Video Poker Firmware Bug Yields Big Money, Federal Charges

JoeyRox writes "Over the course of playing $12 million worth of video poker, Las Vegas resident John Kane stumbled onto a firmware bug in IGT's 'Game King' machines that allowed him to cash out for 10x the amount of his winnings. John and his friends took advantage of the vulnerability to the tune of $429,945. John's friend was arrested by U.S. marshals and charged with violation of the Computer Fraud and Abuse Act, but a federal magistrate ruled that the law doesn't apply and recommended dismissal. The case is currently being argued in a U.S. District Court."

Comments

Fraud is fraud

[i kan reed]

If you knowingly trick a computer into giving you money that's not yours, it's not any different than tricking a person into the same. Open door fallacies are the worst.

Re:Fraud is fraud

[K. S. Kyosuke]

The machine is programmed to behave in a certain way. If you handle it in some way, it will give you more money. I'd blame the vendor. Do you blame the customer who goes to the shop where they often overpay him in change for fraud?

Re:Fraud is fraud

[AuMatar]

But that's not the right law to charge him under. Charge him under fraud or stealing, no problem. This is the anti-hacking law- they're charging him with hacking. I don't think this qualifies. It also is the difference between being tried in the federal court system (hacking is a federal crime) vs the state (which owns the laws for theft and fraud).

Either way he should be prosecuted, the question is why and where.

Re:Fraud is fraud

[gl4ss]

I thought having buggy game machine fw's was a federal offence?
now, do you think he should have been able to keep the money from the first time he pressed the buttons? perhaps the second too, how could he know wtf is really going inside the machine?

at the very least the computer fraud act shouldn't apply to a device that's supposed to just be a device and from his viewpoint it had no difference if it was a mechanical gambling machine or a computer.

bear in mind that in order to get ANY money out of a video poker you have to apply "skill" as well. that is pressing the right buttons at the right time. is it a trick to press the right buttons? "Kane’s attorney, Andrew Leavitt, says Kane played by the rules imposed by the machine, and that’s all that matters."

Re:Fraud is fraud

[cayenne8]

I don't think he should be prosecuted.

They have a machine...he didn't sigh any EULA or agreements about how to use it.

The main use of this machine is you put money into it, you hit buttons, it sometimes pays out.

He found a combination of buttons that causes it to pay out a LOT.

I see no problem with what he did. He simply put money in and pushed buttons on machine set out in public for the purpose of people pushing buttons and sometimes getting money out of it.

Show where he violated the signed terms of use or NDA or other type contract on exactly HOW he was to use the machine, and maybe you have a case.

Re:Fraud is fraud

[gfxguy]

Fraud is committing an act of deception; how did they deceive the computer? Did they use false credentials or something? No - he just re-pressed the cash-out button. That's not fraud, that's a firmware programmer found dead in a ditch. And to address anonymous's concerns - that doesn't make it ethical, it simply makes it not fraud.

Re:Fraud is fraud

[Anonymous Coward]

There was a case like this in the UK a few years ago. A family discovered that a particular cash machine was systematically giving out double the amount you had withdrawn. They repeatedly withdrew money using this machine. They were reported, and convicted of fraud. I doubt it would have happened with one-off visitors. If you ONCE visit a cash machine that gives you £200 and deducts from your account the £100 you intended to withdraw, then you've got lucky: you can't have known it would do that. But repeatedly visiting a machine that is misprogrammed to act in your favour, when you know that that is not how it is intended to function, is something quite different. That clearly amounts to fraud.

Re:Fraud is fraud

[Minwee]

Exactly. For example if I am playing poker and have a lousy hand, but bid high to trick the other players into folding, then that's fraud too. If I use that trick to make money then I'm stealing from the house.

Right?

Re:Fraud is fraud

[gfxguy]

How is it fraud? If you tell a machine you want $20 and it gives you $40 (even if you do it repeatedly), you haven't committed an act of deception. I'm not saying it's right or ethical, I'm saying it's not fraud, and it certainly shouldn't be prosecuted that way. Theft by taking, maybe.

Re:Fraud is fraud

[Anonymous Coward]

Yeah, which happens to be a real problem in the baking industry. I asked for a dozen rolls and got 13. I sensed the baker was trying to make me inadvertently steal, so I threw the last one back at him and called him names. Learn to count.

Re:Fraud is fraud

[Antipater]

Video Poker is very different from the game your friends play. There are no other individuals to play against, only a computer screen.

