00:00:00.292-->00:00:03.792
>>So, the topic of our
presentation today is titled
Backdooring the Lottery and

00:00:03.792-->00:00:09.375
Other Security Tales of Gaming.
Ah, so the overview of the talk
will go through some

00:00:09.375-->00:00:16.125
introductions first, who we are,
so you get some context, what
has happened since 2011 and why

00:00:16.125-->00:00:19.167
that that date is important to
me is that’s the last time I was
here speaking at Def Con about

00:00:19.167-->00:00:25.542
iGaming , ah, security issues,
ah, give a brief historical
overview of some attacks and how

00:00:25.542-->00:00:31.667
the, the focus has switched from
the physical to now more of a
logical side and then probably

00:00:31.667-->00:00:36.000
what’s most interesting and what
Evan’s gonna spend a lot of time
talking about is ah the Eddie

00:00:36.000-->00:00:41.292
Tipton case, ah, how he
discovered, how he rigged the
lottery; what Evan did, ah, to

00:00:41.292-->00:00:45.750
reverse engineer the code,
etcetera. Ah, if time allows
we’ll talk a little bit about

00:00:45.750-->00:00:50.208
the recent Russian, ah, slot
attacks, that, ah, you know,
they were Wired Magazine

00:00:50.208-->00:00:54.500
recently in the reporter was
coming out with another story,
ah, in a couple weeks. And then

00:00:54.500-->00:00:59.375
we will try to wrap everything
up. So, first one page, one
slide about who my company is

00:00:59.375-->00:01:04.917
since they paid for us, SeNet
International, ah, look us up,
always looking to, to, you know,

00:01:04.917-->00:01:09.625
to, ah, talk to people. Who I
am? My name is Gus Fritschie.
I’m the CTO of SeNet

00:01:09.625-->00:01:14.083
International and about five
years ago after our present,
after my presentation, ah, on

00:01:14.083-->00:01:18.000
iGaming, I transitioned ah, a
significant portion of our
practice into the gaming

00:01:18.000-->00:01:21.750
sectors. I just found it more
interesting than, than doing,
the government work, ah, that we

00:01:21.750-->00:01:27.292
had been focusing on, and ah,
and now I am pretty proud of
what we’ve been able to do and

00:01:27.292-->00:01:32.250
the client base we have going
across from lotteries to tribal,
tribal casinos, corporate

00:01:32.250-->00:01:37.250
casinos, daily fantasy sports,
ah, etcetera. >>Hey, so I’m
Evan. Ah, I work for Gus. I live

00:01:41.125-->00:01:46.125
in the, what oh, >> Work with me
>>Yeah, work with Gus, ah,
[laughs], so I live in DC, ah, I

00:01:48.167-->00:01:53.875
work in the [inaudible] distro,
it’s a small one. I do reverse
engineering and stuff. And in my

00:01:53.875-->00:01:58.875
free time I hike and climb and I
live in a van too. So here’s my
van. It’s a, [laugh], but yeah.

00:02:01.625-->00:02:07.958
Gus. >>So, so Evan limited me to
only two memes. So this is, a,
this, this is one of them, Um,

00:02:07.958-->00:02:13.333
so this is not gonna be a, a, a,
super technical talk, but then
again it’s Sunday, last day of

00:02:13.333-->00:02:18.000
Def Con. I am sure we saw,
there’s been a ton of great,
highly technical talks, you

00:02:18.000-->00:02:22.833
know, there’s more of a story
talk, ah, but Evan definitely
does get into the details, ah,

00:02:22.833-->00:02:26.542
with the code which I think, you
know, those of you who are
interested in that subject

00:02:26.542-->00:02:32.708
should find pretty interesting.
So what has happened since two
thousand eleven? Um, first by a

00:02:32.708-->00:02:37.333
show of hands hoe many people
saw my last one on iGaming
security? I was just curious who

00:02:37.333-->00:02:41.917
attended, so a handful of
people. So the good news is for
all of us online poker players

00:02:41.917-->00:02:47.000
is we got paid back our money
from the sites that got shut
down, ah, for the most part. Ah,

00:02:47.000-->00:02:52.625
so that’s obviously a good
thing. Um, but what we have seen
happen is not a lot of movement

00:02:52.625-->00:02:57.625
in iGaming. Ah, the, the green
illustrates the states where
iGaming is legal. So really we

00:03:00.958-->00:03:07.208
only have three, Nevada, ah,
Delaware and New Jersey. Um,
and, ah, the yellow is pending,

00:03:07.208-->00:03:12.208
ah, legislation. Why I find this
slide interesting is even though
it is a small number, its shows

00:03:14.458-->00:03:19.125
that that the footprint is
expanding. And I think I don’t
have a slide, but if I had a

00:03:19.125-->00:03:23.958
slide where it shows where land
based casinos are legal, you
will also see that expanding. We

00:03:23.958-->00:03:29.167
have tons of states, even, five
years ago that have casinos that
didn’t used to have casinos. So

00:03:29.167-->00:03:34.875
we see, uh, um, you know, the,
the potential attack footprint
expanding. Is there a question?

00:03:34.875-->00:03:40.875
>>Ah, what is iGaming? >>Sorry,
iGaming, online poker, online
slots, you know, gambling

00:03:40.875-->00:03:44.875
basically online, but the, the,
the, Caesars and other
companies; they like to call it

00:03:44.875-->00:03:49.875
gaming because gambling has a
bad, you know, bad sound to it.
>>Thank you >>So this sector has

00:03:53.208-->00:03:58.667
not been immune to security
incidence, just like any other
sector that you read about in

00:03:58.667-->00:04:03.375
the news. You know, I am not
going to talk about any of
these, ah, in any detail. Um, I

00:04:03.375-->00:04:08.875
just picked a random sampling of
some of the, ah, breaches that
have been disclosed and of

00:04:08.875-->00:04:13.500
course as you know there’s
plenty of other breaches that
occur that, that never get

00:04:13.500-->00:04:18.500
disclosed that we don’t hear
about. Um, so, this is obviously
an area that, you know, needs to

