I see a lot of complains why this is illegal. It is illegal, as anything that it is illegal, because the law says so.
As, for example, in Nevada:
"NRS 465.075 Use of device for calculating probabilities.
It is unlawful for any person at a licensed gaming establishment to use, or possess with the intent to use, any device to assist:
1. In projecting the outcome of the game;
2. In keeping track of the cards played;
3. In analyzing the probability of the occurrence of an event relating to the game; or
4. In analyzing the strategy for playing or betting to be used in the game,
The irony here is it's only illegal to beat the games because the casinos figured out how to rig the democratic process to get favorable laws passed. If we put it to a vote, what would the public think was more unethical, using a mechanical device to count cards or using lobbyists to make sure you can't lose?
If a casino could lose money, you'd either have only small, locals casinos, or none at all. Votes are rarely referendums on ethics.
In this case we'd (and by we, I mean Nevada residents) compare two scenarios: a world without the big Vegas casinos (and their tax revenue, their employees, the good stuff), or a somewhat rigged world with the casinos.
If there is an industry that can profitably offer better jobs/economic incentives to Nevada, then I think you would see that industry gain power and relatively weaken the grip of the casinos on Nevada.
So maybe in 5 years we'll be complaining about how Nevada residents can't see beyond 'rigged' tech jobs that don't pay as much as the Bay Area...
If a casino lost money more often than not... well, there'd be no more casinos. C'mon, be at least slightly realistic here. Where is it written that casinos are supposed to provide you with great odds? It's entertainment.
There are a lot of things the law says are illegal that are completely ridiculous (a Google search will confirm this).
The discussion is about whether those laws make sense and are moral, or if they were designed by greedy guys in suits trying to punish anyone who dares to play their game in a way different than intended.
And by 'greedy' you mean 'want to stay in business'. What do you think would happen if people were allowed to guarantee wins at a casino? They're not running a charity.
People want to be able to gamble at a casino, even when they know the odds are in the house's favor. If you want to be able to gamble at a casino, you have to make it illegal to cheat; otherwise casinos would go out of business.
Consider this: there are advertisements in the subways that warn people against the psychological dangers of gambling.
Should those be illegal, given that they cause the casino to lose money?
Should Uber be illegal, given that they cause taxis to lose money?
I'm not talking about incentives here. Everyone will act according to their incentives. That's nature. The taxi industry will lobby against Uber. That's nature.
The justification for passing a law should not simply be to help a business stay in business.
Businesses should thrive based on a superior product, not because they threaten people with punishment for not doing things the way they want.
Making fraud illegal is pretty common in lots of industries. That is what these laws are; they are saying you can't agree to a casino's terms for their games and then break them.
It is like it being illegal to dine and dash - you could say, "well hey, he restaurant should have made me pay first if they didn't want me to just leave after my meal! They need to change their business model, not resort to the law"
Or they would get off their laurels, stop resting on law and innovate every time they find a new way someone is gaming the system. It was easy to stop card counting by adding in more cards, but it took catching someone counting and seeing how they where doing it, to come up with a simple hack to stop it.
I see no problem with banning a "cheater" (I don't even like the word, as they just figured out the rules of the game better than the house), from the casino, but to legislate that people cannot use an advantage that they have discovered seems like an abuse of law. The casinos don't have to offer games they know can be gamed, and they are free to come up with their own solutions to restore the odds in their favor. To me abusing the law is just laziness on their part to help maintain their advantage, while criminalizing a class off people who where nothing more than smarter than the house.
The way gambling laws work is that any method that allows the consumer to consistently beat the odds (even if it has a winning rate of 50.00000001%) is illegal.
I would like to know what is morally wrong in defeating a system designed to beat you. Designed to (almost) always win. The Casino is the one that cheats because the odds are not completely random, as they should.
> The Casino is the one that cheats because the odds are not completely random, as they should.
I get what you mean, but what you said means something different, in a way that leads to an interesting question.
The odds are not supposed to be completely random. The odds are supposed to fixed in most (all?) casino games (and in most non-casino games). It is the outcome that is supposed to be completely random in casino games, distributed according to the fixed odds.
That raises a question. What would a game look like where the odds were random? The odds are determined by the rules, so would the game have to have rules that are changing at random?
But if you are given the distribution of the random numbers that determine the rule changes, you could still work out the players odds for the overall game. So do we have to have the distribution that the random rule changes use be completely random, too? But the distribution used to generate the random number used to pick the distribution for picking random numbers to drive the rule changes...do we need to pick that at random....is it going to be random distributions all the way down? My head is starting to hurt...
Yes, when you setup a slot machine you select in the configuration menu exactly which percentage payout you want the machine to have over its lifetime (~3-5 years). In Wisconsin accessing this menu is highly secured: security guards, cameras, auditors all staring over your shoulder making sure what you set is correct. Also they must report that information to the state here as well as the checksums of the games. I think in 2007 they were doing MD5 still, but my memory is fuzzy on it.
Fun fact: by being able to access the payout statistics menu and knowing the machine's installation date it was easy to know which machines would be "hot". I have witnessed machines that paid out poorly for a couple years (+ a few million USD) but would hit regular jackpots near the end of their expected lifecycle.
edit: gambling is a scam, please don't participate
I disagree. To some extent slot machines are more scam-like than the other games, but I think the table games (roulette, black jack, craps) all have well known odds and are generally honest games.
They are not "fair" in the sense that the odds are stacked against you, but I don't believe that that's a reason to completely boycott them.
Gambling is fun. As long as you know going into it that the odds are stacked against you (and how badly they're stacked against you) and you don't go into a game without being prepared to lose your entire stake, there's nothing wrong with gambling.
Don't bet the farm, but go into it knowing you could lose everything, and enjoy a few hours of gambling and "free" drinks. Every once in a while you'll beat the house, and _that_ is quite enjoyable.
Nope. Every single game played in casino is a scam. If you figure out any way to beat them, you will be in huge trouble and even behind the bars. Casinos are powerful enough that they have made this in to actual law. Police will literally be after you if you ever beat casino consistently in any of their games. There are tons of stories on people figuring out how to beat casino in black jack and they were ruined by casinos because of that. This would sound ridiculous to most sane people but casino's have done great marketing and physiological twisting that people now go there with full knowledge of this and think losing is actually fun and its quite enjoyable. Basically what you are saying.
No, a scam requires dishonesty; it is right in the definition of the word.
A casino tells you the exact odds, and everyone is freely able to decide if they want to play given those odds. Yes, they are in the house's favor, but that is what a player trades in return for the whole setup (the casino, the workers, the free drinks, the entertainment, etc)
You can still argue casinos are immoral, but they are clearly not a scam. That would be like saying cigarettes are a scam, just because they are bad for you.
The house can claim malfunction on anything and refuse to pay you. You have little to no recourse. I've witnessed people having their jackpots declared invalid for ridiculous reasons such as a faulty door sensor on the machine (having nothing to do with the game itself.)
You're essentially gambling that you can win the game and the house won't deny your win.
Yes, a casino COULD commit fraud and say a game malfunctioned when it didn't, but that is also illegal, and they do get punished for that. In Nevada, for example, the gaming commission would certainly go after a casino doing that.
If you see a casino cheating, you should report it.
Scam does not require dishonesty and no one is saying anything about morality. I can tell you that you can play poker with me and because I'm so good at it, your chances of winning is 1 in 100. If you still decide to play, it's your choice and it's neither immoral or a scam. However, somehow if you turn out to be better player than me and suddenly I'm losing in droves and then I call police to not only confiscate all your winnings but also bankrupt you and then put you in jail. Now, that's a scam. Being able to pass laws through political lobby and making this whole process legal doesn't make it any less of a scam.
Card counting in black jack is not illegal, and you will not be prosecuted for it or have your winnings withheld (unless you're using a device to help). As long as you and the casino are playing the same game, you are not violating any law (at least in casinos on US territory, e.g. Vegas/Atlantic City, some quick googling suggests that some Native American casinos take a bit more liberty with this and not pay you your winnings).
If a casino catches or even suspects you're card counting, they are well within their rights to refuse to let you play that game anymore.
If, on the other hand, you and the casino are playing different games, e.g. the dealer is playing black jack, but the player is playing I-know-what-the-dealer's-down-card-is-because-of-manufacturing-imperfections-in-the-card, then is it really that unreasonable for the casino to have a case that they don't owe you the money that you won, especially if they can demonstrate intent? (I'd argue that they should give you a bug bounty, but that's a different story)
To address your poker example - say I'm your guest in your hypothetical and, were we playing fair poker, your 1 in 100 odds were correct. Let's also say that I have undetectable X-ray vision contact lenses, thus changing the odds such that I will always win - would you really consider it unreasonable to use the government to get your money back in that situation? The agreement was to play poker, a game which necessarily presumes hidden information from all players. If one player has all the information, the game isn't poker anymore, it's robbery/con.
I agree that the computerized games are a different story, though I believe that consumers have some protection in the form of the various gaming commissions. If you win a jackpot and are denied the payout, contact the gaming commission! The laws are very strict on the points of fairness of those machines, forged in the fires of decades of mafia controlled casinos (at least in Vegas/Atlantic City).
Gambling is a drug. It has all the health benefits of a recreational drug, but at least in (most of) the US, it's not a scam.
Obviously you have rather romantic and idealistic view of how casinos work. When I go to Vegas I often see casinos full of clearly lower middle class crowd wasting away hours on putting in their hard earned cash in slot machines in a hope to win jackpot. Those are the times I am glad I have had some education in math of probabilities and more importantly how powerful tilt rules in their favor.
