I Cheated At Poker By Hacking A Casino Card Shuffling Machine

To win big in poker, you need skill, luck,

and it helps if you somehow know the cards

in every other player's hands.

I'm a terrible poker player,

but I teamed up with this casino cheating expert

and this hacker who uncovered a high tech way

to digitally rig this common card shuffling machine used

in casinos across the US.

Together we designed a scheme

to hack a card shuffling machine.

Let's make some money. I'm in.

And win big in Vegas. It's a crazy little hand.

I'm Andy Greenberg.

I investigate the strange, dark,

and subversive sides of technology for Wired.

This is Hack-Lab.

I cheated at poker by hacking

a casino card shuffling machine.

This experiment takes me to Las Vegas, Nevada.

For DEF CON, America's biggest hacker conference.

I'm meeting Joseph Tartaro,

a researcher and consultant with the security firm IOActive.

Joseph. Hey Andy, how's it going?

Two years ago I wrote a story for Wired

about Joseph's technique for hacking card shufflers

to take full control over a poker game

for perfect undetectable cheating in a casino environment.

And in a moment I'll put his technique to the test by trying

to cheat these unsuspecting poker players

in a real game of Texas Hold'em.

But first I want to understand how the shuffler works.

This is the Deckmate 2 card shuffler

that you hacked two years ago.

This is the most popular card shuffler you're gonna see

in every major poker room.

It's even used in the World Series of Poker.

It actually sits flush.

This is what's next to your knees under the table.

How does the Deckmate 2 work internally?

Like is it actually the same way

that I would like take a deck

and riffle shuffle it, like this?

Is it doing that mechanically inside?

No, actually it has 20, 23, or 26 different shelves

and it will generate a random number.

So I'll say, okay, this first part I'm gonna process.

I'm gonna put that in position three.

Next one, I'm gonna put that in position 12

and it'll eventually just produce a deck.

It's really used to make sure

that the casino just gets more hands an hour.

Technically the shuffler has the capability

to completely sort a deck in order ace to king every suit.

Let me show you.

See the door opened here.

[Deckmate whirring] And now we wait.

And the dealer just pulls the deck out

of this little container at the top.

Correct, there's your deck.

Yeah, here we go.

Perfectly consecutive now.

So obviously like if the shuffler can order the whole deck

as a kind of feature that it shows you by default,

then that means that if you can hack it,

you can reorder the deck and fully control the placement

of every card, right?

Yeah, 100%.

I actually have a fun hand that I could show you

from James Bond's Casino Royal.

[dramatic music]

Have you seen the movie Casino Royal?

[Andy] I have.

In this scenario, Joseph was able

to hack the Deckmate's code

so that it would reorder the deck

so that the dealer would deal out exactly the hands

from the poker game in that movie scene.

I will be James Bond in this scenario.

[Joseph] So here we go.

[tense music]

[Andy] The villain in the movie draws a full house,

just like Joseph.

[Joseph] Aces, fours, sixes.

[Andy] The Bond has a straight flush.

[Joseph] Correct.

And Joseph had hacked the shuffler

to give me that same winning hand.

You did this with code alone? Yes.

In Texas Hold'em, like any kind of poker,

the winner is determined by who has the best hand.

Three of a kind beats two pair

or a straight flush beats a straight.

If a player can control the deck order, they can make sure

that they get the best hand every time.

But there's one big challenge to that approach to cheating.

So wouldn't cutting the deck ruin

this whole like perfect reordering you've done?

Yeah, exactly.

No, you spotted it.

I did not cut the deck here.

So what if the deck is cut?

What do you do then?

I actually have an interesting scenario for you.

I have a mathematically solved deck.

So if we have four players at the table,

no matter what the person sitting

at the dealer button will always win.

Cool, okay, let's see that.

[tense music]

Go ahead and give you the dealer button.

So the way this works is a computer program was written

to try to solve an order of a deck

that no matter where a dealer would cut it,

that position would always win.

