 Well good afternoon. How's everybody doing? Good? All right. So for those of you guys that came in a little late perhaps you're still expecting a talk about airplanes, something that probably would have been pretty controversial, right? Well, the airplane talk is not going to happen. The speaker could not be with us. And so luckily though, we have something that is going to be completely non-controversial given where we all are. And that's a talk about cheating at poker. So we want to give these guys a big hand because not only is this going to be an awesome talk, but they stepped in at obviously the very last minute and they're going to put on a great show for you guys. So let's give Ellie and Celine a big hand. And this is Celine and today we're going to tell you about our secret.com talk. For a good reason, we try to keep it quiet before coming in. You can imagine why. So this is a joint work we did with one of our friend Jean-Michel during our spare time. And so try to imagine if James Bond was cheating at the buy at poker, and I'm not saying he is, but try to imagine for a second. He will go to the lab to see when I say, hey, do you have like one of those insane crazy gadgets and then I can cheat and see all the card? But, well, that's just a movie, right? And we all only have like claim cheating device. Well, a few years back, I was casually trolling onto the black market forums into the Chinese one. And opposed to my attention, I don't speak very well Chinese, but it was about like a weird device and the guy lost all his money and he was warming people and it was super, I think I don't quite understand it. And then when I try to show it to one of my friends who speak better Chinese, the post was gone. And I'm like, OK, I must have as hallucinated. It was like 2 a.m. probably not going to happen. And then it's even going in the back of my mind. And a few months after I come across this post, which basically says I'm not going to read out loud, blah, blah, blah. Yes, those devices, it is real. I don't know what it, at that point, is, but it is real and people get ripped out in Texas. And a lot of people lost a lot of money, about 100K, and then a lot of people got ripped out and then it killed all cultural gaming for poker in Texas. And at that point, I'm like, well, if someone have it in the United States, then I probably can find it on the internet. And sure enough, I was able to find the seller. As soon as I knew what to look for, I was able to find the seller. And the seller used this for a bargain, which is only for 1,000 euros, about 5,000 dollars, with 40% discount, right? He tried to make you a good price. This weird device, and that's all you get, this picture. And so this is a Romanian seller. Of course, I knew this thing from China because I read earlier the blog post, the post on the forum. So we traced it back to China and we were able to find the guy who built the real thing, who would hopefully sell it for us for a cheaper price. And so we identified the guy, got into a contact, or a friend of us got into contact with him and tried to get him to get us a device. And they were like, sure, I give you a good deal. I give you the device and a bunch of gizmo. Don't worry, it's only 1,500 dollars. Please wire me it to Western Union. Yeah. And you're like, OK, that seems absolutely normal. I'm going to go to Western Union and just wire 1,500 dollars to China. What can go wrong? Well, we did it and then we waited a lot. And when we were about to lose hope. A package arrived and like, yeah, we are, we have a talk for Defcon. We didn't know it was working yet, but we feel pretty confident at the point. And so here's a demo of what it looked like. I wish I could give you a better demo, but it's super small. But so here is what it looked like. So I'm going to shuffle the card and it's a fair shuffle, no slight of hand, I promise. And so I'm going to deal two cards. I'm going to put a card. So what the hell is going on, right? Something is reading the card out loud. So is anyone of you have figured out what it is? Nope. OK, let's try again. As you can see, the phone is gone. So we're going to try again. So I'll shuffle and it works. It's like it's really works. And that's really what you see. And that's what a poker player on the table would see. It doesn't miss. It doesn't miss, right? It's actually extremely accurate. So that's the story of this talk. We're going to tell you what the hell is going on and we're going to tell you who works for you about it. So it's a device, of course. And so the device is this. It's a phone or it looked like a phone. It's here for those who can see it. It's basically like, look like a legit smartphone. We believe it's actually inspired by a Samsung core. If you compare the two back to back, it's almost the same thing. On the left side, you can see the Galaxy core. On the right side, you can see the modified device. So they have a bunch of built-in security features, which make it hard to analyze. The first one is they send you the activation code separately and there is no way to activate the device without it, so they are extremely careful, which actually speak a lot about how professional they are, like consumer support as well. They have removed ADB in any debug mode. So it's run on Android, but you cannot run ADB. You can't have any debug mode. And they also prevent you to take any screenshot by simply removing this ability to make sure you cannot extract screenshot of the poker player or the poker video player analyzer, as it calls them. So a few fun facts. Looking at it, it's a custom ROM. It's Chinese 4.22. It's also used in clone devices from Samsung. The shooting hardware is completely hidden from the UI. It's a completely distinct circuit. You can see it. You can probe it. So if you don't know what you're looking for, it's just a phone. And so it's really, really resilient to, like somebody telling you you're cheating, you hand over your phone. There is absolutely nothing