My view is neither romantic nor idealistic. I understand that casinos do fuck people over, exploit addiction and use numerous tricks to cross the wires of people's (already flawed) internal statistical calculators.
Yes, sometimes casinos will use their political strength to not payout a jackpot (malfunction voids all play), but a player does, in fact, have some recourse if the casino is full of shit.
Regardless, if you're going to a casino intending to win a jackpot, you're doing it wrong (because math). If you take a measured approach and enjoy it for what it is (entertainment, not a way to make money), you'll have a much healthier relationship with a casino.
As an aside, there's another industry that uses it's massive political clout and every trick in the book to refuse to pay in situations where one would intuitively believe one should be payed: insurance.
If by "ruined" you mean "banned by casinos", then yes. Otherwise, excepting people who actually attempted to defraud the casinos by cheating in ways we'd all agree are in fact cheating, I think yours might be difficult argument to support with evidence.
Fun fact: by being able to access the payout statistics menu and knowing the machine's installation date it was easy to know which machines would be "hot". I have witnessed machines that paid out poorly for a couple years (+ a few million USD) but would hit regular jackpots near the end of their expected lifecycle.
I'm dubious that there is a per-machine fixed sum over a fixed time like this. Apart from the "progressive" machines that have a jackpot shared across a network of machines, I'm pretty sure that the payout percentage is just a statistical prediction, and that by law each result has to be independent of all previous payouts. Do you have a reference that you could point to that would confirm your understanding? The sources I've found say that each play is random: http://www.vegasslotsonline.com/faq/#random. You might be right, but I wouldn't want you or someone else to rely on this information if it's a myth.
I was actually working on the casino floor for a year and configured, repaired, diagnosed, and twiddled with these machines all day. It was a terrible job, but gave me something to do while hunting for my next IT adventure.
Other interesting observations: the machines based on Windows XP Embedded crashed all the time, the Linux ones were fine.
The Linux ones from several mfrs used APNG for the slot machine graphics. This was my first exposure to animated PNGs in the wild. (~2007)
The Linux machines loaded a kernel module at boot that was supposed to prevent/detect tampering with memory. Some also loaded their own audio driver stack which surprised me: wasn't ALSA or OSS. Very odd, specialized little machines. (Many were Pentium 3 with totally custom motherboards due to strange peripherals)
Progressives cannot legally be removed from operation until someone hits the jackpot. (at least in my state)
Is this the case with card games at casinos? I'm under the impression card games are completely random and cannot have designated odds (except for basic rules like dealer holds over 17 in blackjack).
In this sense wouldn't card games be a wiser bet than slot machines?
Not really, as the odds in games like Blackjack are relatively well known to the point where with a given strategy you can calculate the house edge pretty quickly. For most houses and most strategies, the house has an edge of about 0.3-0.4% which is just enough to make you go broke.
If you can count cards, and they don't use a continuous shuffler you can get this to as good as 0.1% in your favour.
For those intrested games with a low house edge there is a game that beats (counted) black jack's pretty good edge by almost a order of magnitude. If you play craps at a table that allows 100x odds bets. You only bet the minimum on the pass line then the max (100x) on the odds when the point is set. This stratagy lowers the house edge to 0.014%. The only problem is it takes a large bankroll. If the table is a $25 dollar minimum you have to risk $2500 on every round.
The casinos are smart enough that all of the bets with the lowest house edge require high stakes to keep it interesting to the house to participate.
Baccarat is always a high stakes game not because it's "fancy" or "exotic", but because it is nearly the closest a casino will let you get to betting on a coin flip, for every player in the game.
Casinos also do things like add 6-7 decks to a shoe where each additional deck gives the house an additional edge. If they have a continuous shuffle machine the odds don't swing (in favor of the house/player), due to a constant probability of cards in circulation. Moral of the story is if you go to a casino with money expect to leave with out it.
Yes, unless you think it is possible that the casino in question removes cards from their decks.
For instance, playing black jack by the basic strategy is (from wizardofodds.com):
> the probability of an overall win in blackjack is 42.22%, a tie is 8.48%, and a loss is 49.10%. I'm going to assume you wish to ignore ties for purposes of the streak. In that case, the probability of a win, given a resolved bet, is 46.36%.
So yes, your best bet in the casino is probably blackjack, but it is still a losing proposition without counting cards. Face cards tend to favor the players (table), not the dealer. This is because a dealer hitting with a face card more frequently causes a bust than a player hitting a face card (because players don't have to hit when they might bust, dealers do). So a deck that is heavy with face cards is better for players.
Poker, by contrast, the house has no real interest in whether people win or lose - they just get a % cut of each hand played so they win a little every hand.
Amazing loop! I guess that the Government has to charge something for keeping that kind of machines and obviously needs to make sure that the machine maker is not cheating. If the machine gives slightly less prices than some other machines equally taxated, that is unfair competition.
They aren't charging the defendants with a 'moral' crime. I'm not sure what their exact charges are, and they depend on minutae like the article said: "crossing state lines makes it a felony conspiracy to commit fraud". Gaming regulations are written to favor the house. You're correct that we wouldn't expect them to be charged with "tampering with a gaming device" because they never touched it, and they got comparatively light sentences (2 years) compared to Nevada where you can easily get 5-10. Some states may have a new law like "using a computer to manipulate a gaming device" or similar. I think they put that one on the books so that you can't cheat roulette by calculating the trajectory of the ball, or identify unique variances in cards. Regardless, you can expect the laws everywhere to catch up after this incident.
I disagree that the "system is designed to beat you" or that the casino "cheats". The casino is there for entertainment. If you don't use it in moderation it can ruin your life just like any other vice: alcohol, drugs, sex, etc.
If you have $1000-$5000 (or more), you can fly out to Vegas for the weekend, have a really good time (gaming is only part of that), fly home, and you've got a significant chance that you'll either win or break even. You might also lose, and that's the excitement cycle that is gambling. But even if you lose you can also have a good time at a show/nightclub/concert, every kind of themed bar, meet women, etc, so if you discard "winning money" as the primary objective, gambling isn't designed to beat you.
If you go to the casino every day after work, don't be surprised that you will not win anything, or that it might escalate just like any other drug (spending more, not happy when you win, etc).
What shocks me is that these guys have the technical prowess to reverse engineer the game/PRNG, but they didn't have the sense to slow down their pace, or reverse engineer the casino management system to avoid detection (or they didn't think to hide their iphone from the start, they said the first guy was holding it right up to the screen, when $100 spent on a clothing alteration would have allowed him to hide it). If you're going to fly internationally to commit a crime, you should know who you're up against and use adequate countermeasures.
"If you have $1000-$5000 (or more), you can fly out to Vegas for the weekend, have a really good time (gaming is only part of that), fly home, and you've got a significant chance that you'll either win or break even"
FYI Vegas is built on rubes like you.
There is a larger chance you will lose money than break even or win money.
If there was not, Vegas would not exist and its business model would have failed a long time ago.
Their business model works because the House wins.
For the House to win and be profitable, the average person has to lose on average.
If you're going to have fun, that's a great experience, but if you think there's a "significant chance" you're going to not lose, you're exactly why Vegas does as well as it does.
I think the digler999 simply means significant differently than you do. A 40% chance, for example, could still be interpreted as significant. Numerous casino games when played optimally give you a better chance than that of winning or breaking even.
I think that the odds of walking out of a casino with equal to or more than you walked into it is less than 40%. My stats knowledge is failing me right now but if you start with $100 and feed slots at $12/m after an hour the average person should have less than $50 remaining based on the house cut in the article (7.129%).
It would be interesting to see what the likelihood of being up after an hour of regular play is by different common games.
Sure, at slots, but the parent alluded to other games where the odds aren't quite so bad.
In addition, games like poker aren't even played against the house; you're playing against the other players (and the house just takes a cut as a sort of "table fee"). If you're a skilled poker player, you can reduce the effects of luck (what cards you get vs. the cards others at your table get) and come out ahead more often than not.
And I'd agree that even a 30-40% chance of coming out ahead would be "significant"... people in the startup world still start new companies despite the conventional wisdom of a 10% success rate.
Having said that, sure, casino games are pure entertainment. Sure, you can win a little money, but you should never expect to, and you shouldn't play unless you're comfortable losing every cent you put into it.
If you fly to Vegas, put it all on black at roulette, then yes you have 47% chance of doubling your money. But that's a very short vacation with little entertainment value.
The more independent small bets you make, the lower the chance that you will come out ahead.
With correct play slots have some of the lowest house edges per dollar bet. Sports betting has a fairly high edge, 4.5% on normal bets and much higher on exotics. The difference is you make a few sports bets and walk away, while with slots you keep cycling money through until you lose it.
The problem indeed is the small cycle time. If you bet on a sports match with a 4.5% expected loss, then watch the game, you can limit your losses to about 4.5%/hour.
A slot machine with an expected per iteration loss of .1% and a modest 100 iterations/hour, would, over that same hour lose you (just) go over 9%.
The problem with that analysis is that ignores the risk. A 40% chance of winning the lottery would be great, because in the 60% case you've only lost a few bucks on the ticket. However, a 40% chance of winning in a casino is not ideal, because in the 60% case you've lost a ton of money.
exactly. and vegas in particular has the best odds in the nation. It's more typical of indian/riverboat casinos to ratchet up their house edge. vegas you're more likely to see 99% payback machines (of course it varies). They'll do other things to make up for it though, like having fewer $5 blackjack tables and more $25 minimum tables.
vegas can afford to turn their hold percentage much lower because millions of people go there every year and there's competition. Versus a lone indian casino in california's central valley.