It's a bit counterintuitive,

but mathematicians have determined the way to order a deck

so that a specific person at the table will have

the winning hand every time, even if the deck is cut,

so long as you know where at the table they're going

to be sitting.

Surprising that's possible.

So I'm gonna go ahead and cut the deck

and we can deal.

That solves deck trick meant Joseph had

actually reprogrammed the shuffler to order all the cards

such that no matter where the deck is cut,

I would have the best hand.

In this case, two pair.

Queens and nine, so you're two pair of beats mine.

So this does solve the problem of cutting the deck,

but it does seem like if you kept doing

that then players would get suspicious like

why does this guy keep winning?

Why does he keep having the best hands?

Yeah, 100%, they would start asking questions.

There's a much better way we can cheat.

The way the sorting works is there's actually a camera

inside the shuffler and it will read the cards.

And it's kind of funny because it's put in there

for security purposes so that if somebody were

to remove an ace of spades

and add another seven of diamonds,

it would alert the dealer.

In this case, we're actually gonna take advantage

of there's a camera in there to cheat.

[tense music]

So this would be our cheating strategy.

Take advantage of the incredible fact

that there's a camera inside the shuffler.

Hack the machine to get access to that camera,

learn the exact deck order,

and send it via Bluetooth to a phone app.

After all, the Stealthiest way

to win in poker is not to have the best hand.

It's simply to know whether or not you have the best hand

so you can bet or fold accordingly.

What was it that led you to wanna hack the Deckmate 2

in the first place?

It really actually started with a really suspicious hand

in televised poker that just had a lot

of people talking about it.

[Andy] In September of 2022, a scandal blew up the world

of high stakes live streamed poker

in a hand at Los Angeles's Hustler Casino Live

a relative novice holding nothing but a jack of clubs

and a four of hearts successfully called the bluff

of a veteran player.

No player could possibly have thought

that her weak hand would be good enough to call a bluff,

thousands of outraged poker players argued,

unless the person holding it had some extra knowledge

that her opponent's hand was even worse.

In other words, she must have been cheating,

which she denied.

The casino responded with an investigation

which concluded that there had been no evidence

of foul play.

But one little detail in the report

about the card shuffler stuck out to Joseph.

It specifically said it could not be compromised.

And in my world, when people start saying things

are unhackable or very difficult to do,

well to us, that's a bait to prove 'em wrong.

[Andy] Joseph and a couple

of colleagues spent months reverse engineering the shuffler.

They bought their own Deckmate 2

for testing from a secondhand seller,

and the researcher's hacking technique took advantage

of how detonate shuffler are designed

to prevent their code from being altered.

The machine's firmware is designed to take a hash

of its code on startup, a mathematical function

that converts the code into a unique string of characters

and then checks whether that string is different

from the known hash value of the unaltered code.

But Joseph and his collaborators found

that they could simply change that hash value too,

so that the hash of the altered code matches

and no change is detected.

Even then though, a poker cheating hacker would still need

a way to get access to a shufflers internals

to install their code.

Joseph found one, the USB port.

It turns out that the Deckmate 2 has a USB port

that often sits exposed under the table.

So as long as we're able to reach under

and plug this little device into the USB port, we're golden.

So how does this work?

So essentially this is just a miniature computer

and what it will do is we'll plug it into the machine

and it will compromise it, rewrite the code,

and start communicating with the cell phone.

So the way we do that is right here on the back

of the shuffler is a USB port.

So we could either walk up to a live game

and plug the device in, or if we had access to the device

before any player showed up, we could even hide it

inside internally, all we have to do is reach down

and plug this thing in.

The shuffler shufflers gonna actually be flush

with the table and the ports are gonna be down by your knee.

In a poker room, there's so much going on,

people changing seats,

so it's really common to drop some chips or something.

Reach down and just plug something in.

I chose to use this device,

but we could even use a malicious Android phone

and just plug a phone in. Say we're charging it.

So you can charge your phone in

that port in the middle of a game.

