5 ms·

Russians Engineer a Slot Machine Cheat and Casinos Have No Fix (2017)

45 points by lando2319 8y ago

jacquesm 8y ago
Weird how the police and the federal officers allow themselves to be used to protect the business interests of the lowlifes that run casinos. If they can't keep their stuff secure enough that it can't be scammed then maybe they should simply shut those machines down? After all, it's not as if a casino has a right to be profitable.
- eesmith 8y ago
  There are a few responses I can think of. It may be that all of them are true. The law protects what is legal. I may consider bar owners to be lowlifes profiting on alcohol addicts, but the police will protect their business interests and disregard my belief. If they don't, then someone is going to step into that power vacuum. That's how you get organized crime. The state makes money off of casinos, and bars, and brothels (in NV), and gambling, and other activities often called "lowlife." It's hard to cut off that sweet, sweet money supply once it starts.
- rfugger 8y ago
  Police are supposed to follow the law, and if the law bans computer aids to beat the slot machines, then the police are acting correctly in investigating. The more interesting question is how gambling interests have gotten such favourable laws passed that help them maintain profitability in the face of potentially disruptive technology. In general it's not surprising that laws tend to favour entrenched interests in any area though, since that's how power works...
- tomtimtall 8y ago
  Well Ofcause casinos have a right to be profitable. Just like tech startups, as soon as the government is reaping in money through that company they want to keep it alive. Even if it is no net benefit to society or even profitable at all on its own. Look at the current “unicorns” serving subsidized taxi rides and subsidized movie tickets. It doesn’t matter if you provide anything at all as long as you manage to stamp you logo on large enough cash flows everyone benefitting from that cashflow will work to keep you alive.
- smallstepforman 8y ago
  In most states the Gaming profits are taxed, hence up to 30% of the states budget is funded by Gaming operations (here in Australia it is). Regardless of the media rhetoric, no government wants to lose 30% of its budget funding, hence it does everything it can to appease the Gaming industry while pretending to care about community cost. At the end of the day, you can have more schools, hospitals, better roads etc (thanks to Gaming), or you can have less schools, less hospitals, worse roads etc (and be Gaming free).
Theodores 8y ago
Wired's presentation of the article was wasted on me. I invested the time to read but didn't get there in the end. If you are on article 1 of your 4 free ones you expect better than adverts breaking up your reading flow all the time. Also this style of writing is dated, if you are reading a book then a chapter of setting the scene is okay but for the web you wonder if they are ever going to get to the point or even tell you the story. I didn't bail out I just got bored. I can't imagine paying for more than the four free articles. I don't think the subscription model is strictly broken but I can't see publications like Wired lasting forever in an age where information wants to be free.
- jacquesm 8y ago
  > I can't see publications like Wired lasting forever in an age where information wants to be free 1) Nothing lasts forever. 2) Wired has been around longer than the phrase 'information wants to be free', which was a meme that should have died long ago. Information doesn't want anything, you want something: free information, and Wired isn't obliged to give it to you. So what if they extend the 'click bait' to 'article bait', at least they gave you a good enough sample to realize that you weren't going to pay for it. The words you are looking for are 'thank you'.
- Jyaif 8y ago
  Wired is total garbage anyways.
  - dang 8y ago
    Maybe so, but please don't post unsubstantive comments to HN.
acqq 8y ago
The title on HN at the moment ("Engineer finds...") doesn't match the article, and distorts the original. Should be fixed by the mods. Also (2017). There's no "an engineer" who "finds" anything but "engineer" as a verb, the title is: "Russians Engineer a Brilliant Slot Machine Cheat---And Casinos Have No Fix" which means something like "Russians design a cheat" or "Russians construct a cheat." On the topic of "casinos have no fix", it seems that the casinos have FBI protecting them and the other ways of control, which is obviously enough of a fix for them.
- Rjevski 8y ago
  This seems to only be a fix for the greedy people that keep coming back and raise suspicion. A casual player that cheats once and cashes out would be undetected.
  - acqq 8y ago
    > A casual player that cheats once Obviously doesn't exist in the case like this: it is an organized effort depending on specific steps and now that the technique is known, it's easy to detect such attempts by the casinos. If the casinos would estimate that the danger is too big to them they would have stopped using these models or consider some kind of upgrade, so they are obviously OK.
- sctb 8y ago
  We've updated the title from “Engineer finds slot machine cheat. Casinos unable to fix”.
lb1lf 8y ago
I have a hard time deciding whether I really think this scheme qualifies as fraud or not; after all, the machines are initially rigged to give the owner an edge (obviously, otherwise slot machines would be few and far between!) As long as the player is not manipulating the machine, only observing it and exploiting a known weakness negating and then some the edge the owner had, I'd say if slot machine operators cannot live with that, they need to upgrade their machines, not expect The Law to help them out.