> For the House to win and be profitable, the average person has to lose on average.
and if people always lost, vegas would collapse because people would stop going.
You could make the argument that any other expensive hobby is also throwing away money:
* boating: buy a brand new boat for $65k, sell it 8 years later for $35k, plus $5k in total operating costs/insurance. You just "lost" 35k (not counting interest)
* rock climbing: buy $3k of gear and travel, $2k on lessons. Fall and break your arm for $6k, $11k "lost" for a couple years of entertainment.
* "travel", spend $6-10k on hotel, airfare, meals, in 2 weeks, all we have left to show for it is "memories". Great "investment".
(disclaimer: I'm not actually against the things I just mentioned. Only pointing out that they are "throwing away money" just like a weekend in vegas). Unless you're some hyper-disciplined monk who only uses money for humble necessities, you, too are throwing away money just like people do in a casino.
I think the difference in perspective here is that many people see gambling explicitly as a way to make money—not something they would do for fun, but something they would do because they need money, like a job.
These people are mostly wrong (save for the games of skill, e.g. poker, that are only played in casinos for traditional reasons.)
Who are you to tell people how to spend on entertainment? Some people want to spend money on rock climbing, and others want to spend money on gambling. As long as neither leads to financial ruin, who are any of us to judge? I don't work hard so other people can tell me how I should and shouldn't have fun.
The state already tells you how to have 'fun'. What's the difference between being addicted to slot machines and being addicted to -your favorite drug- ? As long as it doesn't lead to financial ruin, it should be fine?
> There is a larger chance you will lose money than break even or win money.
The games are setup to take a percentage. It varies with the game. Slots are some of the worst, IIRC the house take is 10%. Pai Gow poker (depending on house commission and exact rules) is 1%-3%.
If you make bets commiserate with the size of your gambling budget then your expected loss over the long term for slots is 10%. Your expected loss for Pai Gow is 1%-3%.
If you make larger bets than you should given your bankroll or play bad strategies you can lose a lot more. If you get lucky and quit immediately after a big win you can come out ahead.
The house doesn't give a fig if the average person loses or wins; they just need people to play. They are well aware a significant number of people will walk away winners and that makes them happy: it's great marketing!
in las vegas, the hold percentage (on average - since each property can do whatever they like as long as its within regulatory limits) was ~8% in 2016 in vegas, and ~6% statewide in nevada [1]
Yes pai gow or 21 or (the best odds not including card-counting, IIRC), baccarat have better odds. But, if you go to a premier casino on the strip, you might not find a table you can afford. It's not uncommon for them to have a couple $5 tables and the rest $25 (per bet) and up. Mathematically it's a better choice, but a $25 buy-in costs $500 which you can lose in minutes if you're unlucky. Not a lot of people can stomach that (nor should they, as my original argument was for the entertainment value of gaming).
>> "crossing state lines makes it a felony conspiracy to commit fraud".
I don't see any fraud though. Sure, they found a system to beat the slot machines, but I'm not sure how that's fraud. What if some guys think they're really good at playing poker and they take a trip to a casino to play?
At what point does playing smart become fraud? or cheating? When does counting cards in blackjack become cheating? When you get too good at it? This whole area seems rather strange.
The big factor here is that casino's specifically forbid the use of devices intended to affect the outcome of the game. You go to a casino, you have to play by their rules. If not, they can argue you are attempting to defraud them.
Counting cards is a much better example of "playing smart", and it is not actually illegal - although casinos will ban any player they suspect to be counting they will likely not be charged with a crime. But once you bring a personal implement in to the situation, it very much becomes a prosecutable crime.
>> The big factor here is that casino's specifically forbid the use of devices intended to affect the outcome of the game. You go to a casino, you have to play by their rules. If not, they can argue you are attempting to defraud them.
I understand that they may kick you out for being too good (he must be "cheating"). And the argument about using a device to aid you might be a more concise definition of cheating of some sort. But I've never noticed any posted rules that one would reasonably be expected to know about. And the use of the term "fraud" is important because then it becomes a legal issue with big consequences beyond getting kicked out or banned from a particular casino. OTOH a casino doesn't need to post the law for people to read. Does the law defer to the casino rules? That wouldn't be appropriate IMHO.
There are "house rules" and there are laws. I'm kind of wondering where those lines are and what specifically these guys did that constitutes a felony. What specific aspect of their scam was illegal. I'm not disputing that it was dishonest and in effect a scam of sorts.
IANAL but there are a few things in this matter that seem to be common knowledge. How these things will apply to a specific instance is for lawyers to discuss. The law, at least in Nevada, does defer to the casino's right to do business with whomsoever it chooses. The law does not permit the casino to beat a card counter up (like in the movie "Casino") but they can insist that such a customer leave and never come back, and in those cases at least in Nevada, when such a customer tries to return, they may become a trespasser [1].
Casinos can forbid all they want, but the teeth in the deal is that lawmakers back up the Casinos' rights to set the rules and force you to play by them.
To be fair, the lawmakers aren't really necessary. It only avoids the friction of forcing every gambler to sign a legally-binding contract before playing.
"What if some guys think they're really good at playing poker and they take a trip to a casino to play?"
Depends on what they're doing to be "good". Things like card counting can and will get you banned from casinos (though that's more applicable to blackjack).
Advantage play is usually frowned upon but not outright illegal. I reckon exploiting bugs in a slot machine's PRNG really ought to be closer to that than "fraud". Hence, I'm surprised these Russians were charged with anything at all rather than just banned from various casinos as is more conventional for this sort of thing.
I guess the difference between "advantage play" and "fraud" in this case would be whether or not the culprits are breaking the rules of the game. It doesn't sound like they are, seeing as how they're not tampering with the machines.
They were charged and pled, that doesn't necessarily mean fraud was actually committed. DAs have wide latitude when charging people with crimes. If you were a foreign national caught doing this, would you want to take a chance with a jury or bench trial in a hostile (to you) jurisdiction?
Are you saying these people are innocent, and by some strange stroke of chance and luck, they all boarded a plane, flew across the world, and randomly won thousands of dollars ?
> would you want to take a chance with a jury or bench trial in a hostile (to you) jurisdiction?
hell yes I would. People love to rally behind the underdog and see the casinos lose. Look how much publicity the cases get when a machine malfunctions and displays $1,526,838,003.35 on the win meter, and like clockwork, they file a lawsuit to try to claim a billion-dollar payout.( they dont win, but still, people love to rally behind the plaintiff in those cases).
I'd say for the most part, the criminal courts are hostile to all defendants, not just by definition but by the "plea deal" schemes that prosecutors use and by the puritanical tendencies our society shows in their harsh punishments against "offenders" (viz. the drug war, sex offenses, gun charges, etc)
>Are you saying these people are innocent, and by some strange stroke of chance and luck, they all boarded a plane, flew across the world, and randomly won thousands of dollars ?
I think he's saying that they are not necessarily guilty beyond a reasonable doubt of the crime of fraud ("deliberate deception to secure unfair or unlawful gain"). Given the facts presented in the article, I don't think there's much debate to be had about whether they used devices to win at the slots. The question is whether the particular way they did it is (or ought to be) illegal in the jurisdictions they were in.
when you use an active device that essentially guarantees you will win. Elsewhere in the thread someone quoted the Nevada regulations that explicitly state this. I'm sure each state has them now. Had they arrested these guys and didn't find an iPhone with custom software, or a confession that they were remitting their winnings back to Russia, they probably wouldn't be able to charge them with anything (but they could still kick them out of all casinos).
> these guys have the technical prowess to reverse engineer the game/PRNG, but they didn't have the sense to slow down their pace,
Based on the article, it sounds like these guys were more like mules, than they were the masterminds. 90% of the money was sent back... And they rely on this remote system to figure out the next state. This software possibly could be run directly on the phone, but instead they want to keep a tether on the mules.
It's not designed to "beat" you. Casinos are entertainment venues, not banks. One of the main selling points of casinos is the thrill you get from potentially winning a lot of money. You pay for the fun in form of the slight loss of edge in the long run odds.
No one goes in a movie theater and complain that it's "beating" you because you come out with a net negative balance
I don't believe casinos are allowed to advertise that you will walk out with a lot of money either. Only that you might. Restaurants advertise in such a way that suggests you may have the absolute best night of your life and meet all sorts of new friends, that doesn't mean they are promising it.
Pfft. That's a pretty unconvincing argument. Here's a selection of ads from a casino in the Bay Area. The insinuation that you'll strike it rich (and date three tiers up, if you're a man) is pretty strong:
You're proving my point exactly. I never said there wasn't an insinuation that if you play you could win, just that there is no guarantee given. See my other reply for examples of non-casino businesses doing the exact same thing.
It seems like everyone else in this thread is talking about insinuated promises, and you're appearing to refute them by saying they weren't actual promises. No one disputes that they are only insinuations, so either you're posting off topic, or you're refutation is invalid. Take your pick.
> I don't believe casinos are allowed to advertise that you will walk out with a lot of money either. Only that you might.
I never claimed otherwise. Did you read my post?
> Restaurants advertise in such a way that suggests you may have the absolute best night of your life and meet all sorts of new friends, that doesn't mean they are promising it.
I've never seen such an advertisement, nor have I heard of anyone putting up the deed to their house or the title of their car to pay for their restaurant habit.
