Jamming, Relays and the Flipper Zero

Are you being blinded, or deceived ?

A jammed radio band and a broken receiver look identical from the inside. Distinguishing them is the hardest problem in radio-based access control — and it is why our system treats silence as a refusal rather than a permission.

Third of four articles on radio detection in industrial environments. The first two covered what you can hear. This one covers what happens when someone does not want you to hear it, or wants you to hear the wrong thing.

Series "Radio detection in a workshop", 3 of 4

1. Who is in the room?

2. Wideband listening: what an SDR effector finds

3. Jamming, relays and the Flipper Zero ← you are here

4. Is radio monitoring in a workplace legal?

Three families of jamming

Wideband noise. Transmit power across the whole band, continuously. Simple, effective, and perfectly visible to anyone looking.

Reactive jamming. The transmitter listens and only emits when it detects the start of a legitimate frame, just enough to corrupt it. Far more discreet, because the noise floor stays entirely normal.

Protocol jamming. No noise at all — just valid frames. Forced Wi-Fi disconnects, for example. Nothing abnormal at radio level; everything abnormal at logical level.

Any detection strategy that only looks for the first family will miss the other two, which is most of what gets deployed.

The giveaways

None is decisive alone. It is their conjunction that makes a signal.

A noise floor rising with no decodable traffic. The classic signature: plenty of energy received, no valid packets. Something is transmitting that does not speak our language.

An exploding integrity-check failure rate. Packets arrive but their checksums fail — they are being corrupted in flight. This is the signature of reactive jamming, and the noise floor does not show it.

Channel occupancy departing from baseline. Every room has its own occupancy signature, learned during the observation phase. A marked departure from that reference says more than any absolute threshold, because thresholds that work in an electronics lab are meaningless in a machine shop.

And the most useful of all: simultaneous disappearance. Our effectors transmit periodically. If they all stop being heard within the same second, "four hardware failures at once" is markedly less likely than "something is covering the band."

That last one is worth dwelling on, because it costs nothing. It falls out of the system talking to itself continuously — no additional sensor, no additional processing. The most reliable jamming signal we have is a by-product of the architecture rather than a feature we designed.

What we do about it, and what it costs

Nothing more than a refusal, and deliberately so.

You cannot prevent jamming. You can refuse to decide blind. Detected jamming drops the zone to refusal, with a logged event carrying its reason.

The trade-off has to be stated plainly to the operator, before the contract rather than after: the system is susceptible to denial of service. Someone who wants to stop your production rather than enter it will manage by covering the band.

The answer to that is not technical but organisational — a derogation procedure, a fallback mode, monitoring of radio availability. At that point we are no longer in security; we are up against a pair of bolt cutters, and that is resolved by building access control and sound personnel management.

It is also, incidentally, legal: possessing and operating radio jammers is prohibited in most jurisdictions, including across the EU, in the United Kingdom, and in the United States where the FCC treats it as a federal offence. That does not deter everyone, but it changes the nature of the incident from a security failure into a criminal act.

A closing note on direction. An access control that opens on failure is not a degraded control. It is an absence of control with a green light on. The direction of failure was chosen at design time rather than suffered, and it is the first property we verify in any deployment.

Being deceived rather than blinded

Jamming removes information. Spoofing supplies false information, and it is the harder problem.

Replay, and why it is solved

A BLE advertisement travels in the clear and copies easily. That is why we never treat an advertisement as proof of identity: it opens a conversation, it does not authorise one. Authorisation comes from a cryptographic challenge only the key inside the badge's secure element can answer, and which cannot be replayed.

That parry is reliable and well understood. It is also the last easy answer in this article.

The relay, and why it is not

An attacker places one device near a legitimate badge — left in the locker room — and a second near the machine, then relays the conversation between them.

Nothing is forged. The messages are authentic, the signatures valid, the challenge correctly solved. What is manufactured is proximity, and proximity is not a property you can sign.

No cryptographic layer sees this attack. Only a physical measurement contradicts it.

Time-of-flight ranging over ultra-wideband is the benchmark: light does not accelerate on request, so a relay necessarily adds delay. It is the only structural answer. We do not have it today, and we will not pretend otherwise — it is a roadmap line, and our most visible gap against the Aliro standard published by the Connectivity Standards Alliance.

Meanwhile, two things raise the cost. Multi-sensor coherence: with several receivers spread through a room, a real emitter produces a level profile consistent with its position, where a relay often produces an inconsistency — a very strong signal seen by one sensor only, or a profile that does not change while the person moves. Not a proof; an implausibility. And an implausibility is enough to refuse.

And the surrounding conditions: presence must be maintained throughout the period of use, the holder's time window must be open at the same moment, and the access is logged under their name.

Finally, the emitter's radio fingerprint: every transmitter carries measurable manufacturing imperfections — frequency offsets, phase noise, modulation defects — forming a hard-to-imitate signature. An active and promising research field. We follow it. We do not sell it.

The Flipper Zero, precisely

It comes up in every conversation on this subject, usually wrongly. So let us set out the facts.

What it does. A CC1101 transceiver covering the 300–348, 387–464 and 779–928 MHz bands, with an advertised range of about fifty metres. On those bands it reads, records and replays fixed-code remotes: gates, barriers, radio switches, doorbells. Against fixed-code equipment it is formidable, and it has genuinely democratised a skill that previously required real expertise.

What it does not do. It does not touch 2.4 GHz — no Wi-Fi, no Bluetooth, no Zigbee. And its internal power stage is so weak that a jamming attempt carries only a few tens of centimetres. The Flipper alone is not the universal threat it is described as.

What changes the picture. Three-module add-on boards, sold for a few tens of euros, add an ESP32 for Wi-Fi, an nRF24 for proprietary 2.4 GHz, and an amplified CC1101 with an external antenna. With that set, the device reaches wireless keyboard and mouse attacks, Wi-Fi attacks, and much longer-range sub-GHz jamming.

The threat is not the €170 device. It is the device plus the €30 board.

How it is seen. Each module leaves a trace. The sub-GHz emission is visible to an SDR effector. The most common Wi-Fi firmware on these boards produces deauthentication frames in a characteristic volume. The proprietary 2.4 GHz module transmits on distinctive channels with a distinctive addressing format.

None of these is proof of intent. Together, in a workshop where nothing of the sort should be, they form an anomaly worth an alert — which is the correct output. A detection system that concludes "attack" from a radio signature will eventually accuse an innocent contractor's tooling, and be switched off shortly afterwards.

What detection proves

Every row in the right-hand column is a reason to raise an event and refuse, not a reason to accuse. That distinction is the whole operating philosophy: radio detection corroborates a decision, it never anchors one.

Hearing is not understanding

An advertisement received does not prove a presence. A presence does not prove an identity. An identity does not prove an authorisation.

And silence does not prove an absence: it may also mean someone put a cushion over our ears.

That is why our system treats silence as a refusal rather than a permission. It is the least spectacular decision in the whole architecture, and by far the most important.

Last in the series: everything described across these three articles involves listening to radio traffic in a workplace. That is not legally neutral, and the rules differ more between jurisdictions than most vendors admit.