As, for example, in Nevada:

"NRS 465.075 Use of device for calculating probabilities.

It is unlawful for any person at a licensed gaming establishment to use, or possess with the intent to use, any device to assist:

      1.  In projecting the outcome of the game;

      2.  In keeping track of the cards played;

      3.  In analyzing the probability of the occurrence of an event relating to the game; or

      4.  In analyzing the strategy for playing or betting to be used in the game,

http://www.gambling-law-us.com/State-Laws/Nevada/

In this case we'd (and by we, I mean Nevada residents) compare two scenarios: a world without the big Vegas casinos (and their tax revenue, their employees, the good stuff), or a somewhat rigged world with the casinos.

So maybe in 5 years we'll be complaining about how Nevada residents can't see beyond 'rigged' tech jobs that don't pay as much as the Bay Area...

The discussion is about whether those laws make sense and are moral, or if they were designed by greedy guys in suits trying to punish anyone who dares to play their game in a way different than intended.

It makes total sense for a business to act greedily, I wasn't saying otherwise.

It does not make sense for it to become law.

Should those be illegal, given that they cause the casino to lose money?

Should Uber be illegal, given that they cause taxis to lose money?

I'm not talking about incentives here. Everyone will act according to their incentives. That's nature. The taxi industry will lobby against Uber. That's nature.

The justification for passing a law should not simply be to help a business stay in business.

Businesses should thrive based on a superior product, not because they threaten people with punishment for not doing things the way they want.

It is like it being illegal to dine and dash - you could say, "well hey, he restaurant should have made me pay first if they didn't want me to just leave after my meal! They need to change their business model, not resort to the law"

I see no problem with banning a "cheater" (I don't even like the word, as they just figured out the rules of the game better than the house), from the casino, but to legislate that people cannot use an advantage that they have discovered seems like an abuse of law. The casinos don't have to offer games they know can be gamed, and they are free to come up with their own solutions to restore the odds in their favor. To me abusing the law is just laziness on their part to help maintain their advantage, while criminalizing a class off people who where nothing more than smarter than the house.

This is why card counting (in your head) isn't illegal - though it can get you banned. Using a device to do the same thing for you IS illegal.

I get what you mean, but what you said means something different, in a way that leads to an interesting question.

The odds are not supposed to be completely random. The odds are supposed to fixed in most (all?) casino games (and in most non-casino games). It is the outcome that is supposed to be completely random in casino games, distributed according to the fixed odds.

That raises a question. What would a game look like where the odds were random? The odds are determined by the rules, so would the game have to have rules that are changing at random?

But if you are given the distribution of the random numbers that determine the rule changes, you could still work out the players odds for the overall game. So do we have to have the distribution that the random rule changes use be completely random, too? But the distribution used to generate the random number used to pick the distribution for picking random numbers to drive the rule changes...do we need to pick that at random....is it going to be random distributions all the way down? My head is starting to hurt...

Fun fact: by being able to access the payout statistics menu and knowing the machine's installation date it was easy to know which machines would be "hot". I have witnessed machines that paid out poorly for a couple years (+ a few million USD) but would hit regular jackpots near the end of their expected lifecycle.

edit: gambling is a scam, please don't participate

I disagree. To some extent slot machines are more scam-like than the other games, but I think the table games (roulette, black jack, craps) all have well known odds and are generally honest games.

They are not "fair" in the sense that the odds are stacked against you, but I don't believe that that's a reason to completely boycott them.

Gambling is fun. As long as you know going into it that the odds are stacked against you (and how badly they're stacked against you) and you don't go into a game without being prepared to lose your entire stake, there's nothing wrong with gambling.

Don't bet the farm, but go into it knowing you could lose everything, and enjoy a few hours of gambling and "free" drinks. Every once in a while you'll beat the house, and _that_ is quite enjoyable.

A casino tells you the exact odds, and everyone is freely able to decide if they want to play given those odds. Yes, they are in the house's favor, but that is what a player trades in return for the whole setup (the casino, the workers, the free drinks, the entertainment, etc)

You can still argue casinos are immoral, but they are clearly not a scam. That would be like saying cigarettes are a scam, just because they are bad for you.

The house can claim malfunction on anything and refuse to pay you. You have little to no recourse. I've witnessed people having their jackpots declared invalid for ridiculous reasons such as a faulty door sensor on the machine (having nothing to do with the game itself.)

You're essentially gambling that you can win the game and the house won't deny your win.

If you see a casino cheating, you should report it.

If a casino catches or even suspects you're card counting, they are well within their rights to refuse to let you play that game anymore.

If, on the other hand, you and the casino are playing different games, e.g. the dealer is playing black jack, but the player is playing I-know-what-the-dealer's-down-card-is-because-of-manufacturing-imperfections-in-the-card, then is it really that unreasonable for the casino to have a case that they don't owe you the money that you won, especially if they can demonstrate intent? (I'd argue that they should give you a bug bounty, but that's a different story)

To address your poker example - say I'm your guest in your hypothetical and, were we playing fair poker, your 1 in 100 odds were correct. Let's also say that I have undetectable X-ray vision contact lenses, thus changing the odds such that I will always win - would you really consider it unreasonable to use the government to get your money back in that situation? The agreement was to play poker, a game which necessarily presumes hidden information from all players. If one player has all the information, the game isn't poker anymore, it's robbery/con.

