Flipper Zero Field Guide: Sub-GHz, BadUSB, NFC and the Multi-Tool That Broke Airport Security Theater

2026-08-08-16 min read

#flipper-zero#sub-ghz#rfid#nfc#badusb#hardware#edc

In February 2023, the Canadian government announced it was considering banning the Flipper Zero - a $200 handheld device shaped like a cartoon dolphin - citing concerns that it could be used to steal cars. The news spread across tech media, security Twitter, and then mainstream outlets. The Flipper Zero had arrived. And most of the coverage fundamentally misrepresented what it could and couldn't do.

The Flipper Zero is a multi-tool for anyone who works near wireless infrastructure. It combines a Sub-GHz radio, NFC and RFID reader/writer, infrared transceiver, iButton reader, BadUSB capability, and a set of GPIO pins - in a device that fits in a jacket pocket and costs less than a decent soldering iron. It is useful for security researchers, pentesters, hardware hackers, and curious people who want to understand how the wireless world around them actually works.

It is not, as some headlines suggested, a magic car theft device. What it is takes a little longer to explain.

◈ interactive artifact

Flipper Zero - Interactive Simulator

Explore Sub-GHz signal capture, NFC reading, BadUSB payloads, and IR learning on a simulated Flipper Zero OLED interface.

//What Flipper Actually Is

The Flipper Zero was designed by Pavel Zhovner and Alex Kulagin, Russian developers who ran a successful Kickstarter campaign in 2020, raising $4.8 million from 37,000 backers. The project was built on a philosophy of openness: the hardware is documented, the firmware is open source, and the community has been actively building plugins, apps, and protocol decoders since day one.

The core hardware is a STM32WB55 microcontroller paired with a CC1101 Sub-GHz radio, an NXP NFC/RFID chip covering both 125 kHz and 13.56 MHz, an IR receiver and emitter, and a 128x64 monochrome OLED display. Battery life is measured in days. The interface is a directional pad and two buttons. The whole thing is built around a menu system that should feel familiar to anyone who used a Nokia from 2001.

The dolphin mascot - Tamagotchi-style, getting happier the more you use the device - was a deliberate design choice. The creators wanted something that looked approachable, not threatening. That choice became politically complicated when governments started talking about banning it.

//Sub-GHz: The Most Misunderstood Feature

The CC1101 chip covers 300 to 928 MHz, with practical transmission at 315, 433.92, and 868 MHz - the three main frequencies used for consumer wireless devices in North America, Europe, and Asia respectively. This band covers garage door openers, gate remotes, car key fobs (older ones), wireless doorbells, weather stations, and alarm key fobs.

When the Flipper Zero captures a signal on 433.92 MHz, it records the modulation pattern - the on/off timing that encodes the command. For devices using fixed codes, this recording can be replayed to send the same command later. This is the "rolling your own garage door opener" use case, and it works exactly as advertised for devices old enough to use fixed codes.

Modern car keyfobs are a different story. Rolling code systems - KeeLoq, AUT64, and variants used by virtually every car manufacturer since the mid-1990s - generate a new code with each button press. The receiver accepts a code only once and then increments its counter. Capturing and replaying a rolling-code keyfob signal does not work. The received code is already used, and the receiver rejects it.

[INFO]

The Canadian car theft concern was specifically about relay attacks - using two devices to extend the range of a car's keyless entry system. This attack is real and is used in actual car theft. It does not require a Flipper Zero and predates it by years. Standard relay attack devices cost less than $100 from electronics vendors and require no technical knowledge to use.

//NFC and RFID

The Flipper reads both the older 125 kHz RFID standard (EM4100, HID Prox) and 13.56 MHz NFC (MIFARE Classic, MIFARE Ultralight, NTAG, and more). The distinction matters: 125 kHz cards contain no cryptography whatsoever. A UID is broadcast in the clear and any reader can capture it. Hotel room keys in older systems, gym access cards, office building badges from the early 2000s - many of these are 125 kHz cards that are trivially cloneable.

