Posts by jtwaldo

'Doomsday' asteroid Apophis more massive than first thought

Why not nuke it after it safely passes in 2029, just in case?

The asteroid will come much closer in 2029, given us an opportunity to eliminate the risk of future collisions with this particular near earth object. Of course the risk of nuclear detonation directly against the asteroid BEFORE it reaches Earth is that smaller pieces will enter the atmosphere, but what about shortly afterward? Essentially we'd need to launch a nuclear warhead-armed rocket chasing after the asteroid after it safely passes Earth and outside the orbit of the furthest satellites.

SSD tools crack passwords 100 times faster

you are missing something

You get the hashes, transfer them to a hardware optimized (SSD, GPUs, etc) host and run the crack there. There are plenty of legit uses for this technology. eDiscovery etc...

IT contractors convicted of UK casino hack scam

good idea

I figured there was a hash in the barcodes, but was wondering if it might be a very simple XOR hash or something...

Good idea posting AC, I'm sure I'll be tackled at the door next time I walk into a casino for voicing my theories!

your analogies don't make sense

"On serial data lines, there is no such thing as "simultaneously". One of the tickets will *always* be seen before the other one."

Serial data line? Are you assuming that there is only one cashier and that tickets are scanned before a payout is made? In the scenerio I'm describing, there are multiple cashiers and desks throughout the casino, and they all seem to put the tickets in a pile without entering them into the system. Unless there is a camera processing the barcodes... which is possible, then they are just reading the payout amount directly from the ticket and handing you the cash.

"except there *isn't* an adversarial relationship between voters and councils"

But there wouldn't be such a relationship between voting machine vendors? We're not talking about a method of counting votes (or gambling) we're talking about the competition for quality of products within that method. It sounds like your point is that slot machines are inherently secure because of the relationship between users and casinos and that voting machines are inherently not secure because of an analogous relationship between voters and election comissions. That doesn't make sense at all buddy. It assumes that all vulnerabilities and attack vectors are known or can be trivially remediated... and really that's the reason why casino's could be in trouble, because they think they understand all the attack vectors and vulnerabilities. They install camera's all overthe place and only keep cash in hardened locations within the building. That's a physical security control, not an integrity control.

maybe

I have never seen a cashier scan a payout ticket with a barcode reader before handing me cash (at least at the casinos around here). Even if they do tie each ticket to a database key, there may still be holes in the process. i.e, you legitimately put a lot of money into a slot machine, play a couple rounds, cash out, take the ticket home, dupe it, and then have two people bring it to a cashier simultaneously. You just doubled your money.

You would think that the adversarial relationship between users and operators would keep voting machines secure too!

Even if the embedded linux devices/slot machines are relatively secured, there's a lot of complex infrastructure behind them that might not be. If banks and voting machines can get it wrong, I'm betting slot machines aren't 100% perfect either!

This scam could have much wider implications

I find it surprising that the only reason they were caught in this scam was because of the mis-matched payout amount. What controls are in place to identify ticket forgery?

I have been to many casinos where all slot machines print this tickets with barcodes and payout amounts. What's in those barcodes? How easy would it be to trick a slot machine into reading a forged ticket with $10,000 in credit, play one round and collect your payout... on a brand new slot-machine generated and watermarked (if they do in fact watermark such things) ticket?

Also, I'm surprised there haven't been more advanced slot machine hacks out there. You've got a room with thousands of embedded linux devices all networked together. Why hasn't anyone developed a hack that exploits a member benefits card reader vulnerability.