I agree that the computerized games are a different story, though I believe that consumers have some protection in the form of the various gaming commissions. If you win a jackpot and are denied the payout, contact the gaming commission! The laws are very strict on the points of fairness of those machines, forged in the fires of decades of mafia controlled casinos (at least in Vegas/Atlantic City).

Gambling is a drug. It has all the health benefits of a recreational drug, but at least in (most of) the US, it's not a scam.

https://knpr.org/knpr/2015-01/legal-or-not-card-counting-not...

https://www.google.com/search?q=casino+refuses+to+pay

Yes, sometimes casinos will use their political strength to not payout a jackpot (malfunction voids all play), but a player does, in fact, have some recourse if the casino is full of shit.

Regardless, if you're going to a casino intending to win a jackpot, you're doing it wrong (because math). If you take a measured approach and enjoy it for what it is (entertainment, not a way to make money), you'll have a much healthier relationship with a casino.

As an aside, there's another industry that uses it's massive political clout and every trick in the book to refuse to pay in situations where one would intuitively believe one should be payed: insurance.

I'm dubious that there is a per-machine fixed sum over a fixed time like this. Apart from the "progressive" machines that have a jackpot shared across a network of machines, I'm pretty sure that the payout percentage is just a statistical prediction, and that by law each result has to be independent of all previous payouts. Do you have a reference that you could point to that would confirm your understanding? The sources I've found say that each play is random: http://www.vegasslotsonline.com/faq/#random. You might be right, but I wouldn't want you or someone else to rely on this information if it's a myth.

Other interesting observations: the machines based on Windows XP Embedded crashed all the time, the Linux ones were fine.

The Linux ones from several mfrs used APNG for the slot machine graphics. This was my first exposure to animated PNGs in the wild. (~2007)

The Linux machines loaded a kernel module at boot that was supposed to prevent/detect tampering with memory. Some also loaded their own audio driver stack which surprised me: wasn't ALSA or OSS. Very odd, specialized little machines. (Many were Pentium 3 with totally custom motherboards due to strange peripherals)

Progressives cannot legally be removed from operation until someone hits the jackpot. (at least in my state)

In this sense wouldn't card games be a wiser bet than slot machines?

If you can count cards, and they don't use a continuous shuffler you can get this to as good as 0.1% in your favour.

http://wizardofodds.com/games/blackjack/calculator/

Baccarat is always a high stakes game not because it's "fancy" or "exotic", but because it is nearly the closest a casino will let you get to betting on a coin flip, for every player in the game.

Technically, additional decks reduce the expected edge of a card-counter who has only seen some number of cards. Which functions the same way...

For instance, playing black jack by the basic strategy is (from wizardofodds.com):

> the probability of an overall win in blackjack is 42.22%, a tie is 8.48%, and a loss is 49.10%. I'm going to assume you wish to ignore ties for purposes of the streak. In that case, the probability of a win, given a resolved bet, is 46.36%.

So yes, your best bet in the casino is probably blackjack, but it is still a losing proposition without counting cards. Face cards tend to favor the players (table), not the dealer. This is because a dealer hitting with a face card more frequently causes a bust than a player hitting a face card (because players don't have to hit when they might bust, dealers do). So a deck that is heavy with face cards is better for players.

Poker, by contrast, the house has no real interest in whether people win or lose - they just get a % cut of each hand played so they win a little every hand.

I disagree that the "system is designed to beat you" or that the casino "cheats". The casino is there for entertainment. If you don't use it in moderation it can ruin your life just like any other vice: alcohol, drugs, sex, etc.

If you have $1000-$5000 (or more), you can fly out to Vegas for the weekend, have a really good time (gaming is only part of that), fly home, and you've got a significant chance that you'll either win or break even. You might also lose, and that's the excitement cycle that is gambling. But even if you lose you can also have a good time at a show/nightclub/concert, every kind of themed bar, meet women, etc, so if you discard "winning money" as the primary objective, gambling isn't designed to beat you.

If you go to the casino every day after work, don't be surprised that you will not win anything, or that it might escalate just like any other drug (spending more, not happy when you win, etc).

What shocks me is that these guys have the technical prowess to reverse engineer the game/PRNG, but they didn't have the sense to slow down their pace, or reverse engineer the casino management system to avoid detection (or they didn't think to hide their iphone from the start, they said the first guy was holding it right up to the screen, when $100 spent on a clothing alteration would have allowed him to hide it). If you're going to fly internationally to commit a crime, you should know who you're up against and use adequate countermeasures.

FYI Vegas is built on rubes like you.

There is a larger chance you will lose money than break even or win money.

If there was not, Vegas would not exist and its business model would have failed a long time ago.

Their business model works because the House wins.

For the House to win and be profitable, the average person has to lose on average.

If you're going to have fun, that's a great experience, but if you think there's a "significant chance" you're going to not lose, you're exactly why Vegas does as well as it does.

It would be interesting to see what the likelihood of being up after an hour of regular play is by different common games.

In addition, games like poker aren't even played against the house; you're playing against the other players (and the house just takes a cut as a sort of "table fee"). If you're a skilled poker player, you can reduce the effects of luck (what cards you get vs. the cards others at your table get) and come out ahead more often than not.