00:04:20.625-->00:04:26.625
be secured and I think when it
comes to, you know, the
public’s, you know, the, the

00:04:26.625-->00:04:32.250
trust in the integrity of gaming
is extremely important so
without that, you know, you

00:04:32.250-->00:04:38.167
don’t really have a really solid
business model. With the Las
Vegas Sands I do find this

00:04:38.167-->00:04:43.333
interesting. This happened in
December twenty fourteen, um, if
you didn’t read about it. I am

00:04:43.333-->00:04:49.958
not going to spend a lot of time
but, you know, this occurred to
arguably the world’s most

00:04:49.958-->00:04:55.125
profitable gaming organization.
You know, they make millions and
millions of dollars and at this

00:04:55.125-->00:05:01.208
point in time where the breach
occurred they had a very small
IT security staff. Ah, I don’t

00:05:01.208-->00:05:05.417
have not done any work with Las
Vegas Sands, so I can’t speak to
their size of their staff now,

00:05:05.417-->00:05:11.292
but I understand it has
increased a lot, grown a lot
more, ah, money into security in

00:05:11.292-->00:05:17.500
those environments. But the way
this breach occurred was just to
show you how easy it was. It was

00:05:17.500-->00:05:22.167
just a development server that
was stood up, ah, on the
perimeter that they didn’t know

00:05:22.167-->00:05:26.208
about, or they knew about but,
you know, it was used as a
foothold; then they pivoted

00:05:26.208-->00:05:31.375
inside and they just, you know,
ran havoc, ah, destroying, ah,
data and it could have been a

00:05:31.375-->00:05:36.375
lot worse if they, ah, you know
were more sophisticated and
decided to be destructive. Um,

00:05:38.458-->00:05:43.333
so history, let’s get into some
of the early attacks against
slot machines. I’m not gonna

00:05:43.333-->00:05:47.917
really too much time so I want
to give Evan his piece which I
think is more interesting but

00:05:47.917-->00:05:53.458
obviously in the earlier days we
had, you know, physical attacks
with fake coins , yo-yo-ing with

00:05:53.458-->00:05:58.625
a coin on a string and pulling
it back out. Attacks against a
bank nota validator when those

00:05:58.625-->00:06:03.167
started getting installed. Um,
and then we had Tommy Carmichael
here who came up with a couple

00:06:03.167-->00:06:08.458
of inventions, ah, or devices I
should say that allowed him to
commit fraud with a monkey paw

00:06:08.458-->00:06:13.458
which he was sort of able to use
to jam up the arm release, uh,
the coin hopper and then of

00:06:13.458-->00:06:19.625
course with the light wand, uh,
which you know manipulated the
sensors and uh, allowed the, you

00:06:19.625-->00:06:24.625
know, the money, ah, to come out
of the machine without being
won. So we, ah, we saw early

00:06:26.792-->00:06:32.458
attacks were more physical in
nature. Um, and then another
physical attack that we saw that

00:06:32.458-->00:06:36.667
happened in nineteen eighty and
ah, my partner from the lottery
sector, Herb Delehanty wrote

00:06:36.667-->00:06:41.250
about this in his book, um, and
it was also made into a movie.
Ah, I don’t think a very good

00:06:41.250-->00:06:47.708
one, but, it , it , it was
there. Um, and they weighted the
balls so they weighted the sixes

00:06:47.708-->00:06:52.708
and fours and ah, and this was
obviously able to hack them
because you had collusion

00:06:54.750-->00:07:00.083
between multiple parties. Um,
obviously people realized pretty
quickly that it was, ah, that is

00:07:00.083-->00:07:06.000
was a fraud and no one got paid
out even the illegal books knew
that, ah, prior to the lottery

00:07:06.000-->00:07:12.375
even admitting it. So we had
these physical attacks, ah,
against slot machines and other,

00:07:12.375-->00:07:17.375
ah, other forms of gaming. And
then we see a transition to
attacks on the logical, ah,

00:07:19.917-->00:07:24.542
side. And I think we start
seeing these stories, you will
start seeing how they tied

00:07:24.542-->00:07:29.542
together to what, ah, Eddie
Tipton did in the, in the MUSL
Hot Lotto, ah, RNG fraud case.

00:07:32.625-->00:07:38.042
So, ah, some of you may be aware
of Ronald Harris. But he worked
for the Nevada Gaming Control

00:07:38.042-->00:07:44.083
Board and his responsibility was
basically to perform audits of
the gaming software and

00:07:44.083-->00:07:50.375
platforms, and one of the, his
responsibilities was to audit
the e-proms in the slot machines

00:07:50.375-->00:07:56.583
to make sure that, ah, that they
were correct, ah, that they were
correct. Um, but what he did

00:07:56.583-->00:08:03.542
was, instead of auditing them,
he reprogrammed them, ah, so
that, a, when a certain sequence

00:08:03.542-->00:08:08.208
was pushed on the slot machines
or a certain number of coins
were entered it would pay out,

00:08:08.208-->00:08:14.167
ah, winnings and, a, I spoke to
Rex Carlson who is, ah, who was
the Director of the Nevada

00:08:14.167-->00:08:20.125
Gaming Control Board and, you
know, he said they really don’t
know how much money he actually

00:08:20.125-->00:08:24.500
made from this. Um, because he
really will never even, he
didn’t get caught initially

00:08:24.500-->00:08:30.958
because of this. He got caught
because he turned his attention
to Keno and this is where it

00:08:30.958-->00:08:37.458
sort of parallels what Mr.
Tipton did, in the Hot Lotto
case is, since he had access of

00:08:37.458-->00:08:43.917
course to the source code, uh,
he found a flaw in the, in the
pseudo random number generator

00:08:43.917-->00:08:49.958
and then he wrote a program that
allowed him to predict what the
winning Keno number was. So, he

00:08:49.958-->00:08:54.958
went to, ah, Bally’s in Atlantic
City and with an accomplice they
won it on I think the first

00:08:57.167-->00:09:02.042
time, ah, that he played the
numbers and they probably could
have gotten away with it but

00:09:02.042-->00:09:07.458
they had such poor planning, ah,
as far as, you know, what they
were going to do after they won.

