How to Hack a Poker Game

0:00Every company says AI will make employees more productive, but most employees are still stuck waiting on IT. Waiting for app access, waiting for password resets, waiting for someone to fix a laptop issue so they can get back to work. That operational drag adds up fast and IT teams are overwhelmed trying to keep up. Serval was built to automate that work. You describe what you want automated in plain English and Serval builds it for you. No complicated workflow builders, no consultants, just faster support and fewer tickets slowing everyone down. Serval enables IT teams to build automations using plain English instead of drag-and-drop workflow builders.

0:34The platform is designed to eliminate repetitive tickets so IT can focus on strategic work instead of constant firefighting. Serval positions IT as the AI-powered operational backbone of the company, not just a support function. The company guarantees customers can automate 50 % of IT tickets and backs it up with a free 4-week pilot. Learn more or start a free 4-week pilot at serval.com slash uncanny. That's S-E-R-V-A-L dot com slash uncanny. Serval dot com slash uncanny. This show is supported by OutShift, Cisco's incubation engine. Today's AI agents operate in silos, limiting their true potential.

1:16We've been focused on building bigger, smarter models, but scaling up is just one approach. To reach superintelligence together, we need to do more. We need to scale out. And we actually have a blueprint from 70 ,000 years ago. Humans didn't just get smarter individually. The cognitive revolution transformed society because we began sharing knowledge, goals, and innovation. Agents are now at that same inflection point. They can connect, but they can't think together. That's why Outshift by Cisco is building the Internet of Cognition, transforming AI from isolated systems into orchestrated superintelligence.

1:54By creating an open, interoperable infrastructure, Outshift by Cisco is enabling agents and humans to share intent, context, and reasoning. The cognitive evolution for agents is here. Explore the Internet of Cognition at outshift.com. That's outshift.com. Hey, Lauren. How are you doing? I'm good. How are you? I am fantastic today. Thanks. You rarely hear that. happy for you. Before we dive into the show, I have to ask, are you a poker player? Not exactly. What do you mean not exactly? No, I mean, so you've probably heard of this little thing called CES that happens every year in Las Vegas. So for several years, I would go cover CES, often for your team, and would play a little bit of Pi Gao poker.

2:43Are you familiar with Pi Gao? Yeah, it's one of those games I don't understand. Yeah, it's a combination of Pai Gao, which is a Chinese game with dominoes and American poker. And it's played at casinos. You get two hands, you get a set of five cards and a set of two cards, and you're essentially playing against the dealer. And it's quote unquote poker, right? So that's the extent of the gambling that I do. Well, I'm already lost. Yeah. How about you? Do you have a poker face? No, I have sportsbook face, which is me just staring at my phone, waiting for the scores to come in. Is that a real thing?

3:16I think we just coined that. I think so. So if I'm not mistaken, you're asking this because our guest today definitely has some recent experience playing poker. Yeah. Andy Greenberg, welcome down Caney Valley. We're so thrilled to have you on the show. How are you doing? Glad to be here again. Good to talk to you both. All right, Andy, get your chips ready because we're about to double down on poker cheating. Okay, here we go with as many poker puns as possible in this episode.

3:46This is Wired's Uncanny Valley, a show about the people, power, and influence of Silicon Valley. Today, we're hacking our way through a poker game. Recently, our colleague Andy Greenberg and the crew at Wired's Hack Lab experimented with how the card shuffler machine Deckmate 2, one of the most common machines used at casinos, card houses, and private games, could be altered to cheat in a poker game. Then last week, the U.S. Justice Department published an indictment against 31 people, among them NBA stars and members of the mafia, for allegedly running a network of rigged gambling games. One of their rigging methods, and the one described in detail in the indictment, was a manipulation of the Deckmate 2 shuffling machine in almost exactly the same way that Andy and the Hack Lab folks at Wired previously showed.

4:35We'll dive into why their hackability matters for everyone involved, even for those of us who don't frequent a poker table. I'm Michael Kalori, Director of Consumer Tech and Culture. I'm Lauren Good. I'm a senior correspondent. And I'm Andy Greenberg, senior writer covering hacking, cybersecurity, surveillance, and apparently cheating at poker.

