1 00:00:00,000 --> 00:00:02,400 Thank you guys very much. Give Ducky a big hand. 2 00:00:03,200 --> 00:00:03,640 Yeah! 3 00:00:06,220 --> 00:00:08,440 I love you, brother. I love you. Kill it. 4 00:00:08,560 --> 00:00:09,420 Alright, thank you. 5 00:00:11,660 --> 00:00:12,100 Okay. 6 00:00:13,180 --> 00:00:15,260 I feel like I don't need to go through this part. 7 00:00:15,900 --> 00:00:18,480 Like, uh, cause Dr. Chaos Taylor already did. 8 00:00:18,640 --> 00:00:20,400 But my name, as you know, is Ducky. 9 00:00:20,800 --> 00:00:23,040 Uh, some people call me Scott Melnick. 10 00:00:23,200 --> 00:00:28,060 I am the principal security research and developer, uh, for Bulletproof. 11 00:00:28,060 --> 00:00:31,320 Um, I've been in the gaming industry for over 13 years. 12 00:00:31,500 --> 00:00:32,860 I work for a slot company. 13 00:00:33,200 --> 00:00:39,200 I've done everything from, uh, slot development, system software, security, security ops. 14 00:00:39,440 --> 00:00:43,280 I had the whole IT, networking, everything, career, like probably most of you. 15 00:00:43,700 --> 00:00:46,760 Uh, I have, uh, over six patents in that field. 16 00:00:47,020 --> 00:00:50,460 Uh, this is my information, uh, to get in touch with me. 17 00:00:50,620 --> 00:00:54,320 Uh, and I imagine you can find this on the, uh, slide. 18 00:00:55,460 --> 00:00:57,760 So what we're talking about, um, the what? 19 00:00:58,060 --> 00:00:59,860 What is Hustler Casino Live? 20 00:01:00,480 --> 00:01:05,880 It's a online streaming, real money game, poker tournament. 21 00:01:06,380 --> 00:01:14,880 And they air every night where they invite some of the best, uh, poker cash players and, uh, stream it online. 22 00:01:15,300 --> 00:01:17,280 Uh, there's, uh, quite a lot of streaming. 23 00:01:17,580 --> 00:01:23,260 Uh, some buy-ins have exceeded $1 million on the show. 24 00:01:23,440 --> 00:01:24,920 You have to pony up a million. 25 00:01:25,100 --> 00:01:27,340 And of your own cash and chips. 26 00:01:28,060 --> 00:01:28,160 Get on. 27 00:01:28,540 --> 00:01:29,860 So, you know, what happened? 28 00:01:30,620 --> 00:01:34,320 In November of 2022, uh, there was a newcomer. 29 00:01:34,380 --> 00:01:38,960 She was a casual leisure, uh, player, uh, by the name of Robbie J. Lude. 30 00:01:39,160 --> 00:01:40,680 She was accused of cheating. 31 00:01:41,020 --> 00:01:46,380 Uh, her opponent, which we'll get into, uh, shoves for all in. 32 00:01:46,760 --> 00:01:57,980 Uh, and she won a $269,000, uh, pot, which with a poker hand that she probably should have folded, uh, before the actual, uh, 33 00:01:58,060 --> 00:01:58,280 flop. 34 00:02:01,040 --> 00:02:05,200 So, basically, um, everything just went wild. 35 00:02:05,340 --> 00:02:06,500 Man, after that. 36 00:02:06,680 --> 00:02:07,980 And you'll hear the announcer. 37 00:02:08,220 --> 00:02:11,360 Uh, these streams are, uh, delayed. 38 00:02:11,620 --> 00:02:15,860 So, the announcer, uh, who announces on YouTube, he doesn't even know what's going on. 39 00:02:15,960 --> 00:02:18,460 He has no knowledge to keep it kind of real. 40 00:02:18,760 --> 00:02:22,180 And so, after that, the internet went wild. 41 00:02:22,700 --> 00:02:28,040 Reddit, Twitter, podcasts, the whole world was like, this is wild. 42 00:02:28,060 --> 00:02:36,120 weird she is cheating um without a doubt and uh garrett allison was known uh adelstein is known 43 00:02:36,120 --> 00:02:44,740 as one of the top cash players uh and uh she beat her you know so the whole world even these guys 44 00:02:44,740 --> 00:02:48,800 if you believe they're coming or not if you've been watching the conspiracy theories i'm pretty 45 00:02:48,800 --> 00:02:56,360 sure uh they think uh that she cheated too so right now in case you haven't seen the hand uh 46 00:02:56,360 --> 00:03:03,860 i'm gonna show it hope the video uh goes well um you will recognize if you do follow poker one of 47 00:03:03,860 --> 00:03:09,360 the uh very famous all-time poker players and card players phil ivy's here at the table he folded 48 00:03:09,360 --> 00:03:21,700 pretty quick with a better hand actually and um let's watch it and we don't have sound 49 00:03:27,240 --> 00:03:36,300 i'm gonna pause this i'm sorry i i can if i have to uh but it's important to kind of hear 50 00:03:36,300 --> 00:03:43,180 uh what's going on so i need to check windows i'll try it again 51 00:03:46,560 --> 00:03:48,080 okay windows on mute 52 00:03:52,260 --> 00:03:55,080 it is i didn't know i was responsible 53 00:03:57,380 --> 00:03:59,300 uh for meeting this 54 00:04:07,860 --> 00:04:11,620 calling garrett's rays with jack for off it's wine versus wine and 55 00:04:12,360 --> 00:04:18,240 garrett here has flopped a straight flush draw 10 10 9 with a couple clubs he's gonna bet 2500. 56 00:04:20,760 --> 00:04:25,300 wow and rob's gonna call here with jack four with the jack of clubs 57 00:04:26,860 --> 00:04:27,420 he's up so Info talks a little bit than we are 58 00:04:27,420 --> 00:04:29,740 turn is a three puts back to her hearts down 59 00:04:29,740 --> 00:04:35,120 and this is usually when garrett will lay the hammer down with combo drove 60 00:04:35,120 --> 00:04:44,280 girls he's gonna bet ten thousand i think robbie should have probably been out of his hand free 61 00:04:44,280 --> 00:04:54,640 flop that's a car payment she's got a one club and one heart and wow look at this what is she 62 00:04:54,640 --> 00:05:04,040 thinking about here she's gonna raise it we saw her raise ace king a little bit ago for a min 63 00:05:04,040 --> 00:05:11,600 raise here she's gonna min click jack four and you know garrett is just so experienced 64 00:05:13,600 --> 00:05:15,440 oh wait hold on let me scratch my face 65 00:05:18,460 --> 00:05:22,880 how often would she do this with the 10 could he possibly bet three bet here 66 00:05:22,880 --> 00:05:26,180 i mean she just mean clicked the turn 67 00:05:39,620 --> 00:05:44,540 if he calls it could be about two pot size that's left so i think that's what's 68 00:05:44,540 --> 00:05:46,320 gotta be going through his head here 69 00:05:48,600 --> 00:05:55,900 i think he's considering that three betting and yup there's the all in there's the all in 70 00:05:57,340 --> 00:06:02,900 here like i said he's just so experienced and that patterns that sizing 71 00:06:07,280 --> 00:06:08,860 i think he's considering that three betting and yup there's the all in there 72 00:06:08,860 --> 00:06:09,400 i uh this would have gone forever 73 00:06:16,760 --> 00:06:22,780 real many games have options to like call a timeout and you really have to think about something 74 00:06:26,980 --> 00:06:28,940 uh talking's happening right here 75 00:06:44,100 --> 00:06:46,400 what's going on 76 00:06:46,400 --> 00:06:49,340 what is going on here once but it's up to you 77 00:06:52,960 --> 00:06:53,680 it's impossible 78 00:06:56,840 --> 00:07:04,020 we're talking about running it twice like the river which you can do so it could end up 50 50s where it doesn't really matter 79 00:07:10,020 --> 00:07:13,160 Go to the river. The river is a nine. 80 00:07:13,480 --> 00:07:15,400 That one's you for sure. 81 00:07:15,620 --> 00:07:16,920 They're going to run it twice. 82 00:07:18,060 --> 00:07:19,520 Do you have a small pair? 83 00:07:20,420 --> 00:07:22,200 You give me that much credit? 84 00:07:22,600 --> 00:07:23,380 I don't know. 85 00:07:23,600 --> 00:07:25,480 She's good with the first one. 86 00:07:26,520 --> 00:07:27,560 Let's turn him over. 87 00:07:27,920 --> 00:07:28,440 Oh. 88 00:07:29,460 --> 00:07:30,620 No, no, no. 89 00:07:31,840 --> 00:07:34,180 Wait, the cards are correct. 90 00:07:36,920 --> 00:07:40,220 And the river breaks out again. 