>Movie theaters also don't advertise in such a way that suggests will walk out with a lot of money.
in response to someone comparing movie theaters to casinos. Your comment is obviously suggesting that you believe casinos advertise "in such a way that suggests will walk out with a lot of money".
>nor have I heard of anyone putting up the deed to their house or the title of their car to pay for their restaurant habit.
So you're changing the point from "they advertise in a misleading way" to "people can become addicted to it"? That is a different argument so I want to be clear if we're moving on from the original point.
> ... advertise in such a way that suggests will walk out with a lot of money
What you said:
> ... advertise that you will walk out with a lot of money either. Only that you might.
No one said casinos advertise that you will for sure walk out with a lot of money; my point was that they imply that you will walk out with a lot of money. The distinction seems obvious to me.
> So you're changing the point from "they advertise in a misleading way" to "people can become addicted to it"? That is a different argument so I want to be clear if we're moving on from the original point.
The point was never that casino advertisements are misleading, but other advertisements are honest; the point was that casino advertisements are misleading in ways that are ultimately life-ruining. For similar reasons, we hold cigarette and alcohol companies accountable for the content of their advertisements.
>No one said casinos advertise that you will for sure walk out with a lot of money
I don't see the difference between what I said you said and what you said. You were obviously saying they implied that someone will definitely walk out with money. That's what I said you said.
There's a difference between a promise and an implied promise. You were speaking about the former and I was speaking about the latter. I don't know how better to explain this.
I guess you're (as a player) supposed to know, understand, and support the fact that the house always wins. It is, after all, not free to build, staff and run a casino, so it would seem obvious that the money to do all that has to come from somewhere? You're simply not supposed to be able to win "too often".
Sure, it would be better if it were truly a game of chance, I guess that's too difficult to deliver (and verify) at this point. Or, perhaps, the casinos prefer it this way of course. :)
Except Casinos design the distribution of gains so that you're manipulated into believing it'll be worth, even though you rationnaly know that it's no true.
Suspension of disbelief, getting detached from the real world, yes, even manipulation are all perfectly fine as long as you consent to them.
Ohh but there were free drinks and the lighting was just so and it made me feel so good -- so clearly defrauding the place that made me feel that way, even when I rationally knew that was what was going to happen, is perfectly OK.
Are you also OK with stealing popcorn at the cinema because they manipulate you into feeling scared/happy/sad/whatever?
I would never steal popcorn from the theater, but I would definitely smuggle in my own bag of it.
The theater house rule is that no outside food or drink is allowed, but clearly the only purpose of this rule is to support the brazen markup of food and drink at the theater's own concession stand.
I find it difficult to find any harm to the theater in eating smuggled popcorn rather than popcorn purchased on the premises, even when playing Devil's advocate as hard as I possibly can. My worst attempts even end up replacing 90% of the theater employees with a row of vending machines and a subway-style turnstile.
Agreed that there isn't really any harm in a generalized way. You might be surprised to learn that movie theaters (as they're currently operated) don't really get much from the ticket sales, however.
I have a friend who used to be a supervisor at movie theater, and he told me that ~80% of the theater's ticket proceeds went directly to the movie distributor. This is apparently normal in the movie industry.
If concessions went away, theaters would probably need to raise their ticket prices a lot. Even if you drastically cut the employees, there's still rent/taxes/insurance/cleaning. The last two could also conceivably go up in price if it became normal to bring in your own food.
> I find it difficult to find any harm to the theater in eating smuggled popcorn rather than popcorn purchased on the premises, even when playing Devil's advocate as hard as I possibly can.
Games are examined closely by Nevada regulators and cannot be deployed unless those regulators are happy with them. The examination includes study of the code inside. Almost like FDA process from what I recall of both in the 80's.
This could be said for many things: food, alcohol, mobile pay-to-play games, etc, etc. The whole advertising industry is built on making you believe something will be worth it, regardless of rational thought. Seems unfair to single out casinos.
Not really, because slots and other casino games are much more deceiving. The whole thing is engineered so that you believe that you will win lots of money. But the reality is very different, this is how they must be built:
- There is a state sanctioned minimum payout rate. This differs by state, but its between 80-90%. This means that on average you lose 80-90% of the $$$ you put in.
- Slot machines cannot use conditional probability, in other words spins are independent. This means that the machine has no "memory" each spin is like rolling a dice. You dont have higher chance of payout just because you didnt won anything during the last hour.
I've worked for a big slots company and we analyzed our customers a LOT. The big players (AKA whales) who drop thousands per month are not bored rich people in 99% of the cases, they are average people like you and me with a bad gambling addiction. And the state or the casino companies are doing nothing to help these people (why would casino companies care? This is where they are most of their revenue from). This is totally different from other fields - imagine if cigarettes would be advertised as something that makes you healthy and the state would be OK with it.
What if you have 10 slot machines and they are designed in a random way? You can be pretty sure that you are going to win money in the middle-long run and everyone can be sure that this is a proper 'game/bet'. If they are somehow manipulated/designed that is blatant robbery. I don't think that the regular Joe knows this fact. What do you think?
When you're playing blackjack or craps, with physical devices whose odds are quite likely what they appear to be, "can't do math" might be a fair criticism. But when you're playing an underspecified game against a mysterious algorithm, doing math isn't really an option and all that's left is whether or not you trust the establishment.
The math is still there and it's even easier to calculate!
For example the article states that the house keeps $0.07129 for every dollar spent, or put another way, for every $100 coming in, the machines need to pay out ~$93.
Therefore, you can expect to lose on average $7 for every $100 you spend on slots.
To any person skilled in critical thinking it should be clear that the whole is very unlikely to be fair. Luckily for the casinos, many people are not skilled in critical thinking and analysis.
> Sure, it would be better if it were truly a game of chance, I guess that's too difficult to deliver (and verify) at this point.
No - this could be done fairly simply using components that are already available on the consumer market - all you'd need is a simple geiger counter and a radiation source (Americium, like in a smoke detector). Heck, you could go simpler with a transistor - google "transistor random noise source" - plenty of examples out there.
> Or, perhaps, the casinos prefer it this way of course.
This is probably the key. With a real random noise source, you probably couldn't easily figure odds and such (then again, how do they do this with regular games?)...
There's nothing MORALLY wrong with defeating the system.
But it's LEGALLY wrong. That is what will get you into trouble.
In certain countries, it's not morally wrong to criticize The Dear Leader. But it is legally wrong and could get you beat to a bloody pulp and thrown in prison. Other countries have not yet implemented such policies.
The games are supposed to be "random" but the payout rules make the difference. In craps you get even money from bets on the pass line. But the chance you'll win such a bet is about 47% IIRC, not 50%. If you look around the craps table you'll see that the bet payouts don't match the odds of winning, and that's the vigorish for the house.
When casinos host Texas Hold'em, they simply collect a vigorish from the pot. The casino is not otherwise involved in the poker hands.
I'm not disputing your accepted meaning of random. I actually was trying to make common ground with the poster to whom I was responding who was using "random" in a non-standard way.
>> The Casino is the one that cheats because the odds are not completely random, as they should.
Why should they be? It's a form of entertainment not a way to generate income successfully through skill. If the odds weren't stacked against you I think it would get boring quite quickly as the wins wouldn't be as satisfying.
More of a terms of service violation. In my experience growing up in Las Vegas they really only arrested folks who used some device to physically cheat. People who worked the odds by card counting or perhaps taking advantage of an out of balance roulette wheel generally were simply banned for life (which technology and facial recognition makes much easier today apparently).
Conspiring with others to break terms of service is of course a crime, and doing so across state lines, is its own sort of nastyness. But you can see from the prison terms (2 years) it wasn't exactly a big threat to these guys.
I would not mind a slot machine based on chance but when the odds are coded in and payouts are refused because of bugs/etc it is not longer a game of chance it becomes something else. At least with cards and dice there is still a lot of chance and the thrill remains.
however defeating a legal system should still hold a penalty unless said defeat exposes an illegal setup
>I would like to know what is morally wrong in defeating a system designed to beat you.
You know it is designed to beat you, you accept the terms and conditions by entering a casino. Which makes you, if you think it is OK to cheat then, a criminal by law and unethical by any standards.
Yeah, the article uses terms like cheat, scam, malfeasance, swindle and bilk, like the casino deserves that money. It's not some poor little old lady, it's an organized-crime-ridden bribe factory getting beaten at its own shifty dishonest game.
There's nothing dishonest about casino games in regulated casinos. Detailed information on game mechanics and payout odds are generally available from one or more of the following sources: the casino, the local government gaming regulatory agency, and/or the manufacturer/publisher of the games. It takes a minimal amount of effort to figure out which games are the least likely to bleed you dry, and if you spend enough time in or around casinos, and you'll quickly notice that educated/skilled gamblers avoid slots and certain table games like the plague, and gravitate towards games that (generally, if following normal mechanics) have miniscule 'house edges' like single-deck blackjack, baccarat, certain variants of video poker, Pai Gow, etc.
The slot in question an Aristocrat MAV500 mark VI is 32-bit and is no longer in production.
It's as random as much it can be made so in that range of 2,147,483,647? I'm not a programmer I'm not sure how a stop symbol or blank is chosen when programming a slot theme.
Newer slots are 64-bit and have larger virtual reels.
Some slots now even use a product called quantum randomness supposedly true randomness. https://comscire.com/
The CPU architecture bit size (32-bit) has no impact on the random range. You can implement an arbitrary length RNG on any machine.
