well good afternoon how's everybody doing good all right so for those of you guys that came in a little late perhaps you're still expecting a talk about airplanes something that probably would have been pretty controversial right well the airplane talk is not going to happen the speaker could not be with us and so so luckily though we have something that is going to be completely non-controversial given where we all are and that's a talk about cheating at poker so we want to give these guys a big hand because not only is this going to be an awesome talk but they stepped in at obviously the very last minute and they're going to put on a great show for you guys so let's give a lien saleem a big hand [Applause] module my name is Ellie and this is Celine and today we're going to tell you about our secret that come talk for this reason we try to keep it quiet before coming in you can imagine why so this is urgent work we did with on our friend jean-michel during our spare time and so try to imagine if James Bond was shooting at the vibe at poker and I'm not only is but try to imagine for a second he will go to the lab to Q and say hey do you have like one of those insane crazy gadget and then I can cheat and see all the card but well that's just a movie right and we only have like claimed cheating device well a few years back I was casually trolling onto the black market forums into the Chinese 1am but post cause my attention I don't speak very well Chinese which was about like the width device and the guy lost all his money and she was warming people and for super IT and quite understand it and then when I tried to show you one of my friend who speak better chinese so post was gone and I'm like okay I must have originated it was like 2am probably not going to happen and then it's healing in the back of my mind and a few months after I come across this post which basically says I'm not going to read out loud blah blah blah yes those devices it is real on what eat at the point is but Israel and people get ripped out in taxes and rough people lost a lot of money about 100k and then a lot of people got ripped out and then it kill all kosher gaming for poker in Texas another problem like well if someone have it in the United State then I probably can find it on the internet and sure enough I was able to say to find the seller as soon as I knew what to look for i was able to find the seller and the stellar star uses for a bargain which is only 400 4,000 euros about five thousand dollars with forty percent discount right he tried to make you a good price this weird device unless all you get this picture and so this is a romanian setter of course I knew this thing for us from China because I read earlier third block post the post on the forum so we trace it back to China and we were able to find the guy who build the real thing who would hopefully study for it for a cheaper price and so we don't defy the guy goes into a contract or front of us got into contact with him and try to get him together so device and we are not sure I give you a good deal i gives you the device and a bunch of gizmo don't worry it's only 1,500USD please wear me to western union yeah and like okay that seems absolutely normal I'm going to go to western union and just wire $1,500 to China what can go wrong well we did it and then we waited a lot and when we were about to lose hope a package arrived and like yeah we are we have a talk for defcon we know it was working yet but we feel pretty confident i'll point and so here's a demo of what it looked like i wish i could give you a better d mobile super small but so here's what it look like so i'm going to share for the card and it's the first of all no sleight of hand I promise and so I'm going to deal to card I'm going to put a card and so wait what yep what the hell is going on right something is reading the card out loud so it didn't want to view I figure out what it is nope ok let's try again as you see the phone is gone so we're going to try again the waterfalls and yeah it works like it's really worked and that's really what you see and that's what a poker player on the table would see it doesn't miss it doesn't miss read it's actually extremely accurate so that the story of this talk we're going to tell you what the hell is going on and we're going to tell you works you about it so it's a device of course and so the device is this it's a phone or its look likely for it here for those who can see it it's basically like look like little internet phone we believe it's actually inspired by a samsung core if you compare the two back-to-back it's almost the same thing on the left side you can see the galaxy core on the right side you can see the modified device so they have a bunch of built-in security feature which make it hard to analyze the first one is they then use the activation code separately and there is no way to activate the device with our lives of the extremely careful which actually speak a lot about how professional their press consumer super as well they have we move a DB and in debug mode so it's run on Android but you cannot run adb can have any debug mode and they also prevent you today taken a screenshot by simply removing this ability to make sure you cannot extract screenshot of the poker player or the book a video player analyzer as it calls are correct so a few fun fact looking at it it's a Crystal Room of Chinese 4.22 it's also used in chrome devices from Samsung the cheating hardware is completely hidden from the UI to completely this tank secret you can see it you can probe it so if you don't know what you're looking for is just the phone and so it's really really resilient you like some entering your cheating you hand over your phone there is absolutely nothing to see it operate like a phone it can make phone call it has a menu apps you want your facebook snapchat all works perfectly so it's really hard to know if it exists and the funny story is we also found a lot of