The Underground Trade of Car Hacking Tech

0:28This episode is brought to you by Accenture. YubiKeys by Yubico are the original passkeys, small, sturdy, and easy-to-use physical security keys that prevent phishing attacks and account takeovers. Unlike basic multi-factor authentication or MFA methods, such as text message, one-time passcodes, or mobile authenticator apps, YubiKeys provide modern MFA and are a proven security solution that cannot be hacked or bypassed by malicious actors. They safeguard against AI-powered cyberattacks, online identity scams, fraud, and account takeovers. YubiKey's help businesses of all sizes stay ahead of evolving cyber threats and regulatory requirements.

1:06They also protect individuals and everyday users by securing over a thousand accounts, including email, social, password managers, productivity tools, developer tools, and more. For more information on how YubiKey's secure applications, services, and accounts for both individuals and businesses, visit yubico.com slash 404media. And for a limited time, get$10 off your order of exactly two keys from the YubiKey 5 series or Security Key series using the code 404media10 at checkout. YubiKeys are manufactured by Yubico, a company with headquarters and manufacturing centers in Sweden and the United States.

1:46Hello and welcome to the 404 Media podcast, where we bring you unparalleled access in the world, both online and IRL. 404 Media is a journalist founded company and needs your support. To subscribe, go to 404media.co. As well as bonus content every single week, subscribers also get access to additional episodes where we respond to their best comments. Gain access to that content at 404media.co. I'm your host, Joseph. And with me are the 404 Media co-founders, Sam Cole. Hey. Emmanuel Mayberg. Hello. And Jason Kebler. It's sad to do this virtually. yes because of course last week we had our second anniversary party in new york where we well drank and then also recorded a live podcast i can't even remember what we spoke about i think it was mostly q a but yeah it is way easier to do it in person than it is virtually because there's ever so slightly delay whenever you do it like this.

2:52Jason, what did we talk about in New York? It was questions, mostly. We answered questions. We put questions in a jar, or people wrote questions in a jar, and we pulled them out, and we read them. And it was really fun. It went really well. It will be out on the feed in two days, so you can listen to it if you weren't there. Yeah, sounds Sounds good. Sam, what did you make of the party as the person who, thank God, organized the vast, vast majority of it? I had a blast. Yeah, I think listen to the podcast when it comes out on the feed. If you were not able to get into the room because the room itself was so full that people got pushed out of it entirely.

3:37But yeah, it was a really good time. It was great to see everybody. so cool to hear so many people listen to the podcast I always am really excited to hear that so thank you and hello again first ever tech blog podcast mosh pit true Jason crowd surfed a little bit it was good all I can remember is the question about what statue you would be or something and I'm not going to spoil the answer but that's the only one I can remember because I answered it and then Sam immediately took the piss to have my answer you and emmanuel both i want to change my answer though to the carlos atticus laptop statue that just got revealed he's holding a laptop as a saint it's a statue that's dedicated that's beautiful that's my new answer all right well you'll see the episode on your feeds soon and you can listen to the whole uh the whole podcast and whole event then as for this week um emmanuel do you want to introduce this first story yeah i'm taking i'm taking over The first story is from Jill.

4:40The headline is, Inside the Underground Trade of Flipper Zero Tech to Break into Cars. A lot going on there. Let's get into it. The story starts with a description of a video you saw. Tell me about this video. Yeah, so it's first-person perspective, as in clearly this person is holding a mobile phone, I believe in their left hand and then this small white and orange gadget in their right and it has a little screen it has a few buttons like a d-pad and I think some other stuff on the side has some sort of short antenna sticking off as well and this person walks up to a nearby car just looks like some sort of normal sedan vehicle tries to open the door and it's locked They then push some buttons on this little gadget, try to open the car door again, and lo and behold, it now opens.

5:47Of course, this is a demonstration of the tech that we're talking about here. And you may think, well, we've seen car unlocking tech before. What's new about that? And that's totally right. And we will get into that. But it's really about the specific attack involved here, the gadget itself, which we'll definitely talk about, and sort of the proliferation or distribution of this tool, which is if it falls into the wrong hands, it really is threatening to sort of supercharge car thefts around the US, which I don't like to do a prediction. and like i really tried not to it was more the people i spoke to were predicting that would happen um but the writing's on the wall yeah so let's talk about the gadget what is he holding in his hand what is this flipper zero so the flipper zero is a pretty well-known or maybe infamous piece of hacking gear now it came out a few years ago started on kickstarter raised about 5 million, something like that.

