Canada to Restrict Flipper Zero Sales To "Legitimate Actors Only"
Many media sources have reported that Canada is working to restrict Flipper Zero, and the Canadian government confirmed to IPVM that it is planning to restrict sales to "legitimate actors only."
In this report, we share Canada's response to IPVM and examine the impact of the planned restrictions.
For background, see:
- How Flipper Zero Can And Cannot Hack or Harm Cars
- Flipper Zero Access Control Hacking Tested
- How Flipper Zero Increases The Risks Of Access Control Hacks
- The Booming Business Of Flipper Zero
- The Case For and Against Banning Flipper Zero Analyzed
Executive *******
******'* ******* ************ ** ******* **** could ****** *** ** ** ******** taking ******. *** ** *** *** yet ********* **** ** ***** ** do **, *** ** ******* *** Border ********** *** ***** **,*** ******** in ******* **** *** **** ******** in ******** **** ******** ***** *** ** ************ *** already *****.
*** ******** ************ **** ****** * "car ***** ******" ** ******. ** response ** ** **** *******, *** government ********* **** "** ****** **** [for *** ************]... **** ** ******** this ******," *** **** "*** ****** is ** **** ******* **** ******** to ******** *** *** ** **** devices ** ********** ****** ****, ***therefore *** ***********, **********, ****, *** *** ** ************ ****** **** ** ******" [emphasis added]. Flipper COO Alex Kulagin said in a statement that "Flipper Zero can’t be used to hijack any car, specifically the ones produced after the 1990s, since their security systems have rolling codes."
********* ******** ********* **** ******** *** facilitate *** ***** ** ************* ** attacks **** ********, ***** ********** *** easily ********** ********. **** ****** ******** are *********** ** **** *******, ***** involve ******** ******* **** ***** ******* to ********* *** **** * ***'* key *** ******.
**** ******* **** ****** **** ******* consumers, *********, *** ********* ** ****** licenses ** ******* ***** ******* ********* before **** *** ****, ***, ** import ********. **** **** ****** ***** consumers ** ******** ** *** ******** for ********** ********, *** ************* ***** Flipper ****'* ******** ** ****** ** creating *********** ******** ** ********.
Flipper **** **** ***** ** ****, ***** ************
******* ******** ***** ** ****** ** ****, **** * ******* ** ****** showing ******** ***** **** *** ******* purposes, ********* ******* *** ********* ********. A ****** ** *** ****** **** staged *** *** *** ********** ******* Flippers' ************, ***, ** ** ******* below, ******** *** ****** **** ********** car *****.
******* ***** ****** ** **** *** 2023. *** ***** ****** ** ******* sold ***~***,*** ** ******* ****, **** ~***,*** ** ***** ***** coming ******* **** **** *** ******* 2023.
*********** *** ************, ********* ***** ********* illicit ***, **** ******. ** ******* 2022,** ******* *** ****** ********** (***) confiscated **,*** ********, ****** **** *** *** ******** disclose *** **** *** **. ** March ****,******, ******'* ********** ** *** ** Federal ************** ********** (***), ***** ************ the *******, ****** ******** ***** ** **** for ******** **********. ** ***** ****,****** ******* ******* ********, ****** **** ******** *** ********'* card ******** ********.
Canada ********* ******* ************, ***** *** ***** ********
****** *** *** ****** *** ****, with *** ******* ********** ********** ** February *, ****, **** ** ***** to ******** *** *** ** ********. The ***** ** ** ********' **** in ************ *** *****.
*** ***** *** ****** * ***** political ***** ** ******, **** ******* news ************** *** ********* * "*** ***** crisis"*** ***** ******** ****** *******'* **************** ***** **** **** *********. ** *******, ******'* ******* ****, car ************** ** ~**% **** **** ** 2022, *** ** ** ********** ~**% from **** ** ****. ** ******, ******'* *******,*** ***** ********* ** ~**% **** 2022 ** ****.
****** ******* ***** *** ******, *** government ****** * "******** ****** ** ********** **** *****" ** ******** *, ****.
**. *********** ** *** ******* *******(*** *****) **** ****** ***** ** restrict "************* ********** ******* **** **** it ******... ** **** *** *** fobs":
**’* ****** *** **** *** ********* to ***sophisticated ********** ******* **** **** ** ******, *** *******, ** **** *** *** ****. It’s unacceptable that it’s possible to buy tools that help with car theft on the large online platforms. I can assure you that Minister [François-Philippe] Champagne is trying ***** *** ** ******* ***** ***** *** ***** *** ** ******** *****. [emphasis added; some excerpts translated from French]
****ç***-******** *********, ******'* ******** ** **********, Science *** ******** (****),********* ** * **** ** *(******** *******) **** *** ************ ***** extend ** ********:
*********, ***** ** *** ******* ** ****** Safety ******(**** ** *** **'* ***) **** that ****** ** "*****[***] *** ******* to *** *******... **** ** *** Flipper ****":
**** ****pursue *** ******* ** *** ******* **** ** ***** ******** ** ******* *** ******** ******* *** ****** ******* *****, **** ** *** ******* ****, which would allow for the removal of those devices from the Canadian marketplace through collaboration with law enforcement agencies.