91 00:07:40,800 --> 00:07:42,040 Oh my gosh. 92 00:07:44,390 --> 00:07:46,980 I want to see. 93 00:07:47,360 --> 00:07:49,120 Does she have jacks for? 94 00:07:52,860 --> 00:07:53,760 What? 95 00:07:53,880 --> 00:07:54,540 What? 96 00:07:54,600 --> 00:07:55,620 Look at. 97 00:07:55,880 --> 00:07:56,780 What? 98 00:08:00,620 --> 00:08:02,020 Oh, that's, look at Garrett's face. 99 00:08:02,220 --> 00:08:04,280 That is some fucking poker right there. 100 00:08:04,320 --> 00:08:04,820 That was sick. 101 00:08:04,920 --> 00:08:05,220 Wow. 102 00:08:05,720 --> 00:08:06,880 That was sick. 103 00:08:07,180 --> 00:08:08,100 Oh, shit. 104 00:08:08,720 --> 00:08:10,740 That is super, super strange. 105 00:08:10,800 --> 00:08:11,880 You can see his reaction. 106 00:08:12,780 --> 00:08:14,140 Like, what is, what? 107 00:08:14,180 --> 00:08:14,980 You want to kill me. 108 00:08:14,980 --> 00:08:16,300 I'm not going to let it go. 109 00:08:16,380 --> 00:08:17,600 You look like you want to kill me. 110 00:08:17,640 --> 00:08:18,100 There you go. 111 00:08:18,160 --> 00:08:18,440 What's the matter? 112 00:08:19,520 --> 00:08:19,920 Whoa. 113 00:08:22,660 --> 00:08:23,060 Yeah. 114 00:08:54,420 --> 00:08:56,080 Oh, there's why the laugh. 115 00:08:56,700 --> 00:08:57,220 Thanks. 116 00:08:57,980 --> 00:08:59,800 20 years in tech. 117 00:08:59,940 --> 00:09:00,360 Thank you. 118 00:09:00,620 --> 00:09:01,140 Hello? 119 00:09:01,460 --> 00:09:01,540 Hello? 120 00:09:01,680 --> 00:09:01,780 OK. 121 00:09:01,920 --> 00:09:02,260 There we go. 122 00:09:02,420 --> 00:09:03,620 This is better anyways. 123 00:09:03,900 --> 00:09:04,380 Wow. 124 00:09:04,780 --> 00:09:08,820 I'm very technical, by the way. 125 00:09:08,880 --> 00:09:10,320 This is why they called me in on this. 126 00:09:11,520 --> 00:09:12,000 Yeah. 127 00:09:12,700 --> 00:09:16,820 So if you don't understand poker and why she should have never 128 00:09:16,820 --> 00:09:19,580 even had this hand, don't worry about it. 129 00:09:19,640 --> 00:09:20,860 It's not the fun part. 130 00:09:21,080 --> 00:09:24,020 But everyone in the poker world knows you don't really 131 00:09:24,020 --> 00:09:26,900 keep that hand and play it out. 132 00:09:27,920 --> 00:09:29,700 And you see the look on his face. 133 00:09:29,700 --> 00:09:32,080 And if you watch the whole video, it's not hard to find. 134 00:09:32,120 --> 00:09:34,400 Just look up J4 Hustler scandal. 135 00:09:34,860 --> 00:09:36,760 And it continues. 136 00:09:36,860 --> 00:09:37,520 He's talking. 137 00:09:37,660 --> 00:09:39,240 He's like, that's not a poker hand. 138 00:09:39,480 --> 00:09:42,480 And he's running the whole game through his head, 139 00:09:42,600 --> 00:09:45,520 trying to figure out what possibly could have gone on. 140 00:09:45,660 --> 00:09:47,980 And he has been cheated before. 141 00:09:48,720 --> 00:09:51,020 Not on live TV, though. 142 00:09:52,680 --> 00:09:53,720 Sorry, live YouTube. 143 00:09:57,240 --> 00:09:59,160 So we got called in. 144 00:09:59,160 --> 00:10:01,980 And so as you know, I work for Bulletproof. 145 00:10:02,200 --> 00:10:05,200 So why Hustler Live decided, we're 146 00:10:05,200 --> 00:10:07,200 going to have an investigation here. 147 00:10:07,560 --> 00:10:10,760 Everyone's really upset about this cheating. 148 00:10:10,980 --> 00:10:17,160 And there had been the Postal cheating a few years back 149 00:10:17,700 --> 00:10:18,340 before that. 150 00:10:18,540 --> 00:10:20,940 And they never investigated it and said, everything's fine. 151 00:10:21,180 --> 00:10:23,480 So Hustler, Casino Live did the right thing. 152 00:10:24,320 --> 00:10:27,240 And they said, let's just get a security expert in here 153 00:10:27,580 --> 00:10:28,520 and look at everything. 154 00:10:29,160 --> 00:10:30,040 Why Bulletproof? 155 00:10:30,320 --> 00:10:32,680 Well, as you heard at the beginning, 156 00:10:32,940 --> 00:10:35,700 we have gaming experts. 157 00:10:36,000 --> 00:10:38,840 We have gaming experts in this business, 158 00:10:38,940 --> 00:10:41,240 in the casino and lottery business. 159 00:10:41,640 --> 00:10:43,600 And of course, we're security experts. 160 00:10:44,280 --> 00:10:48,460 But we're also owned and a part of a GLI company. 161 00:10:49,240 --> 00:10:51,220 We are a GLI company. 162 00:10:51,440 --> 00:10:53,020 And that's Gaming Laboratories International. 163 00:10:53,680 --> 00:10:59,140 What gaming labs do is they write the guidelines. 164 00:10:59,160 --> 00:11:01,560 They write the guidelines for gaming regulations. 165 00:11:02,240 --> 00:11:07,140 And states, countries, everyone uses those guidelines. 166 00:11:07,480 --> 00:11:08,560 And they make regulations. 167 00:11:08,800 --> 00:11:10,880 So every state has different regulations. 168 00:11:11,400 --> 00:11:14,680 So Nevada, for instance, has regulations 169 00:11:14,680 --> 00:11:17,760 based off of GLI's recommendations. 170 00:11:18,460 --> 00:11:20,520 So once they do that, all the vendors 171 00:11:20,520 --> 00:11:24,060 have to comply with that. 172 00:11:24,300 --> 00:11:27,120 They make their slot machine or their deck shuffler. 173 00:11:27,280 --> 00:11:28,720 And they submit it to the lab. 174 00:11:29,160 --> 00:11:33,060 Or it goes through the states, whatever specifications they did. 175 00:11:33,220 --> 00:11:34,220 They test it. 176 00:11:34,340 --> 00:11:36,140 And they give it the stamp of approval. 177 00:11:36,560 --> 00:11:38,300 So we also have that resource. 178 00:11:38,820 --> 00:11:41,140 But what's important here about the gaming experts 179 00:11:41,140 --> 00:11:45,040 is there are so many nuances in gaming 180 00:11:45,040 --> 00:11:47,460 and really understand how it works. 181 00:11:47,760 --> 00:11:50,280 Coming from the outside, you think, oh, this is unsecure. 182 00:11:50,460 --> 00:11:56,280 But you have to understand the mitigations and what to do 183 00:11:56,280 --> 00:11:57,060 and how things work. 184 00:11:57,160 --> 00:11:58,960 Kind of like cockpits. 185 00:11:58,960 --> 00:12:02,440 And airplanes are unsecure if the door is open. 186 00:12:02,640 --> 00:12:03,860 We kind of know that. 187 00:12:04,120 --> 00:12:07,680 So the FAA actually has a lot of rules 188 00:12:08,140 --> 00:12:10,980 about how to secure that door, because there's 189 00:12:10,980 --> 00:12:11,880 nothing else you can do. 190 00:12:12,060 --> 00:12:13,280 So they secure the door. 191 00:12:13,480 --> 00:12:14,460 Pilots have procedures. 192 00:12:15,520 --> 00:12:16,580 That's an analogy. 193 00:12:16,960 --> 00:12:21,000 And so that's why it's important why they picked us. 194 00:12:21,280 --> 00:12:22,380 So the scope. 195 00:12:22,500 --> 00:12:24,860 The scope was like a dream come true. 196 00:12:25,680 --> 00:12:27,940 They're like, hey, look for evidence of cheating. 197 00:12:28,700 --> 00:12:30,780 Address all these conspiracies, which 198 00:12:30,780 --> 00:12:31,580 we're going to get into. 199 00:12:31,860 --> 00:12:34,600 And figure out all the ways you can cheat. 200 00:12:35,100 --> 00:12:36,580 And then tell us how. 201 00:12:37,040 --> 00:12:38,760 And we're going to close that. 202 00:12:39,020 --> 00:12:40,100 I mean, what a dream. 203 00:12:40,540 --> 00:12:42,620 Asking me to figure out how to cheat. 204 00:12:43,420 --> 00:12:46,100 Who gets an assessment like that, right? 205 00:12:46,620 --> 00:12:50,560 And OK, challenge accepted. 206 00:12:52,260 --> 00:12:54,400 So let me tell you about this talk, though. 207 00:12:55,180 --> 00:12:57,260 So now I'm going on this assessment. 208 00:12:58,000 --> 00:12:59,900 Blindly, I have no idea what they have. 209 00:13:00,920 --> 00:13:02,540 And I've got to do this quick. 210 00:13:02,780 --> 00:13:04,220 So this is kind of a war story. 211 00:13:04,980 --> 00:13:08,080 And per the last slide, this is why you hire hackers. 212 00:13:08,620 --> 00:13:10,900 So I went in and did all the forensic stuff, 213 00:13:11,200 --> 00:13:12,460 you know, imaging machines, whatever. 