Based on the article it seems that the flaw is that the machine uses the timing of human interaction as a significant seed source. This works well enough for unaware people, but as evidenced here is super easy to exploit once the knowledge is out there. Using time (e.g. the time the program started) as the PRNG seed is a very common security flaw. Otherwise experienced engineers keep making this mistake even in 2017.
My guess is the machine uses the start time as the only seed (probably time since boot) and the perpetrators have made a database containing all the possible spins.
This way, the spins are selections from a stream. If you take a number of samples you can guess the position in the stream and then calculate the most advantageous time to run another spin. The inputs are probably read on a 60hz timer anyway so you can predict which time you're going to get within a few ticks.
I don't think that is what the article said. Where do you read that the machine uses the user's timing to seed the PRNG? It talks about timing the button presses but my understanding was that that was only used after the PRNG was cracked. The PRNG is cracked by measuring the timings of on screen cues. These cues are essentially outputs from the PRNG. There is nothing that indicates the user's timing is used as a seed as far as I can tell.
I assume you understood that by timing I didn't mean seconds from 1970. Beyond that this seems to be getting into semantics territory on how we define 'seed'. To be clear, I agree with what you're saying about the PRNG flaw.
We can probably agree that PRNG is a function that takes an input and produces an output. I guess you take issue with me calling this input the seed. My use is probably a simplification indeed, but I thought one that doesn't change any principles. Because the user's interaction timing is crucial, it seems pretty clear to me that the exploit is about influencing the input of the PRNG. We can call this input something else, e.g. internal state. Or we can call it the seed.
Successful communication depends on participants understanding eachother. You'll notice that the context of my comment was replying to a person who stated that they are not a programmer. Filling my post with unnecessarily precise lingo would work to undermine my goal which is to convey a basic idea.
The Wired story was not accurate. It's true that some early (late 70s) UK electronic slot machines had predictable payout series, but this was quickly noticed and fixed. It is trivially simple to build electronic slot machines that are not beatable by observing any reasonably short series of outcomes (for that matter, from observing over the lifetime of the machine).
The successful electronic slot machine hacks in the last 35 years have all involved either measuring internal machine states or modifying the machines.
In this case, the machines were modified to allow profitable play. This is done either to sell the machines to naive casinos (which is what the Russians did in this case) or to casino managers who use them to skim (the manager's confederates win money which need not be reported to casino owners or tax authorities).
Another practice is to modify machines to extract the maximum amount from players, exploiting behavioral tendencies, rather than giving random payouts as required by regulation in most jurisdictions. Advantage gamblers sometimes discover these machines and use the knowledge to play profitably. But it's not enough to observe a few dozen outcomes, you need to know something about how the payoffs are structured.
You won't find these machines in Nevada, because (a) the regulators are smart and powerful and (b) the place is too big a gold mine to risk over small increases in slots revenue. But there are lots of places with inattentive or weak regulators, in which slots is the whole ball game.
>...rather than giving random payouts as required by regulation in most jurisdictions.
Sort of random since it's pseudo random number generator but there is a specific payback percentage chosen. It's like PRNG up to a point then it's not otherwise how can you give out 96% over 10 million spins if it's truly random.
I'm a slot tech but I don't work with PAR sheets we're purposely kept at arms length for a reason.
Detecting and collecting quantum noise in semiconductors is nothing exotic. Johnson-Nyquist noise (thermal noise across a resistor or within a capacitor) is relatively easy to measure within an integrated circuit, and is how Intel's RDRAND, Via's true randomness instructions, etc. work. Another cheap option is to reverse-bias an LED, paint it black, and measure the leakage current, affected by both Johnson-Nyquist noise and redioactive decay / cosmic rays.
There's little to no excuse for these slot machines not including at least a crude quantum noise collection circuit. Collecting quantum noise in a circuit is nothing exotic and only requires a hand full of transistors and a couple of capacitors. I'm a bit sad that ARM didn't include a quantum noise instruction in the basic arm64 instruction set.
On a side note, it's a shame that WiFi and BlueTooth chipsets don't all have a linear feedback shift register accumulating radio noise. They're already measuring noise and detecting bit errors. With only a few extra transistors, they could be made to expose radio noise to the kernel for use in /dev/urandom and friends.
I found it interesting that part of the vulnerability is that the PRNG takes the time the machine 'spins' as a parameter, thus introducing an attack vector.
I don't know whether it's mandated, but I think that a lot of gamblers would want it that way. They want to be able to influence the game. The outome will still be completely random if the other sources of randomness are good, but the outcome still depended on the gambler's timing.
There has to be something that advances the PRNG to the next output. What's the alternative, advancing a single step each time a random number is actually needed? That also has (potentially much easier to exploit) vulnerabilities.
I know I have read stories about this technique being used before. Doesn't it require special hardware and impeccable timing on your person to take advantage of it?
Article indicates that an iphone is the special hardware. It also handles the timing, even preemptively signals the player when to go based on his/her reaction time.
Timing doesn't have to be perfect - only enough to offset the house edge.
Interesting how they're doing it, I guess making an app with image recognition takes too much effort, and having all the logic in an app makes it easier for your fellow thief to go independent and not give you your cut. I guess an app that requires login would be possible.
> So even if they understand how a machine’s PRNG functions, hackers would also have to analyze the machine’s gameplay to discern its pattern. That requires both time and substantial computing power
I would have guessed that the CPU requirements to process the video and map it against the PRNG characteristics would be a bit much for a smartphone, but given how powerful they are these days, that may well be flawed assumption.
I can't speak to the video processing (although with modern neural networks it seems it would be more than doable), but speaking from experience, brute forcing a 32-bit PRNG takes substantially less compute power than you might think...
Not just software; from the article it sounded like this was pretty old hardware, with a CPU only capable of running a basic PRNG. Doing a hardware upgrade on the zillions of old machines out there (I have no idea of the scale) must not be worth losing a couple thousand dollars here and there to sophisticated scammers.
Any simple enviroment sensor would have done the trick, no? (with any new input permutating some old value, so you can't fool the sensors unless you have acess to them all the time)
That bit about the attacker holding his finger over the spin button and then suddenly hitting it is a dead giveaway.
Speed runners manipulate RNG all the time, except, of course, for a little 8 or 16 bit processor, not anything elaborate.
Interesting how the core of an article gets explained with a few sentences given a small amount of background.
At what point does a scheme like this go from just being a way to outsmart the slot machine to felony fraud? I know you are allowed to use those blackjack cheat cards at the tables in Las Vegas but what if I started using a calculator and my own crazy algorithm? Is that fraud? What if I had an ear piece and hidden camera glasses to stream video to some blackjack guru outside in a van? I'm guessing that would be fraud. Is it the fact that he's using an outside source to determine his actions?
Here is a section of the Nevada gambling fraud law that hits close to a method that involves button timing:
>7. To manipulate, with the intent to cheat, any component of a gaming device in a manner contrary to the designed and normal operational purpose for the component, including, but not limited to, varying the pull of the handle of a slot machine, with knowledge that the manipulation affects the outcome of the game or with knowledge of any event that affects the outcome of the game.
In general you are not allowed to do anything clever in a casino. It isn't stated as such, but the actual crime is winning consistently. If you walk into a casino certain that you will not be providing the house with their cut then you will almost for sure run up against some law. Extra laws will be generated as required by the governments involved.
Seems like you are free to believe in any fantasy about you having an edge over the house, except when that belief happens to be true. The mere thought of having a streak of luck would make winning illegal. If thoughtcrimes were animals, this would be a cute little kitty.
> Seems like you are free to believe in any fantasy about you having an edge over the house, except when that belief happens to be true.
This is a pretty common pattern in "intent" crimes. As a simple example: attempted murder requires a potentially-effective plan. Shooting at someone and missing is attempted murder, burning a voodoo doll of them is not - no matter how sincerely you expect it to work.
It does produce an odd situation where stupidity becomes a legal defense, but the basis for it is pretty understandable. It's not criminalizing being right, it's decriminalizing being wrong, presumably because it's too hard to define the boundaries of whether something useless was done with real intent.
I would argue that burning a voodoo doll should at least count for intent to harm.
Lets say I am completely mistaken about how chemistry works and I think that adding salt to wine will somehow make it a deadly cocktail. With intent to kill you I make such a concoction and serve it to you.
In that case I should still be able to be punished under the law.
The article assumes rational behavior with regard to everything except which methods of committing crimes are possible and concludes that punishing impossible attempts creates a rational disincentive to all attempts.
It's right in a game-theory sense, but not a practical one. Proving intent to a jury is based on circumstantial evidence. Shooting a gun at someone is strong evidence of intent to murder because it is widely known that guns are lethal. Countering the weight of that evidence would require very convincing evidence that the shooter did not believe his actions would be lethal. Proving that someone believed burning a voodoo doll would be lethal would be very difficult since it is widely known that burning voodoo dolls is not lethal. Even apparent evidence that the voodoo practitioner had a genuine belief is easily played off as an act, and in criminal law, the benefit of the doubt goes to the defendant.
There's also the matter of people having mistaken beliefs about the probability of punishment.
So legally, I know the "salt in wine" example doesn't count as attempted murder, at least in states that require action towards the murder. Some states have much lower bars where you don't have to try a murder and could merely buy supplies and write out a plan, but even then I don't think guaranteed-to-fail plans count.
It does seem like the sort of thing that ought to be illegal somehow, but I'd need an actual expert's input on what charges they would seek for that.