00:09:07.458-->00:09:12.667
Ah, so this ,of course, raised
suspicion and the authorities
performed an investigation and

00:09:12.667-->00:09:17.667
they went back and looked at
the, at the other work that he
was performing. So what we see,

00:09:19.750-->00:09:26.208
is we see, you know, individuals
with trust. Who were trusted to
perform these reviews and had

00:09:26.208-->00:09:31.208
access, ah, to these devices and
this will parallel, ah, what
happened, ah, with Eddie. And

00:09:34.625-->00:09:39.167
one last example from a
technical perspective and I
talked about this, ah, in my

00:09:39.167-->00:09:45.833
last presentation but this is
from the Absolute Poker/Ultimate
Bet’s Super User scandal, uh,

00:09:45.833-->00:09:50.833
where the owner of the site, ah,
I guess I should say alleged,
because it was never actually

00:09:52.833-->00:09:57.833
one hundred percent proven. Um,
but he had a, convinced one of
the programmers that he needed a

00:10:00.417-->00:10:06.042
back door into the program so he
could see player’s hole cards
because he thought there was;

00:10:06.042-->00:10:09.500
this whole idea was there was
cheating and only he could
figure out if they were really

00:10:09.500-->00:10:15.958
cheating but he proceeded to use
this back door in the, ah, in
the poker software to illegally

00:10:15.958-->00:10:21.958
win about twenty million
dollars, ah, from players. And
this graph shows the individual,

00:10:21.958-->00:10:27.292
one of the accounts, and you can
see that he’s way off there as
far as the norm from, from a

00:10:27.292-->00:10:33.625
winning, winning percentage. Um,
so once again we have examples
from, ah, from Ron Harris with

00:10:33.625-->00:10:40.458
the Keno, uh, you know, being
able to, ah, access the source
code and ah, and find

00:10:40.458-->00:10:45.500
weaknesses. Here we have an
example of placing another
backdoor in the system allowing

00:10:45.500-->00:10:52.375
the, ah, allowing cheat and
fraud to occur in the poker. So,
now I’m going to turn it over to

00:10:52.375-->00:10:57.208
Evan where he is going to get
into the current events and, ah,
what I think is the most

00:10:57.208-->00:11:02.208
interesting topic of this talk.
>>All right, cool. So this is my
first talk by the way. Ah so,

00:11:08.792-->00:11:13.792
[laughs and claps]. So in case
you guys aren’t familiar with
how the like lottery works, ah,

00:11:16.917-->00:11:22.458
there’s individual state
lotteries and each lottery, ah,
manages itself. But there is

00:11:22.458-->00:11:25.500
something called MUSL, which is
like an organization which
oversees all the state

00:11:25.500-->00:11:31.458
lotteries, well most of them.
Um, so, ah, like back in two
thousand five wasn’t it? Or was

00:11:31.458-->00:11:37.833
it two thousand four. Ah, it
doesn’t matter, so like a while
back this guy names Eddie Tipton

00:11:37.833-->00:11:43.167
got at job at MUSL to write an
RNG. Uh, so some of the state
lotteries use like computer

00:11:43.167-->00:11:47.875
numbered, computer RNG’s so like
drawing numbers, ah, others use
like balls out of hats, stuff

00:11:47.875-->00:11:52.875
like that. Ah, well not actually
hats but um, yeah, ah, so he got
a job writing an RNG and pretty

00:11:56.042-->00:12:02.542
much immediately he rigged it,
ah, because obviously he wanted
to make money um, and they

00:12:02.542-->00:12:07.542
weren’t paying him very much.
Ah, but ah, yup, so a these are
all the faces involved in this.

00:12:10.417-->00:12:14.542
Tommy Tipton is like his
brother; he was involved in it,
he helped cash out tickets. Uh,

00:12:14.542-->00:12:18.875
Robert Rhodes, also helped cash
out tickets. It was like a
friend of his. And then Rob Sand

00:12:18.875-->00:12:25.792
was the Attorney General in
charge of like the case. Uh, all
right so, uh in two thousand ten

00:12:25.792-->00:12:32.042
uh, Eddie, went into a gas
station in Iowa and uh,
purchased a ticket for a lottery

00:12:32.042-->00:12:38.208
game. Um, he waited a whole year
to claim the ticket which is
pretty suspicious. Um, and then

00:12:38.208-->00:12:44.292
also he used a mysterious
company incorporated in like
Belize and ah, he went through

00:12:44.292-->00:12:48.792
an attorney to try to cash out
the ticket. So it was obviously
extremely suspicious and ah, the

00:12:48.792-->00:12:53.792
lottery security caught wind of
that and ah, decided to do an
investigation into it. Um, he

00:12:57.750-->00:13:06.125
also couldn’t receive the money
until they completed the
investigation and they refused

00:13:06.125-->00:13:10.750
to give their identities and it
is possibly illegal. Um, so they
withdrew their claims to the

00:13:10.750-->00:13:19.292
prize, uh cause I am assuming
they did not want to get caught.
Um, let’s see here. Apparently

00:13:19.292-->00:13:23.417
they also received a tip from
somebody, ah, that Tipton was
the person in the video,

00:13:23.417-->00:13:32.083
actually I think I know who that
was, but, um, yeah. Ah, so they
started a full investigation in

00:13:32.083-->00:13:39.250
which involved the FBI and stuff
too. Um, and they determined
that it was him, ah, that

00:13:39.250-->00:13:42.792
purchased the ticket. And
because he worked for the
lottery, he was banned from

00:13:42.792-->00:13:46.708
playing the lottery, ah, and
they kind of used circumstantial
evidence to convict him before

00:13:46.708-->00:13:54.292
they actually knew how he
actually rigged the lottery or
that he did for sure. Um, yeah,

