4 ms·

Step 6 of this process was to subvert the machine and print a backdated ticket. How does blacking out ticket sales for five minutes around the draw help against

• cryptonector 2y ago
  Presumably all ticket sales (including their numbers) are synchronously reported to the lottery office by the sales terminals. That would render backdating attacks detectable.
  • jamesfinlayson 2y ago
    Yes - in Australia's lotto system at least, the physical tickets are inserted into the database then printed once they are confirmed to be committed.
  • Breza 2y ago
    Yeah, I imagine they save the list of all the tickets they've sold, get a hash of the values, and then generate the winning number.
• jcrawfordor 2y ago
  The backdating is trivially detectable unless you manage to get the database operations to happen the wrong way around, which is why the whole "holding a packet" thing has to happen. But part of the reason for the blackout period is to account for the possibility of that kind of thing happening anyway. If you have to fake the issue time by five minutes, then 1) the described method is probably infeasible anyway because the connection to the database will time out while the packet is held for multiple minutes, 2) the ticket issue date and audit date on the database event will vary by at least five minutes which makes it obvious that the ticket was improperly issued.