Cutting off people who win too much seems fair; charging them with a crime does not. Correctly estimating when the odds are more favorable doesn't seem like cheating to me.
And that seems fair, in the same way that it's fair for a store to apply undisclosed quantity limits to a customer who figures out how to combine freely-available coupons to make all their merchandise free.
I actually did something like that once. A store I visited put a link to a survey on its receipt with an offer of $10 off any one item on completion. I completed the survey on my phone, which displayed a barcode they could scan and selected a sub-$10 item. The receipt for my free item had a link to a survey....
I limited myself to a few items I actually had a use for. They would have been well within their rights to cut me off after a while, but certainly not to have me charged with a crime.
" NRS 465.075 Use or possession of device, software or hardware to obtain advantage at playing game prohibited. It is unlawful for any person to use, possess with the intent to use or assist another person in using or possessing with the intent to use any computerized, electronic, electrical or mechanical device, or any software or hardware, or any combination thereof, which is designed, constructed, altered or programmed to obtain an advantage at playing any game in a licensed gaming establishment or any game that is offered by a licensee or affiliate, including, without limitation, a device that:
1. Projects the outcome of the game;
2. Keeps track of cards played or cards prepared for play in the game;
3. Analyzes the probability of the occurrence of an event relating to the game; or
4. Analyzes the strategy for playing or betting to be used in the game,
Ê except as may be made available as part of an approved game or otherwise permitted by the Commission.
(Added to NRS by 1985, 970; A 2011, 216; 2013, 1317)"
I know about this, as I had a computer aided scheme to beat roulette (I've written about the historical ways of doing this, the first one was developed by Shannon and Thorp). I think the law was passed to prevent use of blackjack computers which were being sold around that time. Best bet would have been the European countries, who largely don't have such laws. I'm assuming the Russians didn't find as many of the vulnerable slot machines there.
Funny the article gave independent confirmation of about how much you could take out of a casino without them noticing; an important number if you ever develop a scheme.
It's still a big difference between being banned and ending up in jail. Presumably e.g card counting isn't illegal but simply frowned upon. So you get banned. But at what point does it become a crime? The fact that it's even unclear is a bit scary (but probably intentional)
> I know you are allowed to use those blackjack cheat cards at the tables in Las Vegas but what if I started using a calculator and my own crazy algorithm? Is that fraud?
They're not really "cheat" cards: even with a perfect strategy, blackjack still has a (very small) house edge. That's why casinos have no problem with you using them. And if you brought your own, hand-written, crazy algorithm the casino would probably let you play with it - because chances are it's much worse than the perfect strategy the printed card uses (a lot of blackjack players operate under the principle that the previous player's actions influence the game and adopt some pretty stupid strategies as a result).
However, the casino almost certainly wouldn't let you use a calculator, because they'll think you might be using it to count cards. That's why you can't use a phone at the table. Ditto for this:
> What if I had an ear piece and hidden camera glasses to stream video to some blackjack guru outside in a van?
...but the casino would certainly let someone next to you give you advice or help, because unless that person is counting cards they're still going to have a house edge (and it's pretty easy to tell when someone is counting, because you'll start making plays that would otherwise be in the house's favor).
Note that counting cards in blackjack isn't fraudulent in most cases - it's just one the casino cottons on that you're doing it they'll ask you to leave or stop playing. Outright fraud in blackjack would involve something like having the dealer in on the scheme, or using a marked deck of cards.
> it's just [when] the casino cottons on that you're doing it
And maybe not even then. With the incomplete mitigations that casinos already put in for card-counting (multiple decks, etc.), card-counting is tricky and has a very small edge. Consequently, just as casinos know they make money from people with "strategies" with no statistical validity, they know they make money from people who think they can count cards well enough to get an edge but who can't.
This. I've talked to several people who work in casino surveillance. They all said that if they think you're counting, the very first thing they'll do is assign an agent (or maybe a computer, these days) to count along with you.
Make an error or two (vs. perfect counting strategy), and they'll let you keep going, because long-term they'll still have an edge. Count/play perfectly and you'll get backed off or 86'ed.
They other key tip off to get someone assigned to you is your betting patterns.
It's well known that when you're counting cards, there is always a swing to when the player has an advantage. If you're upping your bets when you have the advantage, and then lowering them when the house has the advantage, they'll usually stop you from playing at the blackjack tables and either ask you to leave, or tell you to play something else where they have the advantage, like slots.
Not all casinos, and not even all tables within the same casino. Many of the Vegas casinos will have infinite shuffle machines on the lower-value tables ($5/10 per hand minimum) but have standard 6- or 8-shoe decks on the higher-value tables. The other trend lately is to make the rules less favorable on cheap tables (H17, no resplit, no DAS, etc.) and force you to go to a $25, $50, or even $100/hand table to get the player-favorable rules.
say you're playing a $5 game and your bankroll is $100. If you make one mistake, either at counting or basic strategy, you just gave up 5% of your ROI, over 3x the "edge" you get by counting. I remember hearing the slogan "If you can't play absolutely perfect basic strategy for hours at a time without making a single mistake, counting is not for you".
Which prompts the question of whether anyone starts off with an error or two to 'beat' this check.
Obviously errors aren't sustainable, since the edge is so small, but I wonder if it might be possible to open with an error so you can stick around a little longer before someone checks back in and bars you. More broadly - are counters these days trying not to get noticed, or trying not to get banned?
Once you start winning a good bit of money, the casino is going to be very aware of you. It's their business to know their customers, whether they are cheats or high rollers. If you show up with not a lot of money but win a lot, they are going to watch you. You may not automatically be dinged as a cheater because you give the house their cut every now and then but they know what you are doing. It's only until the point where you begin to eat into their profits that you will be shown the door. The casino knows how much money they need to pull in a night to be successful. This is why big spenders get free stuff.
It really depends on what type of game you are trying to cheat if you are avoiding detection or avoiding a ban. With slot machines, if they think you are up to any mischief, you will face legal issues. As for cards, the casino is going to be aware of your activities if they have any inkling of things like card counting. The dealers know what to look for and you will be watched. The casino is just trying to make sure you don't take too much from them but they also want you to keep winning, it makes others around you think they have a chance too. Make a few mistakes here and there and you delay the moment when they tell you to get lost for the night. You will get noticed so your only option is to just avoid getting banned.
You want to be a bit careful with your terminology: messing with a slot machine is cheating and will get you arrested, counting cards is NOT cheating nor illegal, but will get you backed off or trespassed if you're good at it.
The one actually doing the counting can play haphazardly and consistently lose money but they will covertly signal the partner who comes in with big bets when the situation is advantageous. The big better plays until the count favors the house again and then walks away. The counter keeps at it until the odds are again against the house and then they'll signal the next big better to come in and so on and so on until they win their set amount and move on to the next casino.
It's not illegal. It's not unethical. It's merely unprofitable for the casino and they'll ban you if they figure out that you're doing it.
> ...but the casino would certainly let someone next to you give you advice or help, because unless that person is counting cards they're still going to have a house edge (and it's pretty easy to tell when someone is counting, because you'll start making plays that would otherwise be in the house's favor).
To make it fraud requires two things. First they need to be breaking some kind of legal agreement, secondly they need to use deception to make it seem like they didn't.
In this case it's debatable to what extent they're deceiving anyone, but more importantly all they're doing is pressing the slot button at the optimal time, which is kind of the point of the game. Now most people wouldn't consider this 'fair', but for a legal argument that is a bit vague, even if it might be enough to say, disqualify someone from a tournament.
That's given as an example of "in a manner contrary to the designed and normal operational purpose" - to me, it sounds more like a mechanical slot machine being manipulated by pulling it in such a way that the mechanism doesn't engage in the usual way, perhaps only releasing one of the wheels after you've gotten two to line up well by chance.
Pulling the lever at a time you know to be right still sounds like using it for its normal operational purpose to me. Slot machines are designed to have their levers pulled, even when they will pay out as a consequence.
They offer a system that you can time because they know most people have superstitions that don't work, and they shouldn't be allowed to discriminate when someone finds a method that does work.
If they don't want a time-able system they should remove the feature that lets you stop the wheels. Of course they never will because selective enforcement is profitable so we should remove their legal protection and make them treat everyone equally.
Not a lawyer, but I think the fact he used a device (iPhone) to aid him is what did him in.
But I'm not sure where the line is either... would writing down results from a roulette wheel in a notebook be cheating? If not, why is recording the results of a slot machine?
> would writing down results from a roulette wheel in a notebook be cheating?
If you've been to Vegas, casinos tacitly encourage this by showing the last 100 spins of the roulette wheel and displaying "statistics" about the numbers that have or haven't frequently come up. Of course, this is all garbage because at 100 spins that's nowhere near enough to formulate any kind of statistical theory.
well I attempted to look, but there's too many pages for snake oil "beat the house" systems. I may have been wrong since I cannot find evidence, but if a wheel were biased, people would eventually detect it and exploit it. So at the very least, they would analyze the money drops and see an abnormal money flowing out of one particular table.
Maybe right away, but at what point do I not care about casinos, and resent my tax money helping them enforce their system? Also right away.
I get that it's "cheating", but I really don't care. Not at all. When predators get preyed upon it's funny. I only wish they were taken for more.
For all this "play responsibly" talk, we know that they survive on those who don't, and the last thing they want is for the addicted to wise up. So I have as much sympathy for them as for street-corner drug dealers and I'm sorry our rules protect them.