And I'd agree that even a 30-40% chance of coming out ahead would be "significant"... people in the startup world still start new companies despite the conventional wisdom of a 10% success rate.

Having said that, sure, casino games are pure entertainment. Sure, you can win a little money, but you should never expect to, and you shouldn't play unless you're comfortable losing every cent you put into it.

The more independent small bets you make, the lower the chance that you will come out ahead.

The last time my wife and I were in Las Vegas, the only game we made money on was sports betting.

A slot machine with an expected per iteration loss of .1% and a modest 100 iterations/hour, would, over that same hour lose you (just) go over 9%.

vegas can afford to turn their hold percentage much lower because millions of people go there every year and there's competition. Versus a lone indian casino in california's central valley.

and if people always lost, vegas would collapse because people would stop going.

You could make the argument that any other expensive hobby is also throwing away money:

* boating: buy a brand new boat for $65k, sell it 8 years later for $35k, plus $5k in total operating costs/insurance. You just "lost" 35k (not counting interest)

* rock climbing: buy $3k of gear and travel, $2k on lessons. Fall and break your arm for $6k, $11k "lost" for a couple years of entertainment.

* "travel", spend $6-10k on hotel, airfare, meals, in 2 weeks, all we have left to show for it is "memories". Great "investment".

(disclaimer: I'm not actually against the things I just mentioned. Only pointing out that they are "throwing away money" just like a weekend in vegas). Unless you're some hyper-disciplined monk who only uses money for humble necessities, you, too are throwing away money just like people do in a casino.

These people are mostly wrong (save for the games of skill, e.g. poker, that are only played in casinos for traditional reasons.)

The games are setup to take a percentage. It varies with the game. Slots are some of the worst, IIRC the house take is 10%. Pai Gow poker (depending on house commission and exact rules) is 1%-3%.

If you make bets commiserate with the size of your gambling budget then your expected loss over the long term for slots is 10%. Your expected loss for Pai Gow is 1%-3%.

If you make larger bets than you should given your bankroll or play bad strategies you can lose a lot more. If you get lucky and quit immediately after a big win you can come out ahead.

The house doesn't give a fig if the average person loses or wins; they just need people to play. They are well aware a significant number of people will walk away winners and that makes them happy: it's great marketing!

[1] (pdf warning) http://gaming.unlv.edu/reports/nv_slot_hold.pdf

Yes pai gow or 21 or (the best odds not including card-counting, IIRC), baccarat have better odds. But, if you go to a premier casino on the strip, you might not find a table you can afford. It's not uncommon for them to have a couple $5 tables and the rest $25 (per bet) and up. Mathematically it's a better choice, but a $25 buy-in costs $500 which you can lose in minutes if you're unlucky. Not a lot of people can stomach that (nor should they, as my original argument was for the entertainment value of gaming).

I don't see any fraud though. Sure, they found a system to beat the slot machines, but I'm not sure how that's fraud. What if some guys think they're really good at playing poker and they take a trip to a casino to play?

At what point does playing smart become fraud? or cheating? When does counting cards in blackjack become cheating? When you get too good at it? This whole area seems rather strange.

Counting cards is a much better example of "playing smart", and it is not actually illegal - although casinos will ban any player they suspect to be counting they will likely not be charged with a crime. But once you bring a personal implement in to the situation, it very much becomes a prosecutable crime.

I understand that they may kick you out for being too good (he must be "cheating"). And the argument about using a device to aid you might be a more concise definition of cheating of some sort. But I've never noticed any posted rules that one would reasonably be expected to know about. And the use of the term "fraud" is important because then it becomes a legal issue with big consequences beyond getting kicked out or banned from a particular casino. OTOH a casino doesn't need to post the law for people to read. Does the law defer to the casino rules? That wouldn't be appropriate IMHO.

There are "house rules" and there are laws. I'm kind of wondering where those lines are and what specifically these guys did that constitutes a felony. What specific aspect of their scam was illegal. I'm not disputing that it was dishonest and in effect a scam of sorts.

[1]http://www.pandullolaw.com/Criminal-Defense/Trespassing.aspx

Depends on what they're doing to be "good". Things like card counting can and will get you banned from casinos (though that's more applicable to blackjack).

Advantage play is usually frowned upon but not outright illegal. I reckon exploiting bugs in a slot machine's PRNG really ought to be closer to that than "fraud". Hence, I'm surprised these Russians were charged with anything at all rather than just banned from various casinos as is more conventional for this sort of thing.

I guess the difference between "advantage play" and "fraud" in this case would be whether or not the culprits are breaking the rules of the game. It doesn't sound like they are, seeing as how they're not tampering with the machines.

Are you saying these people are innocent, and by some strange stroke of chance and luck, they all boarded a plane, flew across the world, and randomly won thousands of dollars ?

> would you want to take a chance with a jury or bench trial in a hostile (to you) jurisdiction?

hell yes I would. People love to rally behind the underdog and see the casinos lose. Look how much publicity the cases get when a machine malfunctions and displays $1,526,838,003.35 on the win meter, and like clockwork, they file a lawsuit to try to claim a billion-dollar payout.( they dont win, but still, people love to rally behind the plaintiff in those cases).