- hashkb 8y ago
  If counting cards is illegal, this seems like it'd fall under that same logic.
  - Rjevski 8y ago
    Isn't card counting legal? From what I've read it seems like it's forbidden by the casinos and they can ban you for it, but it is not illegal as far as the law is concerned.
    - maxerickson 8y ago
      Brief search says you can't use a device to count cards, which is probably more analogous to using the phone to crack the cycle. I guess new machines with reasonable random number generators would fix the problem. I wonder if any laws actually specify weak RNGs.
  - paulie_a 8y ago
    Counting cards is completely legal. A casino does have the option of choosing to not do business with someone they suspect of doing it. There are no criminal penalties.
    - hashkb 8y ago
      Sorry... in this case by "legal" I meant "will not get you thrown out of the casino"
robbiet480 8y ago
Previous submission: https://news.ycombinator.com/item?id=13579353 https://news.ycombinator.com/item?id=13579353
anotheryou 8y ago
Why not seed a few more things in to the random numbers like temperature and noise? Both should be hard to measure exactly the same outside the casing, hard to control and when done right should only add randomness. Bringing heaters and timed, stealthy noise-generators should be difficult :) Also past noise should influence the future randomness.
- hashkb 8y ago
  You could measure those things someplace far away (secret), or in a random office underneath the casino.
  - function_seven 8y ago
    If you’re taking the LSBs of those readings, measuring it using another instrument at any distance from the machine would be useless. (Audio) noise and temperature are very noisy inputs.
- maxerickson 8y ago
  The phone is recovering the internal state of the PRNG, different initialization wouldn't stop that.
  - LeoPanthera 8y ago
    This is certainly not my field of expertise, but I would guess that regularly re-seeding the RNG with environmental information would prevent that attack.
- alkonaut 8y ago
  It’s trivial to make it impossible to predict the machine output. Just source even a low quality entropy source. But now take that machine and source code and prove to gambling authorities what its properties are. That’s now almost impossible instead. You have made a machine that may behave differently under evaluation.
- smallstepforman 8y ago
Splines 8y ago
I'm surprised to learn that pressing the "stop spin" button actually makes a difference - I had assumed that your results are calculated and fixed when the spin starts, and stopping it is just cosmetic. Why risk the house edge by allowing users to pick when to stop your spin.
lindig 8y ago
The loophole is that the state of the pseudo random number generator is observed (indirectly) and used for predictions. What if slot machines would use a real source of randomness? I assume that this would cause difficulties with the licensing process for these machines because the "fairness" of the machines would be harder to prove.
- bluepnume 8y ago
  I wouldn't think so. Whatever random result you get, you can bound it to make sure the probability works in your favor a fixed proportion of the time, right? `if (pseudoRandom() < 0.57) houseWins()` gives the same payout as `if (trueRandom() < 0.57) houseWins()` for all intents and purposes; the only difference is the former is more predictable to people trying to game the machine.
  - kbenson 8y ago
    I think the licensing requirements for these machines are strict enough that they want reproducibility in the testing, which would be one reason to require pseudo-random numbers instead of real random numbers. I imagine they might just simulate a million transactions and test the outcome. If it falls outside of expected probabilities, they can dive deeper, and also have a pseudo-random seed to fall back on to figure out if it was just randomness or something is broken or configured to do the wrong thing.
    - jacquesm 8y ago
      That's exactly the reason why they use PRNGs.
Rjevski 8y ago
I am really disappointed that the law is against those people. If the casinos are allowed to scam people by making it look like you are playing a fair game while it's not (the machine is configured to give an advantage to the house), it should be allowed for a skilled player (like someone who found a vulnerability in the machine) to scam the casinos the same way.
- JumpCrisscross 8y ago
  > scam people by making it look like you are playing a fair game while it's not Casinos don’t advertise themselves as a place to get a fair shake. On card tables, they explicitly take their cut in everyone’s view.
- gkoberger 8y ago
  Casino games are highly regulated, and nobody is forced to play. Everyone who plays knows the odds are against them.
  - 0xfeba 8y ago
    > Everyone who plays knows the odds are against them. Tourists know this. Poor locals that hoard in after payday don't all seem too.
  - warent 8y ago
    Nobody is forced to play, but there's a lot of human psychology hacking that the casino employs to get people to gamble more. Takeaway: Hacking humans is legal. Hacking a casino algorithm? Stop right there criminal scum.
    - gkoberger 8y ago
      Well, gambling isn't legal in many states. And both the way they're made and way they're advertised is heavily regulated. I'd say it's a bit dramatic to say "hacking humans is legal". (I mean, it is legal via ads, but even those are regulated to a certain extent)

