A client once asked me to demonstrate the risk rather than describe it. In the car park, before the engagement had properly started, I read the badge of a helpful employee who held a door open. The card was a 125kHz proximity credential. It presents a number. There is no challenge, no key, and nothing secret to compromise, because nothing about it was ever designed to be secret. It opened the comms room.
That is the honest state of the physical layer in a lot of otherwise well-run organisations. The network has been segmented, the cloud has a landing zone, the endpoints have EDR, and the door runs technology from the 1990s that a device costing less than a decent meal can read from a coat pocket.
The devices have become a talking point, particularly the Flipper Zero, which is a small handheld tool that combines sub-GHz radio, RFID, NFC, infrared and a USB interface behind a friendly cartoon interface. Most of the public conversation about it is nonsense in one direction or the other: either it is a magic skeleton key, or it is a toy. It is neither. It is a convenient package for capabilities that security testers have had for two decades, and its real significance is that it moved those capabilities from a specialist kit bag into general circulation.
What these devices actually do, and what they cannot
Reading and cloning low frequency cards. The 125kHz proximity family transmits a fixed identifier with no authentication and no encryption. Anything that can receive it can replay it. This is not a vulnerability in the sense of a flaw to be patched; it is the design, from an era when proximity to the reader was the security model. If your estate is on these cards, cloning is trivial and the only real control is at a different layer.
Replaying static-code radio. Barriers, gates, shutters and some older garage systems use sub-GHz remotes. Where the code is fixed rather than rolling, capture and replay works. Systems using rolling codes properly implemented do not fall to a simple replay.
NFC and 13.56MHz. Here it gets more nuanced, and this is where most of the online exaggeration lives. Modern contactless credentials using mutual authentication and diversified keys are not cloned by waving a handheld device at them. Older or badly configured deployments of 13.56MHz technology, particularly those still using default keys or storing the credential in the clear, are a different matter. The generation of the card matters far more than the brand on it.
Keyboard injection. Presenting as a USB human interface device and typing a payload into an unlocked workstation. Nothing about this is new, and it is defeated by the same control it always was: not leaving workstations unlocked and unattended in public areas.
What they do not do is break well-implemented cryptography, defeat modern contactless payment, or open a properly specified access control system remotely. The failure they exploit is almost always a credential technology chosen fifteen years ago and never revisited.
The law, and why it is the important part
This section carries a caveat I mean sincerely: I am a security architect, not a solicitor, and nothing here is legal advice. If you are scoping physical testing, get proper advice. What follows is the shape of the position as it applies in the United Kingdom, because misunderstanding it is the single fastest way to turn a security exercise into a personal problem.
Owning one is lawful. There is no UK law prohibiting possession of a Flipper Zero or comparable device. They are sold openly and imported legally, and are used by students, engineers, testers and hobbyists. Carrying one is not an offence. The legal question has never been about the object.
The offence is in the conduct. The Computer Misuse Act 1990 is built around authorisation rather than equipment. Unauthorised access to computer material, and unauthorised acts intended to impair the operation of a computer, are offences regardless of whether the tool used was a laptop or a handheld radio. Reading a badge you were given during an authorised assessment sits in a completely different place from copying an employee's badge in a car park, even though the technical action is identical.
The clause that should concern consultancies. The Act also addresses articles intended for use in computer misuse offences, which is where dual-use tooling gets uncomfortable. The device is the same in both cases; what differs is intent and context, and intent is inferred from surrounding circumstances. Stored cloned credentials from systems you have no relationship with, on a device in your bag, is a materially worse position to explain than the same device with a clean profile and an authorisation letter.
Radio is separately regulated. Transmitting on licensed frequencies and interfering with wireless telegraphy sit under their own regime, distinct from computer misuse. A device that transmits is capable of causing offences that have nothing to do with whether you accessed a computer.
The same logic applies to your staff. Somebody in the organisation owns one of these, probably several people do, and treating that as a disciplinary matter rather than a curiosity misreads the situation. The useful policy position is not a ban that will be ignored; it is a clear statement that testing organisational systems requires authorisation, along with a route to ask for it.
Delivering it: who, what, when, deliverables, lineage
Who. This is the hardest ownership question in the article, because access control usually sits with facilities or estates, budget sits with property, and the risk lands on security. Get all three in the same room before proposing anything, because a credential migration is a capital project and security cannot fund it alone.
What. A credential inventory first. What technology is on the cards, what generation, which readers, and which doors protect what. Most organisations genuinely do not know, and the answer is often mixed: a modern system at head office and fifteen-year-old readers at the sites that matter.
When. Prioritise by what is behind the door rather than by site size. Comms rooms, plant rooms, records storage and anywhere holding regulated data come first. A phased migration that starts with critical rooms delivers most of the risk reduction for a fraction of the budget, and gives you a working argument for the rest.
Deliverables. The credential inventory, a door criticality register, a migration plan with phasing and cost, an updated authorisation template for physical testing, and a policy position on personal devices. The authorisation template is the one people skip and the one that protects individuals.
Lineage. This is the physical instance of the same argument I have made about identity elsewhere: a credential that cannot be challenged is not authentication, it is an identifier being trusted. Cloning a proximity card is the physical equivalent of replaying a bearer token, and the remedy is the same, which is mutual authentication and short-lived, revocable credentials.
The honest summary
The devices are not the story. They are a convenient package for capabilities that already existed, and their arrival in general circulation has mostly served to make an old weakness visible to people who were not previously looking. That visibility is useful, because the underlying problem, credential technology that was obsolete a decade ago, was never going to get budget while it stayed invisible.
Two things worth doing this month. Find out what technology your access cards actually use, which usually takes one conversation with whoever maintains the system. And check whether your comms room is on the same credential as the front door, because if it is, the control protecting your infrastructure is a badge that anyone holding a door open will present to a stranger.
If you want the physical layer assessed properly, under written scope, that is the kind of work I do through Cyber Spartans.