I'd say for the most part, the criminal courts are hostile to all defendants, not just by definition but by the "plea deal" schemes that prosecutors use and by the puritanical tendencies our society shows in their harsh punishments against "offenders" (viz. the drug war, sex offenses, gun charges, etc)

I think he's saying that they are not necessarily guilty beyond a reasonable doubt of the crime of fraud ("deliberate deception to secure unfair or unlawful gain"). Given the facts presented in the article, I don't think there's much debate to be had about whether they used devices to win at the slots. The question is whether the particular way they did it is (or ought to be) illegal in the jurisdictions they were in.

when you use an active device that essentially guarantees you will win. Elsewhere in the thread someone quoted the Nevada regulations that explicitly state this. I'm sure each state has them now. Had they arrested these guys and didn't find an iPhone with custom software, or a confession that they were remitting their winnings back to Russia, they probably wouldn't be able to charge them with anything (but they could still kick them out of all casinos).

Based on the article, it sounds like these guys were more like mules, than they were the masterminds. 90% of the money was sent back... And they rely on this remote system to figure out the next state. This software possibly could be run directly on the phone, but instead they want to keep a tether on the mules.

No one goes in a movie theater and complain that it's "beating" you because you come out with a net negative balance

https://www.youtube.com/watch?v=loFmADztvak https://www.youtube.com/watch?v=nzVr8-gHUN4

The tobacco industry got banned from using this sort of psychological advertising years ago, I don't see why casinos should be treated any different.

You're proving my point exactly. I never said there wasn't an insinuation that if you play you could win, just that there is no guarantee given. See my other reply for examples of non-casino businesses doing the exact same thing.

I never claimed otherwise. Did you read my post?

> Restaurants advertise in such a way that suggests you may have the absolute best night of your life and meet all sorts of new friends, that doesn't mean they are promising it.

I've never seen such an advertisement, nor have I heard of anyone putting up the deed to their house or the title of their car to pay for their restaurant habit.

Yes, I did. You said

>Movie theaters also don't advertise in such a way that suggests will walk out with a lot of money.

in response to someone comparing movie theaters to casinos. Your comment is obviously suggesting that you believe casinos advertise "in such a way that suggests will walk out with a lot of money".

>I've never seen such an advertisement

Check out any chain restaurant advertisement. Here is an example: https://www.youtube.com/watch?v=4CbVVq4GStc

>nor have I heard of anyone putting up the deed to their house or the title of their car to pay for their restaurant habit.

So you're changing the point from "they advertise in a misleading way" to "people can become addicted to it"? That is a different argument so I want to be clear if we're moving on from the original point.

> ... advertise in such a way that suggests will walk out with a lot of money

What you said:

> ... advertise that you will walk out with a lot of money either. Only that you might.

No one said casinos advertise that you will for sure walk out with a lot of money; my point was that they imply that you will walk out with a lot of money. The distinction seems obvious to me.

> So you're changing the point from "they advertise in a misleading way" to "people can become addicted to it"? That is a different argument so I want to be clear if we're moving on from the original point.

The point was never that casino advertisements are misleading, but other advertisements are honest; the point was that casino advertisements are misleading in ways that are ultimately life-ruining. For similar reasons, we hold cigarette and alcohol companies accountable for the content of their advertisements.

I don't see the difference between what I said you said and what you said. You were obviously saying they implied that someone will definitely walk out with money. That's what I said you said.

Sure, it would be better if it were truly a game of chance, I guess that's too difficult to deliver (and verify) at this point. Or, perhaps, the casinos prefer it this way of course. :)

Ohh but there were free drinks and the lighting was just so and it made me feel so good -- so clearly defrauding the place that made me feel that way, even when I rationally knew that was what was going to happen, is perfectly OK.

Are you also OK with stealing popcorn at the cinema because they manipulate you into feeling scared/happy/sad/whatever?

This is why we can't have nice things.

The theater house rule is that no outside food or drink is allowed, but clearly the only purpose of this rule is to support the brazen markup of food and drink at the theater's own concession stand.

I find it difficult to find any harm to the theater in eating smuggled popcorn rather than popcorn purchased on the premises, even when playing Devil's advocate as hard as I possibly can. My worst attempts even end up replacing 90% of the theater employees with a row of vending machines and a subway-style turnstile.

I have a friend who used to be a supervisor at movie theater, and he told me that ~80% of the theater's ticket proceeds went directly to the movie distributor. This is apparently normal in the movie industry.

If concessions went away, theaters would probably need to raise their ticket prices a lot. Even if you drastically cut the employees, there's still rent/taxes/insurance/cleaning. The last two could also conceivably go up in price if it became normal to bring in your own food.

economics of movie theatres: https://arstechnica.com/uncategorized/2006/01/5905-2/

- There is a state sanctioned minimum payout rate. This differs by state, but its between 80-90%. This means that on average you lose 80-90% of the $$$ you put in. - Slot machines cannot use conditional probability, in other words spins are independent. This means that the machine has no "memory" each spin is like rolling a dice. You dont have higher chance of payout just because you didnt won anything during the last hour.

