Slashdot Mirror
Computerized Betting System Proves Vulnerable
count3r writes "A front page article in today's New York Times reports that an employee of Autotote has been fired for (allegedly) hacking the system responsible for 65% of all horseracing bets in North America. The caper, if it is indeed a caper, resulted in a series of six bets that paid a total of $3,000,000 in last Saturday's Breeders' Cup."
WHy not just hit them up for several thou a week? Like theyre not gonna notice a 3,000,000 blip.
All Troll + "offtopic" mods are meta moderated as "Unfair", because you abused the system.
DRM will be our savior.....
Oh wait, he required that kind of access to do his job? So DRM wouldn't have helped. What do you mean that most hacks are inside jobs?
when people used to give horses steroids so that they would win their bets. All this new technology is confusing!
Or why don't we look at one of the many articles that don't require registration. Darn NYTimes.
I will never understand how people come up with good, well thought out crime plans, and then totally screw up the execution by rushing things or bring too much attention to the project. Just dumb.
Buttloads of $ vs. determined individual: vulnerability.
Someone will always find a way to steal and no matter how good your security, when you have the human element on the inside, you are vulnerable. That's why auditing to detect theft is as important as securing against it.
"When it rains, it pours." --Morton's Salt
see what happens when you legalize it??? all these crooks get in and screw it over.
Nah, it can't be vulnerable. Online betting is trustworthy. Why, as soon as I get my bonus back from the Nigerian Petroleum Company, I'm going online to bet on the ponies!
Some posts seem to be some confused about what they did. The scheme was simply to change one guy's (electronically registered) bettings after the race was over, with the help of an insider.
Tor
Until a little over a year ago, I was employed at a company that wrote gambling software for sports betting houses. It is big business, let me tell you. :) If anyone has any questions, fire away and I'll answer them.
I never put any backdoor code into anything I submitted but it would have been very easy to do so. We had well over 300,000 lines of code and very little of it was audited. The only problem would have been getting the backdoor in without other programmers noticing as everyone was responsible for different areas. Still, I know it could have been done, I can picture exactly what it would have taken to do so.
Would it have been noticed? Possibly eventually, though I have my doubts. Apparently, there was a bug in our code for one of the complex bet types. It ended up _always_ overpaying a specific complex winning bet type by $1. That is, it always rounded up to the next dollar instead of down and this bug went undetected for YEARS.
All the code was written in VB and we worked crazy amounts of overtime ALL the time. Additionally, the 'business experts' could never get their act in gear and agree to how things should work. I ended up resigning my position.
Oceania has always been at war with Eastasia.
What if a hacker steals from someones children?
:)
We are all someones child after all
no sig.
You obviously know nothing about the horse racing industry. While there may be some shady characters out there, most people in the scene are just your average blokes who are hoping to win a couple bets while at the racetrack. Those are the guys who eventually end up losing because of people who cheat the system.
If it turns out to be cheating, it just goes to show what happens when you want too much too soon. You know, just winning $1,000 or $10,000 probably wouldn't have raised an eyebrow.
And, I wonder how often this bet hits? Technically, the bet was really picking the winner or 4 straight races, plus betting on every horse in next 2. I won a trifecta once that paid a cool grand. To think, if I'd only tried for one more......
If they're guilty, they're idiots.
A lot of people make a lot of money on internet gambling sites without breaking a single law. The people who play online poker suck so bad compared to professional poker players that it is like printing money for anyone who plays the game seriously. I suck which is why I don't play, but a lot of people are willing to give up there hard earned money to a redneck who has played poker since before he could write.
It may not get you $3M, but they won't have to work anymore, and they don't get put in FPMA prison.
Slashdotter are stupid and biased.
This is, just as the article said, a misuse of power, rather than a skillful hack. If I remember, isn't hacking usually prosecuted over the fact that the person obtained illegal access by knowingly circumventing security measures? He was given clearance as part of his job; he misused his security clearance, he didn't gain unauthorized access.
In any case, I'm surprised that ANYONE has the access to modify bets. Shouldn't that info be encrypted or protected or something, kind of like how your Bank's customer service rep can't look up your pin, but can only reset it to a new pin?
$8.95/mo web hosting
Well, they do want some registration stuff, but nothing identifiable to you.