For the german speaking; here's a documentary about a guy who did this in the late 70ies in Germany - without an iPhone, just by developing a feeling for the (back then) mechanical machines.
Fun fact: §263a StGB (German penal code) was in part created to combat this kind of externally assisted prediction for slot machines. It is now punishable with up to five years in prison, if you just create or distribute the software up to three years.
Funny (and sad) how something that could be praised as an ingenious trick a hundred years ago is now considered a crime that state spends serious effort to pursue.
Cannot resist to reference an older perspective (from Smoke Bellew):
Montreal -- Daniel Corriveau said he hopes that his 'victory over the
system will give hope to others.' The computer analyst and his family received more than $620,000 [1C$ =
U$0.75], including interest, from the Montreal casino yesterday, weeks after they overcame odds of one in six billion and beat an electronic keno game three times in a row."
The author explains the following key points:
o Corriveau used an "antique 286" computer to analyse 7,000 combinations from
the keno game, [which uses an electronic pseudo-random number generator].
o Corriveau noticed that the electronic game was repeating numbers in a
predictable pattern.
o Corriveau and several family members bet on what they predicted would be due
to come up; they won three times in succession.
I had originally seen an article speculating someone power cycled a keno machine after recording the winning numbers, with the assumption or knowledge that the random number generator reseeded with a 0 on cold boot. I'm not sure if that's just me mis-remembering the details of this case, or another one altogether. If anyone has a link to the second case please let me know.
Figuring out the pattern of a pseudorandom device used for gambling reminds me of Michael Larson, who learned the patterns used on a TV game show in order to win a lot of money. See https://en.m.wikipedia.org/wiki/Michael_Larson
> Allison notes that those operatives try to keep their winnings on each machine to less than $1,000, to avoid arousing suspicion.
This is likely to be because they're trying to avoid the automatic W-2G that's generated for slot winnings over $1200. Basically if you're playing anonymously on a slot machine, any payout of $1200 or over on a single spin will generate a human interaction. Unless you're playing at fairly high stakes (say, over $100/spin), this is normally rare enough that hitting several $1200+ results in a short time span would be very suspicious. Keeping every win under $1200 allows a person to play as anonymously as you reasonably can in a casino.
The "And Casinos Have No Fix" part of the title seems exaggerated; if nothing else, it appears that only a small subset of 5+ year old machines are affected.
It absolutely is exaggerated. I left a job at a real money slot manufacturer 3-ish years ago where I was a mathematician and 'the rng guy'. Even then our machines weren't susceptible to this attack. We had a fix. And by 'weren't susceptible' I mean probably weren't but could be, because getting the rng wrong is super easy to do. Don't be shocked if regulators just pull these from the floor. They probably had to go through a lot of different machines from different manufacturers to find this in the first place.
From the description of the attack it seems like the only reason other machines aren't affected is because the Russian group running this hasn't gotten their hands on those machines.
Sort of maybe. It sounds like the slot machine makers are being cheap with their machines. There are such things as hardware RNG that will produce a truly random number, it's just that for most applications they're overkill. This seems like an instance where not only aren't they overkill, they're almost mandatory. They talk a bit about using encryption to protect the PRNG algorithm, but that's just a bandaid, at best it buys them a little bit of time, but ultimately it will be cracked the same way.
A hardware RNG is actually pretty cheap to make, there are actually open source (as in the circuit diagrams are available) ones floating around the internet that you can build for less than $20 worth of parts. The manufacturers probably don't want to go that far because a) compared to most of the parts in the machine it's a fairly expensive piece so it will cut into profits, b) hardware RNG function a bit different from a PRNG so properly integrating one requires a certain amount of skill, c) it isn't their problem really, they already got their money, it's the casinos that are losing, and d) it's simpler to just prosecute the handful of people doing this (for now).
That was somewhat covered by point b, but yeah, in terms of verification it's tricky to determine if a hardware RNG is actually, you know, random. The other part that makes it tricky is that most hardware RNGs don't produce enough entropy to keep a system fed during active usage so you typically need to use their outputs as inputs to more traditional PRNGs or to periodically re-seed a PRNG which was actually the main thing I was thinking about with point b.
eh, well designed CSPRNGs are a thing. If they re-seed/add to the entropy pool of the machines on the LSBs of microsecond button timing or something like that, it'll be pretty difficult to influence or predict the outputs.
Don't know what PRNG they use, but for the Mersenne Twister (MT19937, which was considered state of the art the beginning of this millennium) for example you can deduce the state after 600 or so observations (of 32 bit words), and then predict what it'll deliver after that. See [1] for details and some good background on PRNG, if possibly a bit biased (she's promoting her PCG family).
For gambling purposes, probably makes sense to use cryptographically secure PRNG :-)
I disagree with the characterization of the crews as "cheaters". They didn't cheat. They turned a game of chance into a game of skill, then excelled at that skill. Of course this has happened to other games as well, such as with card counting in blackjack, which is also inaccurately described as cheating when it's actually mastery of the game.
Change to roulette, chaos theory, and physicists -- using 8bit hardware in shoes -- and you get the fascinating book "The Eudaemonic Pie" by Thomas Bass. Highly recommended.
Came here to say the same thing. Brilliant book. A team of physicists created a computer to track a roulette ball and wheel with sufficient accuracy to gain a whopping 40% advantage over the house. Their hardware was never reliable enough (in terms of not catching on fire, the predictions were good) to make much money. Doyne Farmer, a member of the team basically invented the field of chaos theory, then went on to make a fortune on Wall Street.
I actually interned at Los Alamos Natl Lab at the Center for Nonlinear Studies while Doyne was there (late 80's - dating myself - before The Prediction Company). Cool guy! He had a nifty custom piece of hardware board for cellular automata in his computer that at the time blew me away. Was a cool job... got to write code that ran on things like Cray YMP supercomputers. Had a Thinking Machines CM-1 as well... (like in Jurassic Park with the blinkenlights).
By "Can't fix", they mean "could fix by putting in new slot machines whose PRNGs aren't crackable, but choose not to because it wouldn't be cost effective".
Why don't slot machines use true random numbers? They could still skew the results however they like.
The true fix is just to replace the machines. As they said the newer machines have encryption to hide the PRNG. Obviously some places can't do that, and the company is not doing it for free. So technically the casinos cannot fix the compromised machines themselves, but they could just replace them.
> If I know the PRNG and the encryption then I can predict the outcome of the encrypted PRNG.
I assume they are mixing the PRNG output with a secret key using some encryption algorithm. Given the cyphertext (observed spins) + the algorithm, you still can't predict numbers until you discover the key.
Depends on the algorithm. Many encryption schemes are vulnerable if you know the cyphertext and can guess the plain text.
This is one of those cases where if they knew what they where doing the PRNG would be fine as is. So, you can't just and wave some undefined encryption scheme and assume they will implement it correctly.
Any cryptographic hash function works as a key derivation function (KDF) or cryptographically secure pseudo-random number generator (CSPRNG). Even ones with broken collision resistance are probably still suitable-- you could just take the bottom bits of MD5(secret_key + counter) and that would be enough.
Very much no. If I know the hash function will always map input X > Y for all machines and I can guess say 100,000 possible states for the PRNG based on for example the time stamp then:
Hash those 100,000 states, compare the output of those hases to the observed output to find the actual PRNG state. Then always know the hashed output of the PRNG.
Edit: You said secret_key aka hidden salt, but if I can get that key by say access to the machine then it's not necessarily hidden.
I am pointing this out because the assumption is a poor PRNG used by incompetent team in the first place. Saying just do X, when it's possible to do X and still have a problem is not an actual solution. It's equivalent of saying just be competent.
Somebody play a tune on the world's smallest violin. People kill themselves because of casino normalizes self destructive behavior. So a bunch of impoverished engineers figure out a way to beat an outfit that profit's off from ripping people off. More power to them. I hope they take out all the fucking casino's ripping people off. Not that I condone hacking but casino really doesn't even register on my empathy list. Fuck them.
It should be legal to burn money also because people love doing it at a swanky place like casinos. At least you won't see people get addicted to dousing your cash with gasoline and throwing a cigarette at it.
I just thought of it and it seems quite exhilarating at the prospect....but it is safer and less addictive than gambling in casinos.
> As Hoke notes, Aristocrat, Novomatic, and any other manufacturers whose PRNGs have been cracked “would have to pull all the machines out of service and put something else in, and they’re not going to do that.”
This just goes to show that despite the money the casinos are losing to this Russian group, they are still making so much money off the people they are cheating that it's not worth fixing the problem.
Why our governments protect the jerks who steal money from the less intelligent members of our society is beyond me. That there are laws that support casinos is no justification. Casinos are themselves a scam and should not be protected against scammers at the expense of tax payers.
> Casinos are themselves a scam and should not be protected against scammers at the expense of tax payers.
In Sweden casino gambling, and other types of gambling, is owned by the state. The state keeps the money from the gamblers. It is like an extra tax that people can choose by themselves. In Spain it is similar for Lottery, it moves a lot of money in Christmas and the state keeps the profits. Any country can achieve similar results applying high taxes to gambling.
I think that forbidding gambling is an error, as it just moves it to more unsafe locations and opens good business for criminal organizations. Standards that regulate gambling are a better solution, it reduces gambling addiction creating less attractive gambling games, it forbids to loan money to gamblers while they are playing (that is really important), and in general keeps gambling in check.
Disclaimer: I have worked in the gambling industry, and I will probably do it in the future.
