Slot Flaw Scofflaws | Hacker News Reader

Slot Flaw Scofflaws

npr.org

31 pointssandebert28 comments

For most slot machines, this is a non-issue. The RNGs used isn't necessarily a secret (most companies use known good algorithms), and there is plenty to seed them, including player/coin input, network traffic, and plain old run-the-RNG-really-fast-continually-so-it's-tough-to-time.

However, this particular hack was with old Novomatic games, a small company at the time that didn't do a very good job here. This is a long solved problem with most other vendors. Bugs do happen, and they're generally covered under the "Malfunctions void all pays and plays" on every machine, and software updates that casinos may or may-not update the floor. Sometimes the news reports on some underflow error, but anybody with internal knowledge realizes the credit meter just went to 2^24-1, or something like that. These are really non-stories internally.

Source: Slot machine developer in previous life.

Kevin Mitnick, "The Art Of intrusion", ch 1: "Hacking The Casinos For A Million Bucks" - weak RNG in video poker machines, hilarity ensues.

Can expound on the hack if anyone cares. It definitely worked (this was 1990's, presumably harder now)

https://archive.org/stream/pdfy-xiVfICtkDwD1k90A/Kevin%20Mit...

The linked article in Wired: https://www.wired.com/2017/02/russians-engineer-brilliant-sl...

And the previous HN discussion of that article:

https://news.ycombinator.com/item?id=13579353

The cheating method is very interesting, but even the WIRED article leaves a lot of unanswered questions. Even if one knows what PRNG is used (the Mersenne Twister, for example), how in the world do they know how the PRNG is used? Are we generating integers, bits, bytes, do these numbers correspond to probabilities? To specific slots? Etc.

It just seems very unlikely to me that this kind of operation is possible without some kind of inside man that gives the cheaters a look at the source code (or at least an idea of how the slot machines work).

> inside man that gives the cheaters a look at the source code

Not necessary; slots are legal to buy in many states, including Nevada. Same machines as the casinos use. Read the ROM's, disassemble the algorithms...

How on earth is this a crime?

Using a "device" to help you gamble at a casino is usually illegal, yes. From the Wired article:

the operatives use their phones to record about two dozen spins on a game they aim to cheat. They upload that footage to a technical staff in St. Petersburg, who analyze the video and calculate the machine’s pattern based on what they know about the model’s pseudorandom number generator. Finally, the St. Petersburg team transmits a list of timing markers to a custom app on the operative’s phone; those markers cause the handset to vibrate roughly 0.25 seconds before the operative should press the spin button.

Wired says they were arrested under a federal fraud charge. I don't know how that part works, but it's definitely illegal under state laws, e.g. Nevada: It is unlawful for any person to use, possess with the intent to use or assist another person in using or possessing with the intent to use any computerized, electronic, electrical or mechanical device, or any software or hardware, or any combination thereof, which is designed, constructed, altered or programmed to obtain an advantage at playing any game in a licensed gaming establishment... [1]

Applies to anything at the casino -- it's not illegal to count cards at blackjack in your head, but you can't use your phone to do it.

[1] https://www.leg.state.nv.us/NRS/NRS-465.html#NRS465Sec075

to obtain an advantage?

So any device the casinos use is illegal.

The casino is covering a bet that is mathematically advantageous already, so no device is needed on their part.

No they aren't. Plenty of casino technology exists to prevent gamblers from having an advantage with perfect, unassisted play. Dealers use automatic shufflers, for instance.

There is a difference between "perfect" blackjack play, and card counting. If a casino is willing to put themselves in a situation where a counter can succeed they deserve to lose every dollar they have, but using a continuous shuffle machine doesn't confer a greater mathematical advantage in a single hand than the casino would already have.

If I was willing to play the slot machines without algorithmic assistance, I deserve to lose.

No arguments there

Continuous shufflers are used in low stakes blackjack to basically make card counting impossible.

The automatic shufflers are probably there to prevent dealers from being "on the take" to one of the players at the table.

Using any sort of device -- be it a phone app that keeps track of random number seeds, or an old school blackjack computer that works via foot taps -- has been illegal for a long while. It makes things no longer a game of chance. Much like how a casino's not allowed to use weighted dice, you're not allowed to use your own probability shifters. Now, if the people that are being discussed were doing this in their head, it wouldn't be illegal. The casinos would be angry at these people, call them mean names, and probably blacklist them, but it wouldn't be a crime. It's only once you add that device to make it something other than a game of chance does it become a crime.

Suppose there's a business where you pay a fixed fee to experience some sort of exhilaration. So far this could describe lots of things: a movie theater, a roller coaster, bungee jumping, prostitution, kayak rental, and yes, a casino slot machine.

In all these cases, part of the exhilaration comes from not being completely sure what comes next. Kayak might tip, movie protagonist might take a wrong turn, etc.

In the slot machine case, the exhilaration is the 5-10 seconds wondering whether you might be the one person this month/year who hits the big jackpot. In that one case, you get an extra bonus. In the other 99.99...% cases, you merely get the exhilaration you paid for.

If you unilaterally change the transaction so it's no longer about the entertainment experience but rather increasing your chances to get the rare thing that causes the exhilaration for everyone, you're stealing -- because the rare thing wasn't actually for sale; only the entertainment value of the chance to get it was for sale.

I personally don't like house-advantage casino games (i.e., not poker) because I don't attach a lot of value to the entertainment part of it, and I understand the math doesn't make it a wise financial transaction. Otherwise I have no problem with a business making a profit from providing a good or service that its customers enjoy. That includes casinos, and that's why I think it's odd to single them out as deserving to be a target of theft.

You are speaking about an abstraction which has no interpretation in the law. A transaction does not have to fulfill some existential purpose.

It also happens to be false. The reason people gamble is to win money. They believe that they are lucky.

Some do. Some look at it as entertainment, regardless of outcome.

Yeah I have the same question: How is guessing the pattern hacking? And how is that a crime? In any other game of chance it's called "having a system."

Generally if you can, unassisted by technology, "beat the casino" then the casino will simply exercise its right to ask you to leave and not come back.

But if you can only do it with, or just choose to do it with, technological assistance, there are likely to be many laws that can apply.

Not always. These guys found a flaw in a casino game's programming, and got prosecuted for exploiting it. No technology at all.

https://www.wired.com/2014/10/cheating-video-poker/

Yes, it's true that "generally" is not "always".

Sorry, poorly phrased on my part. Thought it was a good spot to link to an amazing and infuriating story.

Because a legislature passed a law that says it is, most likely.

I had to read this title 3 times

You'd enjoy Bob Loblaw's Law Blog

Reply on news.ycombinator.com