Best Slashdot Co
Here in Alberta, Canada we have VLTs (Video Lottery Terminals) that let you play a number of different card games and other assorted forms of gambling on a touch-screen terminal. They're a HUGE profit center for the pubs and bars that host them, and for the provincial government. If I were a VLT programmer of questionable moral character, it would be awfully tempting to code a backdoor triggered by some easter egg-type series of screen touches that would let me score a couple hundred dollars at each terminal.
Anybody ever heard of anything like this happening in real life? As an earlier poster said, if you kept your take down to a couple thousand a week, I think it would be pretty unlikely you'd get caught.
They want us to vote online?
Ed Craig "Who cares what you think?" George W. Bush, 4th of July 2001
Fortunately, all of those systems are closed, so I'm sure that security was motto number 1.
Of course, motto number 2 was "Ignore motto number 1".
resulted in a series of six bets
Was was reading this yesterday, it's actually interesting. It wasn't six bets, it was one bet on six consecutive races (called a Pick 6, apparently). The ticket cost over a grand just to purchase.
Apparently, the winning ticket including the first 4 race winners, followed by picking every horse in the field for the 5th and 6th races. This was suspicious because the betting management company allows the bets to be submitted during simulcasting through the end of the 4th race to prevent system congestion, according to the article.
The theory is that the employee submitted a fixed bet at the end of the 4th race. The ticketholder himself, apparently unrelated to the employee who is under investigation for fraud, claims that he is innocent, and is telling the company to put up some evidence or give him his 3 mils.
I dunno about you, but I do detect a strong odor of fish. On the other hand, if the lottery hit for this guy and he is legit, more power to him.
Fortunately, such a thing could never happen with electronic voting machines.
Right?
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
Tug on Superman's cape.
Spit into the wind.
Rip off the NY mafia to the tune of $3,000,000.
There are 01 kinds of cars in the world. The General Lee, and everything else.
The same thing happenes when the mob runs things. Its just instead of it making it into the paper as a "hacker" story, it would wind up in the paper as "Headless Body Found in East River".
Worker Dismissed as Inquiry Widens Into Big Racing Bet
By JOE DRAPE
As the authorities investigated whether an exotic bet worth $3 million on last Saturday's Breeders' Cup horse races was rigged, the company that processed the wager said yesterday that it had fired a "rogue software engineer" who exploited a weakness in its system.
The company, Scientific Games Corporation of New York, said it had turned over the employee's name and evidence of potential wrongdoing to the state police and state wagering officials.
The employee attended Drexel University in Philadelphia with the winner of the bet, racing officials and a state investigator said.
The head of the company, Lorne Weil, said the worker had the access and know-how to breach the system run by the company's subsidiary Autotote, which processes 65 percent of racing wagers in North America.
Industry and law enforcement officials said that the F.B.I. had joined the police and the New York State Racing and Wagering Board in the inquiry of the wager, known as a pick six, which requires bettors to pick winners in six straight races. Payoff on the bet, made through the Catskill Off-Track Betting hub by telephone from Baltimore, has been held up.
Investigators are also looking into whether there have been questionable payoffs at other tracks. "This goes beyond one afternoon and the East Coast," said an investigator, speaking on condition of anonymity.
Though Mr. Weil tried to calm investors in his conference call yesterday, his disclosures pointed up the vulnerability of the $14.5 billion-a-year betting industry for which consumer confidence is crucial.
As racing has become more reliant on off-track and telephone betting, it is also depending more on a network of computers that link tracks and off-track sites. If the systems are proved flawed, or susceptible to manipulation, it could scare off bettors worried about the integrity of the process.
"There needs to be total review of the system so everyone can feel good and see that these things are not widespread," said Bill Nader, a New York Racing Association vice president. "Without integrity in the way a wager is processed, we don't have a sport."
The case in question involves the pick six bet on the last six races of the Breeders' Cup, horse racing's season-ending championship. The entire winning pool was held by Derrick Davis, a 29-year-old Maryland man who made the bets by phone.
Investigators are looking into whether the computer system was manipulated so that a bet made after several races had been run would appear to have been made beforehand.
Though Mr. Weil did not name the dismissed employee, the state investigator and racing officials identified him as Chris Harn, 29, who worked in Autotote's offices in Newark, Del.
Mr. Davis owns a Baltimore-based computer networking business, Utopian Networks Inc., but said yesterday that he was a knowledgeable bettor whose winning tickets were legitimate. "I didn't do anything wrong here," he said, refusing to elaborate and referring questions to his Baltimore lawyer, Steven A. Allen. Mr. Allen said his client was cooperating with the authorities and had nothing to hide.