00:13:54.292-->00:14:01.208
let’s see, he was sentenced to
ten years in prison, ah, he was
out on bond or bail pending

00:14:01.208-->00:14:07.542
appeal, ah, for a good like
year. He actually just pled
guilty pretty recently. Um, this

00:14:07.542-->00:14:15.375
should be point seventeen, but
yeah. And here’s a quick
timeline of events. So he was

00:14:15.375-->00:14:20.583
hired in two thousand three at
MUSL and the first known case of
fraud was in 2005. There could

00:14:20.583-->00:14:26.417
have been earlier cases though;
cause there was written in 2004.
>>And what is interesting about

00:14:26.417-->00:14:30.792
the timeline here if you look at
where it says that that the
Colorado Lottery fraud,

00:14:30.792-->00:14:36.167
Wisconsin Lottery Fraud, Kansas
Lottery fraud, you see a pattern
there. They’re all on the same

00:14:36.167-->00:14:41.375
date and that’s what Evan will
talk about when he gets into how
this code actually worked and

00:14:41.375-->00:14:47.833
how it allowed him to predict
what the winning numbers were
going to be. >>And also, these

00:14:47.833-->00:14:53.250
are just known cases of fraud.
Ah, there are probably more, um,
especially since we found a

00:14:53.250-->00:15:02.667
third date in the code itself
which there were no known cases
of fraud for. Um, so, let’s see

00:15:02.667-->00:15:10.042
here. Uh, there we go. >>Nah,
nah I just also wanted to also
ah, ah a couple of gaps just, in

00:15:10.042-->00:15:15.500
the in the story. As Evan
mentioned, he was really; he was
convicted initially of a charge

00:15:15.500-->00:15:20.417
on really circumstantial
evidence. I mean, they had video
footage from the from the store,

00:15:20.417-->00:15:26.167
ah, which when you think about
it he really made a big mistake
because when he, in the other

00:15:26.167-->00:15:30.500
cases of fraud he actually never
bought the tickets himself; he
had his accomplices, his brother

00:15:30.500-->00:15:34.458
or Robert Rose buying the ticket
but in this case he actually
went in and bought the ticket

00:15:34.458-->00:15:40.292
himself. And perhaps that is
because the prize value was so
large that he just didn’t feel

00:15:40.292-->00:15:44.750
comfortable having someone else
buy the buy the winning tickets.
And he actually went to a

00:15:44.750-->00:15:50.708
convenience store that had audio
and also video surveillance. So
there’s other stores that he

00:15:50.708-->00:15:55.167
could have gone to that wouldn’t
have had the video or the audio
and it’s really the audio was

00:15:55.167-->00:15:59.250
what convicted him because his
voice is very distinctive and
they were able to prove it that

00:15:59.250-->00:16:02.833
way. Of course, he felt and his
lawyer’s felt that was
circumstantial evidence and they

00:16:02.833-->00:16:07.500
did appeal it and during that
appeal process ah, that’s when
we were able to get a hold of

00:16:07.500-->00:16:13.958
the, of the Wisconsin lottery
RNG which Evan will talk about;
and what he did. But, you know,

00:16:13.958-->00:16:18.792
how do you go about rigging a
lottery? And this is my second
and last meme so I was only

00:16:18.792-->00:16:25.792
allowed two, um, but obviously
you become a lottery developer;
write code and have your friends

00:16:25.792-->00:16:30.292
buy the winning numbers. It’s
that easy. And luckily for the
first time we have video

00:16:30.292-->00:16:37.042
surveillance of Eddie Tipton
actually performing the
programming. [laughs] Naw, naw

00:16:37.042-->00:16:47.042
Evan will tell you how he really
did it. >>Yeah so, um, I already
kind of went over this part, but

00:16:47.042-->00:16:54.792
um, so basically what he did; he
worked for MUSL, um, So not all
the lotteries, the state

00:16:54.792-->00:16:59.625
lotteries use the RNG; some of
them use third party RNG’s and
others use like machines that

00:16:59.625-->00:17:04.167
throw balls up in the air and
they come back down and stuff
like that which is what

00:17:04.167-->00:17:08.917
lotteries should do by the way;
ah, they should not use
computers to generate numbers

00:17:08.917-->00:17:17.333
but this is for us [laughs]. Um,
so while he worked there, um, so
they have like a supervised

00:17:17.333-->00:17:24.208
build process, um, so you have
how got past that process which
made the numbers predictable on

00:17:24.208-->00:17:31.250
three dates with other
conditions as well. Um, and the
binaries and the source code

00:17:31.250-->00:17:35.708
were certified by a major
testing lab but in the way he
did it wouldn’t have mattered

00:17:35.708-->00:17:40.000
unless you really went in depth
and ah, checked the binary
against the source code, ah,

00:17:40.000-->00:17:45.708
stuff like that. He also had
access to the computer images,
too, which he could have rigged

00:17:45.708-->00:17:51.375
and used like a root kit or
subvertive, ah, changed the
numbers as well. So even if he

00:17:51.375-->00:17:57.417
wasn’t the one writing the code
he could have rigged the lottery
as well. Um, in twenty sixteen,

00:17:57.417-->00:18:05.125
we were contracted to perform
imaging as one of the RNG’s, um,
and we were actually given

00:18:05.125-->00:18:09.708
permission to review the images
at some point and, ah, I was
asked to, ah, try to figure out

00:18:09.708-->00:18:16.917
how he did it, um, so at this
point nobody had any idea how he
actually did it. Um, he didn’t

00:18:16.917-->00:18:20.542
seem smart enough to use a root
kit, so uh, when he was
convicted, it was assumed he

00:18:20.542-->00:18:24.500
used a root kit to change the
numbers uh, cause they didn’t
find anything in the code and

00:18:24.500-->00:18:30.958
apparently they didn’t find the
binary to be malicious in any
way and um, like I find it kind

00:18:30.958-->00:18:36.333
of questionable that they
analyzed that, but yeah. Um, so
I decided that it, since he was