MIFARE Classic cards - used in countless building access systems, transit cards, and hotel keys - have a documented cryptographic weakness in the Crypto1 cipher that was published in 2008. The Flipper can perform a nested attack on MIFARE Classic to recover sector keys when it knows one key, which is often the default. This is not a new vulnerability. Tools to exploit it have existed since 2008.

The Hotel Key Problem

The practical implication is this: many hotel room keys use MIFARE Classic. If a Flipper Zero user can access a room once - as a legitimate guest - they can read the card, recover the sector keys, and clone the card. The cloned card would work for the duration of the checkout date encoded on it.

This is a real security issue. It is also a problem that has existed since MIFARE Classic cards were deployed, which predates the Flipper Zero by fifteen years. The solution is upgrading to MIFARE DESFire or MIFARE Plus, which use AES encryption that the Flipper cannot defeat.

//BadUSB - HID Injection

When connected to a computer via USB, the Flipper can identify itself as a USB keyboard rather than a storage device. This is the BadUSB attack: the computer trusts it as a HID (Human Interface Device) and accepts keystrokes from it. The Flipper reads payloads written in Ducky Script - a simple scripting language - and executes them at speeds no human typist can match.

The attack works on fully patched Windows, macOS, and Linux systems because it bypasses all file-based security measures. There is no executable to scan, no process to monitor - just keystrokes. The payload runs in the context of whatever is on screen: typically a command prompt or PowerShell session opened by the payload itself.

Payload complexity ranges from juvenile (open a URL) to serious (download and execute a reverse shell, exfiltrate credentials, create persistence). The Ducky Script community has published thousands of payloads. The Flipper stores them on a microSD card and executes them on demand.

[WARNING]

The effective defense against BadUSB is USB port policy, not antivirus. Most organizations can restrict which device types can connect via Group Policy (Windows) or MDM profiles. This is broadly not implemented because it requires inventory of legitimate HID devices and ongoing enforcement. The attack surface exists on most corporate networks.

//Infrared

The IR transceiver is the least controversial and most immediately useful feature. The Flipper ships with a built-in database of IR codes for major TV brands, air conditioner units, and projector systems. It can also learn new signals from any existing remote within range. IR signals have no authentication - capturing and replaying any command works unconditionally.

Practical use: conference rooms with locked-down AV systems (Flipper learns the projector remote during setup, can control it without the physical remote later), hotel TVs (the universal remote database covers most brands), or simply replacing a battery-dead remote.

Security research use: testing IR-controlled systems for replay attack resilience, which they universally have none of.

//The Community and Custom Firmware

The Flipper Zero's official firmware deliberately limits some features in certain regions - Sub-GHz transmission on frequencies outside licensed bands, for instance. The Unleashed and RogueMaster custom firmware projects remove these limits and add additional protocols, tools, and capabilities. These are the versions most serious users run.

The plugin ecosystem has produced: a spectrum analyzer, a UART terminal, a GPIO logic analyzer, a protocol decoder for hundreds of wireless standards, a POCSAG pager decoder, a WiFi scanner (with the optional WiFi devboard), a metronome, a music player, and a Tamagotchi game. The hardware is capable of significantly more than the stock firmware exposes.

//What the Bans Got Wrong

The Canadian discussion, and subsequent legislative interest in other jurisdictions, focused almost entirely on car theft. The car theft attacks being committed in Canada in 2022-2023 used relay attack devices - typically sourced from organized crime networks - that have no meaningful connection to the Flipper Zero. The relay attack exploits the passive keyless entry systems in modern cars, not the Sub-GHz radio in the Flipper.

Banning the Flipper Zero would not prevent relay attack car theft. It would prevent legitimate security researchers, hardware enthusiasts, and developers from using a tool that is, in most of its applications, less capable than the specialized attack hardware already in circulation. The signal that sends to the security community is that legislators are reacting to aesthetics - the dolphin is cute, the name is provocative, the media coverage was hysterical - rather than technical reality.

The actual security vulnerabilities the Flipper exposes - fixed-code garage remotes, MIFARE Classic access cards, BadUSB attacks, IR-controlled systems - are real. They were real before Flipper Zero existed. The appropriate response is to fix the vulnerabilities, not to restrict access to diagnostic tools.