6:53And the attraction was that it's basically a Swiss army knife for hackers. So you can imagine physical penetration testers. These are people who, well, we need to check the physical security of a data center, let's say. So we have to keep people out and make sure they can't put USB keys in here and plant malware in the data center, whatever, or corporations as well banks um all sorts of stuff require physical security and digital security at the same time a lot of that involves cloning key cards like rfid key cards or playing around with nfc that protocol as well and what you used to have to do was buy all of these different hacking tools.

7:37Like I've had ones which can clone key cards, that sort of thing. But the Flipper Zero was bringing all of those into this one thing you could just carry in your pockets. You could do those sorts of attacks. You could also do Wi-Fi de-authentication attacks, which if anyone has been to especially DEF CON or maybe CCC in Germany, you've probably seen this where you keep getting kicked off the Wi-Fi or you can't connect to the Wi-Fi because some person is messing around and performing a Wi-Fi attack, this gadget can do that as well. So it can do basically, well, not everything, but a lot of the things a legitimate security researcher or penetration tester would want to do if they're on a deployment.

8:23So it launches on Kickstarter, raised all this money, and now, I mean, it is in mass production. You can go to the Flipper Zero website and you order one of these gadgets, I think for a couple hundred bucks, you get it in the mail. And it's also been... demonized over the past few years because it does crop up into the news every so often sometimes legitimate sometimes in a way that well it didn't really deserve to be pulled into it into whatever story but here this story really is about the flipper zero because it is so accessible it is demonized but can we just spend like a second talking about Flipper Zero's own branding and image.

9:05It is fairly like a feel-good, positive... I don't know if you'd call it white hat. We covered it a lot because I think it launched when we were in Motherboard and would come up and these kind of fun blogs that people were doing fairly innocent, cool things with it. Is it fair to say that their own image that they put out there is fairly, I don't know, posy? Yeah, absolutely. And I think they're very, very smart to do that. The mascot is like this cute dolphin, right? Yeah, I'm looking at it right now. And on the device itself, it has this little screen. And you can see the dolphin. And it almost talks to you.

9:43It looks like a Tamagotchi, like a pretty high-res Tamagotchi in a way. The marketing is cutesy. It's fun. It's experimental. It's playful. And that all makes sense because the Flipper Zero and the community around it can be all of those things, often is all of those things, often is playful, it is about experimenting, and that is the hacker ethos at the end of the day, right, for a hell of a lot of people. It's a, hey, we just want to figure out how stuff works, we want to have fun, but we also want to keep stuff secure, and that's why it's a legitimate security tool. They probably, it'd probably be a very bad idea if they had dark, grisly hacker hoodie marketing, which ironically some of the custom software we'll talk about in a bit actually does have that marketing as well.

10:33But yeah, it's a legitimate security tool, but a dual use security tool. So what's different about this implementation of Flipper Zero? It's the software, right? Yeah, the software and the firmware as well. Firmware just being, you know, basically a piece of software that acts, you know, a little bit lower down in the stack of applications, operating system blah blah blah all of all of that sort of thing so the flipper zero is powerful um as i laid out it can do all these sorts of attacks but some people want it to be able to do more they want to really screw around with people so some have made their own custom firmware for the flipper zero and what i looked at in particular was called unleashed and this just allows you know like more types of attacks and rfid attacks and all of that sort of thing so people because you can basically fully customize the flipper zero and that is part of the appeal people have made them more much more powerful firmware and then you can get more patches uh on top of that as well to do very specific things i'd say so how does this specific attack work and how does it compare to some of the other high-tech carjacking, or not carjacking, car stealing methods that we've seen in the past couple of years?

11:58Yeah, so as well as the custom firmware, people are making these, I mean, I call them patches in the article. I guess you could call it software, you could call it tweaks, you know, scripts. It doesn't super matter. But when you have this custom firmware, where you then make and install and use these custom patches. And what I was shown is that there are a bunch of them going around, which are specifically to unlock and interact with particular vehicles. So, you know, I was sent one for the Kia. I was sent one for the Suzuki. And to step back a little bit, car theft is obviously a problem. on the lower end of the spectrum, you have people like the Kia boys, which maybe we'll go into more detail later, but there's this phenomenon.

12:49It's on TikTok. People steal cars. They drive them around Milwaukee, I think, primarily, just that's where the phenomenon started. And they will smash a window, go in, steal the vehicle because there's very poor security inside the vehicle itself. Okay. Halfway in between, maybe over halfway, you have people using techie gadgets to break into cars. And then in the same sort of area or a little bit further, I think you have people starting to use these flipper zeros. So usually if you're a tech-focused car thief, you'll do something called a relay attack, which is, let's say you want to steal a very nice looking car that sat on a driveway, but the key fob and the owner is in their house.