Yeah, people in poker tournaments will regularly plug

their phones into casino equipment.

[Andy] So then how does it help you cheat?

This device has a Bluetooth module

and it will wirelessly connect to this phone

and every time a deck gets shuffled,

it will get the exact order

from the camera and send it to me.

So then you know the order

after the deck has been shuffled,

but doesn't it get cut again?

Actually the app solves that problem.

Once we receive our hand, we can look at it,

enter the details we need and we'll know the order.

In other words, Joseph's app has a way around the problem

of a dealer cutting the deck.

The cheater or their partner can enter

into the app the two cards in their hands.

With just the knowledge of those cards.

The app can determine where in the deck

the dealer has cut to.

That's enough for the app to tell the cheater every hand

that the players will end up with

after all the cards are dealt.

A player messing with their phone in the middle

of a game is often against casino rules.

So we decided to try a scheme

where Joseph looks at his two cards and then folds.

Once he's outta the game, he's allowed to pick up his phone

and then he can use the app to see who will win

and signal to me how to bet.

The moment it comes out and I see my two cards,

we'll know every single person's hand.

When Joseph and his team presented

this vulnerability two years ago,

I reached out to the manufacturer,

a firm called Shuffle Master.

A spokesperson for Shuffle Master's parent company,

Light & Wonder, told me at the time

that Joseph's hacking technique was unrealistic

in an actual casino setting.

The company didn't even mention whether a plan

to fix the shufflers security vulnerabilities.

As we prepared to test out how a hacked shuffler can

in fact let a player cheat in a real game of poker.

As you'll see in a moment.

It's a crazy little hand.

I reached out to the company again

to see if they had fixed their security flaws

in the two years since they were revealed.

This time, a spokesperson for Light & Wonder responded

and said they've now patched those security flaws

in virtually every shuffler in use in casinos today

by updating their firmware.

But Joseph was still skeptical.

After all, the machines have no mechanism

to receive software updates over the internet.

They would need a technician to go

and apply a firmware update.

Now maybe that happened, they could also just be implying

that they disabled the USB port,

but in reality we could use the ethernet port.

There's a number of ways to pull this off

and even if they do that, that does not fix the issue

of a maintenance person pulling this off.

Because once you have access to the internals,

it's kind of game over.

To get another opinion about this, I spoke to Doug Polk,

a YouTuber and cardhouse owner in Austin, Texas.

So these shuffle machines,

I've seen them all over the place, frankly.

I've seen them from the largest,

most legitimate established casinos all the way down

to people's home games.

So Doug, how do you feel

about the Deckmate 2 card shuffler?

Like do you trust this thing?

The Deckmate 2 in a casino location

you shouldn't be too scared of.

They have all these casino contracts,

so they have licensed people fixing problems

that there might be.

The problem is once someone has a Deckmate 2

on a black market or a secondary market,

they're now no longer being upkept by the company itself.

Some guy is just basically in the back fixing the machine

and then putting it on the table.

I have heard so many cheating stories

of people using these to cheat players out

of their money when it's not happening at a casino location.

In fact, I've even heard of stories

where at major casinos there were issues at play

with the Deckmate 2.

If there's a camera that knows the cards,

there is always some kind of underlying threat.

Customers are gonna be essentially at the mercy

of the person setting up the machine.

What if you like show up to somebody's private game

or you're in an unlicensed cardhouse of some kind

and you see that there's a Deckmate 2 being used,

what do you do?

If you're showing up in a private game

and there's a shuffler?

I would say you should run for the hills.

We weren't given permission by any casino

to replicate the test on their property.

So we're going off the strip to set up a private game

in a casino-like environment,

a dealer training school in Las Vegas

where I'm going to play against real players who don't know

that the odds are stacked against them.

But before we try this experiment, I need a game plan

on how to cheat like a pro.

So I went to see Sal Piacente,

a security consultant who advises casinos on cheating.

So how are people cheating in casinos in the real world?

Depends on the game.

