Slashdot Mirror
Investigation Into Security Director Who Hacked the Lottery Expands (bgr.com)
An anonymous reader sends the latest update on Eddie Tipton, the man who worked for the Multi-State Lottery Association who was convicted of rigging a lottery game so he could win a $14 million jackpot. BGR reports: "Not too long ago, Eddie Tipton was convicted of hacking into the Multi-State Lottery Association's computer system in order to rig a nearly $17 million jackpot in Iowa. Now comes word that an investigation into Tipton's hacking activities is expanding to include a number of other states. Thus far, lottery officials from Colorado, Wisconsin and Oklahoma have indicated that Tipton may have also gamed lottery jackpots in their respective states. What makes this saga all the more interesting is that Tipton actually used to work at the Multi-State Lottery Association as a security director. In that capacity, Tipton allegedly installed a rootkit onto his company's computer system that influenced the manner in which 'random' numbers were generated. As a result, Tipton was able to calculate and gain access to winning lotto numbers before their public unveiling. With the numbers in tow, authorities claim that Tipton would reveal the winning numbers to friends who would then buy 'winning' lotto tickets and then collect on big paydays."
There are states that use a computer to pick their numbers and not balls pushed out by a machine?
Every state that has one uses it to cut taxes on the rich instead of adding to Education budgets (seriously, there's a John Oliver video over on youtube that explains it). It's addictive gambling that often drains the last few dollars from the poor and worse it gives the lower class a false feeling of hope that discourages them from demanding better living conditions. It encourages the downtrodden to think of luck as a skill you work at and view their failure to win as a personal failure. Lotteries are one of the most vile tools for controlling the working class ever devised. How is it nobody but one guy on youtube ever points this out?
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
The Lottery is a hidden Tax on the Poor.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
B32!
Alternatively, they can just predict /dev/random output if it contains sufficiently low entropy. You don't need root access for that.
No you can't, you're mixing things a bit up. /dev/random - in most implementation is of the *blocking* variety. I will never let the entropy go low enough. If there isn't enough entropy, the device will simply block until enough entropy has been gathered. /dev/urandom - which is the *unblocked* one. It will always spits out random numbers, no matter what the current state of the entropy pool is. If gets too low, you're basically just having a CPRNG (a cryptographic *pseudo*-random number generator). It might look random, but if you collect enough data, you can guess the internal state of the generator and predict the next number.
(Because of these pauses, it might be a performance bottleneck), that's why most implementations also offer...
The problem is that, for performance reason, lots of people tend to use the second one, even for situation where this is a bad idea. Like generating the random numbers needed for a cryptographic key.
See Mining Your Ps and Qs: Detection of
Widespread Weak Keys in Network Devices
Linux is one of the unix-like system that implements these kind of split random/urandom duality.
Linux is also incredibly popular on embed device.
Embed devices tend to have *not that much* sources of entropy (e.g.: no harddrive and input devices with chaotic timing)
Gathering enough entropy for the critical process would take time.
But several implementation use urandom (on the grounds that nobody wants to wait 30 minute after turning an appliance now. They want to push the button and the device imediatly tunring on and being operationnal).
Which is a BAD IDEA(tm) for cryptography.
The good idea would have been: defer the generation of keys as late as possible, e.g.: right before they are actually needed for the first time. By then some entropy (network timings, etc...) could have been generated.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Im sure glad nothing like this would ever happen to voting machines