214 00:13:12,840 --> 00:13:15,600 You learn that, forensics 101. 215 00:13:16,640 --> 00:13:20,160 But they don't kind of teach you how to cheat and figure out 216 00:13:20,160 --> 00:13:20,740 and hack stuff. 217 00:13:21,040 --> 00:13:22,720 And this is what was needed. 218 00:13:22,940 --> 00:13:25,720 And this is why you hire hackers, or why you should. 219 00:13:25,840 --> 00:13:26,520 All of you. 220 00:13:27,760 --> 00:13:29,820 And really, the root of this talk, 221 00:13:29,980 --> 00:13:31,620 even though it's going to be a lot of war story, 222 00:13:31,840 --> 00:13:34,720 this is how security conferences, mainly DEF CON. 223 00:13:34,880 --> 00:13:36,340 I've been coming since DEF CON 13. 224 00:13:36,820 --> 00:13:40,460 And before that, HOPE, a long time. 225 00:13:40,820 --> 00:13:43,720 And this is about how the community has really 226 00:13:43,720 --> 00:13:47,240 helped me with all these facets of technology. 227 00:13:47,560 --> 00:13:50,060 Whether I was interested in it or not, I saw it. 228 00:13:50,360 --> 00:13:52,640 And I've made so many friends. 229 00:13:52,940 --> 00:13:55,980 And it's kind of like having a catalog in your back pocket, 230 00:13:55,980 --> 00:13:59,440 of experts when you need them, and that can teach you. 231 00:14:00,840 --> 00:14:02,460 This is before ChatGPT. 232 00:14:04,080 --> 00:14:06,940 And you can get accurate information from your friends. 233 00:14:09,600 --> 00:14:13,580 So let's address the conspiracies for a moment 234 00:14:13,580 --> 00:14:13,860 here. 235 00:14:14,420 --> 00:14:16,840 So this is the signaling conspiracy 236 00:14:17,240 --> 00:14:19,980 that she was accused of using a vibrating ring. 237 00:14:20,860 --> 00:14:24,180 She was accused of using a sex toy. 238 00:14:24,940 --> 00:14:25,680 Ann attends. 239 00:14:25,740 --> 00:14:25,960 You. 240 00:14:25,960 --> 00:14:26,180 Give me a minute. 241 00:14:26,280 --> 00:14:28,160 The sex toy probably may have come 242 00:14:28,160 --> 00:14:30,940 because this was a few months after the chess cheating 243 00:14:31,480 --> 00:14:35,100 scandal, if you're familiar with it, where I think Elon Musk 244 00:14:35,100 --> 00:14:38,220 kind of suggested that the guy was wearing a sex toy 245 00:14:38,220 --> 00:14:39,060 and being signaled. 246 00:14:39,180 --> 00:14:41,840 And I think it just kind of flowed over from that. 247 00:14:42,320 --> 00:14:45,040 So this is one of the conspiracies 248 00:14:45,040 --> 00:14:47,340 that I had to deal with. 249 00:14:47,500 --> 00:14:48,900 And then there was a lot more. 250 00:14:48,980 --> 00:14:50,320 And we're not going to get into it. 251 00:14:50,400 --> 00:14:51,160 But I had to. 252 00:14:51,780 --> 00:14:54,460 People like the card shufflers rigged. 253 00:14:54,460 --> 00:14:55,360 There's unsecure. 254 00:14:55,360 --> 00:14:58,600 Secure communications to the booth and the camera man 255 00:14:58,600 --> 00:15:00,540 like they can hear someone can pick up 256 00:15:00,540 --> 00:15:02,600 all the chatter of what's going on the booth. 257 00:15:02,860 --> 00:15:06,800 She had special sunglasses and about the rigged card shuffler. 258 00:15:06,980 --> 00:15:10,240 I submitted this talk back in June or the final slides. 259 00:15:10,600 --> 00:15:12,520 So I didn't really get to change them. 260 00:15:12,860 --> 00:15:16,340 But there was a talk at Black Hat kind of based off of this. 261 00:15:16,460 --> 00:15:18,780 So I'm going to add a few more things to that. 262 00:15:18,900 --> 00:15:19,840 And then we'll move on. 263 00:15:21,960 --> 00:15:24,180 So before I even got there, there 264 00:15:24,180 --> 00:15:25,340 was all these complications. 265 00:15:26,780 --> 00:15:29,040 She gave the money back to him. 266 00:15:29,840 --> 00:15:30,200 Whoa. 267 00:15:32,060 --> 00:15:34,520 She said, you know, she felt threatened and cornered. 268 00:15:34,520 --> 00:15:35,280 And maybe she did. 269 00:15:35,420 --> 00:15:36,120 I wasn't there. 270 00:15:36,260 --> 00:15:37,700 I didn't look at that video. 271 00:15:38,020 --> 00:15:41,740 But to the poker world, it was an admittance of guilt. 272 00:15:42,720 --> 00:15:44,940 And like, I don't want this to go any further. 273 00:15:45,060 --> 00:15:47,100 I'm just going to give the money back and make this go away. 274 00:15:47,920 --> 00:15:48,700 Yeah, it didn't. 275 00:15:49,620 --> 00:15:51,280 It was just an admittance of guilt. 276 00:15:51,400 --> 00:15:52,280 So I don't know. 277 00:15:52,440 --> 00:15:55,260 You know, maybe she should have spoke to a lawyer, but she did it right after. 278 00:15:55,340 --> 00:15:55,440 So I don't know. 279 00:15:56,640 --> 00:15:57,260 Oh, boy. 280 00:15:57,320 --> 00:15:57,920 It gets better. 281 00:15:58,340 --> 00:15:59,140 This guy. 282 00:15:59,240 --> 00:15:59,980 What a piece of work. 283 00:16:01,260 --> 00:16:03,280 I'm not going to butcher his last name, but Brian. 284 00:16:03,540 --> 00:16:07,200 Still on the run from the police and a wanted man in L.A. 285 00:16:07,460 --> 00:16:10,820 Well, he worked for Hustler Live Productions in the booth. 286 00:16:11,000 --> 00:16:13,020 So he had knowledge of the hold cards. 287 00:16:13,220 --> 00:16:14,840 He knew all the cards the players had. 288 00:16:15,200 --> 00:16:17,380 So I'm going to take a sip of water. 289 00:16:19,320 --> 00:16:21,180 He had knowledge of that. 290 00:16:21,540 --> 00:16:25,260 So when Hustler Casino, which is different. 291 00:16:25,340 --> 00:16:30,140 from the live production went through security camera footage of the whole 292 00:16:30,140 --> 00:16:35,220 game and after after the game when everyone kind of left the table there 293 00:16:35,220 --> 00:16:39,080 was still some poker players there the production people were there and they're 294 00:16:39,080 --> 00:16:47,140 all you know shooting you know the shit and he pawned $15,000 worth of chip off 295 00:16:47,140 --> 00:16:52,660 of her stack at the table and hustler casino I found this out and fired him 296 00:16:52,660 --> 00:16:58,320 instantly and there's a bunch of police drama in that but all of a sudden all the 297 00:16:58,320 --> 00:17:03,200 internet sleuths the poker world and let me tell you man poker players wow they 298 00:17:03,200 --> 00:17:11,340 are a class of their head there should be a channel about them there is so all 299 00:17:11,340 --> 00:17:18,280 of a sudden he instantly became her conspirator her partner and he was 300 00:17:18,280 --> 00:17:22,580 pissed that she gave the money back and he was going and getting his cut 301 00:17:22,580 --> 00:17:27,820 because she gave the money back and that's what was that was flying 302 00:17:27,820 --> 00:17:38,520 everywhere on the podcast on reddit etc on X so let's get into this so card 303 00:17:38,520 --> 00:17:43,480 shufflers there are multiple types of card shufflers like voting machines and 304 00:17:43,480 --> 00:17:49,820 everything else you can buy them online not usually with the updated software 305 00:17:49,820 --> 00:17:51,980 but nonetheless you can get them there 306 00:17:52,580 --> 00:17:56,220 so you can also read all the patents so if you want to know how all of these 307 00:17:56,220 --> 00:18:03,920 work just read the patent and you'll see it's obvious how they work so there's 308 00:18:03,920 --> 00:18:07,900 two different types of shufflers and I don't know what kind I'm dealing with 309 00:18:07,900 --> 00:18:12,940 but I'm familiar with both before I get there there are single deck shufflers 310 00:18:12,940 --> 00:18:18,300 they're quite old the deck mate one it really only knows that there's 52 carts 311 00:18:18,300 --> 00:18:22,540 or it's making sure there's at least 52 carts it doesn't know what 312 00:18:22,580 --> 00:18:27,700 they are they could be all aces but it tilts if you have more or less it 313 00:18:27,700 --> 00:18:34,080 randomly has