It feels like it would also be helpful if advertisements were rate-limited (for example, if an advertisement is declined three times, don't show it again for another 24 hours).
As far as I know, this dialog is only supposed to pop up for password requestors in your contact list, your own devices (which have an Apple ID based signing credential that can be verified offline) etc., so this seems like an easy to fix bug on Apple's side rather than a conceptual weakness.
So if someone spams me with Bluetooth advertisements, and I decline three times, and then I want to connect some other device that also uses Bluetooth advertisements, now I have to wait 24 hours before I can do so? Seems not ideal either.
A simple solution: On the dialog for the Nth advertisement, also provide a "disable AirDrop for 1 hour" choice. If the user wanted to receive these again, they can re-enable AirDrop from Settings or the Control Center.
That's really neat, but on another level it's a shame that this is possible with so many keycards still.
At least for magnetic stripe keycards, you'd need actual physical access to the card for a second; with many contactless ones, a tap on somebody's wallet/pocket is enough.
Actually secure keycards only cost fractionally more; even classic Mifare (which has been thoroughly hacked) would offer better security than this.
Sounds like something based on NXP Mifare Classic. You first try a dictionary attack against the fob (most readers use whatever default keys the vendor set), if that fails, you collect nonces by touching the flipper to a reader, calculate keys in the companion app on your phone, then add keys to the flipper's dictionary. The attacks are called darkside and nested.
most keycards/fobs are pretty secure and near impossible to copy (e.g. NXP Desfire based systems), others are easy to copy but copies can be detected (e.g. NXP Mifare Classic), it's mostly legacy RFID stuff that's trivial.
I don't know what it's like globally, but around these parts it is way more common to encounter one of these "legacy" systems than any of the modern stuff. Many large campuses were early adopters of fob-based access and upgrades are prohibitively expensive.
One of my favourite attacks against the existing HID-card based systems is... once you scan a card, the 24-bit identifier is split between an 8-bit facility ID and a 16-bit card ID. If you encounter a door that won't open with the card you have, start decrementing the card ID; many of these places assigned card IDs sequentially and by trying smaller IDs you're trying cards for employees who have had longer tenure at the company.
Yeah, but so many hotels seem to use the legacy stuff.
Most keycards I've tested don't even register on my phone, meaning that they're using something pre-ISO-14443 (which very likely does not support any real cryptographic authentication).
> Anthony said that he devised an attack that can work over “thousands of feet,” using an “amplified board” ... Anthony said he is not releasing details of that technique “due to major concerns,” such as giving others the ability to send spam pop-ups “across vast distances, potentially spanning miles.”
Anthony must be the only person knowledgeable of analog electronics design on planet earth then. Security through ignorance.
Yeah the flipper zero is very expensive for what it is. If not I'd have had one. Since it's open source I was hoping for Chinese clones like what happened with that similar device with the round clickwheel but it hasn't happened yet.
Why is it expensive tho? It seems to be this little bridge between digital and somewhat analogue world that you can use for many things. What price would you suggest? Or what alternative way is there to achieve things like this?
The problem with this particular hack is (like with many others where flipper zero is mentioned) that you might just use some 10 BLE micro controller to achieve the same thing.
Usually the things that were glued together in the flipper are never used together for a complex use case. Not sure about what Apple does here, though, so I might be wrong.
Anyway, the cases where you can employ IR, BLE, RFID and the flipper's custom radio in some useful combination seem to be rare and it usually always seems to make more sense to list the needed components for the hack instead of giving some folks finally a (destructive) use case for their expensively acquired gadget.
Of course the idea of delivering the solution as software/declaratively is the interesting part. But applications are rare and seldom new (at some point replaying your old garage door might only deliver so much long term motivation)
It's just an STM32, display and a few radio modules. But with shipping and VAT it's around 250 euro. I imagine the component cost wouldn't be much higher than 50.
But the main issue isn't the component cost, it's just how much I'd pay for something like this. Here in Spain it's a lot of money. It's as much as my current smartphone cost.
The Lockheed's SAVI RFID tags were all historically 433mhz, and on every military shipping container...
There is no security for these tags, so if you can speak to them you can write to them... thus if you had a flipper, one could erase/fake payload on the tag...
The problem is that one doesnt know what the tag data corresponds to in the inventory systems - so the worst one may do is scramble all the tags such that a valid reader would never be able to determine what was in the containers... and one could use a flipper on a drone to fly over a supply bulk of containers and render finding supplies via RFID impossible - or one could copy and paste data from crates, thus making all reads wrong....
It would be great if we lived in a world where "please don't" was an effective security strategy, but we do not, and Apple needs to fix this problem before it goes viral.
Wireless communications are inherently jammable. Where is the border between this and a bunch of microwaves jamming cell reception?
I’m not saying Apple should not have done a better job in anti-spam measures, but “please don’t” is a basis for many nice things we have.
It's also generally against FCC regulations. Airdrop is not a regulated standard; it is entirely up to the implementing party to anticipate and mitigate abuse. The problems you're conflating are not the same, this Flipper Zero attack is entirely enabled by bad design. The explicit issue listed in the article is not inherent to the technology, it is inherent to Apple's vision for the Airdrop user story.
I dunno.. if we just assume everyone around us is gonna be an asshole then we can never have nice things. In order to be able to take the subway I'm willing to assume that not every person in the car is gonna blast their personal music preference at max volume. Yes it is possible for them to do that but that doesn't mean it's on me to invent super smart headphones to block that out. At some point, in some cases, "please don't" is in fact a valid security response.
I'm browsing this article on my "hacking device" (my laptop) while using my "hacking program" (a web browser with devtools) to enjoy the experience.
Later I might take my "child mauler" (dog) on a walk.
For a site with "tech" in the name, I expect significantly better than this nonsense. Flipper Zero is a nice packaging of dev tools but nothing fundamentally new. If it makes the author feel better, we can repeat the attacks with a simple esp32 and save a whole bunch of money - though we'd lose out on the cute animations.
What in this article is nonsense? It did a decent job of explaining that it needs to be compiled from a 3rd party firmware, how the attack works and a video of said attack.
I wasn't particularly appreciative of the phrasing in the opening sentence:
> Thanks to a popular and relatively cheap hacking tool, hackers can spam your iPhone with annoying pop-ups
Because it seems to place blame (possibly unintentionally) on "a popular and relatively cheap hacking tool" rather than "an individual's choice to annoy the shit out of others".
I agree there are uses of the word hacker that don't mean to exploit, but the author here is not using the term in a positive sense. The author is clearly using it in the perjorative.