to see. It operates like a phone. It can make phone calls. It has as many apps you want. Your Facebook Snapchat all works perfectly. So it's really hard to know if it exists. And the funny story is we also found a lot of code who actually found out to China. Not sure why they need that. So we'll air on the side of the back door. So how does it really work? Well, in James Bond movie, it would work like this. The first most man would put his glasses and it would just work magically. I wish it would work that well, but no, that's not how it works. The way it works is you have a pack of card and they're going to give you multiple options to get any type of card, including bicycles from the United States, for United States, also the one popular in China, Macau, Hong Kong and so forth. So you choose the type of card you want and they will mark them for you. And the device itself has a bunch of interesting electronic embedded to it. The first thing they have is infrared LEDs, which go into a black and white camera. So the infrared LED will shoot infrared light through the side of the device because the side of the device is actually modified to allow infrared to go through. The infrared will eliminate the side of the poker player and as a result what you will see is the ink is made to absorb the infrared, so you will see those black dot markings and that's what the camera is capturing. So basically what they do is they use infrared absorption to mark the side of the deck. That's the basic underlying principle. Here is an exposed view. So as you can see here, you probably don't realize it, but the device is on and if you squint really hard, you can see three purpleish dots on the top right and these are the LED, sorry. And if you turn off the light, you see the LED because we took it with a camera and with the UV filter off, and you can see clearly the three LED which are embedded in the side of the poker player and if you can get an idea, it's very, very small, it's here. It's impossible to know if you don't know what it is. So again, speak a lot about the quality of the construction and the professionalism of this kind of device, which really clearly show this is not a homemade or like a low operation, this is probably very professionally made and they probably make a lot of money out of those. So here is an exposed view, so I tear it open and what you can imagine here is you see probably a orange square, this is like custom hardware, they actually backed into the phone. Here's a better view. So you have the camera as I mentioned, which is here. Then you have a custom chip which under the AV, both the audio and the video, which is separate from the phone and then bridge back to the phone. And then here is from the top view, you can see the three LED that I mentioned earlier. And you can see on the right side, there is two dots which are basically the out for IRF and Bluetooth and we'll see how they've been used in a few seconds. And so all of those are connected to a simple antenna which go around the back of the phone to expose to a little better reception. So now it's going to work through how the user experience look like and how you use the app that they actually embedded into the phone. Hi, can you hear me? Can you hear me? Yes, so I'm Celine. And so I'm going to show you how the poker player application works. So this is a screenshot of the device where you can see the Android app menu and can you spot in this screenshot which app is used to control the device? I can't hear you. No, so the app used to control the device is this one, the game app. And so what you do is you click on the icon, start the app and the first screen you'll see is the login screen. So the username is hardcoded and there's only one, it's the admin. And so as mentioned earlier by Elie, the password was sent to us separately from the device. So you type in your password, click on the sign in button and the main screen, the main app screen. But don't worry if you forgot the password or you don't have the password, there is a backdoor password that we found out. So when you are logging in, the main app screen contains six options slash screens. So the first one is the game role. It contains a list of all the game types supported by the device. The second one is purchase. It contains all the game types you already purchased. So that's the one you can use. The upgrade screen is used to buy more game types. Command game is the list of game types you purchased and with a small explanation about how the app will behave depending on the game type. System M4 is not relevant, doesn't contain any useful information. And the last one is settings. It allows you to configure how the device will work. So this is a screenshot of the game hole. So as you can see, there are hundreds of game types that covers a lot of use cases. So this is another indication that people behind this device are running a real lucrative and professional business. So now if you want to use the device to cheat, you go to the purchase screen. On this screen, on top you can see that we have three credits and we use two of them to buy two game types and we have one remaining credit. Notice that the poor spelling in English, that means this device is mainly targeting the Asian market and they didn't spend a lot of time on the English translation. So in our demo we use the second gate type the number to read the card directly. So it's going to read the card directly. So you click on it and then the app is going to show you the settings screen. You can configure the number of players. You can configure input and output methods. So Eli is going to detail those methods later in the talk. You can also configure the device to repeat continuously the reading of the card and just do it once. So if you don't know how to use the device you just hit the start button on this screen and then you get the main game screen. So what you can see on the top of the screen is a live capture of the hidden infrared