an RNG that shuffles the deck some do it different ways this one 314 00:18:34,080 --> 00:18:39,940 it cuts it figures out the position it cuts the carts over and over and over 315 00:18:39,940 --> 00:18:46,500 again until it's shuffled and it passes a laboratory test for entropy and all 316 00:18:46,500 --> 00:18:51,600 that so they make sure multi-deck shufflers it knows the carts it knows 317 00:18:51,600 --> 00:18:52,160 the count 318 00:18:52,840 --> 00:18:56,160 they're really good for multi-deck games because if you go out there like 319 00:18:56,160 --> 00:19:02,260 blackjack you have six card games where there's six not six cards but six decks 320 00:19:02,860 --> 00:19:06,140 in there when you have six decks you don't really have time to make sure 321 00:19:06,140 --> 00:19:10,780 there's enough aces enough Kings you know that's a lot of work and every 322 00:19:10,780 --> 00:19:15,920 shuffle to make sure all those cards are present so they have cameras inside it 323 00:19:15,920 --> 00:19:20,000 and you can find that in the patent and how that works and they're really good 324 00:19:20,000 --> 00:19:21,700 for multi-deck games 325 00:19:21,700 --> 00:19:21,960 and 326 00:19:21,960 --> 00:19:30,700 And the RNG knows all the face values and it orders the cards by the face values and 327 00:19:30,700 --> 00:19:31,320 it comes up. 328 00:19:31,700 --> 00:19:33,300 So this is the part I'm going to add. 329 00:19:34,360 --> 00:19:41,760 There was a Black Hat talk about shufflers and my thing is sleeping here because I wrote 330 00:19:41,760 --> 00:19:42,420 down these notes. 331 00:19:43,880 --> 00:19:50,740 Before this investigation, about earlier in the year, there was one of the podcasters 332 00:19:50,740 --> 00:19:55,720 – first of all, Doug Polk was one of them and I missed Joe Ingram and I apologize to 333 00:19:55,720 --> 00:19:55,940 him. 334 00:19:56,180 --> 00:20:04,500 Joe Ingram, there was incidents at Texas at Prime Social Poker where there was an accusation 335 00:20:04,500 --> 00:20:05,620 of a lot of cheating. 336 00:20:06,120 --> 00:20:16,060 So Joe Ingram looked into it and said, oh, you know, the multi-deck shufflers can be 337 00:20:16,060 --> 00:20:16,380 cheated. 338 00:20:16,560 --> 00:20:17,740 They know what the cards are. 339 00:20:19,200 --> 00:20:20,600 Somebody can have – 340 00:20:20,600 --> 00:20:26,060 They can have an iPhone or whatever in the background and get the list of the cards 341 00:20:26,440 --> 00:20:29,580 and it's really suspect but that's how it works. 342 00:20:29,860 --> 00:20:33,280 So he disclosed this publicly early in 2022. 343 00:20:33,920 --> 00:20:36,580 Doug Polk, by the way, great podcast. 344 00:20:36,900 --> 00:20:39,020 Both of them have really hilarious podcasts. 345 00:20:39,780 --> 00:20:41,340 They're pro poker players. 346 00:20:41,800 --> 00:20:49,040 He also talked about it too and he went onsite and did a live broadcast and said, I don't 347 00:20:49,040 --> 00:20:49,680 know what they have. 348 00:20:49,680 --> 00:20:52,120 But multi-deck shufflers have cameras. 349 00:20:52,480 --> 00:20:54,860 So this was disclosed a long time ago. 350 00:20:54,960 --> 00:20:57,160 We knew about it, the GLI labs. 351 00:20:57,720 --> 00:20:59,060 I knew about it. 352 00:20:59,180 --> 00:21:00,860 I looked into these theories. 353 00:21:01,280 --> 00:21:03,040 So I knew going in. 354 00:21:04,460 --> 00:21:09,920 I wasn't at the Black Hat talk and what this talk about is community and research. 355 00:21:10,200 --> 00:21:13,880 So I'm not sure if they gave the guys credit for that or not. 356 00:21:13,980 --> 00:21:14,520 I wasn't there. 357 00:21:14,660 --> 00:21:15,420 Maybe you were. 358 00:21:15,560 --> 00:21:19,360 But I'm going to assume that they disclosed that. 359 00:21:19,360 --> 00:21:22,120 That these guys' research did that. 360 00:21:23,700 --> 00:21:25,400 I'll eventually see that talk. 361 00:21:26,040 --> 00:21:27,440 So back to card shufflers. 362 00:21:27,720 --> 00:21:30,780 Both have firmware, software and bunches of fun wires. 363 00:21:32,620 --> 00:21:36,300 There's a hash value for both and there's many different ways. 364 00:21:36,500 --> 00:21:38,000 This goes back to gaming experience. 365 00:21:38,440 --> 00:21:43,920 There are many different ways to check this hash value depending on the situation that 366 00:21:43,920 --> 00:21:44,640 they're going into. 367 00:21:44,860 --> 00:21:46,680 But they're certified on the floor. 368 00:21:49,360 --> 00:21:56,240 And as everybody knows, if a shuffling device or really anything out there that we hack 369 00:21:56,240 --> 00:22:00,060 on, if it knows the value of something, then so can an attacker. 370 00:22:00,340 --> 00:22:02,280 That's hacking 101, right? 371 00:22:03,300 --> 00:22:09,320 This is a quote from my report that was the Hustler Live put on there. 372 00:22:10,680 --> 00:22:12,920 So that's a no-brainer there. 373 00:22:13,220 --> 00:22:19,320 Now it ended up being a Deckmate 1, which is a little bit more complicated. 374 00:22:19,320 --> 00:22:21,900 It has an EEPROM. 375 00:22:22,120 --> 00:22:26,540 So we have a very special device and it basically hashes it bit for bit. 376 00:22:26,800 --> 00:22:29,220 And there's ways to do that with many devices. 377 00:22:31,480 --> 00:22:35,980 Also, you have to kind of be in this industry to understand the procedures that go around 378 00:22:36,620 --> 00:22:37,420 all those securities. 379 00:22:37,680 --> 00:22:39,320 There's a lot of vulnerable stuff out there. 380 00:22:39,500 --> 00:22:42,520 But casinos and regulators know this. 381 00:22:42,760 --> 00:22:47,960 And there's a lot of nuances and a lot of procedures, just like that cockpit door on 382 00:22:47,960 --> 00:22:48,620 a 747. 383 00:22:50,720 --> 00:22:53,980 So I get there, I have to inspect the shuffler for foreign devices. 384 00:22:54,160 --> 00:22:56,100 It's something, you know, soldered into it. 385 00:22:56,160 --> 00:22:56,780 I've played with them. 386 00:22:56,840 --> 00:22:57,200 They're fun. 387 00:22:57,760 --> 00:23:02,520 You know, since it was a Deckmate 1, I can check the hashes. 388 00:23:03,000 --> 00:23:06,360 Everything ended up really cool. 389 00:23:06,560 --> 00:23:07,760 My previous slides aren't here. 390 00:23:08,820 --> 00:23:11,880 So I gave them some advice. 391 00:23:12,200 --> 00:23:16,880 I said, look, you need to secure the shuffler between games. 392 00:23:18,020 --> 00:23:19,300 You need to have a shuffler between games. 393 00:23:19,320 --> 00:23:22,700 It adds the dealer get a quick riffle shuffle. 394 00:23:23,440 --> 00:23:27,940 Even though the shuffler is very convenient for getting some entropy, but still give it 395 00:23:27,940 --> 00:23:29,080 a little riffle shuffle. 396 00:23:30,040 --> 00:23:33,340 And a lot of casinos do this because it adds entropy. 397 00:23:33,520 --> 00:23:34,600 Now, it depends on the game. 398 00:23:34,780 --> 00:23:41,860 And poker, doing a quick riffle shuffle, like some regulated markets do, adds a little bit 399 00:23:41,860 --> 00:23:42,520 more entropy. 400 00:23:42,760 --> 00:23:48,000 So if you know the cards and it gets riffle shuffled, the volatility of Texas Hold'em 401 00:23:48,000 --> 00:23:49,240 poker is so great. 402 00:23:49,240 --> 00:23:52,000 That even a percentage can change the game. 403 00:23:52,160 --> 00:23:53,000 It's not perfect. 404 00:23:53,180 --> 00:23:57,760 Because you can kind of still, as a computer or whatever, can still kind of figure out 405 00:23:57,760 --> 00:23:59,180 that something may be near. 406 00:23:59,300 --> 00:24:03,240 So it does give you a slight advantage, but not so much. 407 00:24:04,080 --> 00:24:09,040 And then I said, hey, seal the shuffler with tamper-proof tape or better. 408 00:24:09,220 --> 00:24:12,760 And I gave them some other advice that I'm not going to talk about. 