08Sep
When a palm-sized “hacker multi-tool” called the Flipper Zero went viral on TikTok and YouTube, most clips showed harmless pranks: opening garage doors, spamming Bluetooth pop-ups, or ejecting Tesla charge ports.
Now, a swelling body of reporting points to something far more serious: criminals advertising custom Flipper Zero firmware that can unlock—and in some cases start—mainstream cars from Ford, Volkswagen, Audi, Hyundai, Kia and others.
It’s a combustible mix of hype, real vulnerabilities, and a global car-theft wave that has regulators, automakers, and security researchers arguing over a basic question: is the Flipper Zero the problem, or a symptom of problems in the cars themselves?
What kicked this off
Gizmodo first pulled the threads together after 404 Media reported that underground developers are selling Flipper Zero “car unlock” packages for hundreds of dollars, complete with a PDF listing targeted makes and models and whether the hack enables only door unlocks or full start/drive.
The sellers have pushed slick demo videos across multiple social accounts showing a Flipper seemingly opening different cars; independent reporters say many of those clips appear to be the same video reposted or lightly edited—a classic tell of gray-market software marketing.
Gizmodo says it reviewed the sellers’ materials and saw brand lists and RFID details; it also found the same videos popping up in multiple places. The Verge corroborated core details: the “packages” are tied to custom (and sometimes cracked) Flipper firmware that targets weaknesses in specific keyless entry systems.
Prices reportedly range from roughly $600 to $1,000, and some copies are circulating more widely. While the current crop of tools most reliably unlocks doors, the fear is obvious: once a thief can open a car and access its CAN wiring or diagnostic port, full theft is a short step away.
The company line—and its limits
Flipper Devices, the maker of Flipper Zero, flatly denies that its official product is a turnkey car-theft gadget. In a blog post responding to the new wave of stories, the company argues that Flipper Zero lacks the hardware to perform the “relay attacks” used against rolling-code fobs, can’t magically decrypt modern crypto, and is mostly useful for auditing low-security systems (think older fixed-code remotes, unprotected 125 kHz access cards, and hobbyist RF gadgets).
Crucially, the company says it has not seen verified police reports of car thefts executed with Flipper Zero alone. On the broader policy front, this position has sometimes prevailed. After Canada’s government floated banning Flipper Zero and similar signal-cloning devices amid a surge in auto thefts, the country walked it back a month later—vowing instead to target “illegitimate use” rather than banning the tool outright.
The move echoed civil-liberties warnings that banning research tools can backfire by chilling the very testing that forces manufacturers to fix their security.
Why the claims are plausible anyway
Even if the stock Flipper doesn’t defeat modern rolling-code systems, add-on firmware and modules can change its capabilities, and not all cars implement secure protocols consistently.
Law-enforcement and cybersecurity agencies have been warning for years that Flipper-class devices can replay static RF codes and clone older low-frequency badges. In New Jersey, a state intelligence bulletin documented a student cloning a teacher’s RFID badge with a Flipper to open school doors—an access-control failure, not a car theft, but a vivid example of how weakly protected systems crumble when a cheap, portable tester goes mainstream.
Meanwhile, car thieves have already normalized other wireless attacks that don’t require a Flipper at all. “Relay” kits boost the signal of a key fob inside a house to trick a car into unlocking and starting; “emulator” boxes sold in Europe (some disguised as a Game Boy) emulate expected key-fob handshakes to unlock and start certain EVs.
Hyundai recently offered UK Ioniq 5 owners a paid security update to blunt one such “Game Boy-like” tool—an implicit admission that the vulnerability sits in the vehicle’s system, not in any one hacker widget.
What the underground sellers claim—and what we actually know
The shadowy vendors at the center of the new reports claim their Flipper firmware targets specific radio protocols used in certain keyless entry systems and can:
- Unlock doors on a list of makes and models (precise success rates are unclear).
- Sometimes start or drive specific vehicles, depending on brand/implementation (again, unclear and unverified in many cases).
- Be paired with other tools for more reliable starts (for example, accessing CAN wiring once inside the car).
Reporters who’ve interacted with these sellers say the code is offered via private channels, sometimes with “cracked” versions escaping into the wild.
But the demo ecosystem—reused clips, multiple accounts posting identical footage—makes independent verification difficult. At minimum, the marketing shows a strong intent to monetize vulnerabilities; at worst, it’s a prelude to broader distribution.
The technical backdrop: rolling codes, relays, and CAN-injection
To unpack the claims, it helps to separate three attack families:
- Fixed-code replay (RF remotes, some older fobs): If a remote sends the same code every time, any SDR-class device (including a Flipper) can capture and replay it. Many garage doors and legacy systems remain vulnerable; cars shouldn’t be, but exceptions and misconfigurations exist.
- Rolling-code systems (modern fobs): Properly implemented, a fob and car advance a synchronized counter; captured codes become useless. Defeating this typically requires either a relay (extending the real fob’s signal live) or cryptographic breaks/logic flaws. Flipper’s maker stresses its stock hardware cannot act as a live relay; the underground firmware claims to exploit edge cases where the vehicle’s implementation is weak.
- Inside-the-car attacks (CAN-injection): Once a thief gets into the cabin, they can attach to exposed wiring (sometimes reachable through headlight or bumper gaps) and inject messages on the car’s CAN bus to unlock/start—an attack widely documented in Europe and independent of Flipper Zero.
