Security pro Mark Lachniet has stamped himself as a p0wnball wizard by cracking a commercial pinball machine.

Lachniet, who goes by the handle “Bede”, was able to crack a pinball titled The Hobbit.

Detailed here, the hack saw Bede find his way inside the Jersey Jack production. Inside he found a Celeron-powered PC running Ubuntu 15.10.

Bede says he doesn't want trouble, so isn't detailing his hack other than to offer the following hint:

Use a hardware write blocker to DD the drive and lay down the image on a same-brand SSD of any size 32gb or bigger. In between consider converting to VMDK and setting up a temporary VM to get into it to enable networking and SSH. Single user boot mode. patchelf --set-rpath $ORIGIN for portable binaries. Re-create Apache directory requirements on boot before starting daemon.

Bede did not need dark arts to penetrate the pinball: its motherboard has a 10/100/1000 Ethernet port and half a dozen USB ports.

The hacker used one of the latter to install a webcam the the Ethernet port to upload new images the machine displayed on the monitor in the machine's backbox.

Bede thinks his efforts have great possibilities for creating a worldwide registry of pinball scores, remote management or real-time tournaments. He also imagines “A brand new high (or low) in Internet harassment, stalking and anonymous obscenity.”

The Register can imagine other attacks: undefended machines can be put to many uses and a spot of social engineering by a “pinball technician”, a WiFi card in a USB port and a planted webcam could turn nasty in many ways.

Bede's machine is occasionally online as detailed in the post we've linked to above. He's also recorded the video below to illustrate his efforts, and a longer vid here. ®

Youtube Video