4 ms·

> From Tipton’s point of view, it was complicated. He had done something to see if he could do it. To his surprise, it worked. He said he inserted that code onl

> From Tipton’s point of view, it was complicated. He had done something to see if he could do it. To his surprise, it worked. He said he inserted that code only once; after the code was approved by Gaming Laboratories International, machines containing it were shipped all over the country. The article skips right over this. HTH was this code, which the article reports wasn't even hidden, approved by a third party? Trying to find out, I found this: https://www.desmoinesregister.com/story/news/investigations/2018/03/16/iowa-mastermind-who-scammed-lotteries-5-states-he-says-problems-he-exploited-arent-fixed-should-you/399257002/ https://www.desmoinesregister.com/story/news/investigations/... Which mentions: "Tipton designed his rigged coding so that it wasn't detected in the company's random tests, according to a report Fritschie helped present last year." ...as well as: "Toyne said the association does not have any ongoing contractual relations with Gaming Labs." The "report" mentioned earlier is a DEFCON presentation about gambling fraud in general, pretty interesting read: https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-Gus-Frischie-and-Evan-Teitelman-Backdooring-the-Lottery.pdf https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20pre... In it mentions "The method of rigging the RNG could have been more discrete" and gave the breakdown of reverse engineering the binary to find(?) the source code. It also said the labs tested the RNG for statistical bias (which would pass) and audited the source code (it only gives the Picard Facepalm pic, so I assume the auditors likely relied solely/mostly on the automated test.

dlhavema 8y ago
it sounds like they would have to run their tests with mock dates for every date out of the year to discover anything, unless they happened to run their tests on one of the 3 days mentioned in the code, they wouldn't find it. how many tests would they need to run to really tell if there is any bias?
- lostlogin 8y ago
  What if the rigging was only in a certain year? Auditing each day for the next decade would be safer. A good code review sounds even better.
  - emodendroket 8y ago
    While code review isn't foolproof, this seems like it should have been fairly obvious.
- emodendroket 8y ago
  Well, more than is practical to run, probably.
- Slartie 8y ago
  Why would it even be okay at all for a piece of code that determines the seed for a pseudo RNG via observation of hardware events (a Geiger counter measurement, according to the article) to even access the date and time on a given system? It should have no use for that information, and with a piece of code of that criticality, one would expect auditors to scrutinize any and all syscalls that it performs. This way it should have been fairly obvious that it's requesting the time from the OS, which it shouldn't do in the first place. Mocking date/time info is unnecessary if your code under test is entirely unable to get time information from the system in the first place.
  - moltar 8y ago
    All of the brightest minds were building Facebook ;)
- thedirt0115 8y ago
  I feel like generating a lot (100k? You can tweak to get whatever confidence you want) of numbers for every day for the next several (30?) years and running tests like chi-squared (or others, see http://www.cse.wustl.edu/~jain/iucee/ftp/k_27trg.pdf http://www.cse.wustl.edu/~jain/iucee/ftp/k_27trg.pdf) doesn't seem too crazy when you're talking about millions of dollars in prize money.
8_hours_ago 8y ago
Here's the video of the DEFCON presentation: https://www.youtube.com/watch?v=49KU9NDcCgI https://www.youtube.com/watch?v=49KU9NDcCgI

dlhavema 8y ago

it sounds like they would have to run their tests with mock dates for every date out of the year to discover anything, unless they happened to run their tests on one of the 3 days mentioned in the code, they wouldn't find it. how many tests would they need to run to really tell if there is any bias?

lostlogin 8y ago
What if the rigging was only in a certain year? Auditing each day for the next decade would be safer. A good code review sounds even better.
- emodendroket 8y ago
  While code review isn't foolproof, this seems like it should have been fairly obvious.
emodendroket 8y ago
Well, more than is practical to run, probably.
Slartie 8y ago
Why would it even be okay at all for a piece of code that determines the seed for a pseudo RNG via observation of hardware events (a Geiger counter measurement, according to the article) to even access the date and time on a given system? It should have no use for that information, and with a piece of code of that criticality, one would expect auditors to scrutinize any and all syscalls that it performs. This way it should have been fairly obvious that it's requesting the time from the OS, which it shouldn't do in the first place. Mocking date/time info is unnecessary if your code under test is entirely unable to get time information from the system in the first place.
- moltar 8y ago
  All of the brightest minds were building Facebook ;)
thedirt0115 8y ago
I feel like generating a lot (100k? You can tweak to get whatever confidence you want) of numbers for every day for the next several (30?) years and running tests like chi-squared (or others, see http://www.cse.wustl.edu/~jain/iucee/ftp/k_27trg.pdf http://www.cse.wustl.edu/~jain/iucee/ftp/k_27trg.pdf) doesn't seem too crazy when you're talking about millions of dollars in prize money.

8_hours_ago 8y ago

Here's the video of the DEFCON presentation: https://www.youtube.com/watch?v=49KU9NDcCgI https://www.youtube.com/watch?v=49KU9NDcCgI