code who actually phone to China not sure why she did that so we're on the side of a back door so how does really work well in James Bond movie it would work like this British most men would put his glasses and if you just work magically I wish it would work that well but no that's not how it works the way it works is you have a back of card and they going to give you multiple option to get any type of card including bicycle from the United for United State also the one popular in China Macau Hong Kong and so forth so you choose the type of car you want and they would mark them for you and the device itself has a bunch of interesting electronic embedded to it the first thing they have is infrared LEDs which going to amend a black-and-white camera so the infrared LED will go what should infrared light to the side of the device because the side of the device is actually modified to allow infrared to go through the infrared will eliminate the side of the poker player and as a result what you will see is the ink is made to absorb the infrared so would see those dot black markings and that what the camera is capturing so basically what they do is they use infrared absorption to mark the side of the deck that will be basic underlying principle here is an exposed view so as you can see here you probably don't realize it but the device is on and if you squint really hard you can see three purplish dot on the top right and this is as a lead led sorry and if you turn off the light you see the LED because we took it it with a camera and we see on UV filter off earth with the air filter off and you can see clearly that really led which are embedded in the side of the poker player and if you can get some idea is very very small is here I'm possible to know if you don't know what it is so again speak a lot about the quality of the construction and the professionalism of those kind of device which really clearly show this is not a homemade or like a low pressure it is probably very professionally made and for and they probably make a lot of money out of those so here is an exposure useful I tear it apart open and what you can imagine here is you probably a orange square this is my custom hardware they actually backed into the phone here's a better view so you have the camera that mentioned which is here then you have a custom chip which under the AV both the audio and the video which is separate from the phone and then bridge back to the phone and then choose from the top view you can see the three LED that I mentioned earlier and you can see on the right side there is two dots which are basically the out for RF and Bluetooth and we see how they been using it in a few second and so all those are connected to a simple antenna which go around to the back of the phone to export to a little better reception so now setting is going to walk you how the user experience look like and how you use the app that they actually embed into the phone hi can you owe me yeah can you hear me yes so I'm saline and so I'm going to show you how the poker player application works okay it's like so this is a screenshot of the device where you can see the Android app menu and can you spot in this screenshot which app is used to control the device I can't hear you no so the app use to control the device is this one the game up haha and so what you do is you click on the icon study up and the first screen you'll see is the login screen so user name is out coded and there's only one it's the admin and so as mentioned earlier by Ellie the password was sent to us separately from the device so you type in your password click on the Sign In button and then you access the main screen the main app screen but don't worry if you forgot the password you don't have the password there is a backdoor password that we found out so when you or log in the main app screen contains six options / screens so the first one is the game hole it contains a list of all the game types supported by the device the second one is purchase it contains all the game types you already purchase so that's the one you can use the upgrade screen is used to buy more game types common game is the list of game types you purchase and with a small explanation about all the app will behave depending on the game type system info is not Raven doesn't contain any useful information and the last one is settings it allows you to configure the other device will work so this is a screenshot of the game hole so as you can see there are hundreds of game types that covers a lot of use cases so this is another indication that people behind this device are running a real a lucrative and professional business so now if you want to use the device to cheat you go to the past purchase screen on this screen there is on top you can see that we have three credits and we use two of them to buy two game types and we have one remaining it notice that the poor spelling in English that means this device is mainly targeting the Asian market and they didn't spend a lot of time on the English translation so in our demo we use the second gate type that's the number to read the card directly so it's going to read the card directly so you click on it and then the app is going to show you the settings screen you can configure the number of players you can configure input and output methods so Ali is going to detail those methods later in the talk you can also configure the device to repeat continuously the reading of the card or just do it once so if you want now to use the device you just eat the start button on the screen and then you get the main game screen so what you can see on the top of the screen is a live capture of the Eden infrared camera here and so when the cards are face down on the table the back appears on the left part of the screen well the up symbol is below that you can see how many players are playing you can see what is the game type you use so we use the 10 16 which is the red card directly just