Flipper Zero reading an NFC security key. Adrian Kingsley-Hughes/ZDNET
I love my Flipper Zero, but what I hate are all the fake things that attention-seeking people upload to TikTok. No, the Flipper Zero can’t change gas station signs, it can’t clone credit and debit cards, and it can’t (normally, at least) turn off the screens at your favorite burger joint.
But that doesn’t mean that the Flipper Zero can’t do very interesting and very useful things.
Also: Flipper Zero can be used to lock iPhones running iOS 17, but there is a way to thwart the attack
For the past few months, I’ve been using the set of hardware tools built into Flipper Zero. What’s built into this little toy-like tool?
There is a sub-GHz wireless antenna that can capture and transmit wireless codes to operate wireless devices and access control systems, such as garage door remotes, boom barriers, IoT sensors, and even remote keyless systems.
RFID support allows you to read, store and emulate several different RFID cards.
Also: Do RFID Blocking Cards Really Work? My Flipper Zero revealed the truth
It can also read, write, store and emulate NFC tags.
On the front, there is a 1-wire connector that can read and emulate iButton touch keys (also known as DS1990A, CYFRAL, Touch Memory or Dallas key).
There is also a built-in infrared transceiver that can capture and transmit infrared codes to control things like televisions.
Finally, at the top there are GPIO connectors that allow Flipper Zero to connect to other real-world devices.
Also: How to unlock the true power of Flipper Zero
That’s a lot of features packed into a small $169 device.
But every week, I hear from buyers who are frustrated and disappointed because their Flipper Zero doesn’t do the things it apparently can do based on fake social media videos.
These are some of the things I’ve been doing with my Flipper Zero over the past few weeks.
ZDNET RECOMMENDS
Zero fin
Flipper Zero is a portable multi-tool for pencil testers and geeks in a toy-like shell.
View in the Flipper Zero store
Note: I’m running third-party software on my Flipper Zero, which gives me access to a ton of extra features. But don’t worry, loading third-party software doesn’t void your warranty and you can easily revert to the original software at any time using the Flipper Zero app on a desktop, laptop, or mobile device.
The sub-GHz wireless antenna can pick up signals from car key fobs (and can record them, although playing them in modern cars won’t unlock them due to a feature called “rolling codes” that changes the code with each use).
Also: The best security keys you can buy (and how they work)
This is a handy way to check if the key works and the battery is in good condition.
NFC is everywhere nowadays and Flipper Zero allows you to work with this wireless protocol. It’s built into cards and plastic keychains and is used for all sorts of things, from opening hotel room doors to controlling barriers.
The Flipper Zero can read NFC. Many NFC cards can also be copied and cloned (this depends on the security used for the card, and I can’t give you strict rules about which NFC devices can be cloned).
Also: The best VPN services (and how to choose the right one for you)
Please note that while Flipper Zero can read NFC cards and keyfobs, it cannot decode the card’s encrypted security code, also known as CSC, CVV, CVC, CAV, and many other three-letter abbreviations.
Flipper Zero cannot decode the card’s encrypted security code, so it cannot clone bank cards. Adrian Kingsley-Hughes/ZDNET
Along with NFC, Flipper Zero can read and clone RFID, including hotel cards (as in the image above).
Also: How RFID Tags Can Make In-Person Clothing Shopping Less Frustrating
RFID cards and tags can be blocked to prevent them from being overwritten, but Flipper Zero can prevent many of these mechanisms. Here, it offers to unlock the card if I present it to a valid reader, allowing me to clone the card and unlock the door using both the card and the Flipper Zero.
I’ve used this to clone access cards and key fobs for all types of buildings, and many times staff (and sometimes building owners) didn’t know this trick was possible.
The Flipper Zero can unlock some RFID cards and tags. Adrian Kingsley-Hughes/ZDNET
Yes, Flipper Zero can bypass the security of some Sentry Safe electronic safes using a GPIO output.
This is definitely not something you want to do if it’s not your safe or you don’t have permission, but it just goes to show how unsafe the “free” safes found in hotels, spas, and Airbnbs really are.
The Flipper Zero has a built-in infrared module which, in turn, can be programmed to operate a wide range of devices, from televisions to air conditioning units. Virtually any consumer device that has an infrared remote control interface can be controlled with Flipper Zero.
Another interesting use of this functionality is to test if the infrared remote controls are working. Point the remote control at the Flipper Zero in “read IR” mode and it will detect the signals.
Testing a disassembled infrared remote control. Adrian Kingsley-Hughes/ZDNET
Flipper Zero can act as a BadUSB device, meaning that when plugged into a port it looks like a human interface device (HID), like a keyboard.
Also: The best VPN services for iPhone and iPad (yes, you need to use one)
A BadUSB device can change system settings, open backdoors, recover data, launch reverse shells, or do anything that can be accomplished with physical access. These tasks are completed by using a set of commands written in Rubber Ducky Scripting Language, also known as PatitoScript.
Flipper Zero opens a browser and navigates to a web page without user intervention.
Adrian Kingsley-Hughes/ZDNET
The Flipper Zero can use the GPIO to output electrical signals and act as a signal generator. I last used this to simulate an anti-lock brake system module in a vehicle to confirm that all of the car’s wiring and computers were working.
Now, I don’t recommend that you do this unless your “victims” give you permission, because it can annoy people and is most likely illegal in most places, but the ease with which a Flipper Zero can block a iPhone or carrying out a denial of service (DoS) attack on Android devices is scary.
With just a few taps, Flipper Zero can flood devices within a 30-foot radius with pop-ups, making them nearly impossible to use. And so far, the only defense against this technique is to turn off Bluetooth.
