ly.tl/poker

ly.tl/pokerSpectre

ly.tl/pokerInception

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

Device

ly.tl/poker

ly.tl/poker

ly.tl/poker

Visible differences

Galaxy Core Poker cheating device

ly.tl/poker

Security measures

ADB / debug mode gone No “easy” way to get the APK / analyze what is happening

Screenshot shortcut disabled & framebuffer owned by root Prevent to do screenshot / screencap either via SSH or UI

Activation code sent separately Prevent activation of a “lost” device

ly.tl/poker

Fun facts

Cheating hardware hidden from the UI/system No way to trigger the system without the correct application / setup

Backdoor? No need for network or SIM Lots of phone home code in the APK and lot of weird APK in the phone

Custom rom with custom kernel Chinese 4.2.2 Jelly Bean ROM AOSP

ly.tl/poker

The appApp walkthrough

Casino royale

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

Cards as seen by camera face down

Up Down

ly.tl/poker

Number of players

Cards as seen by camera face down

Up Down

ly.tl/poker

Number of players

Game type

in use

Cards as seen by camera face down

Up Down

ly.tl/poker

Number of players

Feedback device

Game type

in use

Cards as seen by camera face down

Up Down

ly.tl/poker

Number of playersResult

Feedback device

Game type

in use

Cards as seen by camera face down

Up Down

ly.tl/poker

Fun facts

Super user password hard coded in string file... The app has a super user password that allows access on any devices

Most of the interesting features are in a kernel module Remote devices control and cards recognition handled by a kernel module

App(s) not obfuscated Easy to read as 123 if you know Java :)

ly.tl/poker

Basic principleHow does this thing work anyway??

Underlying principle

The World Is Not Enough

ly.tl/poker

ly.tl/poker

ly.tl/poker

Phone

ly.tl/poker

Phone

IR LEDs

ly.tl/poker

Phone

B&W camera

IR LEDs

ly.tl/poker

Phone

B&W camera

IR LEDs

IR passband plastic housing

ly.tl/poker

Phone

B&W camera

IR LEDs

IR passband plastic housing

IR illumination

ly.tl/poker

Phone

B&W camera

IR LEDs

IR passband plastic housing

IR illumination

ly.tl/poker

Phone

B&W camera

IR LEDs

IR passband plastic housing

IR illumination

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

Camera

ly.tl/poker

CameraCustom chip

ly.tl/poker

ly.tl/poker

LEDS

ly.tl/poker

RF Bluetooth antenna

LEDS

ly.tl/poker

Card markingHow does this thing work anyway??Cards marking

Casino Royale

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

Marked cards vs regular cards

Device camera view

ly.tl/poker

Marked cards vs regular cards

Regular cards

Device camera view

ly.tl/poker

Marked cards vs regular cards

Marked cards Regular cards

Device camera view

ly.tl/poker

Card encoding

ly.tl/poker

Card encoding

ly.tl/poker

Card encoding

ly.tl/poker

ly.tl/poker

Feedback devices

Feedback devices

Quantum of Solace

ly.tl/poker

ly.tl/poker

Number of players

ly.tl/poker

Number of players

Sound on/off

ly.tl/poker

Intercepting radio-command

Center frequency: 868.289 MHz Data rate: 2400bps Measured Δf =19kHz

2-FSK modulation

ly.tl/poker

ly.tl/poker

ly.tl/poker

Volume

ly.tl/poker

Volume

Sound on/off

ly.tl/poker

Volume

Sound on/off“necklace”

ly.tl/poker

ly.tl/poker

ly.tl/poker

“Mini vibrators”

Bluetooth P4 receiver

ly.tl/poker

Sneaky time display

ly.tl/poker

External Camera

Wireless camera

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

ly.tl/poker

Battery

Battery housing

Hidden Wireless camera

ly.tl/poker

ly.tl/poker

IR LED

Camera

ly.tl/poker

Camera

ly.tl/poker

Antenna

MCU 8051

Transmission module

ly.tl/poker

Transmission module VM152T

ly.tl/poker

ly.tl/poker

Transmission analysis

ly.tl/poker

Transmission analysis

metadata?

ly.tl/poker

Transmission analysis

metadata?

image

ly.tl/poker

Transmission analysis

One full image

ly.tl/poker

ly.tl/poker

Open questions

Who created such device? Casinos? Level of sophistication means either stolen tech or large underground market

Who is ripping who? Where is this thing actively used? Need detection means and field study!

Where is the ink is coming from? You can’t buy it easily - only for secure marking of docs

ly.tl/poker

Takeway

James Bond devices exist! They are hard to find but reality match fiction

Crimeware can be super sophisticated While NSA have cool tools, the crime mob does too!

A very diverse skillset is required to tackle this type of device infiltration, hardware analysis, software analysis, RF analysis, Vision Alg.

ly.tl/poker

Co-conspirators

Pixel: Hardware specialist

Vivi: Chinese blackmarket infiltration expert

ly.tl/poker

Thanks!