Why our governments are the jerks who steal money from the less intelligent members of our society is beyond me. That there are lotteries in every state is no justification. Lotteries are themselves a scam and should not be protected against scammers at the expense of tax payers.
"Casino is entertainment for which you pay a probabilistic fee proportionate to your spend". Ok, a bit of a stretch, I personally think. I honestly think that people gamble on things like slots because they don't have an educated sense of probability. I'm not sure the transaction is quite as clean as buying a cinema ticket and trading cash for entertainment.
"These guys were right to do it". I think the edge exists because it's ultimately illegal. I think it's tantamount to an illegal distribution of cash from a casino to a mob. Would it be any different if they hacked their bank account?
> I honestly think that people gamble on things like slots because they don't have an educated sense of probability
I once became an investor on a BitCoin gambling site. The operator let you either gamble, the normal route, or invest and receive a share of the payout. He was extremely clear about the house edge.
I went into the chat room and asked people: why do you gamble if you know the odds are against you. The most canonical answer I received:
"Maybe I believe my luck has an edge on the house"
I wonder if there's enough variation in how people pull the handles and push the buttons that they could be used to partially re-seed the PRNG frequently enough that it the seed can't be determined by a video?
That's the technique Linux uses, it feeds keyboard and mouse timing events into one of its entropy pools. I can't see why they wouldn't do this for slot machines.
The article mentions newer slot machines, "whose PRNGs use encryption to protect mathematical secrets" - so new machines are already considered secure.
Aristocrat, Novomatic, and any other manufacturers whose PRNGs have
been cracked “would have to pull all the machines out of service
and put something else in, and they’re not going to do that.”
So they could be fixed, it's purely a financial decision.
as long as older, compromised machines are still popular with customers,
the smart financial move for casinos is to keep using them and accept
the occasional loss to scammers.
sure, but are you gonna put a tiny bit of radioactive material in every slot machine? Not to forget that the RNG would have to be restocked if the material ever runs out
These kind of poker machines are regulated to limit the amount of money they're allowed to keep: usually expressed in cents in the dollar e.g. 86¢. The regulators read the code and certify it.
Could you prove that the extra entropy added to the PRNG pool would not change the limits? Bigger challenge: could you present it in a way that a regulator would agree with you?
Since the title says "Can't Fix": Isn't it fixable by injecting some entropy into the PRNG for every roll like button press durations in nanoseconds, temperature, hardware quantum based, ...?
Easier fix: using a cryptographically secure PRNG. Like the article mentions, newer machines employ this technique, but of course it costs money to replace them.
you'd have to do a hardware mod, and gaming is a regulated industry. so every mod you do has to be submitted to a state or nationwide gaming regulatory authority, takes months (at least) to get approval, and costs easily $100k.
Not to mention full regression testing on the statistics of the game. You would have to "re-prove" the validity of the RNG , which requires another QA cycle, statistical expert, and game designer (to ensure that the frequency and distribution of wins matches the specification sheet)
there aren't many other software bugs in casinos that affect the money. They're usually graphics-related or crashes, and they usually just restart the machine and write a bug report.
If they are related to money, they pull the machine out of the field until a new software version is fixed. A gaming company I used to work at had an issue with multi-jurisdictional machines that worked in Mexico but could display english or spanish. The machines could also change denomination, say from $0.05 to $0.25. There was some bug where if you reset the power, you could get it to bump your credits up from 20 nickels to 20 quarters (or might have been 20 pesos to 20 cents), it was something dramatic and easily exploitable that was fixed promptly.
Reminds me of the first chapter of Kevin Mitnick's 'The Art of Intrusion' [0]. The first chapter tells the story of (I believe) American programmers who reverse engineer the PRNG on a poker machine, so they could predict when the machine would deal the next royal flush.
> A finger that lingers too long above a spin button may be a guard’s only clue that hackers in St. Petersburg are about to make another score.
Seems like this is easy for the scammers to work around. They could calculate the average time it takes for the scammer to lift his hand from his lap and press the button, and then use that time instead of .25 seconds. Would be less successful, but would seem to be almost impossible to detect.
There is a fix and it is not crazy. The gist is they were able to brute force the PRNG of the machines and predict their future state. Hardware RNG is thr answer. In crypto it is obviously bad if someone can predict anything about your random values (keys / IVs). A hardware RNG, "cryptographically strong" RNG algorithms, and resetting the RNG very often make this problem go away.
The problem is that you cannot add a hardware random number generator to existing machines and the cost of buying a new machine is high enough that casinos do not want to do it.
If the scammers get too big the casinos will replace the compromised machines and the scam ends. The scammers seem to know this: they are targeting more an more casinos around the world in an apparent effort to make sure it is worth the risk.
Actually you don't need hardware random number generators. There is enough variance in human input to feed a cryptograhic random number generator. The code to add this probably wouldn't be that hard to write (they might be 8 bit CPUs or some such limit that makes it impossible though). However all code changes have to be certified by regulatory bodies (for good reason) which makes it not worth the effort to fix old machines.
That is fair enough. For older machines I have no idea what the answer is. I just mean designing this securely is not too hard. Hardware RNG is cheap, though. You are right though, these old machines do present a pickle.
That is a surprisingly detailed and reasonable requirement for the most part. Some of those side channel attack resistant requirements are wishful thinking in some ways, but it is also probably obvious in general, if someone is say, performing DPA in the middle of your casino.
Curious how they screwed this one up - did they just have no proper random source? Nothing like modern operating systems use, like disk latency? If you're in the business of doing random numbers, you'd think you'd embed a cheap hardware based random number generator, even if it was extremely limited, just to seed a CSPRNG.
I'm guessing that proper hardware random sources, or the operating system entropy generators, are harder to verify by gaming commissions so they didn't get used. The article does mention that more modern software uses cryptographic generators that can't be predicted.
The title is a bit misleading (clickbait?) - the problem can certainly be fixed, and the article even goes into some of the ways. It just isn't cost-effective. Retiring the problematic machines would do it.
I wonder if they can change the amount of money you play for in those machines, so that it's no longer worth it to try to cheat them?
It looks to me like a PRNG is fed once and never reseeded. That's the only way that simply observing the spin would tell about the outcome. In fact I'm surprised it doesn't just "produce" the outcome every time the button is hit simply from a few bytes of the prng.
As was said elsewhere in the thread: It seems that the organizer of this affair does not want his hired hands to figure out what's going on, telling them instead it's some computer magic they calculate real-time.
Why is it so difficult to create randomness? Input from microphone or even variations in electricity input should be more than enough, no? Why is it such a huge struggle, I don't understand, especially in machines that depend on the randomness.
There are several hardware RNG solutions available now that are truly random (based on physical phenomenon). But, these are older machines and maybe before security was taken so seriously.
Oh I get it! If you can't prove that it's predictably random then you can't prove the outcome (house advantage) and then the casino won't buy the machine. Am I right?
Really funny piece. It really feels like one of those Order vs Chaos battles, with Russians on the Order side. Guys found the order in randomness, I'd like to see the math behind their operational methodology. Also, why iPhone?
After reading a bit about it, it seems very difficult (impossible?) to get a true random set of numbers. Anyboyd here on HN that has some insight? Are there interesting hardware or random-number-as-a-service things going on?
It's still unclear how the organization broke the PRNG in the first place. Were they somehow able to get their hands on a machine for hardware analysis? Or did they just have their "operatives" play slots and capture video which they then manually analysed for patterns?
Offloading the computation to a remote server is a smart idea though. There is a lot of cool stuff happening in the game cheating space.
when gambling just got banned nationally, you have very little incentive to maintain good relations with the manufacturer, and would rather just get whatever you can moneywise for such a large investment.
They already have a fix (better PRNGs), they just don't want to pay to implement it.
"Use 2 PRNGs and switch between them somehow" sounds kinda like "roll your own encryption." This stuff is hard to get right, and iterating on quick-fixes without a deep understanding of the problem seems unlikely to do anything except introduce minor roadblocks for the attackers.
Abusing humans desire to pattern find and take risks for profit is bad. Casinos are bad. If you could weaponize gambling and spread it in an enemy nation, you'd do much to hurt it's GDP. I made a video about why gambling sucks.
Anyone interested in how the gambling industry makes their billions mainly from slot machines, and how they engineer them to hijack people's dopamine systems should read Addiction by Design (MIT Press, 2012).
I get that creating a genuine random number generator isn't easy, but surely this points out that it's something the slot machines should have rather than a PRNG?
How does that encryption work? Is like those sha-256 circuits used in Bitcoin mining? Is it possible to modify the affected machines to allow encryption?
I read a paper on such a technique a while back. The CMOS sensors in smartphones are very sensitive to a certain band of infrared. I think it would be possible to set up a system that automatically detects smartphone location and splashes its general area with infrared. With a good controller and motor setup, you could probably have a single jammer that can alternate between multiple phones.
It's illegal because there's a law prohibiting the use of electronic devices to gain an advantage. If you could study the patterns offline sufficiently that you could use the same technique without a device in the casino, it would be legal.
I mean sure, the business can kick them out, ban them, whatever, that's fine. I have no problem with that.
What I have a problem with is the implication that using public information to succeed at something without any malicious interference in its operation could be a criminal matter.
As, for example, in Nevada:
"NRS 465.075 Use of device for calculating probabilities.
It is unlawful for any person at a licensed gaming establishment to use, or possess with the intent to use, any device to assist:
except as permitted by the commission."http://www.gambling-law-us.com/State-Laws/Nevada/