below you can see if you are using any uptick feedback devices and what its watch it status and finally the important information is the result of the reading so there are two players the app is reading that the next two card on the top of the deck will be six of hearts and eight of diamonds so now just a few fun facts about the app so we found out the backdoor password so this past fall when you have it you can access any devices and by analyzing the game up we found out that the interesting part of the code that controls the input and output devices and does the card recognition is not in the app it's an inner kernel module so now it is going to talk about all the CAD markings is that oops case so still it's just show you that the app should read the marking but the key question is how does marking coming to the card in the first place because of you see if you were to have a bad deck or deck who doesn't feed legitimate in the hand people would be suspicious right to get this is for you you're cheating so what they do is when your orders divide the SQ which type of car do you want i order bicycle because of the most one we use in the united states and that's what you receive as you can observe its wrapped up so if you were to actually hand it over in the poker game it will look like a normal poker deck of cards that would open the deep sign is sealed on so how do they get a calling what happened is a we sealed it and put a card they open the color obviously for marking by opening the bottom of the deck but when you open the deck you might if you don't remove the transparent sleeve then you won't see that so that's very clever of them and then you have the card if you manually inspect the card and if you want to look at them up close you're welcome to after the tool to do that it's really hard to even feel it or see it is actually really chewed early the regular bicycle card as it probably boat and then marked and so I didn't mention the only difference is under infrared light you would see the marking so the regular card up here like this on the right side which is basically just blank whereas the mark hard how this absolution inc which would mark those dots each card name and number would have a different distinct pattern which repeat mutable time over the card for redundancy and because they don't know how how what is the angle exactly where they want to be angered proof as much as possible we went from divisive which one works even we run out of money we have two camera one in charge of actually increasing and get a vision to make it more robust and so you have something which and then you have short black non-black at basically zero and one and it sells it marks a card and then they have a bunch of functions here's one where basically the upper side the lower the upper digit of the number are for the color and then the lower digit is photo numbers this is why they will always say diamond or hard six club for because they first read the suit and then they read the value of the card but short of that I mean no device no gentleman device would be complete if it doesn't have a bunch of bells and whistle right so we let's look at how you actually interact with the thing right because even if you have it it's really hard to use by itself so they bring you a few things the first thing they have is a remote and the remote will do two things for you I told you to change dynamically and silently the number of player at the table because people can come and go as I see people live in the room bye-bye and then the other one is we have the song on and off so assuming that people are talking to you you don't want to get caught you can turn off the poker play we looked into it with Jean share and it's basically a standard two FS key FSK modulation there is three common one for a song on of 14 bank incrementing the player one for decrementing it's on the 800 McGarrett frequencies of sound RF real easy to jump with Izzy also to in person I so you can probably change the volume at will if you know there is one in the room and then in the app configuration you can obviously choose between the speaker and the headset so the headset is composed of two parts the first part is this thing which is a remote and so the remote has a volume button which is to increase or decrease the sound of the back of the ear piece and an on and off button can any one of you can guess what is the lanyards for come on be creative nope just 20 it's just to hang on to your neck sorry so yeah let the necklace and so what it does actually is this is connected to the phone in bluetooth but the earpiece you have in your ear is too tiny they couldn't fit the Bluetooth a meter so this thing would basically be a bridge which will do bluetooth to the phone up and transfer it into RF so you have another analog RF into your you're here so again very easy to eavesdrop with any SDR if you know what to look for and it's very very tiny it has a tiny battery that when you have it on on you it's very very impossible to tell they also have another cool very cool device which is a optic feedback so the idea here is again a bluetooth before it's likely to be 41 and you saw on the screen before that it's disconnected or connected and what it does is it have a bunch of vibrators that you would put easier on your arm or on your leg and each of them will vibrate to tell you who is going to win who is the second one for the third one and so forth so it will bring in sequence and so you can have this uptick feedback if you don't like to have an earpiece hey I think they were all customers so you know they try to activate everyone needs for those who don't really look like they even have the sneaky display idea where so basically what happened is when you read the call it switch the minutes and the second to the first winner a second winner so you can just look at the time on your phone yeah all in the most funny part of the device was the wireless camera and so you can