I've worked for a big slots company and we analyzed our customers a LOT. The big players (AKA whales) who drop thousands per month are not bored rich people in 99% of the cases, they are average people like you and me with a bad gambling addiction. And the state or the casino companies are doing nothing to help these people (why would casino companies care? This is where they are most of their revenue from). This is totally different from other fields - imagine if cigarettes would be advertised as something that makes you healthy and the state would be OK with it.

Yes. Yes it is. That's why they say gambling is a tax on those who can't do math.

The machines are programmed to give out less than they take in. In the middle to long run, you are basically guaranteed to lose money.

For example the article states that the house keeps $0.07129 for every dollar spent, or put another way, for every $100 coming in, the machines need to pay out ~$93.

Therefore, you can expect to lose on average $7 for every $100 you spend on slots.

But it's LEGALLY wrong. That is what will get you into trouble.

In certain countries, it's not morally wrong to criticize The Dear Leader. But it is legally wrong and could get you beat to a bloody pulp and thrown in prison. Other countries have not yet implemented such policies.

Moral and Legal are different things.

Casinos are in the business of providing entertainment through games that sometimes allow you to win money.

If you put money into a PacMan machine, you don't get your money back either. You get entertained by playing the game.

If you go to a movie, you pay money that you don't expect to have returned. You pay for entertainment.

When casinos host Texas Hold'em, they simply collect a vigorish from the pot. The casino is not otherwise involved in the poker hands.

Why should they be? It's a form of entertainment not a way to generate income successfully through skill. If the odds weren't stacked against you I think it would get boring quite quickly as the wins wouldn't be as satisfying.

You don't get upset when you go to a whale show and get wet do you? You don't get upset when you go watch rally racing and get some mud on you?

Conspiring with others to break terms of service is of course a crime, and doing so across state lines, is its own sort of nastyness. But you can see from the prison terms (2 years) it wasn't exactly a big threat to these guys.

however defeating a legal system should still hold a penalty unless said defeat exposes an illegal setup

You know it is designed to beat you, you accept the terms and conditions by entering a casino. Which makes you, if you think it is OK to cheat then, a criminal by law and unethical by any standards.

It's as random as much it can be made so in that range of 2,147,483,647? I'm not a programmer I'm not sure how a stop symbol or blank is chosen when programming a slot theme.

Newer slots are 64-bit and have larger virtual reels.

Some slots now even use a product called quantum randomness supposedly true randomness. https://comscire.com/

Based on the article it seems that the flaw is that the machine uses the timing of human interaction as a significant seed source. This works well enough for unaware people, but as evidenced here is super easy to exploit once the knowledge is out there. Using time (e.g. the time the program started) as the PRNG seed is a very common security flaw. Otherwise experienced engineers keep making this mistake even in 2017.

This way, the spins are selections from a stream. If you take a number of samples you can guess the position in the stream and then calculate the most advantageous time to run another spin. The inputs are probably read on a 60hz timer anyway so you can predict which time you're going to get within a few ticks.

We can probably agree that PRNG is a function that takes an input and produces an output. I guess you take issue with me calling this input the seed. My use is probably a simplification indeed, but I thought one that doesn't change any principles. Because the user's interaction timing is crucial, it seems pretty clear to me that the exploit is about influencing the input of the PRNG. We can call this input something else, e.g. internal state. Or we can call it the seed.

The successful electronic slot machine hacks in the last 35 years have all involved either measuring internal machine states or modifying the machines.

In this case, the machines were modified to allow profitable play. This is done either to sell the machines to naive casinos (which is what the Russians did in this case) or to casino managers who use them to skim (the manager's confederates win money which need not be reported to casino owners or tax authorities).

Another practice is to modify machines to extract the maximum amount from players, exploiting behavioral tendencies, rather than giving random payouts as required by regulation in most jurisdictions. Advantage gamblers sometimes discover these machines and use the knowledge to play profitably. But it's not enough to observe a few dozen outcomes, you need to know something about how the payoffs are structured.

You won't find these machines in Nevada, because (a) the regulators are smart and powerful and (b) the place is too big a gold mine to risk over small increases in slots revenue. But there are lots of places with inattentive or weak regulators, in which slots is the whole ball game.

Sort of random since it's pseudo random number generator but there is a specific payback percentage chosen. It's like PRNG up to a point then it's not otherwise how can you give out 96% over 10 million spins if it's truly random.

I'm a slot tech but I don't work with PAR sheets we're purposely kept at arms length for a reason.

There's little to no excuse for these slot machines not including at least a crude quantum noise collection circuit. Collecting quantum noise in a circuit is nothing exotic and only requires a hand full of transistors and a couple of capacitors. I'm a bit sad that ARM didn't include a quantum noise instruction in the basic arm64 instruction set.

On a side note, it's a shame that WiFi and BlueTooth chipsets don't all have a linear feedback shift register accumulating radio noise. They're already measuring noise and detecting bit errors. With only a few extra transistors, they could be made to expose radio noise to the kernel for use in /dev/urandom and friends.

Timing doesn't have to be perfect - only enough to offset the house edge.

> So even if they understand how a machine’s PRNG functions, hackers would also have to analyze the machine’s gameplay to discern its pattern. That requires both time and substantial computing power

I would have guessed that the CPU requirements to process the video and map it against the PRNG characteristics would be a bit much for a smartphone, but given how powerful they are these days, that may well be flawed assumption.