00:18:36.333-->00:18:42.708
the one writing the RNG itself
that I just looked at the
binaries and compare them to the

00:18:42.708-->00:18:46.042
code. So I didn’t actually have
the code initially so I just
started like, uh, just going

00:18:46.042-->00:18:49.083
through the binaries and reverse
engineering them. So there are a
few binaries that um, the main

00:18:49.083-->00:18:55.417
executables and libraries and
stuff like that. Um, so the most
interesting binary was one that

00:18:55.417-->00:19:00.542
actually, ah, actually contained
like the RNG itself, ah, so it
was actually the first binary

00:19:00.542-->00:19:11.042
that I looked at; I started
looking at. Um, and this is
pretty much what I just said. So

00:19:11.042-->00:19:14.917
I was skimming through all of
the functions of the binary and,
ah, one of them pretty much

00:19:14.917-->00:19:19.458
caught my eye pretty much
immediately. And at this point I
knew that um, all the winnings,

00:19:19.458-->00:19:23.792
all the known cases of fraud
were on certain dates, so this
one I saw had a bunch of date

00:19:23.792-->00:19:31.000
functions right at the top. Ah,
so likes that’s probably it, um,
like I saw another reason for

00:19:31.000-->00:19:35.542
them to states, so I started
reverse engineering it and I saw
pretty much immediately that it

00:19:35.542-->00:19:40.000
referencing those specific
dates, ah the two dates that we
knew and a third day as well.

00:19:40.000-->00:19:45.625
Ah, so I reverse engineered it
and figured out exactly what it
was doing and how it was seeing

00:19:45.625-->00:19:53.625
the RNG and everything like
that. Um, so also it was at the
end of the binary was pretty

00:19:53.625-->00:19:58.750
suspicious so, its like somebody
tacked on that function at the
very end of the like a file. Um,

00:19:58.750-->00:20:03.167
unless you got the source code
for the RNG and we saw that
there was no; that function

00:20:03.167-->00:20:08.458
wasn’t in there. Um, there are
twenty five functions in the
source code and twenty six in

00:20:08.458-->00:20:20.042
the binary, ah. As you can see.
But yeah, um, so ah yeah. That’s
about it. That’s how he did it.

00:20:20.042-->00:20:26.083
Ah, he just, I can go into
details on that real quick. Um,
so basically each time a number

00:20:26.083-->00:20:29.792
is drawn this function was
called and it would receive the
RNG with predictable values, um,

00:20:29.792-->00:20:36.583
on certain days of the year. It
also had to be like a Wednesday
or Sat er uh, and its supposed

00:20:36.583-->00:20:54.542
to be Sunday, Uh a Wednesday or
a Sunday. Um, here’s like the
code. Uh, his function. And so

00:20:54.542-->00:20:58.167
we actually see the RNG of a
bunch of values from the
computer. I am not really sure

00:20:58.167-->00:21:02.208
why he did that. He could have
used anything really, uh, he’s
like a computer name and added

00:21:02.208-->00:21:06.750
like added them up in like
through that to seed with like
the values to the game and

00:21:06.750-->00:21:11.292
everything. Um, he kind of made
it more complicated than was
necessary, ah, which made him

00:21:11.292-->00:21:15.292
have to buy more tickets than
necessary. In some cases he
bought multiple tickets cause he

00:21:15.292-->00:21:24.208
wasn’t sure what the values
would be. Um, yeah. And so
here’s why certification did not

00:21:24.208-->00:21:29.292
work, ah, it was it was
certified by one of the major
testing labs, um, and their

00:21:29.292-->00:21:35.125
testing process was to run the
output of the RNG through a
bunch of statistical tests; um,

00:21:35.125-->00:21:39.833
which is great so it showed the
results were unbiased but it
doesn’t really catch anybody

00:21:39.833-->00:21:46.917
rigging it. Um, they performed
an audit of the source code but
the source code you can probably

00:21:46.917-->00:21:53.417
see the difference it will slip
that past the supervise build
process. Ah, pretty easily, ah,

00:21:53.417-->00:22:00.333
so that’s questionable. Um, and
here’s how he could have done it
better too. He rigged it only

00:22:00.333-->00:22:06.000
three days a year which made it
pretty easy to identify the
winnings. Um, if he rigged it on

00:22:06.000-->00:22:09.625
every single day of the year, it
would be extremely difficult to
identify by the winnings ah,

00:22:09.625-->00:22:14.250
cause what they did what the
investigators did was they knew
that he was like using certain

00:22:14.250-->00:22:19.667
dates, um, so they just went
through all those dates and they
looked up all the winnings. Um,

00:22:19.667-->00:22:24.750
and the ones that were most
suspicious and they followed
those leads, ah, so obviously if

00:22:24.750-->00:22:28.833
you rigged the lottery,
definitely do every single day
of the year. Um [laughs], and

00:22:28.833-->00:22:37.500
yeah. And also he could have
made it, the method of rigging
it more discrete. Ah, he could

00:22:37.500-->00:22:42.292
have used root kits and you now
changed the numbers in memory.
Um, and that would have been

00:22:42.292-->00:22:47.417
much more discrete in ‘ch’ like
having it in the binary, ah,
cause what we do now is we, ah,

00:22:47.417-->00:22:52.208
check updates to the RNGs, uh,
and compare them to the source
code via Bindiff, or if its in

00:22:52.208-->00:22:57.667
Java a write a custom tool for
that. Um, so we can catch
updates like, ah, if anybody

00:22:57.667-->00:23:03.292
tries to like, ah, if a vendor
tries to like pass a like a back
door in like inside the, ah,

00:23:03.292-->00:23:12.833
update we can catch that pretty
easily. Um, so how can this be
prevented, ah, source code

00:23:12.833-->00:23:18.542
should be undergo in depth third
party reviews. Um, I think the
supervise builds are important

00:23:18.542-->00:23:24.917
too. Um, as an additional layer
but for updates and if your just
like, if you have a binary, um,

00:23:24.917-->00:23:30.833
and your not concerned about the
system image, um, it pretty easy
to check those with like Bindiff