camera here and so when the cards are face down on the table the back appears on the left part of the screen where the up symbol is. Below that you can see how many players are playing. You can see what is the game type you use. So we use the 1016 which is the read card directly. Just below you can see if you are using any optic feedback devices and what its status. And finally the important information is the result of the reading so there's two players the app is reading that the next two card on the top of the deck will be 6 of hearts and 8 of diamonds. So now just a few fun facts about the app so we found out the backdoor password so this password when you have it you can access any devices and by analyzing the game app we found out that the interesting part of the code that controls the input and output devices and does the card recognition is not in the app it's in a kernel module so now Ely is going to talk about how the card markings is done. So I'll just show you that the app reads the markings but the key question is how does marking come into the card in the first place because obviously if you were to have a bad deck or a deck that doesn't legitimate in the hand people would be suspicious again this is for real cheating so what they do is when you order a device they ask you which type of card you want I order a bicycle because that's the most one we use in the United States and that's what you receive as you can observe it's wrapped up so if you were to actually look over in the poker game it would look like a normal poker deck of cards that would open the peep sign is still on so how do they get the card in what happened is they resealed it and put the card they opened the card obviously for marking by opening the bottom of the deck but when you open the deck if you don't remove the transparent sleeve then you won't see that so that's very clever of them and then you have the card and if you want to look at them up close you welcome to after the talk to do that it's really hard to even feel it or see it it's actually really literally the regular bicycle card that they probably bought and then marked and so as I mentioned the only difference is under infrared light you would see the marking so the regular card appear like this on the right side which is basically just blank whereas the marked card has this and ink which would mark those dots each card name and number would have a different distinct pattern which repeat multiple time over the card for redundancy and because they don't know how what is the angle exactly right they want to be angle proof as much as possible we even found devices which are more expensive and we ran out of money we have two camera one on its side to actually increase the angle of vision to make it more robust and so you have something which and then you have short black and that's basically 0 and 1 and that's how they mark the card and then they have a bunch of functions here's one where basically the upper the upper digit of the number are for the color and then the lower digit is for the number this is why they will always say diamond or hard 6 club 4 because they first read the suit and then they read the value of the card but short of that I mean no device would be complete if it doesn't have a bunch of bells and whistles right so let's look at how you actually interact with the thing right because even if you have it it's really hard to use by itself so they bring you a few things the first thing they have is a remote and the remote will do two things for you a total you to change dynamically and silently the number of players at the table because people can come and go as I see people living nearby and then the other one is we have the sound on and off so assuming that people are talking to you you don't want to get caught you can turn off the poker play we looked into it with Jean-Michel and it's basically a standard to FSK modulations there is three common one for the sound on off one for incrementing the player one for decrementing it's on the 800 megahertz frequency so standard really easy to jump really easy also to impersonate so you can probably change the volume at will if you know there is one in the room and then in the app configuration you can obviously choose between the speaker and the headset so the headset is composed of two parts the first part is this thing which is a remote and so the remote has a volume button which is to increase or decrease the sound of the earpiece and then on and off button can any one of you can guess what is the line out for come on be creative nope it's just to no it's just to hang on to your neck sorry so yeah that's the necklace and so what it does actually is this is connected to the phone in bluetooth but the earpiece you have in your ear is so tiny they couldn't fit the bluetooth emitter so this thing would basically be a bridge which would do bluetooth to the phone up and transfer it into RF so you have analog analog RF into your ear so again very easy to eavesdrop with any SDR if you know what to look for and it's very very tiny it has a tiny battery when you have it on you it's very very impossible to tell they also have another very cool device which is an aptic feedback so the idea here is again a bluetooth p4 they call it a p4 one and you saw on the screen before that it's disconnected or connected and what it does is it have a bunch of vibrators that you would put either on your arm or on your leg and each of them will vibrate to tell you who is going to win who is the second one who is the third one and so forth so it will ring in sequence and so you can have this aptic feedback if you don't like to have an earpiece hey I think they have a lot of customers so you know they try to accommodate everyone needs for those who don't really look like they even have a sneaky display idea where so basically what happens when you read the call it switch the minutes and the second to the first winner and the second winner so you can