5:00So Andy, let's start with what made you want to chase the story. Why did you and the team here at Wired get interested in seeing if you could rig the Deckmate 2 shuffling machine? Well, this story actually goes back three years kind of in its origin. So this group of security researchers who I talk to pretty frequently at a company called IOactive, they actually got this idea from watching this kind of streamed televised game of poker at Los Angeles' Hustler Live Casino. There is this notorious game that every poker player in America, it seems like, is now familiar with where this inexperienced player who was being staked by a pro, like given lots of money to gamble with, called the bluff of this other veteran player on a major, major pot.

5:45And she called that bluff with a terrible hand, like a jack and a four, basically. And there's no way every poker player knows that you would ever know that you could call a bluff with a hand that bad unless you somehow knew that the other player's hand was even worse. It would make no sense unless you were cheating, poker players tell me at least. Of course, the player who called that bluff, she denies cheating. But this was a huge scandal and there was a big investigation into the game. There was actually like a kind of official report written about the incident in which Hustler Live Casino had to try to get to the bottom of what happened.

6:19And in that report, they looked at all the different possibilities of the ways that the noob player might have cheated, including hacking the automated shuffler machine called the Deckmate that was used in that game and actually used in casinos and private games and gambling establishments all around the world. This machine that automatically shuffles cards. And in that investigative report, it stated, well, we can rule out the automated shuffler because this thing is basically unhackable. It cannot be compromised. That's what it said in the report. So coming back to my sources, these researchers at IOactive, the security firm, they read that.

6:56And to any hacker, honestly, a description like that is just an invitation to prove someone wrong. Like if you hear that something is unhackable, then you cannot help, apparently, if you are a hacker, but try to find its vulnerabilities, which they did. And so by 2023, they had found a whole collection of vulnerabilities in the Deckmate 2 that they were about to present at the Black Hat Hacker Conference in Las Vegas. And they told me about it. By the summer of 2023, they had in fact come up with this technique where they could insert a little device that they had developed into the USB port that sits exposed on the back of a Deckmate 2 shuffler, often like by players' knees under the table.

7:40The machine kind of sits flush with the table. The body of it is below the table, including this exposed USB port. And you can stick a little device into that port and then alter the code of the machine, get access to, this is kind of unbelievable, but the Deckmate 2 has a camera inside of it, put there by the manufacturer. So their hacking device would gain access to that camera and learn the entire deck order as it's being shuffled and then transmit that deck order to a cheating player so that they would know what is in everybody's hand in a game of Texas Hold 'em and be able to bet or fold and essentially cheat perfectly and undetectably.

8:17So why does the company put a camera inside the automated shuffling machine? Well, ironically, that camera is inside the machine to prevent cheating, to ensure the integrity of the deck, basically. It looks to see that all 52 cards are there, that nobody has like slipped in an extra ace or something. But, you know, yes, like it is completely nuts. It feels to me that there is a camera inside this thing where if you're able to hack and then there were, in fact, vulnerabilities in the firmware as well that allowed the security researchers at IOactive to alter the code of the machine undetectably.

8:52And that means that you can get access to that camera and learn the deck order. You know, it did not seem like a good idea to have a camera inside of this thing waiting to be accessed. by hackers. So you hooked up with these researchers recently in Las Vegas. DEF CON is like the big hacker conference that takes place in Las Vegas every year. And you're like, OK, we're in Las Vegas. I know that these guys have this hacked machine. I want to see if it works. So tell us about your experiment. Right. So in 2023, WeAWire broke the story of the vulnerabilities in this machine, thanks to IOactive telling me about them.

9:28And then now in 2025, two years later, we on the video team for our Hack Lab series, we're just thinking like, what is a fun hacking demonstration we can show on camera? And so I had this idea of like, what about that automated card shuffler that got hacked two years ago? Maybe we could, if that vulnerability still exists in these machines, we could demonstrate that. And that's like this really cool Hollywood hack to show on video. And so we got Joseph Tortaro, the lead researcher from IOactive, to join us and not only demonstrate how to hack a Deckmate 2 card shuffler, but we had him and two unsuspecting players sit in on a real game of Texas Hold 'em in which he hacked the shuffler and acted as my cheating partner.