409 00:24:13,880 --> 00:24:18,900 But when I'm telling them about securing this, and especially with the tamper-proof tape, 410 00:24:19,000 --> 00:24:19,220 they're like, oh, yeah. 411 00:24:19,240 --> 00:24:20,900 And this is where DEF CON comes in. 412 00:24:21,320 --> 00:24:24,080 I know tamper-proof tape is bullshit. 413 00:24:26,020 --> 00:24:29,000 I mean, it helps mitigate it a little bit. 414 00:24:29,180 --> 00:24:30,260 You have to know what you're doing. 415 00:24:30,700 --> 00:24:34,140 But one year, I stroll in. 416 00:24:34,220 --> 00:24:41,040 I see my buddy Kyve in the tamper-evident contest that was started by DT, Dark Tangent. 417 00:24:41,180 --> 00:24:43,000 And I'm like, dude, what are you doing? 418 00:24:43,260 --> 00:24:45,160 And he's like, oh, man, watch this. 419 00:24:45,320 --> 00:24:48,620 I'm going to take this tamper-evident tape off of this. 420 00:24:48,620 --> 00:24:49,980 Using acetone. 421 00:24:50,120 --> 00:24:53,320 And I think there's a great video at DEF CON 30 on YouTube that shows this. 422 00:24:53,600 --> 00:24:57,940 And I'm like, like, no way. 423 00:24:58,380 --> 00:25:01,880 This is not the kind of stuff I'm going to learn on my own. 424 00:25:02,060 --> 00:25:02,800 I just see it. 425 00:25:02,820 --> 00:25:03,860 And I'm like, so I know this. 426 00:25:04,120 --> 00:25:05,960 And then I hang out and talk with them. 427 00:25:06,220 --> 00:25:12,360 And when it comes to the shuffler, and this is about getting, you know, this is why you 428 00:25:12,360 --> 00:25:15,760 should, when you're researching stuff, it's humble to give people credit. 429 00:25:15,960 --> 00:25:17,820 I couldn't have done it without these people. 430 00:25:17,820 --> 00:25:22,280 You know, Joe Gran, I first met him at Hack the Planet when, you know, it was part of 431 00:25:22,280 --> 00:25:22,780 the Loft group. 432 00:25:22,920 --> 00:25:25,580 I don't know him personally, but I've talked to him many times. 433 00:25:25,660 --> 00:25:29,300 He used to hang out in the hardware village where I learned about electronics. 434 00:25:29,660 --> 00:25:32,080 I'm not an expert, but I knew it was possible. 435 00:25:32,780 --> 00:25:34,700 I have DEF CON friends, Big Dog. 436 00:25:35,020 --> 00:25:39,720 You know, he taught me how to do rework stations and a little bit of reverse engineering. 437 00:25:40,160 --> 00:25:41,280 All this stuff helps. 438 00:25:41,900 --> 00:25:44,580 And as I told you, the tamper-evident contest. 439 00:25:44,800 --> 00:25:45,600 And now it's the village. 440 00:25:45,700 --> 00:25:46,540 And you should go over there. 441 00:25:46,540 --> 00:25:48,160 And check it out. 442 00:25:48,240 --> 00:25:52,680 And my buddy Kyve, DataGram, and of course DT, I want to thank them. 443 00:25:52,860 --> 00:25:55,900 I would not have known this if it wasn't for DEF CON. 444 00:25:58,840 --> 00:25:59,500 All right. 445 00:25:59,560 --> 00:26:03,000 Now we're going to get into the good stuff here, RFID conspiracies. 446 00:26:07,920 --> 00:26:15,900 So if you've seen, if you've ever watched poker tournaments a long time ago, they used 447 00:26:16,540 --> 00:26:17,800 to show what's called the hole cards. 448 00:26:18,000 --> 00:26:21,380 They used to show a camera built into the table, the cards. 449 00:26:21,580 --> 00:26:24,920 And someone up in the booth would have to type it in so it comes up on the screen. 450 00:26:25,420 --> 00:26:29,520 So that kind of became inefficient, or it wasn't as efficient. 451 00:26:29,760 --> 00:26:32,140 So they started making RFID tables. 452 00:26:32,560 --> 00:26:36,580 These blue squares you see here are RFID antennas. 453 00:26:37,260 --> 00:26:43,920 And they all connect little wires under that black tape to an RFID reader, which is hardwired 454 00:26:44,780 --> 00:26:46,440 up to the booth. 455 00:26:46,480 --> 00:26:46,520 Okay. 456 00:26:46,540 --> 00:26:48,760 This is on a computer that's running poker software. 457 00:26:50,640 --> 00:26:57,440 And so when they do that, they have to place their cards on that reader. 458 00:26:57,700 --> 00:26:59,300 This is what a card looks like. 459 00:26:59,740 --> 00:27:02,920 I have a pack here from the actual casino. 460 00:27:04,200 --> 00:27:08,860 Basically, if you know anything about RFID, you will recognize this. 461 00:27:08,980 --> 00:27:14,380 Or if you've ever been to a bookstore when they existed, they kind of had this text in 462 00:27:14,380 --> 00:27:15,100 the back page. 463 00:27:16,540 --> 00:27:20,640 You can see the antenna, and then you can see the chip in the upper left corner. 464 00:27:21,680 --> 00:27:31,320 These ended up being MIFARE chips, ultralights, and at the 13.56 megahertz range. 465 00:27:31,580 --> 00:27:37,680 And those are rated at 10 centimeters that you have to get to the RFID antenna. 466 00:27:39,940 --> 00:27:43,200 So if you don't – so here's kind of how it works. 467 00:27:43,240 --> 00:27:44,280 I'm not going to go into it. 468 00:27:44,440 --> 00:27:45,480 But you know. 469 00:27:45,480 --> 00:27:47,780 The RFID reader is sending out a magnetic pulse. 470 00:27:47,960 --> 00:27:49,220 It charges the card. 471 00:27:50,160 --> 00:27:54,000 It sends the coil, the chip, puts back the value. 472 00:27:54,320 --> 00:27:56,460 They're all unique to each card. 473 00:27:56,740 --> 00:28:00,100 And now it goes up to the booth, and they know what card it is. 474 00:28:00,320 --> 00:28:02,540 Now they can display it on the monitor. 475 00:28:02,760 --> 00:28:05,500 So now we know who has what. 476 00:28:05,680 --> 00:28:11,040 And then the poker software can instantly calculate the percentages of where they are 477 00:28:11,420 --> 00:28:12,540 and when it's happening. 478 00:28:14,380 --> 00:28:15,100 All right. 479 00:28:15,100 --> 00:28:15,340 Ooh. 480 00:28:15,500 --> 00:28:16,140 Look at that guy. 481 00:28:17,080 --> 00:28:18,480 So – thank you. 482 00:28:18,700 --> 00:28:19,700 Please, please, please. 483 00:28:22,360 --> 00:28:27,020 So when I was there and when – you know, I wanted to be involved. 484 00:28:27,340 --> 00:28:28,780 I was there for a while. 485 00:28:28,940 --> 00:28:30,500 I wanted to be part of production. 486 00:28:30,840 --> 00:28:34,200 I need to know how everything works just like every hacker does. 487 00:28:34,380 --> 00:28:35,260 I want to know how this works. 488 00:28:35,360 --> 00:28:36,180 I want to know what you do. 489 00:28:36,300 --> 00:28:38,820 I want to see everything because I need to. 490 00:28:38,960 --> 00:28:41,760 I got to figure out how cheating is done and other ways to cheat. 491 00:28:42,340 --> 00:28:44,040 So here's me at the table. 492 00:28:44,120 --> 00:28:44,900 Look at all these chips. 493 00:28:45,100 --> 00:28:45,500 They're all mixed with me. 494 00:28:45,960 --> 00:28:50,140 But I already know they're watching it on camera, and I wouldn't do that. 495 00:28:51,120 --> 00:28:54,520 So here I'm working with the booth registering those cards. 496 00:28:54,920 --> 00:28:58,880 Before every game, the software registers new cards. 497 00:28:59,020 --> 00:29:01,840 So they go from ace of spades all the way down to two of clubs. 498 00:29:02,040 --> 00:29:08,000 So they say, okay – and they did call me ducky – they're like, put the ace of spades 499 00:29:08,000 --> 00:29:08,240 down. 500 00:29:08,380 --> 00:29:10,700 Okay, now the next king, et cetera. 501 00:29:10,900 --> 00:29:12,880 And they're registering it with the software. 502 00:29:12,880 --> 00:29:18,140 And if a card ever goes bad – they do go bad a lot because they're fragile – they'll 503 00:29:18,140 --> 00:29:20,620 run down and register a new one. 504 00:29:22,100 --> 00:29:22,820 Oh, boy. 505 00:29:22,940 --> 00:29:24,200 Here comes the conspiracies. 506 00:29:25,220 --> 00:29:33,120 So you know, everyone is a detective on the internet, and poker players are detectives. 