00:23:30.833-->00:23:35.833
to make sure their not malicious
after reviewing the source code.
Um, so what we can do is compile

00:23:35.833-->00:23:41.958
the source code and compare it
to like the actual binary we
get. Um, but there’s another

00:23:41.958-->00:23:46.750
issue like the system image too.
Where these guys are building a
system image that’s not

00:23:46.750-->00:23:52.958
supervised at all. So they could
obviously slip something in. And
ah, it’s pretty difficult to

00:23:52.958-->00:23:59.000
supervise that entire process.
Ah, you can’t check the image.
You can’t be certain of finding

00:23:59.000-->00:24:05.458
anything in there. Um yup, there
you are. >>So thanks Evan, I
think you went over that very

00:24:05.458-->00:24:11.708
well. Um, you know when you
think about it, he actually you
had a pretty good idea because

00:24:11.708-->00:24:16.208
once he got this QVRNG.dll file
in pat’, certified by the
testing labs and you know once

00:24:16.208-->00:24:26.792
again you if the testing labs
supposedly and I know they do
now because we do, you know,

00:24:26.792-->00:24:31.542
review the source code line by
line, ah, but, you know, and
they were, ah, supposed to you

00:24:31.542-->00:24:39.292
know watch them compile the
codes because if they end up
hashing those binaries ah, so in

00:24:39.292-->00:24:45.958
someway we not completely sure
he was able to get the testing
lab to certify this code was

00:24:45.958-->00:24:49.542
valid and he had it on all these
boxes and that never changed.
You know he would make

00:24:49.542-->00:24:55.625
modifications perhaps a QV.exe
to the executable but he never
ever had to modify the .dll. So

00:24:55.625-->00:25:02.083
actually what was interesting,
ah, when we reviewed some of the
more recent MUSL RNGs and you

00:25:02.083-->00:25:05.958
have remember, he started this
process in two thousand three,
you know, he wasn’t this fraud

00:25:05.958-->00:25:10.958
case didn’t happen until two
thousand eleven. He wasn’t you
know convicted, ah, until two

00:25:10.958-->00:25:15.417
thousand fifteen. That’s a lot
of time going on for him to make
modifications and, ah, you know,

00:25:15.417-->00:25:20.458
as Evan mentioned there are
other commercial RNGs in the
lottery sector, um, but you know

00:25:20.458-->00:25:24.000
some of the state lotteries ;
you know their whole mission is
to give back to education or

00:25:24.000-->00:25:31.000
whatever, you know, ah, ah,
whatever there uh, is it, in
written into the law and, uh,

00:25:31.000-->00:25:35.375
you know, so they’re very frugal
with their money and they didn’t
want to you know pay two hundred

00:25:35.375-->00:25:40.583
thousand whatever for a RNG so
they would pay MUSL a much lower
cost. So you have all these RNGs

00:25:40.583-->00:25:44.833
being used in other states and
when we reviewed some of the
other ones, in other states uh,

00:25:44.833-->00:25:49.292
at least the ones we could get
the images to you know it was
interesting because the

00:25:49.292-->00:25:56.833
executable was not, was not
calling the QVRNG.dll. Correct,
Evan? >>Yeah, the newer ones

00:25:56.833-->00:26:00.542
>>Yeah the newer one, so
somewhere along the line I think
he got scared or nervous perhaps

00:26:00.542-->00:26:06.167
after his, his jackpot win and
switched the code so people
wouldn’t even look at the QV,

00:26:06.167-->00:26:12.083
QVRNG.dll and maybe his plan was
once things died down he could
just, you know, call it again,

00:26:12.083-->00:26:16.250
uh, in the future. >>Also I
think he just, ah, he left the
binary out there when he

00:26:16.250-->00:26:20.875
updated. I think he just left in
on there to be honest. Ah,
there’s been some speculation

00:26:20.875-->00:26:24.333
that he left it on there because
he would switch back in the
future but I think he just left

00:26:24.333-->00:26:27.833
it on there when he updated. He
never deleted it to be honest.
>>Yeah the, there’s I mean,

00:26:27.833-->00:26:33.042
there’s different theories for,
for why he did that. Um, but in
the end I think it’s uh, a case

00:26:33.042-->00:26:39.042
of where we see breakdowns in a
couple different areas and
probably the most obvious and

00:26:39.042-->00:26:43.417
basic is that separation of
duties. Here you had somebody
who was Director of Security at

00:26:43.417-->00:26:48.792
MUSL who was a lead programmer.
He had physical access to the
boxes. He had everything. And to

00:26:48.792-->00:26:54.625
give MUSL credit now they have
completely revamped their entire
process, uh, and their

00:26:54.625-->00:27:00.583
operational and management and
technical controls are you know
a hundred times better that they

00:27:00.583-->00:27:06.417
were, uh, when this fraud, ah,
was, uh, what was committed. So
I, we can probably, definitely

00:27:06.417-->00:27:11.125
go into more detail and talk
later, ah, about the Tipton case
outside if you guys have

00:27:11.125-->00:27:16.875
specific questions for Evan like
getting into the weeds of it.
Um, let’s just check my time

00:27:16.875-->00:27:21.833
here. Ah, we’ve got plenty of
time. Ah, I felt we rushed
because I was nervous about the

00:27:21.833-->00:27:28.458
video issues in the beginning.
Um, so the Russian slot machine
hacking. And this sort of ties

00:27:28.458-->00:27:33.500
everything back to the present.
We had, we talked about Ron
Harris, uh, back in the mid

00:27:33.500-->00:27:40.458
nineteen nineties you know we
have the iGaming, uh, the
Ultimate Bet/Absolute Poker, you

00:27:40.458-->00:27:46.083
know, fraud. We have this Tipton
case and here we have this you
know Russian slot machine

00:27:46.083-->00:27:51.708
hacking which a very good
article which I’m sure most of
you read because it was widely

00:27:51.708-->00:27:57.417
tweeted, uh, at least on my
Twitter feed, um and I give a
link to it there. Uh and also