Re:Fraud is fraud

[RoknrolZombie]

Video Poker != Poker

Mainly because you're not playing against other players, you're playing against the house who defines the rules (the Gaming Commission is involved enough to make sure that there's a fair chance of winning, but "fair" does not imply "fair to the players").

Re:Fraud is fraud

[gfxguy]

Why is this a response to my post? I didn't say it was ethical (or even legal), I said it wasn't "fraud." Even the article mentions the case calling it fraud was thrown out, but there are other laws that may have been violated. It's just not fraud.

Re:Fraud is fraud

[j00r0m4nc3r]

Well, they're just mitigating bad luck with shrewd long-game play. It's still a game of luck if you look at it per-hand, but there are betting strategies and other skills involved if you intend to play the long-game, at which point I guess it becomes a game of skill.

Re:Fraud is fraud

[Anonymous Coward]

This happens all of the time with ATM's in the US. It never makes it to court.

When the bank loads an ATM cassette, they know exactly how much money is in it and what denomination of bills it contains. The serial number of the cassette is recorded by the person loading the ATM as well as by the ATM itself, by way of an RFID chip in the cassette. This links back to a database of ATM cassettes and their current load status and contents. The bank knows exactly, down to the serial numbers on the bills, what is in that cassette. Modern ATM's even automate the configuration from that database. The problem is that older ATM's don't.

When you go to an ATM and ask it for $40 (common "fast cash" amount these days), and the ATM has been configured for $20 bills, it dispenses two bills. If it's configured for $10 bills, it dispenses 4 bills. In older ATM's, the configuration is done manually. If a $20 cassette is loaded but the ATM is configured for a $10 cassette, it dispenses the wrong number of bills. That $40 you ask for is 4 bills, but the bills are $20 now, and you get $80.

When this happens, the bank will discover it as soon as they change the ATM cassette. Then they will find EVERY transaction that ATM performed on the previous cassette and contact the account-holders, notifying them that due to an incorrect ATM configuration, they were given more than they requested, and that the account has been rectified to reflect the correct ATM payout. For this transaction, any overdraft fees are waived (by law), and the transaction is applied to the day that the correct is made, not to the day the ATM paid out incorrectly (again, by law).

That's when most people drag their sorry butts back to the bank to make an emergency deposit of some no-longer ill-gotten gains to shore up their account balance.

Re:Fraud is fraud

[K. S. Kyosuke]

Technically you're probably right, however I know that Casinos in Vegas do actually keep photographs and blacklists - if someone is in their books as being a "cheater" (to include card counting), the Casino is well within it's right to escort them from the premises.

Well, that alone makes me side with the guy - if you advertise a game with some rules and then enforce a "but we'll only admit losers to the game" policy, you're already rigging it. Even if it were immoral per se for the guy to walk away with the money, I think that in the grand scheme of things, it would be only a tiny upwards adjustment of bad karma for the gaming industry.

Re:Fraud is fraud

[jittles]

I spent some time in the security room of an Indian casino and I've seen the book with my own eyes. The Indian casinos and Vegas casinos all share this information willingly. You end up in the book in Vegas and you can bet that every legal casino in the country is going to get your information in no time.

Re:Fraud is fraud

[BattleApple]

Instead of calling it a bug, I'd just call it an easter egg.

Re:Fraud is fraud

[gfxguy]

Actually, I'm not pretending it's OK at all, I'm just saying there's no deception; no deception = no fraud.

Re:Fraud is fraud

[nabsltd]

Video Poker is very different from the game your friends play. There are no other individuals to play against, only a computer screen.

Despite this, a video poker player with skill will do far better than one without.

The pay table on the machine will tell you if it is a good machine to play in the first place (skill required to know what is "good"), and then once you do play, knowing what to keep for the draw involves a lot of skill, which varies based on the exact pay table. With this sort of correct play, some video poker machines pay back over 100% in the long run.

Re:Fraud is fraud

[BitZtream]

Read the article.

He's exploiting the interaction between two different software modules to his advantage. While from a technical perspective he didn't write any assembly to exploit a buffer overflow, he instead used his fingers and eyes to write a mental program which moved his fingers in order to exploit an initialization bug in the software. The software was not clearing out memory it reused for like purposes between two different games, by exploiting this, he was able to increase his winnings by 10x.

He really is using a software exploit and 'hacking' the software. He just isn't using your typical UI to enter and run the hack but he really is exploiting a software bug like metasploit would, or any other attack vector.

This isn't your typical hacking applied to some object that just happens to have a processor. He is hacking the software, and more so, a specific version of the software with specific features enabled. This is no different than an attack targeted at Chrome or Safari, it just seems that way because the UI isn't a terminal window.

