Skip to content

Elie Bursztein, Celine Bursztein,

Cheating at Poker

An analysis of electronic cheating devices used at poker tables, exploring covert cameras, RFID readers, and countermeasure testing.

Summary

### The Underground Market for High-Tech Casino Cheating While traditional card cheating historically relied on manual sleight-of-hand, bottom dealing, and physical card marking, modern criminal syndicates have industrialized the craft through sophisticated electronic devices. At 01:07, Google security lead Elie Bursztein and Céline Bursztein introduce their research into the underground ecosystem of high-end poker cheating hardware. Operating through gray-market suppliers and encrypted messaging channels, commercial manufacturers sell complete, turn-key cheating systems—ranging in price from $1,000 to over $5,000—engineered to give corrupt players an invisible, insurmountable mathematical advantage in private games and illicit casinos.

### Hardware Architecture of the Cheating Smartphone At 05:49, the researchers present an in-depth hardware teardown of a commercially purchased cheating device disguised as a standard commercial smartphone: - **Disguised Exterior:** To casual observation, the unit functions as a normal Android smartphone, complete with working touchscreen displays, phone dialing, and standard mobile applications. - **Concealed Infrared Edge Camera:** Hidden along the smartphone's side bezel sits a miniature, high-speed infrared optical sensor paired with an infrared LED illuminator. When the smartphone is casually placed on the poker table next to the chip stack, the camera faces directly across the green felt toward the deck of cards. - **Peripheral Form Factors:** The researchers highlight alternative modular form factors, including car key fobs, cigarette lighters, power banks, and watch bezels containing identical concealed IR sensors.

### Optical Infrared Barcode Technology on Marked Cards At 08:43, the presentation analyzes the companion marked playing cards: - **Invisible Edge Barcodes:** Standard casino-grade cards (such as Bee, Bicycle, or Copag) are treated along their outer edges with invisible infrared-absorptive ink. Under normal visible light, the edges appear pristine and unmarked. - **Sub-Second Scanning:** When the dealer cuts or squares the deck on the table, the smartphone's high-speed infrared camera captures the edge markings of every card in the deck in less than 0.1 seconds. - **Game Calculation Engine:** The onboard processor instantly identifies the exact sequence of the 52 cards, runs real-time combinatorial algorithms for Texas Hold'em, Omaha, or Baccarat, and determines which seat will win the hand before the first card is dealt.

### Radio Frequency Interception of the Audio Transmission To communicate results to the cheating player without raising suspicion, the smartphone utilizes a covert wireless audio link. At 19:03, the speakers reverse-engineer the RF communications: - **Modulation and Frequencies:** The smartphone transmits winning outcomes using standard 2-FSK (Frequency Shift Keying) radio modulation in the 433 MHz ISM band. - **Micro-Earpieces and Inductive Loops:** The signal is received by a magnetic micro-earpiece inserted deep into the player's ear canal, powered by inductive neck loops worn under clothing or direct micro-RF receivers. A synthesized voice whispers the winning player's seat number (e.g., "Player 3") directly into the cheater's ear.

### Reverse-Engineering the Embedded Android Application At 10:58, the researchers deconstruct the proprietary software driving the cheating system: - **Stealth Software Launcher:** The cheating software is packaged as an obfuscated Android APK disguised within the phone's system settings menu, unlocked only through secret dialer codes or specialized multi-finger touch gestures. - **Configurable Game Engines:** The application supports dozens of international card games, allowing operators to configure table seating arrangements, blind structures, and deal styles. - **Software Licensing Protections:** Paradoxically, the underground malware developers implemented aggressive anti-piracy licensing checks and cryptographic dongles to prevent rival cheating rings from pirating their cheating software.

### Defensive Detection Strategies for Poker Rooms At 26:08, the presentation outlines defensive countermeasures to protect home games, charity tournaments, and casinos: - **Optical Inspection:** Using modified smartphones or cameras with infrared-cut filters removed to inspect card edges under 850nm and 940nm infrared illumination. - **RF Spectrum Monitoring:** Deploying software-defined radios (SDRs) like HackRF or RTL-SDR to monitor 433 MHz and 315 MHz spectrum for characteristic bursty 2-FSK telemetry around gaming tables. - **Physical Table Rules:** Enforcing strict casino policies that ban mobile phones, bulky key fobs, and opaque electronic items from resting flat on the table felt adjacent to the card dealing area.

(AI summary — Gemini 3.8 Flash)

Related talks

IoT Village·47 min

  • DEF CON
  • Hardware
  • Date: Aug 2021
  • Location: Las Vegas

Tim Jensen

Tim Jensen (EapolSniper) delivers a hands-on crash course on IoT penetration testing, covering network discovery, firmware extraction, and binwalk analysis.

iot-pentestbinwalkhardware+2