10:09And we actually tried out this exploit in a real game where I cheated against people who had no idea that the shuffler had been hacked. When I finally met Joseph in person in Vegas, I did want to see how the Deckmate 2 works firsthand. Like he was able to open up the machine and show me how it operates. How does the Deckmate 2 work internally? Like, is it actually the same way that I would like take a deck and riffle shuffle it like this? Is it doing that mechanically inside? No, actually it has 20, 23 or 26 different shelves and it will generate a random number. So it will eventually just produce a deck.

10:44It's really used to make sure that the casino just gets more hands an hour. Let me show you. So the door opened here.

10:54And now we wait. And the dealer just pulls the deck out of this little container at the top. Correct. There's your deck. Yeah, here we go. So if the point of the hacking technique is to learn the perfect order of the deck, then what happens once the dealer starts cutting the deck? That is a really good question. It seems like if you just cut the deck when it came out of the shuffler before everybody's hands are dealt, then that would solve this problem of, you know, the cheater knowing the order. But in a game of Texas Hold 'em, once you see what's in your hand or you see the three flop cards, the first cards that are put out publicly onto the table, you'll know exactly where the dealer has cut to or where a player has cut to before the hands are dealt.

11:36And so with the app that IOactive built, this custom cheating app that receives the order of the deck, you can actually, you know, quietly put into the app the cards in your hands or the flop cards on the table. And as soon as you do that, it will tell you what's in everybody else's hand. That solves the problem of somebody cutting the deck. So something that's still sticking in my mind is that in order to compromise the machine, you have to plug this custom-made device that IOactive developed into the USB port of the Deckmate 2. So how do you do that? Like, how do they actually get access to the machine if they're in a situation where, like, they're at a casino or they're at a private game and they want to cheat?

12:17Right. So the way that Joseph, the security researcher, describes this is that port is often sitting under the table by your knees in a casino. So, you know, if you're bold enough to like pretend you dropped your chips or a sandwich or whatever, you can just like duck under the table, plug in this device and start cheating. The company that sells this shuffling machine from the very beginning said that that's not a realistic scenario. You know, things are monitored too closely in a casino. That's not actually possible. I really don't know. And of course, we didn't test that out in our demo in a real casino.

12:47It seems like it could be possible. Joseph points out that people even sometimes charge their phones in that port because it provides power, too. So you could use a malicious Android phone, like an Android phone set up to carry out the same exploit instead of his little hacking device plugged into the shuffler. But also there's this whole other threat model. Once you've seen that by hacking the shuffler through the USB port, you can cheat in this incredibly effective way, that also means that a maintenance person who has access to the machine before the game or the host of the game themselves, if the casino is in on it, if the host of this private game, if it's their shuffler, they can hack their own machine and allow somebody to cheat and you would never know.

13:27So Andy, how do the cheaters who are at the table actually participate in this? Like, how do you see what's going on if you're not a person who's sitting there staring at your phone screen that has access to all of that digital information? Well, I think the point you're raising maybe is that you're not supposed to be messing with your phone in the middle of a high stakes poker game. If you're in the game, you're not allowed to use your phone in some casinos, in certain private games, if enough money is on the line. So the system that Joseph and I set up in our hacking demo that we kind of just like figured out on the fly through a bit of experimentation was that he, being my cheating partner, would fold and get out of the game on the hands where we would cheat.

14:09And then once he was out of the game, he was able to pick up his phone and nobody would think twice about that. So he would look at his hand, he would fold, then he would pick up his phone and quietly put into the app on his phone the two cards in his hand. And then he would know who had the best hand. In fact, he would know everybody's hands. And then he would silently signal to me how to bet or to fold. And the way we actually did that was through a kind of system of covert signaling that used the number of chips he was holding in his hand. I'm an absolutely terrible poker player. I have no idea what I'm doing, but I would just watch Joseph's signals on these hands where he had folded and was out of the game and was instead my cheating partner to see how many chips he was messing with in his hand.