Interesting how the core of an article gets explained with a few sentences given a small amount of background.

>7. To manipulate, with the intent to cheat, any component of a gaming device in a manner contrary to the designed and normal operational purpose for the component, including, but not limited to, varying the pull of the handle of a slot machine, with knowledge that the manipulation affects the outcome of the game or with knowledge of any event that affects the outcome of the game.

In general you are not allowed to do anything clever in a casino. It isn't stated as such, but the actual crime is winning consistently. If you walk into a casino certain that you will not be providing the house with their cut then you will almost for sure run up against some law. Extra laws will be generated as required by the governments involved.

Seems like you are free to believe in any fantasy about you having an edge over the house, except when that belief happens to be true. The mere thought of having a streak of luck would make winning illegal. If thoughtcrimes were animals, this would be a cute little kitty.

This is a pretty common pattern in "intent" crimes. As a simple example: attempted murder requires a potentially-effective plan. Shooting at someone and missing is attempted murder, burning a voodoo doll of them is not - no matter how sincerely you expect it to work.

It does produce an odd situation where stupidity becomes a legal defense, but the basis for it is pretty understandable. It's not criminalizing being right, it's decriminalizing being wrong, presumably because it's too hard to define the boundaries of whether something useless was done with real intent.

Lets say I am completely mistaken about how chemistry works and I think that adding salt to wine will somehow make it a deadly cocktail. With intent to kill you I make such a concoction and serve it to you.

In that case I should still be able to be punished under the law.

It's right in a game-theory sense, but not a practical one. Proving intent to a jury is based on circumstantial evidence. Shooting a gun at someone is strong evidence of intent to murder because it is widely known that guns are lethal. Countering the weight of that evidence would require very convincing evidence that the shooter did not believe his actions would be lethal. Proving that someone believed burning a voodoo doll would be lethal would be very difficult since it is widely known that burning voodoo dolls is not lethal. Even apparent evidence that the voodoo practitioner had a genuine belief is easily played off as an act, and in criminal law, the benefit of the doubt goes to the defendant.

There's also the matter of people having mistaken beliefs about the probability of punishment.

It does seem like the sort of thing that ought to be illegal somehow, but I'd need an actual expert's input on what charges they would seek for that.

Where I live, many bars have 8 line slot machines that are ostensibly "For Amusement Only" but they pay out when people win (and if they know you).

If you win too much, you'll be banned from playing.

Just knowing when to raise your bet does a lot to tip the odds in your favor.

I actually did something like that once. A store I visited put a link to a survey on its receipt with an offer of $10 off any one item on completion. I completed the survey on my phone, which displayed a barcode they could scan and selected a sub-$10 item. The receipt for my free item had a link to a survey....

I limited myself to a few items I actually had a use for. They would have been well within their rights to cut me off after a while, but certainly not to have me charged with a crime.

" NRS 465.075  Use or possession of device, software or hardware to obtain advantage at playing game prohibited.  It is unlawful for any person to use, possess with the intent to use or assist another person in using or possessing with the intent to use any computerized, electronic, electrical or mechanical device, or any software or hardware, or any combination thereof, which is designed, constructed, altered or programmed to obtain an advantage at playing any game in a licensed gaming establishment or any game that is offered by a licensee or affiliate, including, without limitation, a device that:

      1.  Projects the outcome of the game;

      2.  Keeps track of cards played or cards prepared for play in the game;

      3.  Analyzes the probability of the occurrence of an event relating to the game; or

      4.  Analyzes the strategy for playing or betting to be used in the game,

      (Added to NRS by 1985, 970; A 2011, 216; 2013, 1317)"

Funny the article gave independent confirmation of about how much you could take out of a casino without them noticing; an important number if you ever develop a scheme.

Bingo. :-)

> I know you are allowed to use those blackjack cheat cards at the tables in Las Vegas but what if I started using a calculator and my own crazy algorithm? Is that fraud?

They're not really "cheat" cards: even with a perfect strategy, blackjack still has a (very small) house edge. That's why casinos have no problem with you using them. And if you brought your own, hand-written, crazy algorithm the casino would probably let you play with it - because chances are it's much worse than the perfect strategy the printed card uses (a lot of blackjack players operate under the principle that the previous player's actions influence the game and adopt some pretty stupid strategies as a result).

However, the casino almost certainly wouldn't let you use a calculator, because they'll think you might be using it to count cards. That's why you can't use a phone at the table. Ditto for this:

> What if I had an ear piece and hidden camera glasses to stream video to some blackjack guru outside in a van?

...but the casino would certainly let someone next to you give you advice or help, because unless that person is counting cards they're still going to have a house edge (and it's pretty easy to tell when someone is counting, because you'll start making plays that would otherwise be in the house's favor).

Note that counting cards in blackjack isn't fraudulent in most cases - it's just one the casino cottons on that you're doing it they'll ask you to leave or stop playing. Outright fraud in blackjack would involve something like having the dealer in on the scheme, or using a marked deck of cards.

And maybe not even then. With the incomplete mitigations that casinos already put in for card-counting (multiple decks, etc.), card-counting is tricky and has a very small edge. Consequently, just as casinos know they make money from people with "strategies" with no statistical validity, they know they make money from people who think they can count cards well enough to get an edge but who can't.

