of operating a tv remote really casts a wider net. You essentially have to be barely literate to use the thing, where before you had to at least be able to read and execute some walkthroughs. Also you had to kind of be in the security/tech scene to even understand that it was an option, where the flipper has, for a lack of a better word, popularized the attack.
There's a reason that when you go on sites like exploit db well over half of the exploits require some fiddling to make work. Metasploit is similar as well because it requires you to actually be able to use a cli on some level. While that isn't a huge bar of entry, it's still keeps the riff raff out for the most part. The flipper pretty much said fuck it, and let not only the skiddies in, but any dipshit with $80 buy a car stealing autopwn.
I get what you’re saying, but it’s like arguing that hammers should be complicated and/or expensive because they can be used by anyone to break a window.
These tools are exposing security issues, that’s not an issue with the tool. That’s an issue with the things using the shit security.
Banning the tool fixes nothing, it’s like painting a rotting fence. The problem is still there, still getting worse, you can just pretend everything’s fine for a short while before it comes crashing down.
Your response really highlights that you do not get what I'm saying. I'm not arguing it should be banned. I'm saying that acknowledging that the barrier of entry was lowered is at least somewhat of an important factor to consider. Doing it the way flipper did is irresponsible at best, and more realistically ethically corrupt. It's been done though and you can't put the cat back in the bag.
Now governments are trying to ban them, but when 100s of new clones come out I can almost guarantee governments are going to start doing increasingly silly shit to stop it. Do you think that giving every joker a key to any kia/Hyundai is going to lead to governments cracking down on security on the manufacturing side? Or do you think it'll just give them a bigger excuse to make invasive laws? I'm pretty sure I know where it'll lead and I seriously doubt it will be leveling laws against the poor old car manufacturers that donate to campaign funds...