"He is caught in the middle of a maelstrom," Mr. Allen said. "As far as he's concerned, he made a legitimate bet. The race was run, and he won, and he should have received his payoff. And that should have been the end of it. Now, instead, there's an investigation, people are making a variety of wild accusations, and his reputation is being sullied for no good reason."
Thomas Davis, Derrick's father, said his son grew up in Baltimore and attended engineering school in Pennsylvania, but would not be more specific. "I just think it's like the equivalent of his hitting the lottery," the father said. "I know in the bottom of my heart that it's a legitimate bet."
Stacy Clifford, a spokeswoman for the state wagering board, would not comment on the personnel involved in the investigation or its progress.
"The board routinely involves other organizations in its investigations and will involve law enforcement if it feels appropriate," she said. "They fired this person in connection with what happened Saturday, and since we're investigating what happened Saturday, we're certainly looking into it."
What started the investigation last Sunday was the configuration of the winning tickets and that they belonged to one bettor, Mr. Davis, who called his bets in by phone to the Catskill OTB hub, one of five regional corporations that, with New York City OTB, handle off-track bets in New York.
The winning tickets featured "singles," or races with only one horse selected, in the first four legs of the ticket, and then every horse in the final two races. On a $2 ticket, those combinations and strategy cost $192.
Mr. Davis bet a $12 pick-six ticket, or played that exact combination six separate times, costing him $1,152. It was a highly unusual strategy for betting the pick six -- horseplayers like to cover as many combinations as possible -- and the configuration raised suspicions of New York Racing Association officials, who alerted Breeders' Cup Ltd. and the state wagering board.
Mr. Davis had opened the Catskill OTB account within two weeks of the Breeders' Cup, had deposited money on five occasions -- four increments of $500 and one of $250 -- but had not made a bet until that pick six, according to investigative sources.
The six winning tickets were each worth $428,392. In addition, by including every horse in the last two races, the bettor collected 108 of the 186 consolation payoffs for hitting five of six winners; each consolation ticket was worth $4,606.20.
After an initial review on Monday, officials for Autotote and Catskill OTB said the tickets were recorded about 20 minutes before the first leg and appeared legitimate. But after further review, Mr. Weil said, the company determined that the fired employee had taken advantage of a weakness in the processing of bets.
While the tickets were logged and totaled at satellite sites such as Catskill OTB, they were not transferred to the host site, Arlington Park outside Chicago, until after the fifth race when the exact bets were verified. In this state of limbo, Mr. Weil said, the employee, who had the password to the data system, was able to alter the ticket after the results of the first four races of the pick six were known.
When Scientific Games announced the firing, trading in its stock was suspended on Nasdaq for more than 20 minutes. The stock closed at $7.62, down 57 cents. Mr. Weil maintained he was confident Autotote's systems were impenetrable to outside hackers.
"I think people see this for what it is -- a rogue individual bound and determined to exploit the only weak link we see in the system so far," he said.
I have several friends who work for Autotote (as well as some who work for Amtote) and they're all laughing their asses off over this whole thing; especially the media coverage.
-- "Government is the great fiction through which everybody endeavors to live at the expense of everybody else."
The fact is that implementing a gaming system is a nightmare, be it on the ground or in the air. IMHO, quite a bit more difficult than point of sale or banking systems. In addition to being secure, it's gotta be completely fail safe (so if a passenger's terminal goes down seconds after a jackpot he won't loose his winnings and take it out on the cabin crew). Also, it's going to be transaction heavy - hundreds of smaller, individual bets over a gambling session as opposed to, say, a higher end credit card transaction every minute at a department store cash register. If you add in the fact that gambling is a potentially addictive activity that piques the interest of organized crime, you have a recipe for any disaffected insider to slip in hacks and back doors.
On the whole, I'm not surprised that someone corrupted a gambling system. I'm just surprised that this doesn't make the newspaper more often.
"Prepare for the worst - hope for the best."
Also, the ocean is wet, and there is porn on the internet.
Just so you know.
-B
I'm trying to figure out why people think computerized betting is any more vulnerable to fraud than the non-computerized variety.
The Breeder's Cup incident was an inside job! There have been numerous Casino incidents where employees have tried to scam their employers. A security system is only as good as the people with whom the system is entrusted. This is true for physical security as well as computer security.
Lastly, criminals are not, inherently, stupid. It only seems like that as the stupid ones are the ones that usually get caught. Borrowing from Kaiser Sousay (Kevin Spacey) in Usual Suspects : the greatest trick a master criminal has ever pulled is convincing the world that a crime has not been committed.
