Cheating at poker James Bond Style

download Cheating at poker James Bond Style

of 106

Embed Size (px)

Transcript of Cheating at poker James Bond Style

  • ly.tl/poker

  • ly.tl/pokerSpectre

  • ly.tl/pokerInception

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

    Device

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

    Visible differences

    Galaxy Core Poker cheating device

  • ly.tl/poker

    Security measures

    ADB / debug mode gone No easy way to get the APK / analyze what is happening

    Screenshot shortcut disabled & framebuffer owned by root Prevent to do screenshot / screencap either via SSH or UI

    Activation code sent separately Prevent activation of a lost device

  • ly.tl/poker

    Fun facts

    Cheating hardware hidden from the UI/system No way to trigger the system without the correct application / setup

    Backdoor? No need for network or SIM Lots of phone home code in the APK and lot of weird APK in the phone

    Custom rom with custom kernel Chinese 4.2.2 Jelly Bean ROM AOSP

  • ly.tl/poker

    The appApp walkthrough

    Casino royale

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

    Cards as seen by camera face down

    Up Down

  • ly.tl/poker

    Number of players

    Cards as seen by camera face down

    Up Down

  • ly.tl/poker

    Number of players

    Game type

    in use

    Cards as seen by camera face down

    Up Down

  • ly.tl/poker

    Number of players

    Feedback device

    Game type

    in use

    Cards as seen by camera face down

    Up Down

  • ly.tl/poker

    Number of playersResult

    Feedback device

    Game type

    in use

    Cards as seen by camera face down

    Up Down

  • ly.tl/poker

    Fun facts

    Super user password hard coded in string file... The app has a super user password that allows access on any devices

    Most of the interesting features are in a kernel module Remote devices control and cards recognition handled by a kernel module

    App(s) not obfuscated Easy to read as 123 if you know Java :)

  • ly.tl/poker

    Basic principleHow does this thing work anyway??

    Underlying principle

    The World Is Not Enough

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

    Phone

  • ly.tl/poker

    Phone

    IR LEDs

  • ly.tl/poker

    Phone

    B&W camera

    IR LEDs

  • ly.tl/poker

    Phone

    B&W camera

    IR LEDs

    IR passband plastic housing

  • ly.tl/poker

    Phone

    B&W camera

    IR LEDs

    IR passband plastic housing

    IR illumination

  • ly.tl/poker

    Phone

    B&W camera

    IR LEDs

    IR passband plastic housing

    IR illumination

  • ly.tl/poker

    Phone

    B&W camera

    IR LEDs

    IR passband plastic housing

    IR illumination

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

    Camera

  • ly.tl/poker

    CameraCustom chip

  • ly.tl/poker

  • ly.tl/poker

    LEDS

  • ly.tl/poker

    RF Bluetooth antenna

    LEDS

  • ly.tl/poker

    Card markingHow does this thing work anyway??Cards marking

    Casino Royale

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

    Marked cards vs regular cards

    Device camera view

  • ly.tl/poker

    Marked cards vs regular cards

    Regular cards

    Device camera view

  • ly.tl/poker

    Marked cards vs regular cards

    Marked cards Regular cards

    Device camera view

  • ly.tl/poker

    Card encoding

  • ly.tl/poker

    Card encoding

  • ly.tl/poker

    Card encoding

  • ly.tl/poker

  • ly.tl/poker

    Feedback devices

    Feedback devices

    Quantum of Solace

  • ly.tl/poker

  • ly.tl/poker

    Number of players

  • ly.tl/poker

    Number of players

    Sound on/off

  • ly.tl/poker

    Intercepting radio-command

    Center frequency: 868.289 MHz Data rate: 2400bps Measured f =19kHz

    2-FSK modulation

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

    Volume

  • ly.tl/poker

    Volume

    Sound on/off

  • ly.tl/poker

    Volume

    Sound on/offnecklace

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

    Mini vibrators

    Bluetooth P4 receiver

  • ly.tl/poker

    Sneaky time display

  • ly.tl/poker

    External Camera

    Wireless camera

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

  • ly.tl/poker

    Battery

    Battery housing

    Hidden Wireless camera

  • ly.tl/poker

  • ly.tl/poker

    IR LED

    Camera

  • ly.tl/poker

    Camera

  • ly.tl/poker

    Antenna

    MCU 8051

    Transmission module

  • ly.tl/poker

    Transmission module VM152T

  • ly.tl/poker

  • ly.tl/poker

    Transmission analysis

  • ly.tl/poker

    Transmission analysis

    metadata?

  • ly.tl/poker

    Transmission analysis

    metadata?

    image

  • ly.tl/poker

    Transmission analysis

    One full image

  • ly.tl/poker

  • ly.tl/poker

    Open questions

    Who created such device? Casinos? Level of sophistication means either stolen tech or large underground market

    Who is ripping who? Where is this thing actively used? Need detection means and field study!

    Where is the ink is coming from? You cant buy it easily - only for secure marking of docs

  • ly.tl/poker

    Takeway

    James Bond devices exist! They are hard to find but reality match fiction

    Crimeware can be super sophisticated While NSA have cool tools, the crime mob does too!

    A very diverse skillset is required to tackle this type of device infiltration, hardware analysis, software analysis, RF analysis, Vision Alg.

  • ly.tl/poker

    Co-conspirators

    Pixel: Hardware specialist

    Vivi: Chinese blackmarket infiltration expert

  • ly.tl/poker

    Thanks!