Government ******** ** ****
****** ****** ****** *** **** ****** both ********* ** **** *********.
****** ****** ****** **** **** "** action **** [*** *** ************]... **** be ******** **** ******":
*** ********** ** ****** ** ******** all ******* ** *** ******* **** to ***** ******** ** ******* *** wireless ******* *** ****** ******* ***** which ***** ***** *** *** ******* of ***** ******* **** *** ******** marketplace ******* ************* **** *** *********** agencies.
*********’* ******** ****** ** ********** **** Theft ******* ******** **********, *********** *** municipal ********** *********, ******** ******* *** law *********** *************** **** ****** *** country ** ******* *** ***** *** scale ** *** **** ***** ***** in ****** *** *********** ** **** to ******* **. ************ ******** * Statement ** ******, ********** ** **** together ** ****** **** *****,and ** ********** ** ****** **** that **** ** ******** **** ******. [emphasis added]
**** ****** **** **** "*** ****** is ** **** ******* **** ******** to ******** *** *** ** **** devices ** ********** ****** ****, *** therefore *** ***********, **********, ****, *** use ** ************ ****** **** ** banned":
*** ******** ** **********, ******* *** Industry *** ********* *** ********* ** ban *** ************ *** ** ******** devices **** ****** *** ******. *** intent ** ** **** ******* **** measures **restrict *** *** ** **** ******* ** ********** ****** ****, *** ********* *** ***********, **********, ****, *** *** ** ************ ****** **** ** ******. Innovation, Science and Economic Development Canada is already working with Canadian companies, online retailers and the automotive industry to address this issue and will be announcing its specific plans in the near future. [emphasis added]
Restrictions *******
*** ********* **** **** ****** ********* that ****** **** *** **** *** a ******* ***, ******* **** *** "legitimate" ****** ** ***** ********/**** ********. We ********** **** ****** **** ******* retailers, *********, *** ********* ** ****** licenses ** ******* ***** ***** ** vetting ********* ** ***, ****, ***, or ****** ********. ***** ** ********* for ****, ** *** ****** ********* firearm *****: **** ******** *** ******** banned ** ******, *** ****** (**** certain ******** *** ******) *** **** restricted *** *********** *** ******** **** if ********** * ***************** ****** ********. ****** ***** ********* ******* ******** for *********** ****** ** ********, ****, or ****** ********.
***** *** * ******* ** ********** uses *** ********, *** *** ******* are ******** ** ******* ***** ** helping **** ******* ******* *** *********. As *** *** ****** ************* & Communications *********** ******** ** * ******* **** ********, ********:
*** ** **** ** * ********, legitimate, *** ********** *** *** ********** and ******* ***** ** ***** *****, access, *** ******* ******* *** *********.
****** *** ************ ******** ****** ** not ******** ** ** * ******* ban, **** ******** **** ** **** nonetheless ************* ******** ******* ****'* ******** operations *** ********. **** ********* **** Flippers ** * *** *** - something **** *** ******* *** ** the ******** *** *** ** ******** with *** ***** **** ***** *******. Many **** ****** ****** **** ******* to ****** * ******* ** ** through **** ***** **** ** ******* process ** ****** *** ***** *** hassle. ********* ** *** ******* *** requirements ***, *** ************ *****, ** practice, **** * ******* ****** ** a ***. **** ** ********** **** because ************** **** *** ******* ***** to ******* ******* ************ (****** **** firearms), ******* **** **** ********* *** regulators **** ****** **** *********** *** face **********.
Flipper **** *******
******* **** *** **** ******* ********* to * ******* *** *******, ****** that ******** "***'* ** **** ** hijack *** ***, ************ *** **** produced ***** *** *****":
******* ****can’t ** **** ** ****** *** ***, ************ *** **** ******** ***** *** *****,since ***** ******** ******* **** ******* *****. Also, it’d require actively blocking the signal from the owner to catch the original signal, which Flipper Zero’s hardware is incapable of doing. Flipper Zero is intended for security testing and development and we have taken necessary precautions to ensure the device can’t be used for nefarious purposes. [emphasis added]
How ******** *** ********** *** *****
*** ********* ******** ********* **** ******** can ****** ********** ***** *** ******** "produced ***** *** *****," *** **** Flippers *** *********** ** ******* **** "bloc[k]" *** "*****" ******* **** *** fobs. ****** **** ************* ** ******* in ******** ********, ** ** ***** easy *** ***** ** ******** ********** firmware ******* ** ***** **.
******** ***, *** ********, *********** ** RollJam *******. ******** *** ******* *** communication ******* * ***'* *** *** and *** ******* ** ******** **** / ****** *******. ****, ******* ** tandem **** * ****** ******* ** with * ****** **** *******, * ******** *** ****** *** duplicate * ****** ****** **** *** key ***, ***** ** ** ********* gain ****** ** * *******.
*** **** ******** ***********, *** **** testing:*** ******* **** *** *** ****** Hack ** **** ****.
US ************
*** ** ********** *** *** *** announced *** ***** ** ******** ********. Canada's ******** ***** ****** ******* *************.
****** ** *** ** *** **'* closest ******** *** ******, *** *** actions ***** ** *** ** *** two ********* *** ***** ********* ******** and ******** ******** ** *** *****. The ********** ******** *** ******** ********** of *** *.*. *** ****** **** that ******'* ******** ***** ****** *** U.S. ** ******** ******* ******* ** align ******** ********* *** ******* ******* shared ***** *******.