13:37well you use a couple of devices to basically extend the range of that key fob that sat in a fruit bowl on their kitchen counter or something which usually can't reach the car but now you're using these couple of devices to relay that signal over to the car you activate it you can get in the car and drive away and this has been a huge problem uh in the uk uk police will upload photos of this happening um caught on ring cameras or cctv in the us it's done as well i imagine europe but i can't remember off the top of my head if i've seen the case from europe but that's what usually happens and in response or perhaps in parallel a lot of car manufacturers introduce something else called rolling codes which is well even if someone gets the signal and tries to use it to open the car or whatever, we're going to change the code every single time.

14:33So they can't just relay the signal they get into the car or whatever. It's supposed to be a protection for that. This is very similar to how tickets work now. When we're talking about barcodes to get into concerts, it used to be that there was just one barcode, and then both Ticketmaster and AXS went into something where the barcode refreshes every 10 seconds. right and i feel like it's very similar technology possibly we don't need to get into it but it's very similar because like people figured out how to crack that and then basically they're like well we need to like change this constantly yes so it's yes because you bring that up that they did crack it because that's exactly what's happened with cars as well in that the people i spoke to a couple of hackers they say they've been able to essentially reverse engineer how those rolling codes work by a lot of development, a lot of reverse engineering, and apparently buying source code related to particular vehicles as well.

15:34And what the Flipper Zero custom patches are able to do is basically figure out what the next code is going to be. So they push that and it's like, oh, even though the code has changed, this device knows what it is in advance. And that's sort of what makes us different to previous attacks, Emmanuel, to finally answer your question after several minutes of me going down that rabbit hole. Yeah, I don't know if you know, but shouldn't the rolling code problem you just described be solved by now? Isn't there common forms of encryption and randomly generating numbers that should not allow them to reverse engineer what the next code is?

16:13Are they using really old software to do this? You would think that. And I often think that sort of car manufacturer security is similar almost to like industrial control systems or airplanes sometimes where they just use these very antiquated ways of going about things. And the actual patches I was sent, again, the Kia and the Suzuki, which are not luxury vehicles, obviously. I've spoken to people who've sold tech to break into luxury vehicles specifically. but if you go through those scripts and other screenshots i was sent i was sent it actually shows there was no encryption on those so of course it varies from car model to car brand to manufacturer manufacturer or whatever but the hackers who go by daniel and darrow they have this pdf which is a couple of pages but it has like 200 different models of vehicle and maybe um a dozen or so brands overall, you know, not just the Kias and the Suzuki's, but I think there's Ford on there, Fiat as well.

17:25I'm bringing up now Skoda, Citroen, Peugeot, Mitsubishi, Honda is in development. So whereas the Kia boys were obviously targeting Kias, and I think Hyundai is as well, because the security was crap. This seems to be a potentially bigger issue because it's unlocking all of these other cars which which have presumably better security one of your sources mentioned the kia boys as well why is that so my uh source one of the people i spoke to who's sort of in this community and they were the one that was actually reverse engineering some of these patches they mentioned the kia boys because they think that eventually they will become flipper boys.

18:09Again, Kia boys, they break into Kias and Hyundai's rare, rare low tech. For a long time, you've been able to get phone unlocking, sorry, not phone unlocking, car unlocking technology, but it's been pretty expensive. You try to go buy one of these online, and if you don't get scammed, which I think could be a big thing, it's going to cost you potentially thousands of euros or dollars to buy a device like this, like a code grabber or a relay attack tool or something like that, what the Flipper Zero potentially could do here is that, well, it's just 200 bucks. So somebody with not as much money to spend, but who still wants to mess around with cars, like the Kia boys, could potentially get a Flipper Zero and mess around with it that way.

18:58And I should just say that Straight Arrow News covered this particular attack before. They tested it out and they verified it worked on a vehicle, which is very interesting. And that made my job a little bit easier with this article. But this was focused much more on the trade, which is that you go to Daniel or Dero, the two hackers who are selling this tech, one for Flipper Zero, one for a Raspberry Pi, and you have to pay them between$600 and$1 ,000. So still an investment. you know people i spoke to that software is leaking out they're reverse engineering it so you don't have to pay the money anymore and there's this looming threat well maybe it's going to leak and it was sent to me so clearly it is leaking i'm not going to post it online so then everybody can just unlock cars that would be an insane thing for a journalist to do but i wouldn't be surprised if this trickles out very very soon and that is why it could apply to communities like the Kia Boys, for example.

