Hacking the Planet Under Glass

Rich Wickersham opens by explaining that modern pinball machines have become connected devices, with Bluetooth, Wi-Fi and other protocols, while classic electromechanical designs had no computers at all. He frames the risks around competitive play, where tournament prize pools can reach six figures, and where score integrity, cheating and machine availability matter to both players and operators.

The middle of the talk covers a bug found in 2020 in the companion mobile app for an early Bluetooth-enabled pinball machine. In one version of the app code, the flaw could affect players in an active multiplayer game. After the app was pulled from the app stores, the next code version dropped support for it, but the underlying protocol stayed in place. Disclosure was slow, and the speaker found that contacting developers directly worked better than approaching senior executives.

In closing, Wickersham offers recommendations for tournament directors, such as removing the Bluetooth dongle where the design allows it, and argues that small manufacturers often under-prioritize security. He encourages researchers to keep pressing vendors and says he is now building contacts with larger pinball companies. The takeaway is that adding connectivity to long-lived physical devices needs security review from the start.