Re:Fraud is fraud

[nabsltd]

Malfunction voids the game.

The machines were working exactly as they were programmed to work.

The casinos may not like the fact that they paid out more money than they "should", but they were not malfunctioning. If it was a single unit instead of units all over the US, I'd agree you definitely could call it a "malfunction", but with every unit acting that way, the line is a lot harder to draw.

That goes both directions.

Actually, it doesn't, as only the casino gets to decide if it was a "malfunction". I've never heard any story about a machine that was paying out too little and the casino made it right.

Re:Fraud is fraud

[Hatta]

he instead used his fingers and eyes to write a mental program which moved his fingers in order to exploit an initialization bug in the software

And if I use my fingers and eyes to write a mental program that allows me to beat the house at blackjack(e.g. card counting), is that hacking too? No, it's strategy.

He really is using a software exploit and 'hacking' the software.

Bullshit. He's playing the game as it is implemented. He found a strategy that allowed him to win more than the casino intended. The game might be unfairly balanced against the casino, but that's the casino's fault.

The technical details of how his strategy works doesn't change the fact that it's a strategy. And discovering winning strategies is the whole point of playing games.

Re:Fraud is fraud

[gnasher719]

If you knowingly trick a computer into giving you money that's not yours, it's not any different than tricking a person into the same. Open door fallacies are the worst.

That would depend on what the law actually says. And I mean the exact wording. In the case of a gambling machine, you throw in money, you press buttons, and the machine may or may not spit out money, which you then keep. That's how it works. If the machine spits it out, it is yours.

Re:Fraud is fraud

[geekoid]

what am I a casino owner? video game machine expert? head of marketing? how should I know it's not some special promotion?

Don't make the consumer responsible for machine mistakes.

Re:Fraud is fraud

[geekoid]

"Intentionally abusing a process in bad faith can be a crime,"
no.

"and should be a crime"
never. If this is the case the consumer becomes responsible for every possible mistake. That is a path I don't want to travel.

Do you want a bill for a product you got charged the wrong price for? Do you want to be responsible for any possible mistake a store/corporation might do?

Re:Fraud is fraud

[geekoid]

wrong. The people who claimed it wouldn't make mistakes deceived the owner.

It's not a deception from the consumer by any definition.

Deception, beguilement, deceit, bluff, mystification and subterfuge are acts to propagate beliefs that are not true, or not the whole truth (as in half-truths or omission). Deception can involve dissimulation, propaganda, and sleight of hand, as well as distraction, camouflage, or concealment.

They didn't propagated a belief, they didn't tell a half truth.
Did they omit anything from anyone? If someone asked them what they were doing and the didn't tell the truth to that person, then it' s a deception to that person.

No deception, no fraud. Too bad So sad.

Plus, its a horrible business move to go after these people. the PR is bad.
Far better saying yeah, the machine had a bug, it's fix. I guess those guy were lucky!
Now people will come in and spend hundreds looking for a machine with a bug.

Re:Fraud is fraud

[geekoid]

No, you are the asshole. Plus shortsighted and egotistical, so you are the complete tri-fuckta.

Yeah. lets make people completely responsible for software errors. That way when you are charged the wrong price, you can be billed the next time the store does their books.
Oh, sales tax calculated wrong? well you better be ready to pay the difference to the store.

Hey, last time you pumped gas, there was an error and we charged yo for one less gallon, pay up now!

On and on.

"You haven't made me sign a document stating that I won't kill you while you sleep"
and there it is; a completely incorrect absurd example that has nothing to do with the issue at hand. You have no valid point, you lose.

Re:Fraud is fraud

[pla]

This is why the Gaming Commission is required to test/inspect the machines (to include deposits and payouts) on a regular basis. Until you have evidence that this is happening you're just trying to justify theft. If the machine were found to be faulty, the individual would have their provable losses returned to them, probably up to a few hundred dollars.

That sounds just peachy - Except that the machines in question had the exact same tests done to them, and still contained a bug that no one had caught for who knows how long.

It counts as pure hubris to claim that bugs in the opposite direction (opposed to the player) don't exist and remain uncaught.


That said, the definition of "fraud" here has a lot of flexibility. I recall a case from my youth (when I worked for a competitor of IGT, for whatever credibility that gives me) where someone cracked our RNG algorithm on a "pick 3" type game. After they had won a few hundred grand, the jurisdiction asked us to look into it, and we changed the RNG, the player stopped winning game after game after game. No charges ever followed, because it shouldn't count as fraud if you figure out how to win the fucking game, even though an entire state government lost a noticeable amount of money.