507 00:29:33,760 --> 00:29:35,020 So here it goes. 508 00:29:35,460 --> 00:29:41,700 She had in that water bottle an RFID reader that could capture his cards. 509 00:29:42,260 --> 00:29:42,860 So here it goes. 510 00:29:42,860 --> 00:29:44,800 And everyone started latching. 511 00:29:45,020 --> 00:29:46,980 The flipper zero was kind of gaining more traction. 512 00:29:47,300 --> 00:29:50,140 So everyone started latching onto that. 513 00:29:50,380 --> 00:29:55,560 And so she knew what all the cards were from nine feet away. 514 00:29:58,200 --> 00:30:03,280 So I knew going into this that it might be total BS. 515 00:30:05,220 --> 00:30:06,120 Excuse me. 516 00:30:06,900 --> 00:30:08,720 And I had the dealer's cards there. 517 00:30:08,940 --> 00:30:10,700 Now, you know, kind of be fair. 518 00:30:11,120 --> 00:30:12,640 If you knew anything about –. 519 00:30:12,640 --> 00:30:16,500 If you knew anything about RFID, there is passive and active. 520 00:30:17,120 --> 00:30:19,540 And these cards are passive. 521 00:30:19,820 --> 00:30:23,480 But they do – when they're sitting on there, they are charged. 522 00:30:23,700 --> 00:30:26,180 So really all you need to do is kind of sniff it. 523 00:30:26,300 --> 00:30:27,680 You don't have to worry about charging it. 524 00:30:27,840 --> 00:30:34,400 But if you do have a device, you know, like the Proxmark flipper zero, that will send 525 00:30:34,400 --> 00:30:34,860 that out. 526 00:30:35,020 --> 00:30:36,620 Well, the flipper zero does more than that. 527 00:30:37,420 --> 00:30:42,500 So if she did have something that was charging the cards, it would have – had to reach 528 00:30:42,640 --> 00:30:43,280 out nine feet. 529 00:30:43,620 --> 00:30:49,180 It also would have had to skip over all the dealer's cards that she had next to him in 530 00:30:49,180 --> 00:30:51,220 her hand and read the value. 531 00:30:51,620 --> 00:30:54,620 Not only that, she has to catalog all the cards. 532 00:30:57,200 --> 00:30:59,300 Like RFIDs is going to get a serial number. 533 00:30:59,440 --> 00:31:00,940 You don't know if it's an ace or a seven. 534 00:31:01,100 --> 00:31:05,300 So you kind of have to see every card go by and catalog that in your water mug. 535 00:31:07,400 --> 00:31:08,500 Hey, you know, look. 536 00:31:08,820 --> 00:31:10,800 If it's possible, please let me know. 537 00:31:10,940 --> 00:31:11,380 Maybe. 538 00:31:12,640 --> 00:31:13,480 That's what this is about, right? 539 00:31:14,880 --> 00:31:15,280 Yeah. 540 00:31:16,640 --> 00:31:18,540 I got to do it all, all right? 541 00:31:18,880 --> 00:31:22,420 So this report is going public to poker players, right? 542 00:31:22,860 --> 00:31:24,640 And I know this. 543 00:31:24,740 --> 00:31:26,880 So I'm like, oh, man, I'm going to have to test this. 544 00:31:27,300 --> 00:31:29,020 And maybe, you know, maybe I'm wrong. 545 00:31:29,360 --> 00:31:34,180 So I had a little bit of a problem with my Proxmark before I went. 546 00:31:34,340 --> 00:31:38,460 I was packing, and I couldn't get the high frequency antenna working. 547 00:31:38,560 --> 00:31:39,240 And I was like, oh, crap. 548 00:31:39,580 --> 00:31:42,360 I called my good friend. 549 00:31:42,360 --> 00:31:46,840 I met at DEF CON, Matt, who's out in the audience. 550 00:31:47,020 --> 00:31:47,840 And I'm like, dude, my Proxmark. 551 00:31:48,020 --> 00:31:50,080 And he was like, dude, reach out to Iceman. 552 00:31:50,340 --> 00:31:55,460 And if you don't know who Iceman is, then you don't own a Proxmark. 553 00:31:56,400 --> 00:31:59,960 So I reach out to him, and he's like, yeah, describe the problem you're having. 554 00:32:00,300 --> 00:32:02,300 And we talk for a bit, but I got to go. 555 00:32:02,500 --> 00:32:03,680 So I bring it with me. 556 00:32:03,800 --> 00:32:09,020 And then Matt also shows me this other fun device and says, hey, I've got one of these. 557 00:32:09,160 --> 00:32:10,560 It's an iCopy X. 558 00:32:10,960 --> 00:32:12,340 And it's basically a Proxmark. 559 00:32:12,340 --> 00:32:14,740 Like with a Raspberry Pi. 560 00:32:14,920 --> 00:32:17,200 It's like you don't have to plug it into your computer. 561 00:32:17,560 --> 00:32:19,000 It just knows. 562 00:32:20,240 --> 00:32:20,980 It's right there. 563 00:32:21,080 --> 00:32:23,820 So from a few feet away, nope, doesn't work. 564 00:32:24,280 --> 00:32:29,080 I tried to see how far I could get, and it just wasn't feasible. 565 00:32:29,920 --> 00:32:30,400 Yeah. 566 00:32:30,520 --> 00:32:32,220 So I'm a big Mythbusters fan. 567 00:32:33,480 --> 00:32:36,640 So I, you know, I might be wrong. 568 00:32:36,980 --> 00:32:38,600 Maybe there is a way to do this. 569 00:32:38,740 --> 00:32:41,540 So now I've got to look, well, what would it take to work? 570 00:32:41,540 --> 00:32:44,180 Whether it was whoever in the next room. 571 00:32:44,400 --> 00:32:47,940 And so, bam, here's where DEF CON comes in and research. 572 00:32:48,300 --> 00:32:50,940 You got to do your due diligence and research on everything. 573 00:32:51,420 --> 00:32:57,740 So this guy, I've never met before, but he's a fellow and very well known for securing 574 00:32:57,740 --> 00:32:59,440 RFID GP. 575 00:33:00,260 --> 00:33:02,880 I'm not going to butcher his last name, but Hanky. 576 00:33:03,800 --> 00:33:07,600 This is a test he did with high frequency. 577 00:33:07,900 --> 00:33:10,720 And this is the test he did with those antennas. 578 00:33:11,000 --> 00:33:11,520 This is the test he did with those antennas. 579 00:33:11,520 --> 00:33:12,760 He did it at three meters. 580 00:33:12,940 --> 00:33:13,600 It was unsuccessful. 581 00:33:14,120 --> 00:33:16,280 I have a link to the paper if you want to read it. 582 00:33:16,380 --> 00:33:18,140 He did eventually get, like, to a foot. 583 00:33:18,500 --> 00:33:22,680 But I was pretty sure you couldn't fit those antennas into a water mug. 584 00:33:23,520 --> 00:33:25,480 And don't think I didn't want to go up in the ceiling. 585 00:33:26,800 --> 00:33:28,980 But still, the dealer's cards are there. 586 00:33:29,940 --> 00:33:31,880 Let me tell you how DEF CON helped. 587 00:33:32,340 --> 00:33:36,900 And I knew it was BS going in because I've attended these talks out of interest. 588 00:33:37,180 --> 00:33:41,140 Christine Paget does some mind-blowing RFID stuff. 589 00:33:41,280 --> 00:33:41,500 And I'm not going to lie. 590 00:33:41,520 --> 00:33:43,160 I was at both these talks. 591 00:33:43,300 --> 00:33:49,100 But the one that really rang to me, and I had to go find it, was 17, RFID myth busting. 592 00:33:49,400 --> 00:33:53,100 She talked about a lot of ranges. 593 00:33:53,460 --> 00:34:00,060 But she did show that she did get up to a foot, I believe, with MyFair, which is impressive. 594 00:34:00,220 --> 00:34:01,020 She didn't demo it. 595 00:34:01,120 --> 00:34:03,400 But she was talking about you could do it at home. 596 00:34:05,040 --> 00:34:05,940 So here it goes. 597 00:34:06,220 --> 00:34:08,660 And some of this pertains to the last part. 598 00:34:08,820 --> 00:34:09,880 And I've got to speed up now. 599 00:34:11,180 --> 00:34:12,980 Someone at Discord helped me. 600 00:34:13,120 --> 00:34:16,160 He never gave me permission to use his name because he never answered back. 601 00:34:16,300 --> 00:34:17,480 He was like, I'm through with that clown. 602 00:34:18,060 --> 00:34:21,900 But he helped me out with some of the radio communication. 603 00:34:22,680 --> 00:34:29,060 And then this gentleman, Ket Breton, who's super scary, who's been making antennas, I 604 00:34:29,060 --> 00:34:30,660 don't know, since the 1950s. 605 00:34:30,660 --> 00:34:32,560 You can find him in the RFID village. 606 00:34:33,500 --> 00:34:34,480 I didn't know who he is. 607 00:34:34,560 --> 00:34:36,360 I once again called up my buddy Matt. 608 00:34:37,780 --> 00:34:38,940 And phoned a hacker. 