Hacking arcades for fun

The talk begins with a curious old Windows machine in a Brazilian arcade, which led the speaker to examine the cashless card system behind it. Early reconnaissance of the vendor's public websites yielded little, but a global client map and an Android app pointed to a wider API. Its behavior changed by account code, and an older API version skipped authorization checks.

Findings covered several areas. Sequential object identifiers exposed other customers' cards, balances and personal details. Password reset and email change flows accepted requests without tokens, enabling account takeover. A race condition let a single promotion be claimed many times. Exposed files held invoices with customer data, a booking search returned every reservation when left empty, and public admin panels and bundled JavaScript revealed more internals. On the physical side, arcade cards used MIFARE Classic with default keys and stored only a card number, so they could be cloned to a Flipper Zero or emulated from the app.

The talk closes with responsible disclosure: the vendor was contacted, a meeting followed, and a report was sent, though no reply came afterward. Takeaways include enforcing object-level authorization on every endpoint, validating tokens server-side, guarding state changes against concurrent requests, and avoiding default keys and identifier-only tokens on physical cards.