Re:Fraud is fraud

[daveime]

And this is why you are replying to posts on Slashdot, rather than doing drugs, booze and hookers on your private island in the Bahamas.

Re:Fraud is fraud

[tehcyder]

There is no implicit contract involved here. There is no transaction. There are no goods or services being purchased that can be returned or be made good if there is a defect.

Nonsense. If you play the machine, you are entering into a contract with the owner which says you are prepared to gamble on the chance of winning some money.

Do you really think the owner can just fix the machine so that it never pays out?

Re:Fraud is fraud

[tehcyder]

Fuck your anglo-saxon religion. FUCK IT.

So in your wonderful religio-legal system, if I accidentally transfer my life savings to your account which is one digit different from my other savings account, that's fine and you can just keep it?

Well, fuck YOU, mate.

Re:Fraud is fraud

[Kilo Kilo]

The customer is merely making the best of the situation. The worker is defrauding 7/11, since she was hired to do a job that she's clearly not capable of doing correctly.

Re:Fraud is fraud

[tragedy]

With this sort of correct play, some video poker machines pay back over 100% in the long run.

Turns out, according to the article, if you find the correct way to play the machine to turn a profit, you get prosecuted.

Re:Fraud is fraud

[nabsltd]

The theory would rely on Video Poker being the *one* slot machine in the casino that uses random chance in shuffling.

Video poker isn't a slot machine, and the shuffling is purely random.

The skill comes in knowing what cards to keep on the "hard" hands, but other people have figured it out for you, so you don't have to be as "smart", just have a good memory.

Abuse of civil matters

[briancox2]

This looks to me like a civil matter. That is, if there had never been the DMCA. There is a recent trend by big corporations to abuse the criminal court systems to resolve their disputes with the heavy hand of govnernment. I don't think it will stop until we stand up and demand government that is FOR the people.

Re:Abuse of civil matters

[Anonymous Coward]

well, I stood up and said it.. but then everyone in the cube farm turned around and looked at me funny so I sat back down

After RTFA

[John Napkintosh]

I don't see this as being a criminal act, but given the way that it was carried out, I think the casino has every right to demand 9/10 of his winnings back.

You win a game at the $1 level, exploit a bug to change your cash level to $10 before accepting the payout, and then accept your payout. Well, you didn't actually make the bet at the $10 level, so you shouldn't expect your winnings to be multiplied by 10, but that's what's happening here. I'd argue that he's still entitled to the original 1x amount and let the casino ban him if they want to.

Re:After RTFA

[briancox2]

You're right. As a result of a civil case, I would expect him to have to pay back the money. But claiming he is a criminal is not necessary. We used to have the view in this country that anything which could be handled properly as a civil matter, SHOULD be handled as a civil matter.

Our legal system and law enforcement system has enough to deal with without imprisoning people over financial disputes.

Re:After RTFA

[neminem]

We have a phrase for that, "works as coded", and it is a sarcastic phrase that we make fun of mercilessly. The fact that the rules were clearly printed on the machine as to how it was supposed to behave, and it was clearly behaving differently than that (and in a way that was obviously not intended behavior) makes it a malfunction. It was a software malfunction rather than hardware, but clearly still a malfunction.

Going to jail for it? That'd be a bit of an overreaction. But he should definitely have to give back his unearned winnings.

Can't cheat an honest man

[egcagrac0]

The point of the machines (from the player perspective) is to stick in money, push buttons, and make it dispense more money (vouchers) than you put in.

The house edge comes from the fact that pushing the buttons correctly in all situations is difficult.

This guy did it right. If the house wants to fix the "bug" that allowed him to take out more money than they thought he should, that's their right.

Prosecution on this one... very grey area.

But I'll forward the how-to on to my video poker friends, just in case they find a machine with those firmware revisions, so that they'll be sure not to expose themselves to prosecution in this manner.

Re:Can't cheat an honest man

[Sancho]

With video poker, the house edge is built in to the device. The edge is that the payout schedule beats the odds of getting the hand.

In this case, the machine was defective, which generally voids all plays (this is usually written on the machines.)

The defect was that a player could trick the machine into thinking more money had been wagered than actually had been. This means that the payout schedule could be higher than the odds of getting the hand.

The guy shouldn't be charged with a crime, but the casino almost certainly has the right to demand the money back (unless they failed to post the warning about voiding plays.)

