Shuffle Up and Deal: Analyzing the Security of Automated Card Shufflers
summary
Reverse engineering of ShuffleMaster Deckmate One and Deckmate 2 finds no secure boot, a predictable LCG seeded from a timer, universal hardcoded credentials and update key (cracked with John the Ripper), and exposed USB/serial/ethernet interfaces. Firmware is dumped via SD/Flash and a custom update packer/unpacker is built, enabling a Raspberry Pi Zero exploit that exfiltrates camera reads to a phone. Demonstrations show camera-assisted leak, false shuffle and card‑count bypass working in proof‑of‑concept; recommend locking bottom ports and fixing GAT/G2S attestation.
AI-written summary · about
chapters (12)
- 0:00Research team and motivation
- 1:49DeckMate card shufflers overview
- 5:41Attackers and access vectors
- 8:35Casino architecture and G2S
- 14:15Game Authentication Terminal flaws
- 16:27DeckMate One firmware reverse engineering
- 23:33DeckMate Two hardware analysis
- 27:45DeckMate Two update vulnerabilities
- 30:59Random number generation flaws
- 33:26Cheating strategies for DeckMate Two
- 35:53Live card tracking attack demo
- 39:34Conclusions and recommendations
related talks
01h 03mHack To Discover Weaknesses In A Series Of Smartcards
38mMission mPOSsible
40mExposing The Deep-Secure Elements Of Smartcards
23mPoint of Sale System Architecture and Security
40mWhen hardware attacks scale
48mEverybody be Cool, This is a Robbery!
24mSecurity through Transparency: Tales from the RP2350 Hacking Challenge
36mOpen Sesame - Or How Secure Is Your Stuff In Electronic Lockers