609 00:34:38,940 --> 00:34:43,740 And I'm like, dude, do you know anybody who could build an antenna or a device that could 610 00:34:43,740 --> 00:34:47,080 sniff an RFID card, a MyFair? 611 00:34:47,380 --> 00:34:48,540 And he was like, you know what? 612 00:34:48,700 --> 00:34:50,240 He went and checked with his buddies. 613 00:34:50,560 --> 00:34:52,100 He said, call this guy. 614 00:34:52,980 --> 00:34:53,700 And I did. 615 00:34:54,000 --> 00:34:56,400 And I said, hey, what would it take? 616 00:34:56,700 --> 00:34:59,820 And he said, yeah, let me get back to you on that, buddy. 617 00:34:59,920 --> 00:35:00,420 I'm busy. 618 00:35:00,740 --> 00:35:02,120 He kind of laughed. 619 00:35:02,780 --> 00:35:04,720 So that was a definite sign. 620 00:35:05,400 --> 00:35:08,920 And when it came for the solution, one of my DC-404s. 621 00:35:08,940 --> 00:35:11,180 And the protections. 622 00:35:11,500 --> 00:35:13,360 He deals with a lot of radio stuff. 623 00:35:13,600 --> 00:35:14,400 He tinkers. 624 00:35:14,420 --> 00:35:15,140 He makes a lot of stuff. 625 00:35:15,320 --> 00:35:21,680 But I know he had dealt with Faraday cages because that was one of the solutions I was 626 00:35:21,680 --> 00:35:26,380 looking about to stop any signals just for extra protection. 627 00:35:26,680 --> 00:35:29,760 I would have known any of these people or got any of this information. 628 00:35:30,220 --> 00:35:31,660 And that's what this is about. 629 00:35:31,780 --> 00:35:38,260 You make friends that are like knowledge that you'll always have for your life. 630 00:35:39,000 --> 00:35:39,780 High five. 631 00:35:41,660 --> 00:35:43,140 So I'm going to speed up. 632 00:35:43,200 --> 00:35:43,960 Signaling remotes. 633 00:35:43,960 --> 00:35:49,540 This is where Kent really came in handy because we talked for hours on this. 634 00:35:49,920 --> 00:35:55,480 So let's address the TENS unit and the sex toy and the vibrating chair, okay? 635 00:35:56,080 --> 00:35:57,120 First her ring. 636 00:35:57,300 --> 00:35:59,840 It was a ruby ring worth about 120 grand. 637 00:36:00,660 --> 00:36:02,520 This was about an hour into the game. 638 00:36:02,660 --> 00:36:05,940 So it's like, okay, you could have a signaling ring, whatever. 639 00:36:06,640 --> 00:36:07,840 But here's the problem. 640 00:36:07,840 --> 00:36:14,940 The production booth was approximately 20 to 25 feet away behind a constructed firewall, 641 00:36:15,260 --> 00:36:17,600 cement and bars. 642 00:36:18,860 --> 00:36:24,760 One thing about personal devices, TENS units, remotes, whatever, for your foot massager, 643 00:36:25,400 --> 00:36:32,060 we'll call it a foot massager, they typically work up, when it's radio, they typically work 644 00:36:32,060 --> 00:36:33,020 up to 30 feet. 645 00:36:33,240 --> 00:36:35,260 Because what are you going to do? 646 00:36:35,400 --> 00:36:37,080 Reach 100 feet? 647 00:36:37,080 --> 00:36:39,100 100 feet with your personal device remote. 648 00:36:39,440 --> 00:36:44,760 And then Bluetooth is kind of what I found out is really low rated because they're not 649 00:36:44,760 --> 00:36:49,140 going to invest the money when you should have your phone for controls right there. 650 00:36:49,500 --> 00:36:54,160 And when it's somebody remotely from the other side of the country, you know, wherever 651 00:36:54,160 --> 00:36:58,380 your significant other is, they have apps for that. 652 00:36:59,040 --> 00:37:00,780 They can control it through their phone. 653 00:37:00,940 --> 00:37:04,280 It goes to your phone, which has to be a very close proximity. 654 00:37:05,820 --> 00:37:07,060 You know, I learned from... 655 00:37:07,060 --> 00:37:12,280 I learned from Kent in the biohacking village, by the way, we'll talk about this in a second, 656 00:37:12,460 --> 00:37:18,520 the body, because of all the water, it's not really a good antenna, it does give problems. 657 00:37:19,040 --> 00:37:28,520 Kent actually developed the antenna for a ring that women use to, you know, put wherever, 658 00:37:28,780 --> 00:37:35,140 but it's for measuring temperature and all that for ovulation to conceive. 659 00:37:35,400 --> 00:37:37,040 Very cool. And he... 660 00:37:37,040 --> 00:37:40,380 And he told me what a pain that was. 661 00:37:40,640 --> 00:37:42,320 He's like, yeah, that's... 662 00:37:42,320 --> 00:37:43,300 It's very difficult. 663 00:37:43,880 --> 00:37:48,040 And that's why we're going to talk about it in a second. 664 00:37:48,220 --> 00:37:51,780 So I did all these tests, line of sight, 33 feet. 665 00:37:51,900 --> 00:37:55,560 I actually got it behind a firewall in a controlled and uncontrolled environment. 666 00:37:56,660 --> 00:38:03,960 You know, about 16 feet, which is impressive, but it was not by any means 25 feet. 667 00:38:09,180 --> 00:38:11,460 So this is a fun story real quick. 668 00:38:13,780 --> 00:38:15,640 I want to do an experiment. 669 00:38:15,840 --> 00:38:17,500 Everyone travels here, right? 670 00:38:17,620 --> 00:38:19,280 And you have accounting departments. 671 00:38:19,900 --> 00:38:21,380 And I had recently had trouble. 672 00:38:21,540 --> 00:38:23,180 They were like, hey, what's this $5 for? 673 00:38:23,380 --> 00:38:24,460 I'm like, I don't have time. 674 00:38:24,540 --> 00:38:24,660 No. 675 00:38:24,720 --> 00:38:25,120 What's it for? 676 00:38:25,360 --> 00:38:25,720 Okay. 677 00:38:25,960 --> 00:38:26,560 Rightfully so. 678 00:38:26,680 --> 00:38:27,140 I get it. 679 00:38:27,360 --> 00:38:32,900 So I call up the boss man and sort of people say, hey, I want to buy a raw chicken, a 680 00:38:32,900 --> 00:38:36,020 few pounds of beef and a sex toy and wrap it in jeans. 681 00:38:36,200 --> 00:38:37,020 And I want to see... 682 00:38:37,040 --> 00:38:38,840 I want to see the remote distance from this. 683 00:38:38,980 --> 00:38:42,280 And I want to expense it and not say what it's for. 684 00:38:42,920 --> 00:38:43,780 For accounting. 685 00:38:45,800 --> 00:38:46,920 They said no. 686 00:38:47,140 --> 00:38:47,480 Boo. 687 00:38:47,980 --> 00:38:49,820 I was like, oh, fine. 688 00:38:50,980 --> 00:38:53,420 Yeah, let's talk about the TENS unit, please. 689 00:38:54,080 --> 00:38:54,860 This is me. 690 00:38:55,080 --> 00:38:56,100 I took videos. 691 00:38:56,200 --> 00:38:59,020 I attached the TENS unit to myself and tortured myself. 692 00:39:00,460 --> 00:39:00,980 Yeah. 693 00:39:01,780 --> 00:39:02,560 Let me... 694 00:39:02,560 --> 00:39:05,680 I cranked that sucker up to 15 and it hurt. 695 00:39:05,680 --> 00:39:08,780 And I wanted to see the possibility of vibrating in a chair. 696 00:39:08,980 --> 00:39:11,240 Like I said, I went all avenues here. 697 00:39:11,420 --> 00:39:13,420 People are latching on to stuff, man. 698 00:39:13,660 --> 00:39:15,740 So I went through that avenue. 699 00:39:16,640 --> 00:39:20,440 I'll never post the video, but I kind of keeled over. 700 00:39:20,660 --> 00:39:23,340 And I was like, oh, my God. 701 00:39:23,480 --> 00:39:25,660 And hey, maybe she has that. 702 00:39:26,080 --> 00:39:28,700 So the report ended up nonconclusive. 703 00:39:28,840 --> 00:39:30,180 I did say it was possible. 704 00:39:30,660 --> 00:39:33,580 And I said, really, you know, if you think about it, only she truly knows. 705 00:39:33,840 --> 00:39:34,260 Oh. 706 00:39:34,260 --> 00:39:35,360 Back to the report. 707 00:39:35,580 --> 00:39:38,580 I didn't mention this with the shuffler. 708 00:39:38,740 --> 00:39:41,840 There is kind of a misprint of what Hustler said. 709 00:39:43,600 --> 00:39:48,020 We never said the shuffler was unhackable. 710 00:39:48,480 --> 00:39:50,980 I think they meant that shuffler wasn't hacked. 711 00:39:51,160 --> 00:39:53,400 Because we gave them advice how to secure it. 712 00:39:54,320 --> 00:39:58,060 And we even told them, hey, nothing's ever going to be secure. 