45 points by lando2319 8y ago

Weird how the police and the federal officers allow themselves to be used to protect the business interests of the lowlifes that run casinos. If they can't keep their stuff secure enough that it can't be scammed then maybe they should simply shut those machines down? After all, it's not as if a casino has a right to be profitable.

eesmith 8y ago
There are a few responses I can think of. It may be that all of them are true. The law protects what is legal. I may consider bar owners to be lowlifes profiting on alcohol addicts, but the police will protect their business interests and disregard my belief. If they don't, then someone is going to step into that power vacuum. That's how you get organized crime. The state makes money off of casinos, and bars, and brothels (in NV), and gambling, and other activities often called "lowlife." It's hard to cut off that sweet, sweet money supply once it starts.
rfugger 8y ago
Police are supposed to follow the law, and if the law bans computer aids to beat the slot machines, then the police are acting correctly in investigating. The more interesting question is how gambling interests have gotten such favourable laws passed that help them maintain profitability in the face of potentially disruptive technology. In general it's not surprising that laws tend to favour entrenched interests in any area though, since that's how power works...
tomtimtall 8y ago
Well Ofcause casinos have a right to be profitable. Just like tech startups, as soon as the government is reaping in money through that company they want to keep it alive. Even if it is no net benefit to society or even profitable at all on its own. Look at the current “unicorns” serving subsidized taxi rides and subsidized movie tickets. It doesn’t matter if you provide anything at all as long as you manage to stamp you logo on large enough cash flows everyone benefitting from that cashflow will work to keep you alive.
smallstepforman 8y ago
In most states the Gaming profits are taxed, hence up to 30% of the states budget is funded by Gaming operations (here in Australia it is). Regardless of the media rhetoric, no government wants to lose 30% of its budget funding, hence it does everything it can to appease the Gaming industry while pretending to care about community cost. At the end of the day, you can have more schools, hospitals, better roads etc (thanks to Gaming), or you can have less schools, less hospitals, worse roads etc (and be Gaming free).

Theodores 8y ago

Wired's presentation of the article was wasted on me. I invested the time to read but didn't get there in the end. If you are on article 1 of your 4 free ones you expect better than adverts breaking up your reading flow all the time. Also this style of writing is dated, if you are reading a book then a chapter of setting the scene is okay but for the web you wonder if they are ever going to get to the point or even tell you the story. I didn't bail out I just got bored. I can't imagine paying for more than the four free articles. I don't think the subscription model is strictly broken but I can't see publications like Wired lasting forever in an age where information wants to be free.

jacquesm 8y ago
> I can't see publications like Wired lasting forever in an age where information wants to be free 1) Nothing lasts forever. 2) Wired has been around longer than the phrase 'information wants to be free', which was a meme that should have died long ago. Information doesn't want anything, you want something: free information, and Wired isn't obliged to give it to you. So what if they extend the 'click bait' to 'article bait', at least they gave you a good enough sample to realize that you weren't going to pay for it. The words you are looking for are 'thank you'.
Jyaif 8y ago
Wired is total garbage anyways.
- dang 8y ago
  Maybe so, but please don't post unsubstantive comments to HN.

acqq 8y ago

The title on HN at the moment ("Engineer finds...") doesn't match the article, and distorts the original. Should be fixed by the mods. Also (2017). There's no "an engineer" who "finds" anything but "engineer" as a verb, the title is: "Russians Engineer a Brilliant Slot Machine Cheat---And Casinos Have No Fix" which means something like "Russians design a cheat" or "Russians construct a cheat." On the topic of "casinos have no fix", it seems that the casinos have FBI protecting them and the other ways of control, which is obviously enough of a fix for them.

Rjevski 8y ago
This seems to only be a fix for the greedy people that keep coming back and raise suspicion. A casual player that cheats once and cashes out would be undetected.
- acqq 8y ago
  > A casual player that cheats once Obviously doesn't exist in the case like this: it is an organized effort depending on specific steps and now that the technique is known, it's easy to detect such attempts by the casinos. If the casinos would estimate that the danger is too big to them they would have stopped using these models or consider some kind of upgrade, so they are obviously OK.
sctb 8y ago
We've updated the title from “Engineer finds slot machine cheat. Casinos unable to fix”.

lb1lf 8y ago

I have a hard time deciding whether I really think this scheme qualifies as fraud or not; after all, the machines are initially rigged to give the owner an edge (obviously, otherwise slot machines would be few and far between!) As long as the player is not manipulating the machine, only observing it and exploiting a known weakness negating and then some the edge the owner had, I'd say if slot machine operators cannot live with that, they need to upgrade their machines, not expect The Law to help them out.

