Specter Open-Source NFC Reader: Bug Scanning Tool for Flipper Zero

Post Views: 1

A new open-source application named Specter has been developed for the Flipper Zero device, designed to identify active near-field communication (NFC) readers by detecting the radio frequency fields they emit.

How It Works

The tool operates within the 13.56 MHz frequency range, which is commonly used by modern contactless payment systems, access control readers, transit gates, and hotel locks. The Flipper Zero’s onboard ST25R3916 chip includes a hardware-based external-field detector, a component also utilized for card emulation functionality.

Duty-Cycle Analysis

The Specter application employs a duty-cycle analysis to determine the presence of an NFC field. By measuring the proportion of time a carrier signal is active over a short interval, the tool generates a smoothed FIELD % value to indicate signal strength. A reader positioned directly against the device’s case produces a high FIELD % reading, while a distant or low-power reader may register a lower value.

Sensitivity Settings

Users can adjust sensitivity settings to filter out background noise, allowing for the detection of weak signals or focusing on strong, localized fields. Visual and tactile feedback is provided through a magenta LED and vibration alert, enabling hands-free operation during sweeps.

Proximity Indicator

The proximity indicator progresses through stages—FAINT, NEAR, CLOSE, and STRONG—to guide users during the search.

Limitations

Limitations of the tool include its inability to detect low-frequency NFC systems operating at 125 kHz, such as older HID Prox or EM4100 access control panels. These devices lack the hardware required for field detection via the Flipper Zero’s low-frequency pathway. Additionally, some NFC skimmers may remain dormant until activated by a genuine card, while others may be shielded, rendering them undetectable.

The creator of Specter, Kailash Parshad, emphasized that the absence of a detected signal does not confirm the absence of a reader, as the tool provides a relative indication of proximity rather than an absolute assessment.

Future Updates

Future updates are planned, including a timestamped detection log, a silent sweep mode for screen-off operation, and experimental low-frequency sensing using coil-based methods.

Availability

Installation involves placing the tool in the apps/NFC directory on the device’s SD card. For advanced users, building the application from source code requires the ufbt utility and a USB connection. The tool is freely available on GitHub, offering a customizable solution for security researchers and enthusiasts.

Conclusion

Its development highlights the ongoing challenges of detecting covert NFC-based threats and underscores the importance of open-source collaboration in addressing emerging cybersecurity risks.