Russians Engineer a Slot Machine Cheat and Casinos Have No Fix (2017) | Hacker News Reader

Russians Engineer a Slot Machine Cheat and Casinos Have No Fix (2017)

wired.com

45 pointslando231957 comments

I have a hard time deciding whether I really think this scheme qualifies as fraud or not; after all, the machines are initially rigged to give the owner an edge (obviously, otherwise slot machines would be few and far between!)

As long as the player is not manipulating the machine, only observing it and exploiting a known weakness negating and then some the edge the owner had, I'd say if slot machine operators cannot live with that, they need to upgrade their machines, not expect The Law to help them out.

If counting cards is illegal, this seems like it'd fall under that same logic.

Isn't card counting legal? From what I've read it seems like it's forbidden by the casinos and they can ban you for it, but it is not illegal as far as the law is concerned.

Brief search says you can't use a device to count cards, which is probably more analogous to using the phone to crack the cycle.

I guess new machines with reasonable random number generators would fix the problem. I wonder if any laws actually specify weak RNGs.

Counting cards is completely legal. A casino does have the option of choosing to not do business with someone they suspect of doing it.

There are no criminal penalties.

Sorry... in this case by "legal" I meant "will not get you thrown out of the casino"

I had the same thought, so looked up the laws - the difference between counting cards and this trick is that they are using both external devices and other people to help. If they could get the timing correct solely with their own observation, it would be legal.

I'd be curious to know where the line is drawn for something like cybernetic implants

If the casinos see you winning too much, they throw you out, no explanation given.

They try other things first, to probe if you're just 'lucky.'

It's kind of fun to talk to undercover casino security though, especially when they catch on.

that's different from being arrested.

Actual current cybernetics implants or fantasy-some-day-maybe implants ?

I would imagine similar to card counting though that if discovered you'd simply be banned from the casino, legal or not.

I agree entirely.

Furthermore it's fairly trivial to build a good entropy source into these machines if they wanted to, rather than relying on a PRNG. ChaosKey [1] immediately comes to mind as one example.

[1] https://altusmetrum.org/ChaosKey/

You'd probably be surprised to hear that a PRNG is a requirement rather than an economy thing. The behavior of the machine is supposed to be deterministic and an actual random number generator would not be and hence could conceivably pay out less than the legal minimum for an extended period of time, leaving the casino owner then position of having to say it's 'random chance' that the customers aren't winning enough.

That is surprising, considering elsewhere in the casino people are using rolled dice for random number generation.

Rolled dice are audited to ensure they are fair, the manufacture of such dice is pretty strictly controlled.

It's hard to cheat with such dice without the cheating becoming obvious after a number of rolls.

But for slot machines - essentially special purpose computers - such cheating would be trivial and hard to detect. And so regulators made sure that you don't have the 'but it's random' excuse for a machine that never pays out.

I can maybe see it because they were using external tools, kind of like those roulette computers. But there was a story [1] about this in the US a while ago with a bug in a poker machine. They were forced to return the money even though all charges were eventually dropped. The casino should be going after the machine's manufacturer. I have no sympathy for casinos. Absolute scum of society, preying on people to keep them impoverished and destroying communities.

[1] https://www.wired.com/2014/10/cheating-video-poker/

Would the people who go to casinos find alternative, perhaps more dangerous means to gamble if they didn't exist?

Honestly, I don't think a good majority of them would. Casinos are psychologically optimized to get you to spend the most time and money there and it works. They are also just convenient and legal, eliminating pretty much all barriers to entry except age.

Weird how the police and the federal officers allow themselves to be used to protect the business interests of the lowlifes that run casinos. If they can't keep their stuff secure enough that it can't be scammed then maybe they should simply shut those machines down?

After all, it's not as if a casino has a right to be profitable.

There are a few responses I can think of. It may be that all of them are true.

The law protects what is legal. I may consider bar owners to be lowlifes profiting on alcohol addicts, but the police will protect their business interests and disregard my belief.

If they don't, then someone is going to step into that power vacuum. That's how you get organized crime.

The state makes money off of casinos, and bars, and brothels (in NV), and gambling, and other activities often called "lowlife." It's hard to cut off that sweet, sweet money supply once it starts.

Police are supposed to follow the law, and if the law bans computer aids to beat the slot machines, then the police are acting correctly in investigating. The more interesting question is how gambling interests have gotten such favourable laws passed that help them maintain profitability in the face of potentially disruptive technology. In general it's not surprising that laws tend to favour entrenched interests in any area though, since that's how power works...

Well Ofcause casinos have a right to be profitable. Just like tech startups, as soon as the government is reaping in money through that company they want to keep it alive. Even if it is no net benefit to society or even profitable at all on its own. Look at the current “unicorns” serving subsidized taxi rides and subsidized movie tickets. It doesn’t matter if you provide anything at all as long as you manage to stamp you logo on large enough cash flows everyone benefitting from that cashflow will work to keep you alive.

In most states the Gaming profits are taxed, hence up to 30% of the states budget is funded by Gaming operations (here in Australia it is). Regardless of the media rhetoric, no government wants to lose 30% of its budget funding, hence it does everything it can to appease the Gaming industry while pretending to care about community cost. At the end of the day, you can have more schools, hospitals, better roads etc (thanks to Gaming), or you can have less schools, less hospitals, worse roads etc (and be Gaming free).

I am really disappointed that the law is against those people. If the casinos are allowed to scam people by making it look like you are playing a fair game while it's not (the machine is configured to give an advantage to the house), it should be allowed for a skilled player (like someone who found a vulnerability in the machine) to scam the casinos the same way.

> scam people by making it look like you are playing a fair game while it's not

Casinos don’t advertise themselves as a place to get a fair shake. On card tables, they explicitly take their cut in everyone’s view.