14:53And through those chips alone, he would give me the signal of what to do. And he would know when I had the best hand and he would tell me to bet big and I would win these massive pots. What was he doing with his hands? Like, what did he do with the chips? Our system was just like, play with one chip means fold. Play with two means call. Play with three means raise. And so I would just do as I was told. And when I had the winning hand and I saw him messing with those three chips, I would sometimes go all in and take these unsuspecting players for enormous sums of money.

15:31This is a Bond movie. This actually is a Bond movie. Andy, you are Wired's James Bond. Well, it's funny you should say that because we experimented with other ways of cheating, too, and other ways of hacking the shuffler. You can not only learn the exact order of the deck, but you can actually reorder the deck by hacking it, too. And Joseph tried that, and he demonstrated to me that he could, in fact, replicate the exact hand from Casino Royale where Bond has a straight flush, and we played out that hand, too. He can, with code alone, deal you exactly the hand he wants you to have. But that just seemed like a kind of actually clumsy way of cheating where it would start to become apparent if you had like these crazy, amazing James Bond hands too often.

16:11So instead, we just stuck with this much more subtle technique of learning the deck order rather than messing with the deck order. Let's take a quick break. When we come back, we're going to find out how this cheating strategy panned out for Andy and why the FBI, the mafia and the NBA are all involved with the Deckmate 2 machine.

16:36This week on the political scene from The New Yorker, Trump's rupture in the world order. Europe caught between two adversarial great powers. That's basically dialing back the clock to not only pre-World War II, but really it's a pre-20th century view of the world. And I would say it's a world of permanent insecurity that we're looking at. Join me, Evan Osnos, and my colleagues Jane Mayer and Susan Glasser every Friday on The Political Scene, available wherever you get your podcasts.

17:14Welcome back to Uncanny Valley. Today, we're talking about hacking poker games. So, Andy, you're sitting in a room in Las Vegas at a poker game. You're not playing with real money, but everybody at the table has chips and everybody wants to win. You are sitting next to your co-conspirator from IO Active, and then there are two unsuspecting players at the table with you. Joseph is watching the cards on his app. He knows who at the table has the best hand, and he is signaling to you to fold, to call, or to raise by playing with a certain number of chips in his hand. Did you clean them out? Did this work?

17:49Well, I am actually such a bad poker player that I was still losing for the first hour of the game, which is kind of amazing. I thought this was going to be the most humiliating evening of my life that I went all the way to Vegas, set up this like incredibly elaborate experiment to cheat and still lost like that really almost happened. But that was just actually bad luck. Like we were not actually hacking the shuffler to give me good hands. We were just hacking the shuffler to know when I had the best hand. And so it took me like more than an hour to start getting good hands. And then once I did, I would know exactly when I had the best hand thanks to Joseph's signals.

18:22and yes, we did eventually just clean out these two players. If it had been real money, it would have been a very lucrative scheme. And ultimately, I felt pretty bad about having done this to them on camera, and by the end of the night, I did confess to them. I have to confess, both of you are far better poker players than I am, and I was cheating this whole game. I guess the question is, can you tell how I was cheating? I did not tell anything it was up. Maybe you looked at your phone a couple times? I don't know. Actually, it was Joseph who was looking at his phone. It was the shuffler. The shuffler was hacked.

18:56It transmitted via Bluetooth the exact order of the deck to Joseph's phone. He was then signaling to me whether I should bet or fold. Because honestly, I'm a terrible poker player. I have no idea what I'm doing. So that experiment was run over the summer. And I want to switch gears now to the news from the government's indictment last week. because the indictment document alleges that members of several organized crime families and some well-known figures from the NBA, including Portland Trailblazers coach Chauncey Billups and a former player and assistant coach named Damon Jones, were all part of a network of rigged gambling games.