Make an error or two (vs. perfect counting strategy), and they'll let you keep going, because long-term they'll still have an edge. Count/play perfectly and you'll get backed off or 86'ed.

It's well known that when you're counting cards, there is always a swing to when the player has an advantage. If you're upping your bets when you have the advantage, and then lowering them when the house has the advantage, they'll usually stop you from playing at the blackjack tables and either ask you to leave, or tell you to play something else where they have the advantage, like slots.

I assume casinos use infinite shoes now so it's not even an issue?

Obviously errors aren't sustainable, since the edge is so small, but I wonder if it might be possible to open with an error so you can stick around a little longer before someone checks back in and bars you. More broadly - are counters these days trying not to get noticed, or trying not to get banned?

It really depends on what type of game you are trying to cheat if you are avoiding detection or avoiding a ban. With slot machines, if they think you are up to any mischief, you will face legal issues. As for cards, the casino is going to be aware of your activities if they have any inkling of things like card counting. The dealers know what to look for and you will be watched. The casino is just trying to make sure you don't take too much from them but they also want you to keep winning, it makes others around you think they have a chance too. Make a few mistakes here and there and you delay the moment when they tell you to get lost for the night. You will get noticed so your only option is to just avoid getting banned.

The one actually doing the counting can play haphazardly and consistently lose money but they will covertly signal the partner who comes in with big bets when the situation is advantageous. The big better plays until the count favors the house again and then walks away. The counter keeps at it until the odds are again against the house and then they'll signal the next big better to come in and so on and so on until they win their set amount and move on to the next casino.

It's not illegal. It's not unethical. It's merely unprofitable for the casino and they'll ban you if they figure out that you're doing it.

It will, if you're a world famous gambler:

https://news.ycombinator.com/item?id=13226725

Isn't card counting mitigated with modern shufflers that produce an entirely fresh deck at the start of each play?

In this case it's debatable to what extent they're deceiving anyone, but more importantly all they're doing is pressing the slot button at the optimal time, which is kind of the point of the game. Now most people wouldn't consider this 'fair', but for a legal argument that is a bit vague, even if it might be enough to say, disqualify someone from a tournament.

Under Nevada gaming law it's not vague - the law might be invalid, but varying slot timing is explicitly banned.

Pulling the lever at a time you know to be right still sounds like using it for its normal operational purpose to me. Slot machines are designed to have their levers pulled, even when they will pay out as a consequence.

If they don't want a time-able system they should remove the feature that lets you stop the wheels. Of course they never will because selective enforcement is profitable so we should remove their legal protection and make them treat everyone equally.

But I'm not sure where the line is either... would writing down results from a roulette wheel in a notebook be cheating? If not, why is recording the results of a slot machine?

If you've been to Vegas, casinos tacitly encourage this by showing the last 100 spins of the roulette wheel and displaying "statistics" about the numbers that have or haven't frequently come up. Of course, this is all garbage because at 100 spins that's nowhere near enough to formulate any kind of statistical theory.

"Roulette - Biased Wheels and Wheelhead Speed - Casino News Daily"

I read the cached version, its an advisory for casinos about how to look out for biased wheels. I'll look again tonight when I get home.

http://www.gambling-stories.com/2014/03/joseph-jaggers-roule...

Hilariously, in some casinos, they actually hand out notebooks and pens for that purpose.

I get that it's "cheating", but I really don't care. Not at all. When predators get preyed upon it's funny. I only wish they were taken for more.

For all this "play responsibly" talk, we know that they survive on those who don't, and the last thing they want is for the addicted to wise up. So I have as much sympathy for them as for street-corner drug dealers and I'm sorry our rules protect them.

https://vimeo.com/169617086

Fun fact: §263a StGB (German penal code) was in part created to combat this kind of externally assisted prediction for slot machines. It is now punishable with up to five years in prison, if you just create or distribute the software up to three years.

Cannot resist to reference an older perspective (from Smoke Bellew):

http://www.online-literature.com/london/smoke-bellew/4/

http://catless.ncl.ac.uk/Risks/15/80#subj2

Montreal -- Daniel Corriveau said he hopes that his 'victory over the system will give hope to others.' The computer analyst and his family received more than $620,000 [1C$ = U$0.75], including interest, from the Montreal casino yesterday, weeks after they overcame odds of one in six billion and beat an electronic keno game three times in a row."

The author explains the following key points:

o Corriveau used an "antique 286" computer to analyse 7,000 combinations from the keno game, [which uses an electronic pseudo-random number generator].

o Corriveau noticed that the electronic game was repeating numbers in a predictable pattern.

o Corriveau and several family members bet on what they predicted would be due to come up; they won three times in succession.

I had originally seen an article speculating someone power cycled a keno machine after recording the winning numbers, with the assumption or knowledge that the random number generator reseeded with a 0 on cold boot. I'm not sure if that's just me mis-remembering the details of this case, or another one altogether. If anyone has a link to the second case please let me know.

This is likely to be because they're trying to avoid the automatic W-2G that's generated for slot winnings over $1200. Basically if you're playing anonymously on a slot machine, any payout of $1200 or over on a single spin will generate a human interaction. Unless you're playing at fairly high stakes (say, over $100/spin), this is normally rare enough that hitting several $1200+ results in a short time span would be very suspicious. Keeping every win under $1200 allows a person to play as anonymously as you reasonably can in a casino.