activate the wireless camera again from the UI and it's come packaged as a car key there are many many other option for you they also offer watches a belt shirt and the bunch of other we got the car key one because it was easier to tear powered and so the cocky look like this it should look like almost like a real key again to the next post view on how it works so now that we know how it works here and expose you on when you use the car key you put a deck in front and then you can see on the rapidly so you see it and you see they're going back and forth on the screen of the phone and so you can do it again an interesting quirk that we found is as you can hear the cool club plump because as at reduction it has a literal translation in English so we better just like translating with any bad translation software and just like well it's prompt it's actually club but oh well that one of the funny quirk about it and so the key again have the same principle they have LEDs behind the plastic which will let the infrared go through here is an exposé view the time you have two LEDs and the camera is just next to it so it shows when I tear it apart what you see is the hidden camera on the left side the battery they give you to these things like suck so much power that I was released profile and Luke the device was a ton of bad one sir estimate what the hell is that it's called MKT heat what the hell thermo sorry what the hell is that and then I look it up and basically they have a kernel module who check the temperature of the phone and will shut it down before it exploded so you know they just one wants you to die but this thing basically so power angry you that they had to put the system in place and thus MC upon for the key to key god really hard and a battery which is a 800 million per battery will last you probably 30 minutes so you have another one so you go to the bathroom open the key plug the battery and you go back right to the poker game every 35 minutes that's been if you what you have to do choose the expose you you see again the camera you still cameras the 2i LEDs and they all attach this if you have a small antenna and you have an MCU 1851 which controls it we were able to find to find it online except there is no data sheet so we had to basically do a gas work when we were looking at the transmission and so we were using a software-defined radio to actually try to understand how the thing were transmitting images in the idea of can we jam it can replace it the answer is yes to both actually it was really hard for us because we realize this is not digital it is literally a image and so we were looking at that with image to the 200 2400 biggert bend like Wi-Fi and we think it's pal or NTN and TNC but we really bother it i mean this resolution on me are really a customer to do with analog with more like a digital kids so it was videos you probably hard for us to figure out how to do it but yes with normal str you are able to jam the singing and should we play measures at will so you can clearly defend against yourself again this thing if you play poker gets more chilling by just jamming their poker player if you don't like volvo again they actually offer you a nice option to customize attention to detail again so that leave us with a few open question that we don't have a good answer the first thing is this is the most sophisticated cheating device we ever seen and we ever heard of and it begs the question of how they created it and it's a lot of work but you have to rehouse a normal phone I'd love electronics do a lot of programming programming I mean they have a kernel module in seafood you image recognition manage multiple perfex and we don't know if it's either a check which has been used before by Cassie no we heard if you look it up some casino hollis technique in the 1980s 1990s of having some type of camera to catch people do a coward counting so maybe that come from there or they actually build it and in that case there is a larger on a bird market that don't know of but it's really interesting to know who might be a social device the second thing is we don't believe it's actively using casino because casino have professional dealer so it's really hard to use those kind of deck we believe is more for background background playing or among free and so it begs the question of who is buying it and who with basically being who and finally interestingly enough it's not like you can't really go by at office depot infra red ink like L can I get some infrared absorption ink and it would look at you very funny there is only view if you places who actually Souls sales also how they get a hand on it and how they create a marketing process is there something we haven't much unsure about so if you take aways um yes jenna from device exists it's really hard to find but actually you can get lucky and get one it's not like it's pretty expensive but you can get one crime work can be super sophisticated you know we have heard at Def Con again and again about the NSA playset but apparently the mob boss have wealth equivalent and it's just we have a look at it's just yet and finally he did acquire love skill set to be able to actually prepare this presentation and we had to go from hardware analysis software analysis to arrive analysis so we want to basically acknowledge and thank our coconspirator who only just want to be named by the surname pixel help us with the hardware analysis and VV was the person who was able to get it out of China so a big thanks to them so thank you very much for attending I know that was not the doc you expected but thank you we will happily take question if you have any and if you want to know more when we're going to put this right on line just follow us on Twitter and we'll make them available thank you very cool thanks man very cool if everybody could please not if you're walking out the back door stop that please exit out these doors towards where I am pointing to your left
0 Comments