How cheaters use rigged DeckMate 2 shuffling machines in poker games | Kaspersky official blog
Source Kaspersky Security Blog
Description
We explain how vulnerabilities in DeckMate 2 shuffling machines allowed criminals to gain insights into opponents’ hands and win massive sums at poker.
Impact
For European organizations, particularly casinos, private poker clubs, and gambling regulators, this vulnerability poses a significant risk to the integrity and fairness of card games. Exploitation can lead to substantial financial losses for players and operators, reputational damage, and legal consequences. Illegal or unregulated gambling venues in Europe may be especially vulnerable due to the use of second-hand or unpatched DeckMate 2 devices. The ability to remotely or physically manipulate shufflers undermines trust in gaming operations and could facilitate organized crime activities. Additionally, the exposure of embedded device vulnerabilities highlights broader cybersecurity risks in IoT and embedded systems used in gaming and entertainment sectors. European regulators may face challenges enforcing compliance and ensuring that all deployed devices are updated and secured. The threat could also impact European manufacturers and suppliers of gaming equipment if similar design flaws exist. Overall, the integrity of gambling operations and consumer confidence in Europe could be adversely affected if such vulnerabilities are exploited.
Defensive guidance
European organizations should implement the following specific measures: 1) Conduct thorough inventories of all DeckMate 2 devices in use, including rented and second-hand units, to identify those lacking manufacturer updates. 2) Ensure all devices are updated with the latest firmware and hardware revisions that disable exposed USB ports and improve firmware integrity checks. 3) Change all default or hard-coded passwords on devices where possible, replacing them with strong, unique credentials managed securely. 4) Physically secure shufflers to prevent unauthorized access to USB ports or internal components, including tamper-evident seals and restricted access policies. 5) Monitor network traffic for unusual Bluetooth or cellular modem communications that could indicate data exfiltration. 6) Avoid using devices with cellular modems in untrusted environments or ensure secure cellular configurations to prevent fake base station attacks. 7) Train staff and operators to recognize signs of device tampering and enforce strict controls on device handling. 8) Collaborate with manufacturers and regulators to ensure compliance with updated security standards for gambling equipment. 9) Prefer licensed and regulated venues over private or illegal clubs where device maintenance and security are less assured. 10) Employ comprehensive cybersecurity hygiene for all embedded devices, including regular vulnerability assessments and penetration testing focused on IoT components.
Summary
The DeckMate 2 is a professional automated card shuffler produced by Light & Wonder since 2012, widely deployed in casinos and private poker clubs globally. It uses an internal camera to verify the deck contains all 52 cards and to shuffle them, taking about 22 seconds per shuffle. The device includes a USB port for firmware updates and, in some rental models, a cellular modem for usage data transmission. Researchers demonstrated in 2023 that the DeckMate 2 is vulnerable due to hard-coded system passwords that are identical across devices, allowing attackers with physical access to connect a small device (e.g., Raspberry Pi or USB-sized module) to the USB port and overwrite the firmware. They bypass the firmware integrity check by altering the stored reference hash, enabling malicious code to control the internal camera and transmit the exact card order via Bluetooth to an accomplice’s phone. This accomplice then signals the cheating player covertly. The vulnerability stems from poor password management, exposed USB ports, and insufficient firmware validation. In 2025, law enforcement indicted a criminal group that exploited these vulnerabilities in real poker games, using pre-hacked DeckMate 2 devices to cheat wealthy victims, with losses exceeding $7 million. The criminals combined this with other cheating tools like marked cards and special glasses. The manufacturer has since disabled the USB port and improved firmware verification in updated devices, but many second-hand or rented units in illegal or private venues remain vulnerable. The threat demonstrates the risks of embedded device vulnerabilities in gambling equipment and the importance of secure device lifecycle management.