Timeline for Did Russian hackers beat slot machines with an app?
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 27, 2020 at 14:43 | comment | added | gnasher729 | The attacker doesn’t need super fast reaction time of 250ms. For example if they practice until they can pull the trigger reliably 480-520 ms after the signal, you just adjust the signal. | |
| Jun 19, 2017 at 21:46 | comment | added | Oddthinking♦ | @Tsar: No, this is taking a "solid IT rule" which is about a particular device, and incorrectly applying it to the class. If a hacker gets physical access to your Linux server, you can expect that they will be able to access the data on there... but not on every Linux server in existence. You give a very specific conditional, which makes it no longer a solid rule. | |
| Jun 19, 2017 at 14:09 | comment | added | T. Sar | @Oddthinking If the devices use the same software and hardware with the same out-of-box exploitable weakness, which seems to be the case, then yes - it is game over for every single device of that type. A good analogy would be padlocks with the same secret. Once you got the key to open one of them, all of them are already defeated. This happens way more frequently that we at IT would like to admit... | |
| Feb 10, 2017 at 17:47 | comment | added | Gilles 'SO- stop being evil' | Your links for “Some PRNGs are good but some are broken” are backwards. A Mersenne twister would be awful for a slot machine: if you see a few hundred consecutive outputs then subsequent outputs are predictable. This corresponds to the hackers' MO, BTW: observe outputs, give some time for the server to calculate the possible RNG states, come back observe a few to re-sync, then profit. Dual_EC_DRBG would be fine for a slot machine: there may be a secret key that NSA knows that allows them to break it, but nobody knows how to break it without knowing that secret key. | |
| Feb 10, 2017 at 7:13 | comment | added | Nij | EGM in some countries is legally mandated to have a payout ratio of at least in the region of 80% credit bet, with further limits on the distribution of outcomes and actual payouts. They're also often legally restricted to having a payout ratio below somewhere in the mid-90% (to prevent possible circumvention and fraud). 1% edge on EGM would be ludicrously inefficient as a moneymaking enterprise, the casino operator knows that and has every reason to lower the payout ratio below 90%, so without the requirements to be as high, they have been known to drop as far as the 30-40% ratio. | |
| Feb 9, 2017 at 12:54 | comment | added | Oddthinking♦ | "Even if they tilt the odds by 1% in their favour, over the course of thousands of pulls by four men over a week, that 1% adds up." [citation-needed] The house edge of slot machines vary, but less than 1% is very, very low. | |
| Feb 9, 2017 at 12:51 | comment | added | Oddthinking♦ | "A solid IT rule is once a hacker has physical access to your machine, it is game over." It is game over for that device but it isn't the case that all devices in the class are lost, which is what you are assuming here.. | |
| Feb 8, 2017 at 18:50 | history | edited | RomaH | CC BY-SA 3.0 |
Better summary to help answer though it may not be completely answerable
|
| Feb 8, 2017 at 17:10 | vote | accept | Frezzley | ||
| Feb 8, 2017 at 16:55 | history | edited | RomaH | CC BY-SA 3.0 |
added 1 character in body
|
| Feb 8, 2017 at 16:48 | history | answered | RomaH | CC BY-SA 3.0 |