This guy had better be very careful in the next few years, no matter what happens in court - the sort of folks who are involved in gambling are not known for taking such matters lying down.
He may very well wake up one morning with a horse's head in his bed.
Or more probably, wake up to that particular clammy feeling one gets from freshly mixed cement around one's body....
www.eFax.com are spammers
In other news, shortly after being dismissed the former employee had an unfortunate accident resulting in the breaking of both his kneecaps.
I bet the average geek would think a lot harder about crossing Vinnie, and risking death, than just risking a little jail time.
"Politicians are interested in people. Not that this is always a virtue. Fleas are interested in dogs." P.J. O'Rourke
Two relavent bits of info:
1) They fired the QA department due to cutbacks over a year ago.
2) There is no "Production Control" group. The same people who develop the apps support them (with little to no oversight). They have never had a way of preventing this type of fix.
One time I found santa lying dead in the living room. I asked my dad why santa was dead and he said: "Son... Sometimes.. Santa gotta get whacked."
It's organized crime that's going to get him. Revenge.
I see evidence that this guy is pretty lame - he's dumb enough to screw up a good scam his first time out by shooting for the moon. We can't assume that a novice is the first person to find this scam, but AutoTote indicates he's the first to be caught.
I'll wager dollars to doughnuts that he's just closed the loop on a lucrative betting system being utilized by any number of "organized" gamblers, and will be hearing from a guy named Vito in the near future.
The cure for cancer is coming: Reovirus
Drexel rules! I hope to work for a Drexel MBA at some point in my career.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
It was not a matter of just getting one lucky bet right.
In the Pick-6 scheme, you get a jumbo prize if you pick all 6 winners correctly.
What this guy did was buy a number of bets - each for $12 (that's probably all he had available). In each of the bets, the winners of the first 4 races were the same and he chose every possible combination for the winners of the last 2 races. Sounds like he knew who was winning the first 4 races and bet on every possible outcome for the last 2.
Mmmm.. Donuts
It was a relatively expensive and complicated bet based on the cumulative outcome of six separate races... and he placed the exact same bet six times.
Once you've done that, putting a flashing marquee on your front lawn that reads "cheating the OTB out of millions of dollars is my very smart, infallible plan" is officially redundant.
So from the article we can deduce there is a disconnect between the actual placing of the bet to the actual determination of a payoff. What they need is a chain-of-evidence system, so that bet's are placed (stored securely), once the race is closed for betting, the records should be posted to a new server (stored securely), then finally at payoff, the two records should be verified to have have been tampered with. Of course, this Engineer could have known both databases, but in this case you could insure no one person has rights to both databases. Of course a conspiracy of two is possible. My final problem with this is what about a one-way hash on these things: hasn't Kumar in India ever read about database encryption, why should an Engineer be allowed to see the plain-text record anyway? Otherwise you set HORSE_NBR = 5 (High Chapperal).
"This isn't a study in computer science, its a study in human behavior"
I am sure you are perfectly right in that it is a royal pain in the butt to get an inflight gambling sytstem to work properly.
That being said, I am sure it is just a matter of time before it is commonplace. The payoff is just too high, and the airlines are just too hard pressed to let go of a profit opportunity like this.
Tor
handicapping is a lot like the game of Go. Its all about pattern recognition. What the patterns translate to.Computers have a hell of a time being good at it.
A Good Troll is better than a Bad Human.
Is there some development methodology or practice a company can implement to protect itself from "rogue" programmers like this? The NSA / CIA / FBI / Pentagon must have software that they want to guarantee is uncompromised. How do they do it?
I'm looking for a HEPA media filter for my TV. I'm alergic to reality shows.
Charge the company that programmed the betting system too, why don't you!
Tuus crepidae innexilis sunt.
My little brother won a Tri-Super jackpot at a greyhound racing track a few years back. He hit three dogs in order (trifecta box) in the first race, and having won that he could then try to guess the first four dogs, in order, in the next race. Needless to say, he hit all four in order, otherwise I wouldn't be telling the story. He won $360,000. Half was split with an off-track bettor who picked the same dogs. Out of the remaining $180,000, $135,000 was left after taxes. Alas, my little brother was 16 at the time, and thus ineligible to bet - the money legally went to my mom's evil lawyer husband. My little brother got a brand-new Chevy Malibu LS (sport version), and little else. The husband spent it all on deer hunting trips, Reno gambling loss trips, and Jack Daniel's Tennesee Whiskey. Oh, and he beat the living shit out of our mom, too.
