Six people have been charged in what prosecutors say was a scheme to hack Connecticut state lottery terminals so they produced more winning tickets and fewer losing ones.
At least two of the suspects have been charged with felonies, including first-degree larceny, first-degree computer crimes, and rigging a game, according to an article published by The Hartford Courant. The suspects allegedly owned or worked at retail stores that produced winning tickets in numbers that were much higher than the state average. Of tickets generated at one liquor store, for instance, 76 percent were instant winners in one sample and 59 percent in another sample. The state-wide average, meanwhile, was just 24 percent. After manipulating the terminals, the suspects cashed the tickets and took the proceeds, prosecutors alleged.
The charges come several months after lottery officials suspended a game called the 5 Card Cash after they noticed it was generating more winning tickets than its parameters should have allowed. The game remains suspended. Investigators say more arrests may be made in the future. Almost a year ago, prosecutors in Iowa presented evidence indicating the former head of computer security for the state’s lottery association tampered with lottery computers prior to buying a ticket that won a $14.3 million jackpot.
Citing arrest warrants, here’s how The Hartford Courant said the Connecticut scheme worked:
An investigator for the Connecticut Lottery determined that terminal operators could slow down their lottery machines by requesting a number of database reports or by entering several requests for lottery game tickets. While those reports were being processed, the operator could enter sales for 5 Card Cash tickets. Before the tickets would print, however, the operator could see on a screen if the tickets were instant winners. If tickets were not winners, the operator could cancel the sale before the tickets printed.
Based on the bare-bones description, the hack appears to have exploited software weaknesses that not only caused ticket requests to be delayed when terminals were carrying out certain functions but also to allow operators to know ahead of time if a given request would produce a winning ticket. If this theory is correct, such timing and disclosure flaws should have been caught by developers and lottery auditors long before terminal operators were able to exploit them.
SOURCE: Dan Goodin | Ars Technica