Flipper Zero: Microsoft Project-Based Learning Program

CCI partnered with Microsoft in a Project-Based Learning Program for an experiential learning experience involving the Flipper Zero, a portable multi-tool device. The project ran from June 3 to Aug. 2, 2024.

About the Flipper Zero

The Flipper Zero is a small hand-held electronic device, an easy-to-use gadget that can capture and replay many over-the-air signals.

For example, the Flipper Zero can analyze and simulate wireless signals, such as Bluetooth, Wi-Fi, and radio frequencies. The device can also:

• Be used as a universal remote control for such devices as televisions, air conditioners, and car locks. 
• Scan and emulate RFID cards used for access control and payment systems.
• Scan for Wi-Fi and Bluetooth signals, which are critical capabilities native to smartphones.

The product has become a popular topic on social media, as posters cite its ability to hack remotes, garage doors, and electronic message boards. 

Some worry that these easy-to-conceal gadgets can find vulnerabilities in nearby electronic devices that either emit or receive Bluetooth, Wi-Fi, or radio frequency signals.

Project Overview 

Students  selected to participate in the project were loaned a Flipper Zero to measure the device’s capabilities to determine how it can be used and if more safeguards are needed. Potential projects could include:

• Determining Flipper Zero's out-of-the-box capabilities. What signals can it natively capture or replay?
• Validating or debunking social media videos on Flipper Zero. Reproduce a video to determine if the device can do what is portrayed or show how the video is inaccurate or false.
• Capturing signals in, around, and near your home. What can you derive from them? Can they be replayed or manipulated for malicious purposes?
• Capturing signals near critical infrastructure locations. Do specific or unique signals appear at locations that are used for public service or safety? Can these signals be replayed or manipulated?
• Studying signals coming from nearby smartphones. What can the Flipper Zero capture, replay, or manipulate? Can the device degrade or disrupt signals as they are being sent or received?

Microsoft provided:

• A Flipper Zero.
• A mentor to direct the student team.
• Access to Microsoft Azure capabilities if students can demonstrate technical competencies to advance the project.
• A project outline.

Benefits to Participants

Students selected for the program:

• Received a stipend of $25 per hour.
• Were mentored by someone from Microsoft.
• Enhanced their soft skills.
• Had the opportunity to network with students, faculty, and Microsoft staffers.

Eligibility 

Students must be enrolled in cyber or cyber-adjacent classes at a college or university within the  CCI network.

They must attest that any research or learning for this project will be used only for ethical purposes, and that no harm will be done to students, CCI, or Microsoft. 

Participants must also:

• Be a U.S. citizen.
• Be enrolled at a Virginia institution of higher education within the CCI network.
• Have completed one year of college/university education.
• Have declared their major in cyber or a cyber-related field.
• Commit to staying in the program from start to finish. 
• Be able to travel to pick up project materials in person prior to the project start on June 3, 2024.
• Students will meet one day a month with Microsoft (meetings will be scheduled in advance and might be in person at Microsoft’s Reston headquarters or via virtual meeting).
• Demonstrate previous or existing interest in cybersecurity (for example, Hack the Box or other online CTF-style activities, has a home lab, cyber club, etc).

Timeline

Students will work on the project from June 3 to Aug. 2, 2024.  The kick-off and any future in-person meetings will be held at Microsoft’s Two Freedom facility in Reston, Va.

Participants must return the device to Microsoft on Aug. 8, 2024.

Requirements

Participants will conduct themselves as professionals, attend all meetings, and participate actively in project-related tasks. 

They must also:

• Work on the program for a minimum of 2 to 4 hours per week. Work will be monitored through a timesheet system.
• Attend the kick-off meeting and all meetings to follow to be successful throughout the project (meetings will be scheduled in advance and might be in person at the Microsoft headquarters in Reston, Va., or via virtual meeting).
• Attend meetings, which  will be held every two weeks from 4 to 5 p.m.
• Attend in-person and/or virtual meetings.
• Participate in project-related tasks.
• Provide their own computers, laptops, etc. 
• Inform their university/college advisor of project participation.
• Provide CCI with their advisor’s name, title, and email.

Reasons for Dismissal

This project presents a professional opportunity for students, who are expected to conduct themselves in a manner befitting a professional environment. Attendance at meetings and active participation in project-related tasks are incumbent upon students, with accountability being a requisite aspect of their responsibilities.

Students could be dismissed for failure to:

• Attend all mandatory meetings.
• Actively participate in project-related tasks.
• Meet participation requirements. 
• Resolve attendance and participation issues. 

Participants’ advisors will be notified once via email if the student is in danger of being released. If a participant is released, they and their advisor will be notified of the dismissal.