19:55Because they might get hold of it eventually. In case it wasn't clear, at the moment, the software is fairly exclusive, both in the price and just who has access to it. But it's software. It is not hard to imagine that it leaks and becomes more widespread. Finally, you mentioned that Flipper Zero, for good reason, I think is let's say aggressive in explaining what its technology does and defending its brand. So I'm not super surprised about their reaction to the article, but I thought the article was very clear and very fair about what the Flipper Zero's role in it is. And yet they had a pretty wild response to the article.

20:47You want to talk about that? Yeah. Yeah. So initially, when I'm reporting and writing the article, I asked Flipper Zero for comment. I actually explained to them in my email saying, because I wanted to make it clear to them, I'm not a random journalist covering this. I've been covering hacking and cybersecurity for like 10 years. And I said, I understand that this tool, this is not what the Flipper Zero is designed for. It's for legitimate security researchers. I already know all of that context. So basically, as a wink-wink to them. You don't need to patronize me by telling me that sort of thing.

21:22They then gave a very, very thoughtful statement, which reiterated, yes, it's a dual-use technology, it's used by security researchers, but they very rightfully said that this is much more about the car manufacturers and their poor security. And I totally agree with that. We published a story, a few outlets aggregated, you know, Gizmodo and that sort of thing, the sort of other sort of technology websites that would cover a sort of car hacking thing. And then Flipper Zero comes out, which with a pretty, well, I mean, you said it's expected, I guess I'll say unusual blog post and they have the headline, can Flipper Zero really steal your car?

22:05Spoiler, no it can't and then they do like a mocking tweet the media is talking about how flipper zeroes on the dark web can break into like really sarcastic and over the top there's an image of their you know mascot dolphin pulling a hacker and a guy fox mask out of the garbage and I was like is that Joe is that Joe supposed to be in an image but no I guess it's like the hacker and there's people in cars around it looking angry um yeah but then yeah so so there's the sarcasm and like the defensiveness which is okay i don't know for the article is pretty fair i thought your statement was great and then they go through some technical stuff which they say it relates to certain vulnerabilities but my understanding is that it relates to actually to a different word it relates to the rolling codes and they don't seem to fully understand it relates to rolling codes essentially without getting too technical so i don't know it seems very defensive uh about it and i can again i kind of get why like the canadian government tried to ban the flipper zeros before like they've had to deal with some very very crazy stuff but hey this is a legitimate concern now because criminal hackers are making this for the flipper zero and i'm afraid that's just a fact yeah i i wanted to talk about this because i don't know i just think about this stuff a lot like i really really think about how our work is perceived and also how we are in this mess, this mess being a total collapse of trust in the media and that sort of thing.

23:38And it's stuff like this. It's like this is a really bad blog post by them. It's very damaging because they're a very popular product, as we've just discussed. And there are a lot of people who have no idea how journalism works. They have no idea how the information ecosystem works, etc. And this blog post is very much in the vein of fake news. This has nothing to do with us. This is totally wrong. And you multiply that across the entire... Every politician has been doing this for many years. Lots of companies have been doing this for years. Anytime that there's any negative coverage of anything, the sort of gut reaction is like, this isn't our fault.

24:30This is like journalists sensationalizing something. And it's like, this was a very thoughtful article that was very clear about the issue. It's a very serious issue. And it's like, I think Flipper Zero is very cool. Like, I have long thought that this is a very cool company. I've long thought that this is like a very cool device that's being used for like really interesting security research. I still believe that, but it is like really disappointing to see a response like this because the response is one that is like, it's just not in good faith. It's like not, it's not a good response and it's very disappointing.

25:12Like I think it's fucked up and I don't know, like maybe I'll see Flipper Zero representative at some hacking conference at some point. And they'll be like, why did you say something mean on the podcast? But it's like, this is super damaging. Like it's really damaging to trust in journalism, to trust in this sort of thing. And I understand that there are politicians who like blow stuff out of proportion and that are trying to ban them. And that like they really want to make sure that their product is seen as something that is like a force of good and a force of research and a force of STEM tools and teaching kids about stuff like this.

25:50And it's like, yes, these car manufacturers used bad security for their key fobs a long time ago. But this is a factual article that describes something that is happening. You can't just stick your fingers in your ears and close your eyes and be like, blah, blah, blah, this is old, this is not happening, because it is happening. It's a really disappointing response. Yeah, I agree. Especially, as you say, they are a legitimate actor in this space and they do really good stuff. Then to have a response that isn't in good faith kind of just undermines it all. Before we move on, to tease it somewhat, our next story is about nostalgia.

