7 ms·

Jackpot-fixing investigation expands to more state lotteries

41 points by tokenadult 11y ago

gojomo 11y ago
The firm involved, "Multi-State Lottery Association" (http://www.musl.com/ http://www.musl.com/), is a non-profit which lists 37 US lotteries as members (http://www.musl.com/musl_members.html http://www.musl.com/musl_members.html). California is not listed, but MUSL also apparently originated "Powerball", which is available in California. Sounds like they might offer some great jobs for hackers and security professionals! Alas, their 'Careers' page (http://www.musl.com/musl_careers.html http://www.musl.com/musl_careers.html) reports: "There are currently no positions available."
- luckyduck2015 11y ago
  MUSL is a weird org. They have compliance requirements for security that are only disclosed to the Counsel of the lottery organization, who signs an NDA. Their actual requirements as far as I could tell are similar to IRS 1075. Lotteries are as secure as any state revenue or health department. (I.e. In most cases decent perimeter and shitty internal controls)
hackuser 11y ago
How could anyone have the ability to install a rootkit undetected on the lottery computer? Computing systems that aren't properly secured are like bank vaults left unsecured, but in many cases they also are remotely accessible. People shouldn't be any more shocked at these exploits than the 'exploit' of an employee stealing cash from an insecure bank vault. We should expect it. It would be a honeypot if we took security seriously. For some reason people don't take the security of digital assets as seriously as security of physical assets; we don't invest the significant resources required to secure them.. How secure are voting machines, as an example? Given the enormous stakes of elections, we know what to expect.
- Spooky23 11y ago
  Poor internal controls. Getting internal security threats like this dealt with requires strong controls and frequent audit. That means 5x or more staff. In the old days, the lotto used ping pong balls to pick numbers and all operations were observed by a third party auditor. IMO, you need physicial processes that can be observed and understood by a layman to have a high level of assurance.
  - toomuchtodo 11y ago
    Cheaper to just go back to physical processes that can be easily audited. Simple = better.
    - brianwawok 11y ago
      Is it easy to audit ping pong balls? Seems you can weight them just as easily as you can do a root kit.
      - Spooky23 11y ago
        You can write down a procedure to weigh them, measure them, document chain of custody, etc. With a computerized process, how do you assure that the code isn't tampered with? Or that the OS is tampered with? You can do it, but the average auditor from KPMG or Deloitte can't, and the people who can are hard to find.
- gojomo 11y ago
  Doesn't necessarily require a 'rootkit'. Maybe it's a smaller bit of subtle corruption of a random-number generator. Maybe even it's an unintentional flaw that he learned about during an audit and then decided to exploit rather than fix.
  - Cyberdog 11y ago
    The prosecution is saying it's a rootkit. So either they found a rootkit, or the prosecution just though tit was a sufficiently tech-ish enough word to build a case around while hoping nobody would call them on the lack of evidence for one (the latter would not surprise me).
jackfoxy 11y ago
Real random numbers, https://github.com/jackfoxy/RandomBitsSolution https://github.com/jackfoxy/RandomBitsSolution The wrapping code can be short and sweet and run in a repl on an audited machine... or go back to Ping-Pong balls as suggested by others. The point being just about any software supplied be a vendor is going to be non-trivial and in some way exploitable.

41 points by tokenadult 11y ago

The firm involved, "Multi-State Lottery Association" (http://www.musl.com/ http://www.musl.com/), is a non-profit which lists 37 US lotteries as members (http://www.musl.com/musl_members.html http://www.musl.com/musl_members.html). California is not listed, but MUSL also apparently originated "Powerball", which is available in California. Sounds like they might offer some great jobs for hackers and security professionals! Alas, their 'Careers' page (http://www.musl.com/musl_careers.html http://www.musl.com/musl_careers.html) reports: "There are currently no positions available."

luckyduck2015 11y ago
MUSL is a weird org. They have compliance requirements for security that are only disclosed to the Counsel of the lottery organization, who signs an NDA. Their actual requirements as far as I could tell are similar to IRS 1075. Lotteries are as secure as any state revenue or health department. (I.e. In most cases decent perimeter and shitty internal controls)

hackuser 11y ago

How could anyone have the ability to install a rootkit undetected on the lottery computer? Computing systems that aren't properly secured are like bank vaults left unsecured, but in many cases they also are remotely accessible. People shouldn't be any more shocked at these exploits than the 'exploit' of an employee stealing cash from an insecure bank vault. We should expect it. It would be a honeypot if we took security seriously. For some reason people don't take the security of digital assets as seriously as security of physical assets; we don't invest the significant resources required to secure them.. How secure are voting machines, as an example? Given the enormous stakes of elections, we know what to expect.

Spooky23 11y ago
Poor internal controls. Getting internal security threats like this dealt with requires strong controls and frequent audit. That means 5x or more staff. In the old days, the lotto used ping pong balls to pick numbers and all operations were observed by a third party auditor. IMO, you need physicial processes that can be observed and understood by a layman to have a high level of assurance.
- toomuchtodo 11y ago
  Cheaper to just go back to physical processes that can be easily audited. Simple = better.
  - brianwawok 11y ago
    Is it easy to audit ping pong balls? Seems you can weight them just as easily as you can do a root kit.
    - Spooky23 11y ago
      You can write down a procedure to weigh them, measure them, document chain of custody, etc. With a computerized process, how do you assure that the code isn't tampered with? Or that the OS is tampered with? You can do it, but the average auditor from KPMG or Deloitte can't, and the people who can are hard to find.
gojomo 11y ago
Doesn't necessarily require a 'rootkit'. Maybe it's a smaller bit of subtle corruption of a random-number generator. Maybe even it's an unintentional flaw that he learned about during an audit and then decided to exploit rather than fix.
- Cyberdog 11y ago
  The prosecution is saying it's a rootkit. So either they found a rootkit, or the prosecution just though tit was a sufficiently tech-ish enough word to build a case around while hoping nobody would call them on the lack of evidence for one (the latter would not surprise me).

jackfoxy 11y ago

Real random numbers, https://github.com/jackfoxy/RandomBitsSolution https://github.com/jackfoxy/RandomBitsSolution The wrapping code can be short and sweet and run in a repl on an audited machine... or go back to Ping-Pong balls as suggested by others. The point being just about any software supplied be a vendor is going to be non-trivial and in some way exploitable.