Put bluntly: if custom firmware helps a Flipper unlock a door—even intermittently—that’s often enough to enable the well-trodden CAN/OBD step that follows.
Automakers’ response: a patchwork
Public statements remain cautious. Many brands simply refer to “organized crime” using “electronic devices,” a category broad enough to include game-boy emulators, relay kits, and now Flipper-based tools.
Hyundai’s UK move—charging owners £49 ($67, approx.) for an anti-emulator update—sparked consumer ire and litigation talk; UK media tracked a string of Ioniq 5 thefts attributed to emulator boxes. Whether the same weaknesses exist across North America varies by market and model year, making this a messy, brand-specific landscape.
Regulators, for their part, have oscillated between condemning “hacking devices” and acknowledging that insecure vehicles are the root cause. Canada’s pivot from a device ban to punishing illicit use was notable, as it signaled a shift toward outcome-based enforcement (arrest the thieves) rather than tool bans that may hamper researchers.
Civil-liberties groups like the EFF have long argued a ban-first instinct criminalizes security work without fixing weak products.
Where the evidence is strongest—and where it isn’t
Strongest evidence:
- Underground marketing exists for Flipper-based car unlock firmware, with demo videos and brand lists, and some cracked copies are circulating. Multiple reputable outlets have reviewed these materials first-hand.
- Real-world misuse of Flipper-class tools against weak systems (RFID access, basic RF locks) is well documented by state cybersecurity orgs and incident bulletins.
- Automaker vulnerabilities to wireless tools (not necessarily Flipper) are documented and have prompted paid or optional mitigations, particularly in the UK and EU.
Weakest evidence:
- Verified, police-attributed car thefts using a Flipper alone. Flipper Devices says it hasn’t seen such reports; independent outlets have not published case-study police files naming the tool as the primary means of theft. (This doesn’t mean it hasn’t happened; it means the evidentiary chain isn’t public.)
Why this matters now
Organized auto theft is rising in multiple markets, and the barrier to entry for wireless exploitation is falling. A decade ago, practical attacks required expensive SDRs and deep RF skills; today, a motivated buyer can get a $200 pocket tool and a step-by-step “package”—or, for more advanced attacks, spend five figures on a turnkey emulator box with a touch screen.
If even a fraction of the cars on the road use insecure or misconfigured keyless protocols, the economics tilt rapidly in thieves’ favor.
The social-media feedback loop makes it worse. Sellers of gray-market tools rely on viral video proof to gin up demand; platforms amplify the clips; journalists and researchers then chase down what’s real and what’s marketing smoke. In that vacuum, consumers are left guessing whether their specific car is at risk.
What owners can realistically do (for now)
- Use “double-lock” or “deadlock” modes (where available) and disable passive entry in settings if your car supports it; this prevents the car from waking for a hands-free handshake, which many emulator devices exploit. (Check your owner’s manual.)
- RF-protect key fobs at home (Faraday pouches/boxes) to blunt basic relay attacks; keep the spare far from doors/windows.
- Layer visible deterrents (steering-wheel locks, driveway posts) with hidden ones (aftermarket immobilizers, OBD port locks) so an unlocked door doesn’t equal a stolen car.
- Update vehicle software promptly; if your brand offers an anti-theft update—even a paid one—consider it until regulators force broader recalls.
These steps won’t make an insecure protocol magically secure, but they raise time and noise for thieves while the industry plays catch-up.
What needs to happen next
Automakers should publish candid security advisories naming affected model years and regions, push over-the-air mitigations where possible, and recall hardware when not. “Security through obscurity”—hoping thieves don’t figure it out—is a failed strategy in 2025.
Regulators should mandate minimum standards for keyless systems (robust rolling codes, relay-attack mitigations, tamper-resistant CAN access), require transparent vulnerability reporting, and stopgap owner communications. Canada’s decision to punish unlawful use rather than ban research tools is a better long-term path, paired with industry accountability.
Platforms need to rapidly label or downrank “how-to theft” content while preserving room for legitimate disclosure. The line can be fine, but monetized criminal marketing—especially reused demo clips tied to paid firmware—isn’t ambiguous.
Security researchers should keep testing, documenting, and disclosing responsibly. The Flipper Zero has legitimate uses—from RF protocol development to penetration testing—that help surface flaws before criminals scale them. Banning the flashlight because thieves use light won’t stop burglary; fixing the locks will.
Bottom line
The latest wave of Flipper Zero “car unlock” claims is not pure hype—but it’s also not proof that a $200 toy has magically broken modern automotive cryptography. What it does prove is more familiar and more urgent: too many vehicles on the road still rely on keyless systems that can be fooled, relayed, or emulated; once a thief is inside, well-known CAN/OBD techniques finish the job.
The Flipper Zero is best understood as a catalyst—a cheap, ubiquitous platform that amplifies the consequences of weak designs. Unless automakers harden those systems and communicate honestly with owners, the underground will keep selling—and polishing—the next “one-click” unlock.
This article avoids operational details that would facilitate wrongdoing. If you believe your vehicle is affected, contact your dealer for security updates and consider the interim owner steps above while monitoring official advisories.
Comments