Casino games are highly regulated, and nobody is forced to play. Everyone who plays knows the odds are against them.

> Everyone who plays knows the odds are against them.

Tourists know this. Poor locals that hoard in after payday don't all seem too.

Nobody is forced to play, but there's a lot of human psychology hacking that the casino employs to get people to gamble more.

Takeaway: Hacking humans is legal. Hacking a casino algorithm? Stop right there criminal scum.

Well, gambling isn't legal in many states. And both the way they're made and way they're advertised is heavily regulated. I'd say it's a bit dramatic to say "hacking humans is legal". (I mean, it is legal via ads, but even those are regulated to a certain extent)

There's lotteries or live gaming everywhere but Utah and Hawaii.

>Everyone who plays knows the odds are against them.

You'd be surprised.

On the flip side, nobody is forcing the casinos to not upgrade their slot machines with this known flaw. If the casinos work by exploiting a flaw in human psychology, why can't we exploit a flaw in their machines?

Most people who play slots think that the games are fair... as in completely random. They're not, though. They use specific patterns to trick gamblers into thinking they 'almost won' on the screen.

But it is a "fair" game. The casino isn't scamming anyone, any more than anyone selling a service is scamming someone. The odds are correct and generally posted. Just because the house makes money, doesn't mean it is a scam

I'm surprised to learn that pressing the "stop spin" button actually makes a difference - I had assumed that your results are calculated and fixed when the spin starts, and stopping it is just cosmetic. Why risk the house edge by allowing users to pick when to stop your spin.

Previous submission: https://news.ycombinator.com/item?id=13579353

The loophole is that the state of the pseudo random number generator is observed (indirectly) and used for predictions. What if slot machines would use a real source of randomness? I assume that this would cause difficulties with the licensing process for these machines because the "fairness" of the machines would be harder to prove.

I wouldn't think so. Whatever random result you get, you can bound it to make sure the probability works in your favor a fixed proportion of the time, right?

`if (pseudoRandom() < 0.57) houseWins()` gives the same payout as `if (trueRandom() < 0.57) houseWins()` for all intents and purposes; the only difference is the former is more predictable to people trying to game the machine.

I think the licensing requirements for these machines are strict enough that they want reproducibility in the testing, which would be one reason to require pseudo-random numbers instead of real random numbers.

I imagine they might just simulate a million transactions and test the outcome. If it falls outside of expected probabilities, they can dive deeper, and also have a pseudo-random seed to fall back on to figure out if it was just randomness or something is broken or configured to do the wrong thing.

That's exactly the reason why they use PRNGs.

Why not seed a few more things in to the random numbers like temperature and noise?

Both should be hard to measure exactly the same outside the casing, hard to control and when done right should only add randomness.

Bringing heaters and timed, stealthy noise-generators should be difficult :) Also past noise should influence the future randomness.

You could measure those things someplace far away (secret), or in a random office underneath the casino.

If you’re taking the LSBs of those readings, measuring it using another instrument at any distance from the machine would be useless. (Audio) noise and temperature are very noisy inputs.

The phone is recovering the internal state of the PRNG, different initialization wouldn't stop that.

This is certainly not my field of expertise, but I would guess that regularly re-seeding the RNG with environmental information would prevent that attack.

It’s trivial to make it impossible to predict the machine output. Just source even a low quality entropy source.

But now take that machine and source code and prove to gambling authorities what its properties are. That’s now almost impossible instead. You have made a machine that may behave differently under evaluation.

The affected PRNG (90's design) was reseeded every 100ms and only had 96 bit resolution. These days the PRNG is reseeded every 10 ms (+-5ms sliding interval) and use a minimum of 1024 bit resolution.

The title on HN at the moment ("Engineer finds...") doesn't match the article, and distorts the original. Should be fixed by the mods. Also (2017).

There's no "an engineer" who "finds" anything but "engineer" as a verb, the title is: "Russians Engineer a Brilliant Slot Machine Cheat---And Casinos Have No Fix" which means something like "Russians design a cheat" or "Russians construct a cheat."

On the topic of "casinos have no fix", it seems that the casinos have FBI protecting them and the other ways of control, which is obviously enough of a fix for them.

This seems to only be a fix for the greedy people that keep coming back and raise suspicion. A casual player that cheats once and cashes out would be undetected.

> A casual player that cheats once

Obviously doesn't exist in the case like this: it is an organized effort depending on specific steps and now that the technique is known, it's easy to detect such attempts by the casinos. If the casinos would estimate that the danger is too big to them they would have stopped using these models or consider some kind of upgrade, so they are obviously OK.

We've updated the title from “Engineer finds slot machine cheat. Casinos unable to fix”.

Wired's presentation of the article was wasted on me. I invested the time to read but didn't get there in the end. If you are on article 1 of your 4 free ones you expect better than adverts breaking up your reading flow all the time. Also this style of writing is dated, if you are reading a book then a chapter of setting the scene is okay but for the web you wonder if they are ever going to get to the point or even tell you the story. I didn't bail out I just got bored.

I can't imagine paying for more than the four free articles. I don't think the subscription model is strictly broken but I can't see publications like Wired lasting forever in an age where information wants to be free.

> I can't see publications like Wired lasting forever in an age where information wants to be free

1) Nothing lasts forever.

2) Wired has been around longer than the phrase 'information wants to be free', which was a meme that should have died long ago. Information doesn't want anything, you want something: free information, and Wired isn't obliged to give it to you. So what if they extend the 'click bait' to 'article bait', at least they gave you a good enough sample to realize that you weren't going to pay for it. The words you are looking for are 'thank you'.

Wired is total garbage anyways.

Maybe so, but please don't post unsubstantive comments to HN.

Reply on news.ycombinator.com