A few years later, the Malibu had been wrecked, my mom discovered him cheating on her and divorced him (he could beat her as well as me and she wouldn't leave him, but cheat on her and he's divorced, go figure), and all the money was gone.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
Scientific Games also does lotteries. Here is how they are rigged. Only the gangsters running the rackets make money from gambling.
The Uncoveror: It's the real news.
Right but "Rosebud" and "Crying Game" because of the movies they are have their "secrets" pretty much known to everyone. I still run across a lot of people who have never heard of the "Usual Suspects", so giving that away has a lot more meaning than those examples that you gave. Almost like me giving away the "secret" to "The Ninth Configuration" vs "The Sixth Sense".
Plus, yes, the attribution at the time of reading wouldn't mean anything to those reading it. But as soon as they started watching the movie they'd immediately would make the connection, especially since KS is such a big star now (unless of course their short term memory is like mine, in which case they'd probably forget they read it, what movie are we talking about again?)
This one will really blow your mind. Darth Vader is Luke Skywalker's Father!
How ya like dat?
I see your Keyser Soze, and I raise you C. S. Lewis.
This next song is very sad. Please clap along. -- Robin Zander
On race tracks... I don't know if this still goes on, but have you ever seen a man stood on a box waving his arms about like a mad seal at a race course? They are signalling the odds of different horses in some kind of sign language.
I believe the name is tic-tac man... aha, ive found a link which explains it a bit better here
This does not affect the profit or loss of the racetracks and pari-mutual organizations ONE CENT. The pool for the pick 6 wager was $4,569,515... and the track is obligated to pay that amount back, less a "hold" percenatge (that the revenue for the track).
If this guy's winning tickets are disqualified, it will only increase the amount paid back to those who legitimately won. I'm guessing because I don't know the exact hold percenatge, but there were probably 8 or 9 winning tickets, each paying out $428,392. 6 of them belonged to the man in question. If his tix are disqualified, it will only mean that the $2.5 million that they were worth will be disrtibuted among the valid winners.
Under no circumstances will the racetrack make or lose any extra money as a result of what happens. If there were no other winners, the pool would either be carried over, or paid to the consolation winners (5 of 6). Most tracks employ the carry-over (to the necxt day), but this is the Breeder's Cup, which is a special, nationwide, once-a-year event, so the rules may be different.
True story: A guy I work with in NY is from Texas. He had a meeting with someone from the database group last week, and when he came back, he was telling us about the things "That Russian guy" told him. Well, the DB group doesn't have any Russians in it, so we asked him who he was talking about. His answer: "You know, the Russian guy with the beard. Vito." Once you've been to Texas things like this don't really surprise you anymore.
One, which is the one you get by default if you bet with the off-track betting agencies, is the one described where the odds change *after* you have placed the bet. The agency takes their cut, and the rest is distributed to people who placed winning bets in proportion to the amount they bet. An Australian developed an early analog computer, the totalizer, to automate this process in the 1920s(?), thus continuing Australia's long history of being a world leader in gambling technology ;)
Bookmakers at the track instead offer fixed-odds betting - any individual bet is at known odds, though they can and do adjust them nearly continuously.
As to your question as to how bookmakers offering fixed-odds bets know how to judge the odds, they follow the patterns of bets very closely (nowdays often with the aid of computers) and keep track of information about the horses they are offering bets on. However, bookmakers can and do lose money on a race. Some very rich men (notably a guy called Kerry Packer) make a habit of screwing bookmakers each year at Melbourne Cup day.
Any sufficiently advanced technology is indistinguishable from a rigged demo
--Andy Finkel (J. Klass?)
Not in any useful matter.
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.
It's common practice to transfer the matrix of a pick 6 after the 5th race is official. The is because of the size of the matrix otherwise.
My question is "where was the state supervisor during this?"
I'll refrain from saying more here, but beleive me, there is a whole lot more to this story than's been said, and a lot of things that will tell the tale if anyone looks.
I can tell you that during my time with AmTote, the tote operator couldn't change bets at all, only place a bet (just like everyone else did, at a ticket machine), or he could cancel them. And big muddy footprints all over when he did. I don't know that this is still the case, but I would think so.
In all honesty, I have an axe to grid with AutoTote, because of something one of their operators did to me during a race. Doesn't matter now, I guess.
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.