Authorized security research: test the claim
Study how replay, credential copying, relay, and interference attacks differ, then test one bounded security claim on a training system.
Understand it
Separate the attacker’s capabilities
Replay repeats an observed message. A simple fixed-code receiver may accept it because the message has no freshness check. A changing encrypted counter or a fresh challenge can let a receiver reject old messages. Encryption alone does not automatically provide freshness.
Credential copying reproduces the data a reader relies on. A UID-only training reader may accept two devices with the same ID. A cryptographic card-reader exchange can require a secret that a UID read does not reveal. “NFC,” “RFID,” and “encrypted” are categories, not verdicts about security.
Relay forwards a live exchange between legitimate endpoints. It differs from replay because the forwarded response may be fresh. Authentication that proves possession of a key does not necessarily prove physical distance; timing and proximity defenses address a different property.
Interference-assisted capture attempts to prevent a legitimate receiver accepting a message while an adversary records it. That changes whether a captured value is still fresh. Jamming also disrupts other users of the spectrum: owning the test receiver does not provide a general right to jam. Study this mechanism in the browser model; over-the-air interference needs a separately assessed, legally compliant RF test facility.
Input injection abuses a trusted input path, such as USB HID. The text-only lab in Module 13 demonstrates the trust boundary without a destructive payload. Fuzzing feeds varied or malformed inputs to find incorrect handling; start with an offline parser or a disposable app you wrote.
What the Flipper actually establishes
A protocol name is a decoder result. A read UID is an identifier. An accepted replay is evidence about that receiver, configuration, and message. None of these alone proves that an entire product family is compromised. The rolling-code simulator omits real cryptography and vendor-specific recovery logic; use it to test freshness reasoning, not to claim an exploit against a manufacturer.
Lab: build the evidence
-
Write the claim: “My isolated, fixed-code training receiver accepts a repeated authorized command” or “My UID-only bench reader treats a copied training ID as the same tag.” Define the target, permission, permitted action, and recovery first.
-
For RF, complete the Romanian radio checks and use a non-security device such as a lab chime. For the tag experiment, use unenrolled practice tags and a standalone reader with no building connection. If you lack that setup, use the synthetic rolling-code simulator and label the result simulated.
-
Establish a positive control using the original remote or tag. Record the expected harmless outcome and the receiver configuration.
-
Follow Module 4’s fixed-code replay or Module 6’s training-tag write/emulate procedure once. Record whether the reader accepts the replayed message or copied identifier.
-
Use a negative control: a different unenrolled training tag, or a non-matching saved button on the same lab remote. Avoid guessing live credentials or cycling through code spaces. A rejected control makes the acceptance result easier to interpret.
-
Compare your finding with the rolling-code model: accept a fresh value, then replay the consumed value. Explain what freshness adds and why adding encryption without replay protection is a different claim.
-
Write a mitigation recommendation tied to your result, such as authenticated messages with freshness checks or a supported cryptographic credential system. Remove test enrollments and restore the lab configuration.
Show that you can do it
- A threat model identifying access, capability, target, and security property.
- A positive control, a bounded test, and a negative control on authorized equipment or an explicitly labelled simulation.
- A precise finding, alternative explanations, mitigation, and cleanup record.
Record the result in your learning notebook. Repeat the explanation tomorrow without looking at this page.
Check yourself
Sources
Read the primary sources: Flipper: static and dynamic protocol support · Microchip HCS301: synchronization model (PDF) · Flipper: LF RFID · Flipper: NFC · Flipper: USB and BLE keyboard emulation. Course review: 10 September 2026.