Space Invaders and the Assumptions Systems Make
Long before I was paid to find ways into systems, I had already discovered that some machines could be persuaded to do things their designers never intended. I just didn't think of it that way at the time.
I've spent a good part of my career in cybersecurity, much of it as a penetration tester, and I still do that work today. A lot of it comes down to looking at a system and asking a fairly simple question: what happens if I don't use it the way its designers expect me to?
I'd always assumed I learnt to think that way once I started working in technology. Then recently I remembered something from my youth.
Space Invaders.
When the game was still relatively new, arcade machines seemed to be everywhere, and coins disappeared at an alarming rate. Somewhere along the way, though, we discovered there was another way to get a credit.
It involved a piezoelectric lighter, the type that produced a sharp click and a spark and was often found in hot water systems on building sites (but that's another story). If you put it in the right place around the coin mechanism, or sometimes near the joystick, and clicked it, every now and then CREDIT 01 appeared on the screen.
No coin required.
I hadn't thought about it for years. When the memory came back, I started wondering whether it had actually happened or whether it was one of those things that had become distorted over time. So I went looking, and it turns out I didn't imagine it.
In his 1982 book Invasion of the Space Invaders, Martin Amis described young arcade players using electric cigarette lighters and other electrical devices near sensitive parts of machines to gain extra lives and extended play. A later retrospective on the book also draws attention to the same practice.
That was reassuring. Apparently, I wasn't making it up. What interested me more, though, was that I could now look back at something we were doing as kids and understand what was probably happening.
The machine wasn't really checking for a coin
An arcade machine doesn't actually care about the coin itself. What matters is the signal telling it that a coin has been inserted.
Normally, the coin went into the mechanism, a switch operated and the game received an electrical signal telling it to add a credit. The machine assumed that if it received that signal, a coin must have been inserted. Under normal circumstances, that was a perfectly reasonable assumption.
The piezoelectric lighter introduced something the designers probably hadn't expected. Its igniter produces a very short, high-voltage electrical pulse, which is what creates the spark. Get that pulse close enough to the wiring or electronics in an old arcade cabinet and it could interfere with the circuitry.
On some machines, it appears to have been enough to make the game see something sufficiently similar to the signal it expected from the coin mechanism. If that happened, the game added a credit even though no coin had passed through the machine.
So the important part wasn't really the coin. It was the signal the coin was supposed to produce. As far as the machine was concerned, the expected event had occurred. In reality, it hadn't.
Of course, none of us were thinking about any of that at the time. The technique wasn't exactly reliable either. Sometimes you got a credit, sometimes nothing happened and sometimes, apparently, you crashed the machine, hopefully without damaging it.
We just knew that if you put the lighter in the right place and clicked it, occasionally CREDIT 00 became CREDIT 01.
I didn't have the language for any of this then. Years later, after spending a large part of my working life in IT and cybersecurity, I would see the same basic problem again and again.
Systems make assumptions about how they will be used, what information they can trust and what should happen next. A web application may assume that a value arriving from the browser is legitimate. An API may accept a correctly formed request without properly checking whether the person making it should be allowed to. A workflow may assume that one step must have happened simply because the next one has begun.
More recently, AI systems have introduced their own versions of the same problem.
Almost every conversation about technology now seems to involve AI in some way. Things are moving quickly, new capabilities are appearing constantly, and it is easy to feel as though we are dealing with entirely new problems every few months.
Some of them genuinely are new. But a lot of the underlying security questions are very familiar.
What does the system trust? What is it taking for granted about the input it receives? What happens if someone can reproduce the result it expects in a way its designers never anticipated?
Today that might involve an AI model, an API, an identity token, an automated process or something else entirely. Back then it was a Space Invaders machine and a piezoelectric lighter.
Looking back, I like the fact that Space Invaders was probably my first encounter with something I would now recognise as a vulnerability. We weren't trying to understand how the machine worked. We didn't know what fault injection was, and we certainly weren't thinking about security. Someone had simply discovered that if you did something the machine wasn't expecting, sometimes it behaved in a useful way.
Technology has changed enormously since Space Invaders, and the systems we work with now are far more complex. But a lot of the underlying security questions are still the same. What does the system trust? What is it taking for granted about the input it receives? Can that input be reproduced, altered or supplied in a way the designers did not expect?
The technology keeps changing. The fundamentals don't. And the basics still need to be done well.
References
Amis, Martin. Invasion of the Space Invaders: An Addict's Guide to Battle Tactics, Big Scores and the Best Machines. London: Hutchinson, 1982, p. 32, “Chips with Everything.” Amis describes the use of electric cigarette lighters and other electrical devices near arcade machines to obtain additional play.
https://archive.org/details/invasion-of-the-space-invaders-1982 Derboo, Sam. “Invasion of the Space Invaders.” Hardcore Gaming 101, 30 October 2011. The retrospective discusses Amis’s account of players interfering with arcade machines using electric cigarette lighters and other battery-powered devices.
https://hardcoregaming101.net/vgbooks/vgbooks-invasion.htm