713 00:39:58,280 --> 00:39:59,180 It's all in the report. 714 00:40:00,440 --> 00:40:04,240 What security company or researcher would ever say something's unhackable? 715 00:40:04,240 --> 00:40:07,960 And if you read the whole thing, you should come to that conclusion. 716 00:40:08,440 --> 00:40:12,560 And so, yeah, we never said that. 717 00:40:12,700 --> 00:40:19,180 I think when Hustler was doing a live, was doing a synopsis of my evidence, they just 718 00:40:19,180 --> 00:40:20,380 kind of said, yeah, it's unhackable. 719 00:40:21,660 --> 00:40:23,360 Sorry, I forgot to put that in there. 720 00:40:23,620 --> 00:40:25,380 So hey, math real quick. 721 00:40:26,460 --> 00:40:32,120 Poker software, if you know what the Monte Carlo method is, it's a measurement of uncertainty. 722 00:40:32,680 --> 00:40:33,620 It's complex. 723 00:40:34,240 --> 00:40:35,560 They use it in accounting, a lot of stuff. 724 00:40:36,040 --> 00:40:37,400 And that's what they use. 725 00:40:37,600 --> 00:40:39,240 I decided to do it flat out. 726 00:40:39,500 --> 00:40:43,960 Now this wasn't in the report, but poker players still argue with me today. 727 00:40:44,060 --> 00:40:44,720 She cheats. 728 00:40:44,780 --> 00:40:45,520 She cheated. 729 00:40:45,700 --> 00:40:47,020 I don't really offer an opinion. 730 00:40:47,340 --> 00:40:48,960 But I was thinking about this. 731 00:40:49,800 --> 00:40:56,540 And I said, you know, if somebody actually did know the cards, and really you have to 732 00:40:56,540 --> 00:40:58,920 know what's coming up next in the hand. 733 00:40:59,240 --> 00:41:02,880 But we do know all the cards that went by, even if you watch the game. 734 00:41:02,880 --> 00:41:08,200 These are the cards G-man, Garrett, needed to win. 735 00:41:08,440 --> 00:41:10,660 It's a 53 to 47% chance. 736 00:41:11,060 --> 00:41:15,760 If you're in the booth and you know, are you going to say, yeah, go all in. 737 00:41:17,340 --> 00:41:20,060 Go all in with the 193K you have left. 738 00:41:20,220 --> 00:41:21,980 You only have a 47% chance. 739 00:41:22,180 --> 00:41:25,920 It's like putting it all in red on the roulette wheel. 740 00:41:26,180 --> 00:41:27,880 So I kind of think about it. 741 00:41:27,920 --> 00:41:30,320 I'm not saying, you know, hey, criminals are dumb. 742 00:41:31,320 --> 00:41:32,200 So maybe. 743 00:41:32,200 --> 00:41:33,020 Maybe it happened. 744 00:41:33,580 --> 00:41:35,500 So look, back to this. 745 00:41:36,520 --> 00:41:37,980 Why did I do this talk? 746 00:41:38,300 --> 00:41:39,680 I want everyone to know this. 747 00:41:39,820 --> 00:41:40,500 I'm big on this. 748 00:41:40,860 --> 00:41:47,500 You know, academia, it does provide you with a foundation of knowledge and how to look 749 00:41:47,500 --> 00:41:48,000 into things. 750 00:41:48,200 --> 00:41:51,200 But not like DEFCON and other conventions. 751 00:41:51,580 --> 00:41:52,320 You come here. 752 00:41:52,460 --> 00:41:53,640 You go to all these villages. 753 00:41:53,780 --> 00:41:58,240 They will throw stuff at you that will blow your mind, that you've never seen before. 754 00:41:58,380 --> 00:41:59,100 And you learn this. 755 00:41:59,280 --> 00:42:00,360 And you make friends. 756 00:42:00,460 --> 00:42:01,840 And you learn stuff from them. 757 00:42:02,200 --> 00:42:03,940 So you're like, holy moly. 758 00:42:04,000 --> 00:42:09,860 At DC 404, we had this 13-year-old that was like, this is how you smash the stack in Linux. 759 00:42:09,960 --> 00:42:11,680 He did his first presentation back then. 760 00:42:11,820 --> 00:42:12,820 And you're like, wow. 761 00:42:13,660 --> 00:42:17,960 And everyone should know, you know, absolute knowledge, you're never going to know everything. 762 00:42:19,040 --> 00:42:20,240 You'll never know it. 763 00:42:20,320 --> 00:42:21,660 Unless you invented it, maybe. 764 00:42:21,960 --> 00:42:27,980 But you know, that's why, you know, my friends here and all of you out there are so valuable. 765 00:42:30,880 --> 00:42:32,180 And I could have done it. 766 00:42:32,180 --> 00:42:34,560 I could have done this investigation without knowing them. 767 00:42:35,840 --> 00:42:37,940 You know, it's just everything. 768 00:42:40,340 --> 00:42:41,580 This is the true saying. 769 00:42:41,900 --> 00:42:43,180 And I'm telling this to everybody. 770 00:42:43,740 --> 00:42:47,060 Jack of all trades, master of none is better than a master of one. 771 00:42:47,520 --> 00:42:49,180 I think in hacking at least. 772 00:42:50,320 --> 00:42:58,880 And Robert Anton Wilson, a dead philosopher, that's why he's famous now, he really kind 773 00:42:58,880 --> 00:42:59,460 of said it all. 774 00:42:59,580 --> 00:43:01,360 A human being should be able to kind of do everything. 775 00:43:01,640 --> 00:43:02,160 Build a bridge. 776 00:43:02,180 --> 00:43:02,680 Start a war. 777 00:43:02,740 --> 00:43:03,260 Change a diaper. 778 00:43:04,180 --> 00:43:05,840 You know, program a computer. 779 00:43:07,820 --> 00:43:09,180 Specialization is for insects. 780 00:43:10,880 --> 00:43:11,900 And I believe that. 781 00:43:12,140 --> 00:43:12,560 Hey, look. 782 00:43:12,620 --> 00:43:14,380 I want to thank Hustler Live Casino. 783 00:43:14,400 --> 00:43:15,440 They did the right thing. 784 00:43:15,640 --> 00:43:16,280 Nick and Ryan. 785 00:43:16,520 --> 00:43:19,000 Ryan Feldman works really hard to keep that. 786 00:43:19,380 --> 00:43:24,380 The poker players that really helped explain a little bit more poker to me. 787 00:43:24,640 --> 00:43:25,200 Joe Tall. 788 00:43:25,460 --> 00:43:26,680 I nicknamed this one. 789 00:43:26,900 --> 00:43:27,940 He's Gus Fritchie. 790 00:43:28,040 --> 00:43:29,160 And I just call him the Fritz. 791 00:43:29,220 --> 00:43:30,180 That's his new poker name. 792 00:43:30,440 --> 00:43:32,160 D. Gaff, who I set up in the booth. 793 00:43:32,160 --> 00:43:33,780 With one of the announcers. 794 00:43:33,920 --> 00:43:34,840 And Parley Slow. 795 00:43:35,020 --> 00:43:36,280 They all explain poker. 796 00:43:36,660 --> 00:43:37,720 Again, thanks. 797 00:43:37,840 --> 00:43:43,100 You know, the Tampa Evident Village, Hardware Hacking Village, all the DEFCON speakers event. 798 00:43:43,440 --> 00:43:45,020 My DC 404 crew. 799 00:43:46,200 --> 00:43:47,080 Yeah, that's right. 800 00:43:48,860 --> 00:43:50,260 You know, the contest. 801 00:43:50,580 --> 00:43:56,480 I was in the DEFCON documentary at Ulam's challenge. 802 00:43:56,760 --> 00:43:57,760 I got dragged on stage. 803 00:43:57,840 --> 00:43:58,500 It was short person. 804 00:43:58,840 --> 00:44:00,840 And I learned a lot during the competition. 805 00:44:01,040 --> 00:44:01,620 I was like, okay. 806 00:44:01,620 --> 00:44:02,660 What do you want me to do? 807 00:44:02,780 --> 00:44:04,080 And that was fun. 808 00:44:05,440 --> 00:44:06,720 Here are all the links. 809 00:44:06,920 --> 00:44:09,440 I think it's all in the download media server. 810 00:44:09,700 --> 00:44:13,560 But hey, I was talking about Joe Ingram and how you disclose that shuffler. 811 00:44:13,780 --> 00:44:16,120 You can look at that for the Texas shuffler thing. 812 00:44:16,320 --> 00:44:17,500 And he talks about that. 813 00:44:17,820 --> 00:44:21,960 I might add that to the slide and Joe Ingram's talking about that. 814 00:44:23,260 --> 00:44:26,220 And some more information later on the patent. 815 00:44:26,500 --> 00:44:27,540 I might add that. 816 00:44:27,740 --> 00:44:29,980 And you know, that's it. 817 00:44:30,080 --> 00:44:30,420 Finito. 818 00:44:31,620 --> 00:44:32,000 Thank you. 819 00:44:36,780 --> 00:44:37,900 I'll be over here. 820 00:44:38,180 --> 00:44:39,120 I guess, question. 821 00:44:39,280 --> 00:44:45,100 And I have all the RFID cards with me. 822 00:44:45,140 --> 00:44:47,600 If you want to see one or if you have a scanner and you want to scan one.