cheating at poker james bond style
TRANSCRIPT
ly.tl/poker
ly.tl/pokerSpectre
ly.tl/pokerInception
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
Device
ly.tl/poker
ly.tl/poker
ly.tl/poker
Visible differences
Galaxy Core Poker cheating device
ly.tl/poker
Security measures
ADB / debug mode gone No “easy” way to get the APK / analyze what is happening
Screenshot shortcut disabled & framebuffer owned by root Prevent to do screenshot / screencap either via SSH or UI
Activation code sent separately Prevent activation of a “lost” device
ly.tl/poker
Fun facts
Cheating hardware hidden from the UI/system No way to trigger the system without the correct application / setup
Backdoor? No need for network or SIM Lots of phone home code in the APK and lot of weird APK in the phone
Custom rom with custom kernel Chinese 4.2.2 Jelly Bean ROM AOSP
ly.tl/poker
The appApp walkthrough
Casino royale
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
Cards as seen by camera face down
Up Down
ly.tl/poker
Number of players
Cards as seen by camera face down
Up Down
ly.tl/poker
Number of players
Game type
in use
Cards as seen by camera face down
Up Down
ly.tl/poker
Number of players
Feedback device
Game type
in use
Cards as seen by camera face down
Up Down
ly.tl/poker
Number of playersResult
Feedback device
Game type
in use
Cards as seen by camera face down
Up Down
ly.tl/poker
Fun facts
Super user password hard coded in string file... The app has a super user password that allows access on any devices
Most of the interesting features are in a kernel module Remote devices control and cards recognition handled by a kernel module
App(s) not obfuscated Easy to read as 123 if you know Java :)
ly.tl/poker
Basic principleHow does this thing work anyway??
Underlying principle
The World Is Not Enough
ly.tl/poker
ly.tl/poker
ly.tl/poker
Phone
ly.tl/poker
Phone
IR LEDs
ly.tl/poker
Phone
B&W camera
IR LEDs
ly.tl/poker
Phone
B&W camera
IR LEDs
IR passband plastic housing
ly.tl/poker
Phone
B&W camera
IR LEDs
IR passband plastic housing
IR illumination
ly.tl/poker
Phone
B&W camera
IR LEDs
IR passband plastic housing
IR illumination
ly.tl/poker
Phone
B&W camera
IR LEDs
IR passband plastic housing
IR illumination
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
Camera
ly.tl/poker
CameraCustom chip
ly.tl/poker
ly.tl/poker
LEDS
ly.tl/poker
RF Bluetooth antenna
LEDS
ly.tl/poker
Card markingHow does this thing work anyway??Cards marking
Casino Royale
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
Marked cards vs regular cards
Device camera view
ly.tl/poker
Marked cards vs regular cards
Regular cards
Device camera view
ly.tl/poker
Marked cards vs regular cards
Marked cards Regular cards
Device camera view
ly.tl/poker
Card encoding
ly.tl/poker
Card encoding
ly.tl/poker
Card encoding
ly.tl/poker
ly.tl/poker
Feedback devices
Feedback devices
Quantum of Solace
ly.tl/poker
ly.tl/poker
Number of players
ly.tl/poker
Number of players
Sound on/off
ly.tl/poker
Intercepting radio-command
Center frequency: 868.289 MHz Data rate: 2400bps Measured Δf =19kHz
2-FSK modulation
ly.tl/poker
ly.tl/poker
ly.tl/poker
Volume
ly.tl/poker
Volume
Sound on/off
ly.tl/poker
Volume
Sound on/off“necklace”
ly.tl/poker
ly.tl/poker
ly.tl/poker
“Mini vibrators”
Bluetooth P4 receiver
ly.tl/poker
Sneaky time display
ly.tl/poker
External Camera
Wireless camera
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
ly.tl/poker
Battery
Battery housing
Hidden Wireless camera
ly.tl/poker
ly.tl/poker
IR LED
Camera
ly.tl/poker
Camera
ly.tl/poker
Antenna
MCU 8051
Transmission module
ly.tl/poker
Transmission module VM152T
ly.tl/poker
ly.tl/poker
Transmission analysis
ly.tl/poker
Transmission analysis
metadata?
ly.tl/poker
Transmission analysis
metadata?
image
ly.tl/poker
Transmission analysis
One full image
ly.tl/poker
ly.tl/poker
Open questions
Who created such device? Casinos? Level of sophistication means either stolen tech or large underground market
Who is ripping who? Where is this thing actively used? Need detection means and field study!
Where is the ink is coming from? You can’t buy it easily - only for secure marking of docs
ly.tl/poker
Takeway
James Bond devices exist! They are hard to find but reality match fiction
Crimeware can be super sophisticated While NSA have cool tools, the crime mob does too!
A very diverse skillset is required to tackle this type of device infiltration, hardware analysis, software analysis, RF analysis, Vision Alg.
ly.tl/poker
Co-conspirators
Pixel: Hardware specialist
Vivi: Chinese blackmarket infiltration expert
ly.tl/poker
Thanks!