Backdooring the Lottery and Other Security Tales

Summary

### Evolution of Casino and Gaming Exploitation At 01:30, the speakers provide an overview of the regulatory and security landscape governing casinos, state lotteries, and tribal gaming. Starting at 06:00, they examine historical mechanical cheating techniques, profiling notorious slot machine fraudster Tommy Carmichael. Carmichael engineered physical tools—such as the monkey paw, the slider, and the optical light wand—which bypassed coin-counting microswitches and blinded optical sensors inside payout hoppers to trigger automated jackpot dumps.

### Insider Tampering: The Ron Harris Case At 07:31, the presentation explores the infamous case of Ron Harris, a computer technician and investigator for the Nevada Gaming Control Board. Leveraging his official mandate to audit and approve gaming hardware, Harris accessed proprietary slot machine source code and secretly burned modified EPROMs containing malicious logic bombs. He also calculated computerized Keno pseudorandom number generator (PRNG) cycles, successfully rigging games until his arrest in Atlantic City in 1995.

### The MUSL Hot Lotto Insider Attack At 12:03, the focus turns to the landmark Eddie Tipton case at the Multi-State Lottery Association (MUSL). Serving as Information Security Director, Tipton held administrative control over the computerized random number generation systems powering multi-state drawings. At 13:36, surveillance footage captured Tipton personally purchasing a winning $16.5 million Hot Lotto ticket in Iowa, violating strict bans on lottery employees participating in drawings.

### Forensic Analysis of the qv_rng.dll Backdoor At 16:40 and 19:41, the speakers dissect the forensic investigation conducted by Cyber Security Turner, which analyzed hard drive images from the lottery draw machines. Investigators discovered that Tipton had injected malicious code into `qv_rng.dll`, a core dynamic-link library responsible for seeding the PRNG. When drawings occurred on three specific dates of the year, falling on particular days of the week and matching exact clock times, the software bypassed atmospheric noise seeds and initialized a predictable linear congruential PRNG algorithm, giving Tipton the exact winning number sequences in advance.

### Russian Slot Machine PRNG Reverse Engineering At 27:16 and 28:48, the speakers describe a sophisticated international syndicate active from 2011 to 2014 that targeted Aristocrat Mark VI slot machines. Operatives inside casinos recorded video clips of spinning reels using mobile phones and transmitted the footage to remote analysis servers in Saint Petersburg. By calculating the internal state of the machine's PRNG, the servers timed spin commands down to the millisecond, sending haptic vibration alerts to the operative's phone indicating the exact moment to press the spin button for guaranteed payouts.

### Security Vulnerabilities and Network Segmentation in Modern Gaming Concluding between 33:21 and 36:21, the presenters evaluate architectural vulnerabilities across modern gaming operations. They emphasize that while casinos enforce strict physical surveillance, internal IT networks frequently suffer from excessive vendor trust, unsegmented floor networks, and compliance checklists that fail to prevent determined insiders and advanced hardware attacks.