just look at the the time on your phone and you're like oh yeah all in the most funny part of the device was the wireless camera and so you can activate the wireless camera again from the UI and it comes packaged as a car key there are many many other options for you they also offer watches belt shirt and a bunch of other we got the car key one because it was easier to tear apart and so the car key look like this it will look like almost like a real key again here's an exposed view on how it works so now that you know how it works here is an exposed view on when you use the car key you put the deck in front and then you can see on the app reading it so you see it and you see the deck going back and forth on the screen of the phone and so you can do it again an interesting work that we found is as you can see here they call clubs plum because there's a translation in English so we bet it's just like translating with any bad translation software and it's like well it's plum it's actually club but oh well one of the funny quirk about it and so the key again have the same principle they have LEDs behind the plastic which will let the infrared go through here's an exposed view this time you have two LEDs and the camera is just next to it so here's when I tear it apart what you see is the hidden camera on the left side the battery they give you two these things like suck so much power I was really surprised when I looked at the device there was a ton of background service I'm like what the hell is that it's called MKT heat what the hell is that and then I look it up and basically they have a kernel module which checks the temperature of the phone and will show it done before it explodes so you know it just wants you to die but this thing basically is so power angry that they had to put this system in place and the same thing happened for the key and a battery which is 800 mAh battery will last you probably 30 minutes so you have another one so you go to the bathroom open the key plug the battery and you go back to the pocket game every 35 minutes that's basically what you have to do here's the exposed view you see again the camera you see the camera the two LEDs and they all attach you have a small antenna MCU 1851 which controls it we were able to find to find it online except there is no data sheet so we had to basically do a guesswork when we were looking at the transmission and so we were using a software defined radio to actually try to understand how this thing were transmitting images in the idea of can we jam it can we replace it the answer is yes to both actually it was really hard for us because we realized this is not digital it is literally an image and so we were looking at that to emit to the 400 gigahertz band like wifi and we think it's bad or TNC but we're really bad at it I mean neither Jean Michel nor me are really accustomed to do it with analog with more like a digital kid so it was really a surprise and really hard for us to figure out how to do it but yes you are you are able to jam the thing and to replay images at will so you can clearly defend against yourself against this thing if you play poker against more cheating by just jamming their poker player if you don't like Volvo again they actually offer you a nice option to customize attention to detail again so that leave us with a few open questions that we don't have a good answer the first thing is this is the most sophisticated device we've ever seen and we've ever heard of and it begs the question of how they created it and it's a lot of work right you have to re-house a normal phone add a lot of electronics do a lot of programming I mean they have a kernel module in C who do image recognition manage multiple peripherals and we don't know if it's either a tech which has been used before by Casino we heard if you look it up some Casino had this technique in the 1980s 1990s of having some sort of camera to catch people doing counting so maybe they come from there or they actually build it and in that case there is a larger on the ground market that don't know of but it's really interesting to know who might be a such a device the second thing is we don't believe it's actually used in Casino because Casino have professional dealers so it's really hard to use those kind of deck we believe it's more for background playing or among friends so it begs the question of who is buying it and who is basically ripping who and finally interestingly enough it's not like you can't really go buy an office depot infrared ink you're like oh can I get some infrared absorption ink and they would look at you very funny there is only a few places who actually source sales also how they get a hand on it and how they create the marketing process is there something we haven't much answer about so if you take a ways yes the device exists it's really hard to find but actually you can get lucky and get one it's not it's pretty expensive but you can get one crime work can be super sophisticated you know we have heard at DEF CON again and again about the NSA play set but apparently the mob boss have well the equivalent and it's just we haven't looked at it just yet and finally it did require a lot of skill set to be able to actually pre-prefer this presentation and we had to go from hardware analysis to software analysis to graph analysis so we want to basically acknowledge and thank our co-conspirator who only just want to be named by his or her name PIXTER helped us with the hardware analysis and Vivi was the person who was able to get it out of China so a big thanks to them so thank you very much for attending I know that was not the talk you expected but thank you we're really happy with the question if you have any and if you want to know more when we're going to post the slides online we'll make them available, thank you thanks man if everybody could please not if you're walking out the back door stop that please exit out these doors towards where I am pointing to your left