You know in dice you're switching dice, you're sliding dice.

In baccarat you're doing false shuffles

where a dealer has a mix of cards.

There are so many ways of cheating at poker.

How do you deal with the fact

that the deck's gonna get cut?

Well, there's a way beating the cut.

They call it a pass.

So a pass looks like this.

I just set the deck up.

There's my jack of spades on top.

So now you would cut the deck.

When you cut that jack of spade now goes

right into the middle.

So now when I get ready to deal...

[cards flicking]

I don't know, how did you do that?

It's a pass.

I actually recut the cards.

I'll do it face up so you can see it.

When you cut the cards, I complete the cut,

but I leave it sticking out just a little bit in the back.

When I square the deck up, I get a break above it.

And then real quick, I just transpose those two halves.

[Andy] Oh my god, that was so slick.

I really didn't catch that the first time at all.

I see a lot of surveillance footage in poker

you're switching cards with another player,

you're marking cards,

you have the deal doing false shuffles.

What is a false shuffle?

I'll just give you a quick example of one card.

The jack of spades.

I want to keep that card on top.

If you shuffle this way in the hands,

this is an old style of shuffle

where they were shuffling just like this

and this deck, it looks like it's getting mixed

and I'm only controlling one card here.

[cards flicking]

[Andy] And that card never moves?

No, well it did move, but I'm keeping track of it.

It goes to the bottom, back to the top.

All these devious ways that dealers can cheat

is one reason casinos have started

to use shuffling machines in the first place.

Automating the shuffle takes

the dealer's motivations outta the equation.

Have you heard

about people rigging Deckmate 2 shufflers to cheat?

Well, it's happening a lot in private games.

I've never heard of being done in the casino.

And what about cardhouses in, you know,

Texas or other states where you might have

these gambling establishments that are not regulated

in the same way they are here in Vegas?

Anything goes. [chuckles]

Then anything goes.

Have you talked to people who have done it?

Correct, so these cheaters were able to get the machines

and gaff 'em before they hit the table.

I personally have never heard

of it being done in the casino.

However, if there's money involved,

believe me, someone's staying up late at night

to figure out how to steal that money.

So there seemed to be a lot of ways

to compromise a card shuffler before a game,

but that was only half of our scheme.

Now I needed a way to communicate

with Joseph secretly during the game.

A system of signaling with my cheating partner.

The number one scam that happens

in poker rooms every day

throughout the world undetected is signaling.

How do you send these covert signals?

There's a couple of ways of doing it.

For example, a common gadget in the old days would be this.

This is called a thumper.

And what happens is you would wear this on your body

and this would go up to your thigh.

I'd have this like down my pant leg or something?

Correct. Right.

And then this would be in my shoe

and this would be on my big toe.

And when I want to give you a signal, I just press down

and that'll vibrate in your hand.

[Andy] Yeah, in the movie Casino

there's a really clear example of a cheating team using

a thumper and getting caught.

[stun baton zapping] [man grunting]

I needed a more subtle approach.

So what are some other innovative ways

that you've seen people cheat?

Another innovative way where people communicate

is a device that looks like this.

This is a loop that goes around your neck.

All this wiring is underneath your clothing.

This goes through a hole in your pants

and plugs into your iPhone.

And then, I dunno if you can see that,

that's the earpiece. That is tiny.

This little thing goes in your ear?

Yeah. This is an earpiece?

I would take it like this

and before you go onto the casino floor,

you just take it and now it's right next to my eardrum.

And now when my partner is talking to me,

I can hear her like a third voice in my head.

That's crazy, Sal.

I feel like I was told in kindergarten not

to do this kind of thing.

So how do you actually get it out then?

There only one way to get that out with a magnet.

Wow. And you could see...

There it is.

But I wasn't sure if this voice in my ear approach

would work an our cheating scenario.

I needed a partner at the table

who could see the cards in their hands,

enter a couple of them into an app

and then silently tell me what to do.