No idea how he stumbled upon that

[TheNastyInThePasty]

From TFA: Kane began by selecting a game, like Triple Double Bonus Poker, and playing it at the lowest denomination the machine allows, like the $1.00 level. He kept playing, until he won a high payout, like the $820 at the Silverton.

Then he’d immediately switch to a different game variation, like straight “Draw Poker.” He’d play Draw Poker until he scored a win of any amount at all. The point of this play was to get the machine to offer a “double-up”, which lets the player put his winnings up to simple high-card-wins draw. Through whatever twist of code caused the bug, the appearance of the double-up invitation was critical. Machines that didn’t have the option enabled were immune.

At that point Kane would put more cash, or a voucher, into the machine, then exit the Draw Poker game and switch the denomination to the game maximum — $10 in the Silverton game.

Now when Kane returned to Triple Double Bonus Poker, he’d find his previous $820 win was still showing. He could press the cash-out button from this screen, and the machine would re-award the jackpot. Better yet, it would re-calculate the win at the new denomination level, giving him a hand-payout of $8,200.

no sympathy for the casino

[Chirs]

As long as he didn't do anything but push the standard control buttons, I think he's entitled to whatever he can get.

If the casino thinks they're paying out too much, they can sue the maker of the video poker machine.

New Monopoly Chance Card

[organgtool]

"Casino error in your favor. Go directly to jail"

Apples and oranges

[Gription]

There is a major difference in the two situations...
The UK scenario is people accessing a machine designed to give them their own money from their own bank accounts. Doubling the money as you remove it in no way resembles any intended purpose for the machine.

The video poker machine is a situation where the machine is intended to supply an opportunity for the users to extract as much money from the machine as possible. While they are doing this they are supposed to try to accomplish this by spending the least quantity of cash possible. The coding of the machine is supposed to try to counter the user's intent to acquire as much money as possible.
I find it hard for them to cry foul when someone is overly successful at accomplishing the intended purpose unless the user was directly altering or interfering with the operation of the machine. That doesn't appear to be the case here. The machine was simply following its program as supplied by the manufacturer.

Programmer Error Or Programmer Intent?

[Jane Q. Public]

Maybe the guy who programmed the firmware did it intentionally. Just a thought. But it's a valid one. How the hell would this guy know?

Seriously. Maybe the programmer put in a "back door" so he could get a few dollars in winnings when he went to Vegas. How do we know otherwise? In which case this player was not committing fraud at all... the machine would have been doing exactly as it was intended to do by the programmer.

And there is probably no way to prove it either way. So let the guy go.

Re:Programmer Error Or Programmer Intent?

[networkBoy]

Other than it being a crime for the programmer to play on the games.

Re:Programmer Error Or Programmer Intent?

[Jane Q. Public]

"No, it doesn't work that way. What matters is if the player is playing the game as intended by the owner of the game, not the programmer."

Nonsense. The owner of the game has very little say in the matter. They don't write the law.

I can write software to do damn near anything I want. That doesn't mean other people are obligated to do it that way. At most that would be a violation of terms of service, not the law.

"The player is committing a crime as soon as he intentionally takes advantage of the fact that the machine is not playing by the stated rules."

Again, nonsense. The player commits a crime when he violates the LAW. Since when do software companies write the law? If it worked the way you state, then software companies could, in effect, write their own laws by dictating the rules of the game. Now... it may be that there is a law that specifically says that in Nevada, but I'm far from convinced that such a law exists. I'd want to see it. As far as I know there is no such law anywhere else. Even CFAA does not contain such specific language.

"When he does it again just to see if it happens again then he might have committed a crime. When he tells his friends and they use the trick to beat the machine then they have all committed a crime."

Again, I'd have to be shown the specific law saying that. I'm not aware of one. It may be against the law to violate the House rules. I don't know. But since when do the House rules pertain specifically to operating software in a particular way?

If you can show me an actual law that backs up your claims, I'd be happy to admit I'm wrong. But until I see one, call me skeptical.

Re:Versus humans

[turp182]

The odds aren't "rigged" in any game where a human is in control. The house is always going to win due to statistics. A dealer would quickly be caught if he/she "rigged" the game in a persons favor.

The guy in question just figured out a method of pushing existing buttons that "rigged" the game in his favor.

The game maker is at fault, not the person who figured out how to take advantage of it. They let the bug into the system. No hacking was involved, just pressing the buttons that were available.

A counter-suit to reclaim defense expenses would be the appropriate measure in my opinion, not that my opinion regarding legal issues is worth event 2 cents...