We’re CovertSwarm – expert ethical hackers, red teamers and penetration testers. From testing out new tech for our clients, to networking and competing at events like DEF CON, we work relentlessly to sharpen our skills and give back to the cyber community.
We’re CovertSwarm – expert ethical hackers, red teamers and penetration testers. From testing out new tech for our clients, to networking and competing at events like DEF CON, we work relentlessly to sharpen our skills and give back to the cyber community. But we can’t do this without the help of some impressive gadgets. And this time, it’s a handheld hacking device – Flipper Zero – that’s caught our eye.
While it looks like a 90s Tamagotchi, don’t be fooled. This cyber Swiss army knife is packed with features that let you hack any time, anywhere, into many devices. It brings together some of the main hacking and research tools in one bundle, so use it wisely – it wields enormous power. Here, we break down the gadget, share our first impressions, and consider how it’s going to be useful to our team of ethical hackers.
It’s a pocket-sized tool for on-the-go pentesting and security analysis, capable of accessing control systems, interacting with hardware and analysing various types of radio signal. Despite its small size and innocuous, toy-like appearance, it packs some impressive tech under the hood (more on that later). It’s both open source and programmable, and compatible with a library of plugins to add extra features.
If Flipper looks familiar, there’s a good reason why: it was inspired by previous hacking tools like pwnagotchi, except it’s a lot more versatile. The team behind it wanted to develop something ‘functional but fun’, with all the essential kit you’d need in one device. Thanks to a hugely successful Kickstarter campaign – which smashed its target of $50,000 by raising closer to $5 million – it’s now shipping worldwide, and we’ve already got our hands on a few. Whether you’re a student or seasoned expert, it’s a great bit of kit to add to your arsenal for prototyping, hardware research and pentesting on-the-go.
Tiny but mighty, Flipper Zero keeps a lot of hacking hardware close to hand. Some of its features include:
Sub-1 Ghz radio: Transmit and receive digital signals within the 300-928 MHz range, ideal for control systems like remote keys, remotes, barriers and IoT sensors.
iButtons/TouchMemory/Dallas keys: Clone and replace building and office keys.
U2F/universal 2nd factor: Use for hardware security tokens and log into apps like Gmail, Amazon and Facebook.
GPIO pins: Plug directly into hardware or extend Flipper’s capabilities with extra modules.
Bad USBVirtual keyboard: Replicate physical keyboard commands to automate tasks or use alongside breakout techniques.
NFC/near field communication: Replicate high-frequency waves that need close contact for access controls, like building entry points or barriers.
RFID/radio frequency identification: Read, clone and emulate low-frequency signals that work from further away, including access cards, removing the need for a physical card.
Infrared sensor: Control TVs, air conditioning systems, stereos and more through common commands like volume, temperature, and switching on or off. Flipper Zero has lots of public databases with pre-loaded controls for common brands.
Thanks to Flipper Zero’s ability to analyse and replay various signals, you can figure out which ones devices use and copy them. Even if Flipper doesn’t recognise the protocol, it can still replay it – and thanks to its built-in ports, you can run more sophisticated tests by connecting it to a computer. Ultimately, you can emulate a wide range of signals from wireless gadgets like remotes, key fobs and key cards and use them for wireless control, or to store multiple access keys in one handy device.
On a more technical front, Flipper is an ethical hacker’s multi-tool, reducing the need for extra physical kit like antennas and adapters when working in the field. Possible uses include testing security weaknesses in WiFi networks or intranets, gaining access to physical security points in buildings like a virtual lock-picker, or testing hardware security by connecting its GPIO pins directly to a circuit.
One of the biggest draws of Flipper Zero is that it’s completely open source – meaning there’s going to be huge scope to write your own plugins or download others from public libraries. It’s compatible with all operating systems, as well as source-code editors like VSCode, and can be programmed for repetitive tasks and techniques like fuzzing, analysis and debugging. However, this side of the technology is still being developed and refined, so watch this space.
Flipper needs no computer, drivers or smartphone for its main functions, and it’s built with a simple interface and D-pad for navigating menus. As an on-the-go device, it can last up to 7 days on a single charge, thanks to a low-energy LCD display. Along the sides, you’ll find various ports – including for USB C charging, connections and GPIO pins – to plug Flipper into hardware or add modules like sensors and interfaces. But be aware that you’ll need a MicroSD slot to store any data. You can check out the full specs on the Flipper website.
The point of Flipper is to make hacking fast and fun, and turn pentesting into a game. Like a throwback GigaPets toy or Tamagotchi, the sassy dolphin character ‘evolves’ as you interact with digital systems in real life, building a unique personality. Because Flipper’s intended audience is so diverse, it combines a professional hacking tool with an engaging gadget, suitable for everyone from cyber security veterans to fresh-from-college newbies.
Here’s the statement from the team behind Flipper:
Official firmware will not have any kind of potentially illegal features, such as jamming, brute force, etc. So Flipper Zero should be completely legal in all countries. Since it’s open source, you can always implement any feature you want or use 3rd party firmware made by the community. In this case, all responsibility is on you.
Like any kind of hacking tool, technology or technique, it’s all about the intent. In the wrong hands, or used for the wrong purposes, this small piece of kit could do serious damage. But it’s also a great device for professional ethical hackers looking for vulnerabilities in systems and applications, to strengthen their protection from bad actors.
Every day, our experts work relentlessly to expose weaknesses and build stronger security for companies, data and people. Flipper Zero is just one piece of the puzzle – and one way we’re mitigating future attacks from hackers. Through technology like Flipper, we unearth unguarded entry points, defective security processes and digital gaps in the fence – so you can fix them before they’re exploited. It’s why we’re a leading name in cyber, and why we’re keen to work with both businesses and industry talent that takes their security seriously.
If you’re interested in joining the Swarm, send us a message or take a look at our latest vacancies. For business enquiries, get in touch with our experts. Together, we can make the digital world safer for everyone – and stop hackers in their tracks.
Cybersecurity Glossary
Read this comprehensive list we’ve compiled to assist experts, C-level executives, and those embarking on a cybersecurity career in navigating the extensive array of terms in…
An In-Depth Guide to Remote Desktop Protocol (RDP)
The continually changing nature of today’s workplace has made remote access technology essential.
Mitigating Credential Stuffing Attacks with IP Rotation: Strategies and Considerations
This article covers effective strategies to fight credential-stuffing attacks using IP rotation. By Ibai Castells
CovertSwarm at DEF CON 32: Insights from the Swarm
This time last week, our Swarm was taking over Las Vegas at DEF CON 32 – one of the biggest and oldest hacker conventions in the…