00:27:57.417-->00:28:03.667
Willy Allison, World Game
Protection Conference, he was
also quoted, ah, in the article

00:28:03.667-->00:28:07.417
and, ah, and World Game
Protection Conference is a
conference here in Vegas in the

00:28:07.417-->00:28:11.625
December time frame and, ah, it
pretty much focuses on physical
security but he’s broadened it

00:28:11.625-->00:28:17.583
and, ah, he has some inside
information as far as how this
fraud occurred as well but

00:28:17.583-->00:28:24.917
basically just to re-hash the
story and tie it back in. In two
thousand nine Putin made, ah,

00:28:24.917-->00:28:31.792
gambling illegal in Russia.
There was this flood of slot
machines on the black market,

00:28:31.792-->00:28:40.583
um, so, a, some of them or a lot
of them, you know, were sold to
other casinos but some found

00:28:40.583-->00:28:47.083
there ways into the hands of the
Russian Mafia. And ah, they
ended up reverse engine, well

00:28:47.083-->00:28:52.375
I’ll just get to that piece of
what they did. But in two
thousand eleven some casinos in

00:28:52.375-->00:28:56.792
Europe were noticing some
suspicious payouts and then in
two thousand fourteen in, ah,

00:28:56.792-->00:29:03.208
Missouri, ah, they noticed, ah,
unusual and high payouts on some
particular slot machines. Um, so

00:29:03.208-->00:29:07.125
they started investigating this,
you know, and they, and you know
this is where you have

00:29:07.125-->00:29:12.708
compensating controls and other
pieces actually worked to end up
detecting the fraud. Because

00:29:12.708-->00:29:17.042
they had to go back to the
physical surveillance cameras
and, ah, tie this all together,

00:29:17.042-->00:29:22.708
um, but these individuals they
came back and they were later
arrested, ah, in Missouri and

00:29:22.708-->00:29:28.458
them some more were arrested in
Singapore, ah, last year. But
what did they do? They reverse

00:29:28.458-->00:29:32.792
engineered, similar to what, you
know. Evan did with the, with
the code, but they reverse

00:29:32.792-->00:29:38.250
engineered, ah, the software;
ah, the binary on the slot
machines and they found a

00:29:38.250-->00:29:45.458
weakness, ah, in the PRNG. Uh,
so what they would what the guys
would do is they would take a

00:29:45.458-->00:29:51.208
video of a certain number of
spins, um, you know twenty, I
say twenty four there but, um,

00:29:51.208-->00:29:56.500
it varied, ah, and that data was
transmitted back to their
comrades, ah, back in Russia

00:29:56.500-->00:30:03.375
where they were using, ah, you
know,very high, ah, powerful
computers to, to process this

00:30:03.375-->00:30:07.792
data send it back to them. They
had an app on their phone which
would then vibrate a couple

00:30:07.792-->00:30:13.375
seconds, milliseconds before
they were supposed to hit the
button and it wasn’t always

00:30:13.375-->00:30:19.458
successful but it did result in
a much higher payout, um, and so
this is an example where we have

00:30:19.458-->00:30:25.000
a case where there was a
weakness in the, ah, computer
programming in the RNG. This

00:30:25.000-->00:30:32.542
wasn’t built on purpose, it was
just a mistake that the
developers made. Um, and this

00:30:32.542-->00:30:39.708
vulnerability, you know,
impacted a particular vendor,
ah, Aristocrat, I believe, on

00:30:39.708-->00:30:46.667
their older, uh, versions but,
ah, the claim now is and I think
not to steal the reporter’s

00:30:46.667-->00:30:53.875
thunder but that they claim that
have working code for even
modern, more modern, ah, slot

00:30:53.875-->00:30:58.375
machines and are threatening to
release this code to the general
public. They were trying to

00:30:58.375-->00:31:03.000
blackmail Aristocrat, I believe,
ah, but ah so far that hasn’t
worked. But it will be

00:31:03.000-->00:31:10.292
interesting to read the story
when that comes out. So, we
talked about some issues here

00:31:10.292-->00:31:16.250
in, in a lot of, ah, different,
ah, different sectors. What can
casino and operators do to

00:31:16.250-->00:31:23.208
better protect themselves? I
think it’s a lot, no different
than any other industry from

00:31:23.208-->00:31:29.500
healthcare to banking, you know,
we get caught in this trap of
compliance, you know, we gotta

00:31:29.500-->00:31:32.792
be compliant, we gotta be
compliant, we gotta be compliant
and we waste a lot of money on

00:31:32.792-->00:31:36.417
paper doing that but we have to
understand, I know I am
preaching to the choir that

00:31:36.417-->00:31:40.625
compliance does not equal
security. And ah, you know, when
I first got into, you know,

00:31:40.625-->00:31:46.708
working with casinos and other
gaming operators I, I went in
there thinking these guys going

00:31:46.708-->00:31:52.500
to be super secure. You know,
you see all the movies, you
know, Oceans Eleven they got all

00:31:52.500-->00:31:57.333
this surveillance cameras and
they are very good from a
physical perspective for the

00:31:57.333-->00:32:04.917
most part. But you know, quite
honestly they, they, they really
are lacking, ah, in the

00:32:04.917-->00:32:10.917
technical security controls. But
that’s really no different than
any other sector and they are

00:32:10.917-->00:32:16.292
doing a lot more now to improve,
ah, themselves, they’re being
proactive. I’m working with

00:32:16.292-->00:32:21.667
several. I know other firms are
working with them, so they
really are taking it, ah, to

00:32:21.667-->00:32:27.667
heart to improve their security
and protect their players, uh,
uh, their players’ data. Um you

00:32:27.667-->00:32:32.458
know, they, more money needs to
be spent, ah, on information
security and also the operators

00:32:32.458-->00:32:40.667
need to start asking the game
manufacturers what, what, how is
your system secure? What

00:32:40.667-->00:32:45.583
controls do you have in place?
And you know, I’ll give you an
example, we were working with a,