26:31And when I think about the Flipper Zero, I always think about this Casio watch that I just posted in Slack. Did you guys have this? Did you have a naughty kid in school that ever used one of these? the calculator watch the calculator watch no not the calculator it's like it can copy the whatever the RF signal of a remote oh it's the TV remote watch yeah so there was always a kid in class who could like turn off the TV if we were watching something or like turn off the air conditioner it always reminds me of the flipper zero it's a proto flipper zero yeah definitely the same sort of vibe we still get these just wear them they're cool Well, since you teased the article, Emmanuel, I'll just take us to the next one.

27:17When we do come back, it is about nostalgia, specifically the 80s, and of course, AI slop. We'll be right back after this.

27:38How many SaaS applications are being used at your company right now? If you can't keep count, you're not alone. Trellica by 1Password helps you discover and secure access to all your SaaS apps, even unmanaged shadow IT. I've been using 1Password products for years and have been thrilled with how easy they brought better security into my life. Trellica by 1Password inventories every app in use at your company. Then, pre-populated app profiles assess SaaS risks, letting you manage access, optimize spend, and enforce security best practices across every app your employees use. Manage shadow IT, securely onboard and off-board employees, and meet compliance goals.

28:18Trellica by 1Password provides a complete solution for SaaS access governance, and it's just one of the ways that extended access management helps teams strengthen compliance and security. I switched to 1Password about a year ago, which I'd been putting off for a while because I thought migrating would be a pain. I couldn't believe how easy it was to switch and how quickly I become used to using 1Password in all my browsers, apps, and devices. It's made my life so much easier. 1Password's award-winning password manager is trusted by millions of users and over 150 ,000 businesses, from IBM to Slack.

28:53And now they're securing more than just passwords with 1Password Extended Access Management. Plus, 1Password is ISO 27001 certified with regular third-party audits and the industry's largest bug bounty. 1Password exceeds the standards set by various authorities and is a leader in security. Take the first step to better security for your team by securing credentials and protecting every application, even unmanaged shadow IT. Learn more at 1Password.com slash 404. That's 1Password.com slash 404, all lowercase. In cybersecurity, speed is everything. Breaches often start with a single exposure. An open cloud bucket, a forgotten subdomain, an API spun up without your knowledge.

29:39And the real question is, who finds it first? You or an attacker? Enter Intruder, the exposure management platform built to keep lean engineering and security teams ahead of breaches and a fast-moving threat landscape by unifying vulnerability management, attack surface discovery, and cloud security. Intruder protects your entire infrastructure, from endpoints and edge networks to web apps and APIs. finding exposures beyond CVEs, including over a thousand attack surface issues other platforms miss. And it's always on, so you don't have to lose sleep wondering if you're exposed. When a new critical vulnerability drops, Intruder checks your systems within hours.

30:19It also keeps constant watch on your network, so you know the instant a port opens or a new service goes online. The platform also runs daily scans to catch misconfigurations in cloud accounts before they become a problem. Intruder puts an end to alert fatigue. It prioritizes what's most urgent using exploit likelihood and real-world threat intelligence with easy-to-follow remediation advice for fixing issues fast. Your embedded AI security analyst, Greg, saves you time at all stages of your security workflows, whether you need instant remediation help or to validate false positives. Stop breaches before they start with Intruder.

30:56Plans start at just$99 per month. start your free trial and get 20 off your first three months at intruder.io slash 404 media that's intruder.io slash 404 media

31:20all right and we are back this is one that jason wrote and i believe with matthew galt as well Yes, I opened the link to check that. The headline is, 80s nostalgia AI slop is boomifying the masses for a past that never existed. So, Jason... Stranger Things-ass videos, AI videos. Right. What is the latest AI slop then? What is this meta that we're seeing now? It's interesting because these are not new. People have been making these for a few years. It's just that they've caught on recently because, I don't know, they've hit the algo in a certain way. But basically, it's like, imagine you're watching Stranger Things or The Goonies or something like this.

32:07It's like very prototypical, like 80s TV shows slash movies, like teen after school special vibes. And so they start basically with like, have you heard what's going on in 2025? Like they have, they're always scrolling through their phones and they have this thing called Instagram and it makes people upset. And they're like, wouldn't you love to go back to 1985, you know, where we drink Coca-Cola and have a nice time out of glass bottles. And I don't know. It's just like, it's nostalgia porn. It's like, you can imagine it. Maybe we'll play a little clip here. You made it back. How's 2025? I heard no one talks face to face anymore and everything's lived through something called social media.