Cardea v1.0 - relay attack watch

Leave it in the car. Tell it you are walking away. It listens for your key answering a question nobody asked.

Why a Flipper can see this at all

A passive-keyless car asks its key a question over a 125 kHz magnetic field that reaches about a metre. The key answers over UHF — and that answer is a real radio transmission, built to unlock a car from across a car park.

The common relay theft carries only the question: one box at the car, one by your front door. Nobody relays the answer, because nobody has to — the key's UHF reply reaches the car through the wall on its own. That is what makes the attack practical with two cheap boxes, and it is what leaves the attack audible from the driver's seat.

What it does

Hops all five worldwide key bands (315 / 390 / 433.92 / 868.35 / 915 MHz), camps on whichever one speaks, pulls individual bursts out of the RSSI stream, and grades them against three independent families:

• UNSOL — key-shaped bursts while you have declared yourself away
• RHYTHM — gaps too even to be a human thumb
• CLONE — the same frame arriving over and over

The rules that keep it honest

• One burst is never evidence.
• RELAY LIKELY needs two of the three families, and one of them must be RHYTHM — a rule a failing test put there, because pressing your own key six times is both unsolicited and identical.
• A metronome ticking for over a minute is furniture, not a thief. Weather stations settle at ODD TRAFFIC with a BEACON tag instead of screaming all night.
• The score is capped at 92. It never claims certainty.
• It cannot hear the 125 kHz half, cannot decrypt your key's reply, and says so — in the app, not just the README.

Also in here

Optional key learning (two agreeing presses build a duration + envelope + band template, after which every other remote in the street stops counting), a six-panel animated primer on how relay theft actually works, a three-page alert that explains itself, a watch report, and a CSV event log.

Receive only. It never transmits.

Install

Download cardea.fap and copy it to /ext/apps/Sub-GHz/ on the SD card. It appears under Apps → Sub-GHz → Cardea.

Built against the ufbt release channel (API 87.1) and CI-checked against dev (API 88.2). If it refuses to start on your firmware, rebuild with ufbt.

Verification

18,476 host checks on the evidence engine, including a randomised sweep over 3,000 generated situations asserting the honesty invariants. Screen mockups are rendered from the app's own layout constants and caught four real collisions before they reached a device.

Not tested against a real relay attack — for obvious reasons. The engine is tested against synthesised signals whose answers are known in advance.