19:35Miami Heat guard Terry Rozier was charged in a separate alleged gambling scheme as well. But for the main scheme, the rigged card games, It seems that one of the methods used was very similar to the one that you and Joseph used in your experiment. I have to know how you reacted to the news when you saw that the Deckmate 2 was actually named in the indictment. I mean, I could not believe it. I'd seen the headlines that morning of these NBA figures who had been arrested in this scheme. And then I just got busy with other work. I had no sense at all that this was any kind of hacking operation. It took me hours to start like reading other people's reports and then finally the indictment.

20:13And I just could not believe it that they had actually done almost exactly what we had done. We published our video on October 10th. And then just two weeks later, this alleged mafia run NBA involves gambling scheme had actually done almost exactly the same thing that we had just revealed. I mean, it was just a bizarre coincidence. After you did read the indictment, what did you learn about how similar this operation was to the one that you experienced? Like, were there other hacking mechanisms used? Well, it was actually kind of remarkable how close it was to the scheme that Joseph and I had developed almost just by chance, it felt like.

20:50I mean, we were just making it up on the fly, practically. They didn't use a USB device to, like, hack their shuffler on the spot. These were private games where the host of the game had set up a rigged game. So it was their shuffler. They had hacked it ahead of time. But they had done almost exactly the same thing of not reordering the deck, but rather learning the deck order and transmitting it. In fact, they transmitted it over the internet to some remote operator in a different state, according to the Justice Department, who would then send the deck order back to one of the players in the game.

21:21Just like Joseph being my cheating partner, they had these players in the game who they called the quarterback or the driver, the kind of secret cheating mastermind in the game. who I think similarly was there so that they could look at their cards and then fold, then pick up their phone, and it wouldn't be suspicious, and then start, once they learned the deck order from their phone, signaling to everybody else in the game. They were using exactly the same covert signaling system that Joseph and I had developed, but they were actually using it to steal hundreds of thousands, ultimately millions of dollars from these victims.

21:55That's wild. So in the years that you've been reporting about the Deckmate 2, you've reached out to the company that makes it several times, and they've told you on different occasions that they've addressed the security concerns. Maybe they disabled the USB port or made other changes to the hardware or the software. The security experts that you've spoken to, I'm sure, have thoughts about these changes that they've made. Are they enough? Well, it's interesting because in 2023, when I wrote about the Deckmate 2 for the first time, back then, Light and Wonder, the parent company of ShuffleMaster, which sells the Deckmate 2, told me that this just wasn't realistic, that it really didn't matter, that this could never be pulled off in a casino, kind of not really even thinking about the fact that you could use a rigged shuffler in a private game or in an unlicensed card house or someplace like that.

22:39But then we did reach out again to Light & Wonder ahead of our video demonstration just this past summer. That's when I learned that Light & Wonder had in fact pushed out security updates to its shufflers in casinos, in Las Vegas, in Atlantic City, all around the world, if you have a contract with them. They even made those security updates available to people who have, you know, secondhand unlicensed shufflers. And that security update may, in fact, patch the vulnerabilities that we were hacking in our demonstration. But the problem it doesn't solve is when people are hacking their own Deckmate 2, and they're not going to put in the security update before they rig their own machine.

23:14So there's this kind of insider problem that is not fixed by some update to the firmware. The problem there really is that Light and Wonder has just been manufacturing and selling a machine for years that has a camera inside. You know, that was probably a bad idea. So I'm curious what the big takeaway is here. For people who don't play poker, go to the casino all that regularly, except for me and Mike making our regular pilgrimage to CES. Why should people care about this story? Aside from the fact that it is a twisted tale. You know, to me, I guess it's like just kind of a parable about modern technology.

23:53You know, like the more that we digitize simple devices and processes, like something as simple as shuffling a deck of cards, when you make that a digital device, when you make it a smart tool, then you've introduced the risk that it can be hacked. And that's true not just of like automated shufflers in casinos where a lot of money is on the line, but also of medical devices in hospitals and smart devices in our homes, including security systems, including things that we depend on in our daily lives. The more that we add digital tooling into like that kind of infrastructure of our lives, the more vulnerable it becomes to being messed with, meddled with, sabotaged, surveilled.