hashkb 8y ago
If counting cards is illegal, this seems like it'd fall under that same logic.
- Rjevski 8y ago
  Isn't card counting legal? From what I've read it seems like it's forbidden by the casinos and they can ban you for it, but it is not illegal as far as the law is concerned.
  - maxerickson 8y ago
    Brief search says you can't use a device to count cards, which is probably more analogous to using the phone to crack the cycle. I guess new machines with reasonable random number generators would fix the problem. I wonder if any laws actually specify weak RNGs.
- paulie_a 8y ago
  Counting cards is completely legal. A casino does have the option of choosing to not do business with someone they suspect of doing it. There are no criminal penalties.
  - hashkb 8y ago
    Sorry... in this case by "legal" I meant "will not get you thrown out of the casino"

robbiet480 8y ago

Previous submission: https://news.ycombinator.com/item?id=13579353 https://news.ycombinator.com/item?id=13579353

anotheryou 8y ago

Why not seed a few more things in to the random numbers like temperature and noise? Both should be hard to measure exactly the same outside the casing, hard to control and when done right should only add randomness. Bringing heaters and timed, stealthy noise-generators should be difficult :) Also past noise should influence the future randomness.

hashkb 8y ago
You could measure those things someplace far away (secret), or in a random office underneath the casino.
- function_seven 8y ago
  If you’re taking the LSBs of those readings, measuring it using another instrument at any distance from the machine would be useless. (Audio) noise and temperature are very noisy inputs.
maxerickson 8y ago
The phone is recovering the internal state of the PRNG, different initialization wouldn't stop that.
- LeoPanthera 8y ago
  This is certainly not my field of expertise, but I would guess that regularly re-seeding the RNG with environmental information would prevent that attack.
alkonaut 8y ago
It’s trivial to make it impossible to predict the machine output. Just source even a low quality entropy source. But now take that machine and source code and prove to gambling authorities what its properties are. That’s now almost impossible instead. You have made a machine that may behave differently under evaluation.
smallstepforman 8y ago

Splines 8y ago

I'm surprised to learn that pressing the "stop spin" button actually makes a difference - I had assumed that your results are calculated and fixed when the spin starts, and stopping it is just cosmetic. Why risk the house edge by allowing users to pick when to stop your spin.

lindig 8y ago

The loophole is that the state of the pseudo random number generator is observed (indirectly) and used for predictions. What if slot machines would use a real source of randomness? I assume that this would cause difficulties with the licensing process for these machines because the "fairness" of the machines would be harder to prove.

bluepnume 8y ago
I wouldn't think so. Whatever random result you get, you can bound it to make sure the probability works in your favor a fixed proportion of the time, right? `if (pseudoRandom() < 0.57) houseWins()` gives the same payout as `if (trueRandom() < 0.57) houseWins()` for all intents and purposes; the only difference is the former is more predictable to people trying to game the machine.
- kbenson 8y ago
  I think the licensing requirements for these machines are strict enough that they want reproducibility in the testing, which would be one reason to require pseudo-random numbers instead of real random numbers. I imagine they might just simulate a million transactions and test the outcome. If it falls outside of expected probabilities, they can dive deeper, and also have a pseudo-random seed to fall back on to figure out if it was just randomness or something is broken or configured to do the wrong thing.
  - jacquesm 8y ago
    That's exactly the reason why they use PRNGs.

Rjevski 8y ago

I am really disappointed that the law is against those people. If the casinos are allowed to scam people by making it look like you are playing a fair game while it's not (the machine is configured to give an advantage to the house), it should be allowed for a skilled player (like someone who found a vulnerability in the machine) to scam the casinos the same way.

JumpCrisscross 8y ago
> scam people by making it look like you are playing a fair game while it's not Casinos don’t advertise themselves as a place to get a fair shake. On card tables, they explicitly take their cut in everyone’s view.
gkoberger 8y ago
Casino games are highly regulated, and nobody is forced to play. Everyone who plays knows the odds are against them.
- 0xfeba 8y ago
  > Everyone who plays knows the odds are against them. Tourists know this. Poor locals that hoard in after payday don't all seem too.
- warent 8y ago
  Nobody is forced to play, but there's a lot of human psychology hacking that the casino employs to get people to gamble more. Takeaway: Hacking humans is legal. Hacking a casino algorithm? Stop right there criminal scum.
  - gkoberger 8y ago
    Well, gambling isn't legal in many states. And both the way they're made and way they're advertised is heavily regulated. I'd say it's a bit dramatic to say "hacking humans is legal". (I mean, it is legal via ads, but even those are regulated to a certain extent)