So I laid out our whole scheme to sell.

Okay, so we're actually gonna do this.

We are going to set up a game with unsuspecting players.

We're gonna hack the Deckmate 2 shuffler

and we'd love your advice about how to do this

so we don't get caught.

Oh, I'm definitely interested in being involved in this.

I'd love to introduce you then to Joseph Tartaro,

who is our hacker here. Hi, Sal.

Hey. So nice to meet you.

Pleasure, my pleasure. Thanks for having me.

We'd appreciate your advice about how

to actually pull this off.

Is the machine telling you who's gonna win?

It's going to tell every hand in rank

of which seat's going to win.

So Joseph is gonna have on his phone

an app that he created.

The Hack Shuffler is gonna transmit the full exact deck

order to his phone.

I need to be able to communicate

to him if he has the top hand to stay in

or just fold right now.

I'm an absolutely terrible poker player.

I'm gonna depend entirely on Joseph to tell me what to do

'cause he's my cheating partner.

The question is how should he signal?

Chips, how many chips in your hand.

Could the signal be raise, fold, call?

Yeah, if you just play with one chip

that's telling him to fold.

Two chips, that means call.

You play with all your chips, that means raise.

So this would be our signaling system.

Joseph picks up one chip, I fold.

Two, I call.

Three, I raise.

You're an experienced poker player.

I'm not.

I would like to be told like exactly what to do

like an idiot poker robot.

Three chips, three commands,

and I will just follow it like a computer

that you're programming.

You think that'll work?

Why not?

Let's give it a try.

Let's make some money. I'm in.

[Andy] And now it's time to test

if Joseph's exploit can be pulled off

in an actual high stakes game of Texas Hold'em.

And Sal will be watching us on monitors in another room.

As we settle into our places at the table

and mentally run through everything

to make sure we're straight,

Joseph's USB hacking device is in place.

He has the app running on his phone.

When everything was ready we brought in

our unsuspecting poker players,

a couple of friendly Las Vegas locals,

named Elle and Fernando.

They're unaware of the experiment,

that Joseph and I know each other,

or that anyone will be cheating.

The dealer pulls a freshly shuffled deck

from the Deckmate 2 and cuts it.

It's time to play.

My strategy at the moment will be

to look at my two cards fold,

and then I can pull out my phone, enter the details I need,

and then I can start signaling to Andy

and make sure that he wins as much money as we can.

It's up to you. [tense music]

And I'm folding. Fold, okay.

[Andy] Early on I could see

our Hack Shuffler cheating system was working.

Joseph folded, picked up his phone

and started playing with three chips in his hand.

He was signaling to me to bet.

So it's up to you.

Check, Andy?

I think I will actually bet.

Six to stay in.

He's playing. Six to stay in.

Yeah. Okay. [tense music]

Turn these. [tense music]

Okay. Hold that.

Six. [tense music]

Action to you.

Okay, check. Check.

Six. I don't like it.

[chuckles] I fold. [tense music]

It's all yours. All yours, buddy.

[Andy] And sure enough, I won the hand with a straight.

Money is not real.

I'm still sweating though, I dunno why.

Even though I was cheating or maybe because I was cheating,

I found I was incredibly nervous.

On other hands, Joseph and I flubbed our communications.

At one point, I misread his signal

and folded when I had a winning hand

and he looked at me like I was an idiot.

I'll fold.

I'll fold.

I'll fold.

I'm out.

More than an hour into our three hour game,

I kept drawing nothing but bad hands.

I'll fold. [tense music]

Joseph this loosening up.

It was clear to me that even though I had a hacker

on my side, luck was not.

After all, we hacked the shuffler to let me know

when I had a good hand not to actually deal me one.

Fernando on the other hand, seemed to be on a hot streak.

Just from paying antes and folding on all my losing hands.

My pile of chips was dwindling and his was growing.

To make matters worse, Joseph forgot at one point

that he was supposed to signal to me with his left hand

and I couldn't see how many chips

he was holding in his right hand.