00:32:45.583-->00:32:50.542
ah, one, ah, a casino
organization and, ah, we were
doing a security assessment;

00:32:50.542-->00:32:56.333
just a basic vulnerability
assessment and, ah, realized
that from the corporate network

00:32:56.333-->00:33:00.292
we could get from to the slot
machines and touched an
interface card in the slot

00:33:00.292-->00:33:06.250
machines and when I brought that
up to the director of IT’s ah,
attention because I was curious,

00:33:06.250-->00:33:11.125
like, should you be able to do
this? It didn’t seem right . He
was like well let me fire off a

00:33:11.125-->00:33:15.292
note to the ah, I’m not going to
say the gaming manufacturer’s
name. And they came back, oh no,

00:33:15.292-->00:33:20.875
the only things these should
talk to is, ah, is a their
tracking database. It doesn’t

00:33:20.875-->00:33:26.333
need, it should be firewalled
off. So you have, you know,
operators, you know, operators

00:33:26.333-->00:33:29.958
are trusting their vendors to do
their installations and they are
not and you know sometimes not

00:33:29.958-->00:33:33.417
doing it correctly and then also
questioning what other controls
do you have in place, you know,

00:33:33.417-->00:33:37.833
as far as SCLC process, ah with
this code. You know, obviously,
these huge organizations they

00:33:37.833-->00:33:45.958
are not like MUSL, they don’t
have one guy writing the code ah
they have hundreds, ah, but how

00:33:45.958-->00:33:53.167
do we trust that that code is
secure especially when we are
dealing with some, ah, a lot of

00:33:53.167-->00:33:58.833
the gaming operators do a large
amount of off shore, ah,
development. What are the

00:33:58.833-->00:34:06.667
controls in place? Luckily, we
do have gaming regulations with
security components. You know,

00:34:06.667-->00:34:12.500
when New Jersey, uh, the second
state to legalize the iGaming,
ah, they came out with very,

00:34:12.500-->00:34:19.042
very comprehensive security
controls. At least, at least
more comprehensive than what was

00:34:19.042-->00:34:24.208
in the unregulated industries.
If you recall atnthat time there
was really no security controls

00:34:24.208-->00:34:29.458
in place. Ah, and you know, to
date, New Jersey is very proud
of the fact that they haven’t

00:34:29.458-->00:34:35.042
had a security incident or a
breach or their controls are
working effectively. You know,

00:34:35.042-->00:34:41.958
Maryland, for example, ah, their
gaming commission requires their
land-based operators to undergo

00:34:41.958-->00:34:45.917
an annual security assessment.
Once again, I am not saying it
is perfect but it’s a step in

00:34:45.917-->00:34:50.375
the right direction to have
these security regs, these
compliance regulations in place.

00:34:50.375-->00:34:55.500
And then, of course, we have our
regular regulatory compliance
standards, PCI, etc. but as the

00:34:55.500-->00:35:00.917
last bullet says there often its
left up to the operator to
determine the level of security

00:35:00.917-->00:35:05.333
that is implemented. There’s not
strict guidelines even when it
come to New Jersey and the

00:35:05.333-->00:35:11.042
testing; it’s sort of left up to
us working with the operator to
determine who deep we dive and

00:35:11.042-->00:35:18.625
as you can guess a lot of that
comes to funding and budget for
those operators. So conclusion,

00:35:18.625-->00:35:24.833
while regulated iGaming has
added additional controls, you
know, there’s still room for

00:35:24.833-->00:35:29.542
improvement both on the
operators and regulators. And
this goes to brick and mortar

00:35:29.542-->00:35:36.708
casinos as well and also to the
lottery sector. Um, you know, in
my opinion as I mentioned, I

00:35:36.708-->00:35:44.625
think one of the key risk is in
the code. And that’s what
concerns me most. You know, and

00:35:44.625-->00:35:50.708
I think this applies to all
forms of online, online gambling
and also brick and mortar. Ah, I

00:35:50.708-->00:35:58.958
mean, it would be in my opinion
pretty easy for something to be
ah, added, to-to-to one of these

00:35:58.958-->00:36:04.833
iGaming sites that could allow
fraud to be committed. It’s
happened in the past. I think

00:36:04.833-->00:36:10.042
it’s going to happen again and
its very important for the
regulators and operators, ah, to

00:36:10.042-->00:36:15.208
work together and, you know, the
last point is as you saw in the
slide with the map, you know,

00:36:15.208-->00:36:21.208
while it is still small with
iGaming, it’s growing. Daily
fantasy sports is here. You

00:36:21.208-->00:36:28.042
can’t watch an NFL football game
without seeing Draft Kings or
FanDuel advertising. You know,

00:36:28.042-->00:36:33.625
it has become more widely
accepted. You know sports
betting is a, looks like, you

00:36:33.625-->00:36:41.417
know, it could become legal in
in other states besides, ah,
Nevada. Um, you know, no longer

00:36:41.417-->00:36:49.083
is gaming focused on Nevada and
Atlantic City; it’s across the
entire United States and as it

00:36:49.083-->00:36:56.833
becomes, you know ah, you know,
as it expands that attack
footprint expands, ah, the

00:36:56.833-->00:37:00.792
opportunity expands for crime
and fraud to be committed. So
that’s what we have. I hope you

00:37:00.792-->00:37:05.167
enjoyed the presentation. I’m
sorry for some of the technical
delays and we rushed a little

00:37:05.167-->00:37:11.083
but, ah, in the beginning when
we probably didn’t have to. Um,
but, we would love to speak with

00:37:11.083-->00:37:15.917
any of you, ah, outside, if you
have any specific questions,
especially for Evan, I know he

00:37:15.917-->00:37:19.583
went through those code, those
code slides pretty quickly but,
you know, he can definitely go

00:37:19.583-->00:37:23.417
into more detail as far as how
that code worked, the various
functions etcetera, etcetera.,

00:37:23.417-->00:00:00.000
but thank you for attending and
enjoy the last day at Def Con.
[Applause]