Slashdot Mirror
Allegation: Lottery Official Hacked RNG To Score Winning Ticket
SternisheFan writes with this excerpt from Ars Technica about what may be the most movie-worthy real-life crime story of the year so far: Eddie Raymond Tipton, 51, may have inserted a thumbdrive into a highly locked-down computer that's supposed to generate the random numbers used to determine lottery winners, The Des Moines Register reported, citing court documents filed by prosecutors. At the time, Tipton was the information security director of the Multi-State Lottery Association, and he was later videotaped purchasing a Hot Lotto ticket that went on to fetch the winning $14.3 million payout.
In court documents filed last week, prosecutors said there is evidence to support the theory Tipton used his privileged position inside the lottery association to enter a locked room that housed the random number generating computers and
infect them with software that allowed him to control the winning numbers. The room was enclosed in glass, could only be entered by two people at a time, and was monitored by a video camera. To prevent outside attacks, the computers aren't connected to the Internet. Prosecutors said Tipton entered the so-called draw room on November 20, 2010, ostensibly to change the time on the computers. The cameras on that date recorded only one second per minute rather than running continuously like normal.
"Four of the five individuals who have access to control the camera's settings will testify they did not change the cameras' recording instructions," prosecutors wrote. "The fifth person is defendant. It is a reasonable deduction to infer that defendant tampered with the camera equipment to have an opportunity to insert a thumbdrive into the RNG tower without detection."
In court documents filed last week, prosecutors said there is evidence to support the theory Tipton used his privileged position inside the lottery association to enter a locked room that housed the random number generating computers and
infect them with software that allowed him to control the winning numbers. The room was enclosed in glass, could only be entered by two people at a time, and was monitored by a video camera. To prevent outside attacks, the computers aren't connected to the Internet. Prosecutors said Tipton entered the so-called draw room on November 20, 2010, ostensibly to change the time on the computers. The cameras on that date recorded only one second per minute rather than running continuously like normal.
"Four of the five individuals who have access to control the camera's settings will testify they did not change the cameras' recording instructions," prosecutors wrote. "The fifth person is defendant. It is a reasonable deduction to infer that defendant tampered with the camera equipment to have an opportunity to insert a thumbdrive into the RNG tower without detection."
I'm actually surprised there haven't been more cases of insiders rigging lotteries.
I should think knowing all of those zillions of dollars are just sitting there would cause more people to decide to see if they could get away with it.
Lost at C:>. Found at C.
...but instead of hacking a random number generator, they injected paint into the ping-pong balls used for the live drawing.
http://en.wikipedia.org/wiki/1...
Of course. If you read more about the story, this guy setup a shell corporation in Belize that tried to claim the prize just before it was going to expire. He obviously knew that he couldn't walk in and claim the prize, but he thought he could get away with having this magical shell corporation claim it on his behalf and that it wouldn't get back to him.
AntiFA: An abbreviation for Anti First Amendment.
I'm surprised to see a complete lack of audit trails on critical systems like this. They need to require individual accounts of which every action is logged in an immutable audit trail. On both the camera system and the random number box. There is no way to prevent malfeasance committed using privileged accounts, but you should at least be able to determine who did what after the fact.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
Are all criminals dumb, or do we just catch the dumb ones?
That's something I've always wondered.
Harald
What is the point of using an expensive and highly locked down computer in place of a dead simple machine filled with pingpong balls?
RNG sucks. I'd rather play a BLM or a THF.
Get free satoshi (Bitcoin) and Dogecoins
Probably the latter. The selection bias here is huge. The really smart criminals aren't caught.
Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
Why do people who have access to the computer also have the ability to control the cameras?
Splitting responsiblity this way is such a basic and obvious security measure.
The real "Libtards" are the Libertarians!
From reading various articles on this, the person in question entered the room under the auspices of carrying out legitimate maintenance work, but had doctored the surveillance camera so it only recorded one second a minute rather than continuously - getting the other person to look the other way for a few minutes is a simple matter of social engineering ("hey, I forgot X and I'm right in the middle of this, could you get it?") and doesn't mean they were in on it.
The really smart criminals get into politics. Then, even if you are caught, nothing happens to you...unless you've pissed off another higher ranked politician, in which case it doesn't matter if you've actually done what you've been accused of.
He's got the winning lottery ticket, there was a malfunction with the camera's. So far I haven't seen any 'evidence' that that person actually did it. He might have been in cahoots with his co-workers. Splitting the ticket 2-5-ways is still pretty lucrative.
If he did it, he was pretty dumb to think he could get away with it. He should've
1. Remained anonymous (if possible, some lotteries allow it, some don't), let his lawyer pick up the money
2. Gone for a lot lower number (winning low enough so you can get a cash payout at the shop (~$600/week is still a nice bonus))
3. Allowed enough time for the evidence to be destroyed (video camera's probably overwrite old stuff every n months) then played and collected. If you implement your own RNG, you could easily predict numbers in advance.
Custom electronics and digital signage for your business: www.evcircuits.com
Someone hasn't read TFA.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
Darn young baby boomer whippersnappers are so lazy. He wouldn't have been caught if he'd just typed in the code live instead of slothfully brandishing a newfangled flash drive!
cat > rootkit.exe
In my day, I would've had to key it in the front panel! A command shell is pure luxury!
Gamingmuseum.com: Give your 3D accelerator a rest.
...put the cameras on a 30 minute loop and hired an acrobat to lower into the room from the roof after hours and change the system. Then do the Lotto Commissioner's wife to keep him distracted.
Just be sure to check for a new logo on the floor.
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
> "Four of the five individuals who have access to control the camera's settings will testify they did not change the cameras' recording instructions," prosecutors wrote. "The fifth person is defendant."
In other words, five out of five individuals will testify that they did not change the cameras' recording instructions.
Go look at the Powerball PRIOR to the new group bring awarded managing it.
You will see that over and over, the winners were on the east coast. Keep in mind that CA was one of the largest states to be part of Powerball, and had one of the most buyers of tickets, and yet, states on the east coast overwhelmingly won more than CA, esp. on the big ones.
Technically, it is possible. Statistically, it was theft that was going on.
I prefer the "u" in honour as it seems to be missing these days.