I had to not so subtly remind him.

Joseph, are you left-handed?

Hmm? No. Okay.

Were the other players onto us?

Would Sal, who was on the security cam,

spot what we were doing?

Most worrying of all,

it started to seem like I might cheat and still lose.

After more than an hour of watching my stack

of chips shrink, I finally got the hidden signal

from Joseph to raise.

I could see this might be my last chance,

and Fernando feeling confident,

seemed ready to match my bets.

I went all in. [tense music]

10, 8, what do you have? Ace high.

Some pretty hands, but... All work.

[Joseph] Getting spicy over here.

You see the ace and you're just like,

Nah, I'm not faulting this thing.

Was just feeling lucky. Nice hand.

[Andy] A few minutes later, thanks to Joseph's signal,

I called a big bet from Elle.

That's 40,000. Even if I didn't go...

I think that's the rest, she's all in.

[Joseph] You're kind of all in on the next hand anyway.

Yeah. [tense music]

What you guys got?

[Elle groans] Pair of fours, take it.

You weren't scared of the jack, huh?

No. All right, thanks guys.

Thank you, Elle. Good luck.

[Joseph] Thanks for all the money. [chuckles]

Not long after that I got the signal

from Joseph to bet big again.

I'll do 40. 40,000.

Spicy game. [Fernando chuckles]

I'll call that. [tense music]

You can do whatever I want, right?

Yeah, pretty Much. So I'll make it a hundred.

Hundred thousand's the bet. [tense music]

Yikes, here we go. The moment of truth.

It's a crazy little hand.

I'm gonna do another hundred thousand.

Another a hundred thousand. You guys are aggressive.

Right. All right.

You're calling too? Yeah, I'm calling.

He's calling. What do you guys have?

When the cards came out, Fernando had a pair of aces,

but I had surprised him with a straight on the river.

A pretty shocking hand that nearly cleaned Fernando out.

You got so lucky.

Were you bluffing the whole time?

He got lucky at the end.

I'm sorry, that was kind of ridiculous.

I owe you an apology, but I'll take it.

It's the semi bluff.

You know you bluff until you make it.

Before long... Go all in.

All in. [tense music]

It was all over.

Two pair. [tense music]

And that's that.

Yep, it was time to bring Elle back in and come clean.

Welcome back.

I have to confess, both of you are far better poker players

than I am and I was cheating this whole game.

I guess the question is, can you tell how I was cheating?

I did not tell anything that was up.

Maybe you looked at your phone a couple times.

I don't know.

Actually it was Joseph who was looking at his phone.

It was the shuffler.

The shuffler was hacked.

It transmitted via Bluetooth,

the exact order of the deck to Joseph's phone.

[chuckles] Wow.

He was then signaling to me whether I should bet

or fold because honestly I'm a terrible poker player.

I have no idea what I'm doing.

After our players left,

we brought in Sal to get his thoughts.

[chuckling] That was fantastic.

How's it going? Gentlemen, that was great.

It worked beautifully.

You're a dangerous individual, my friend.

I wouldn't want to be against you.

Sal, you have seen thousands of hours

of actual surveillance footage,

including of people cheating.

Watching this as you were this whole time.

How do you think this rates?

Like what did you think of this as a scam?

I thought it was right on top.

I mean, there's nothing to see.

We were playing it very aggressively.

If we had had more time and just like played

more conservatively with a smaller edge,

I think it could have been even stealthier, right?

Totally, totally.

There's no doubt this would've went on undetected.

The real story here isn't just about cheating at poker,

it's about trust.

As we add more digital smart components to everything

from our household products to cars to medical devices,

all of it becomes more vulnerable

to surveillance and manipulation.

If a smart card shuffler can let a hacker rig

a game of poker, it's worth asking,

What other digital devices in our lives might be a risk?

Who else can manipulate the machines around us

to get an unfair advantage?

And it's worth remembering that sometimes

the old analog approach can even the odds.

[bright music]