A hardware RNG is actually pretty cheap to make, there are actually open source (as in the circuit diagrams are available) ones floating around the internet that you can build for less than $20 worth of parts. The manufacturers probably don't want to go that far because a) compared to most of the parts in the machine it's a fairly expensive piece so it will cut into profits, b) hardware RNG function a bit different from a PRNG so properly integrating one requires a certain amount of skill, c) it isn't their problem really, they already got their money, it's the casinos that are losing, and d) it's simpler to just prosecute the handful of people doing this (for now).

For gambling purposes, probably makes sense to use cryptographically secure PRNG :-)

[1] http://www.pcg-random.org/predictability.html

I disagree with the characterization of the crews as "cheaters". They didn't cheat. They turned a game of chance into a game of skill, then excelled at that skill. Of course this has happened to other games as well, such as with card counting in blackjack, which is also inaccurately described as cheating when it's actually mastery of the game.

Why don't slot machines use true random numbers? They could still skew the results however they like.

A secure PRNG can be made trivially.

Now, implement it on a system from 2008 whose source and tooling has been scattered to the winds.

The encryption community has dealt with this issue for a long time and there are a lot of useful approaches, and many ways to fail.

  >  If I know the PRNG and the encryption then I can predict the outcome of the encrypted PRNG.

This is one of those cases where if they knew what they where doing the PRNG would be fine as is. So, you can't just and wave some undefined encryption scheme and assume they will implement it correctly.

Hash those 100,000 states, compare the output of those hases to the observed output to find the actual PRNG state. Then always know the hashed output of the PRNG.

PS: Read https://en.wikipedia.org/wiki/Cryptographic_hash_function Now if each machine used it's own hidden salt then that would be a real option. But, cryptographic hash does not imply an unknown salt.

I am pointing this out because the assumption is a poor PRNG used by incompetent team in the first place. Saying just do X, when it's possible to do X and still have a problem is not an actual solution. It's equivalent of saying just be competent.

It should be legal to burn money also because people love doing it at a swanky place like casinos. At least you won't see people get addicted to dousing your cash with gasoline and throwing a cigarette at it.

I just thought of it and it seems quite exhilarating at the prospect....but it is safer and less addictive than gambling in casinos.

This just goes to show that despite the money the casinos are losing to this Russian group, they are still making so much money off the people they are cheating that it's not worth fixing the problem.

Why our governments protect the jerks who steal money from the less intelligent members of our society is beyond me. That there are laws that support casinos is no justification. Casinos are themselves a scam and should not be protected against scammers at the expense of tax payers.

In Sweden casino gambling, and other types of gambling, is owned by the state. The state keeps the money from the gamblers. It is like an extra tax that people can choose by themselves. In Spain it is similar for Lottery, it moves a lot of money in Christmas and the state keeps the profits. Any country can achieve similar results applying high taxes to gambling.

I think that forbidding gambling is an error, as it just moves it to more unsafe locations and opens good business for criminal organizations. Standards that regulate gambling are a better solution, it reduces gambling addiction creating less attractive gambling games, it forbids to loan money to gamblers while they are playing (that is really important), and in general keeps gambling in check.

Disclaimer: I have worked in the gambling industry, and I will probably do it in the future.

"These guys were right to do it". I think the edge exists because it's ultimately illegal. I think it's tantamount to an illegal distribution of cash from a casino to a mob. Would it be any different if they hacked their bank account?

I once became an investor on a BitCoin gambling site. The operator let you either gamble, the normal route, or invest and receive a share of the payout. He was extremely clear about the house edge.

I went into the chat room and asked people: why do you gamble if you know the odds are against you. The most canonical answer I received:

"Maybe I believe my luck has an edge on the house"

  Aristocrat, Novomatic, and any other manufacturers whose PRNGs have 
  been cracked “would have to pull all the machines out of service
  and put something else in, and they’re not going to do that.”

  as long as older, compromised machines are still popular with customers,
  the smart financial move for casinos is to keep using them and accept
  the occasional loss to scammers.

Could you prove that the extra entropy added to the PRNG pool would not change the limits? Bigger challenge: could you present it in a way that a regulator would agree with you?

Not to mention full regression testing on the statistics of the game. You would have to "re-prove" the validity of the RNG , which requires another QA cycle, statistical expert, and game designer (to ensure that the frequency and distribution of wins matches the specification sheet)

But what would be the difference with other casino software bugs then, are those also "Unfixable" then?

If they are related to money, they pull the machine out of the field until a new software version is fixed. A gaming company I used to work at had an issue with multi-jurisdictional machines that worked in Mexico but could display english or spanish. The machines could also change denomination, say from $0.05 to $0.25. There was some bug where if you reset the power, you could get it to bump your credits up from 20 nickels to 20 quarters (or might have been 20 pesos to 20 cents), it was something dramatic and easily exploitable that was fixed promptly.

[0] https://www.amazon.com/Art-Intrusion-Exploits-Intruders-Dece...

Seems like this is easy for the scammers to work around. They could calculate the average time it takes for the scammer to lift his hand from his lap and press the button, and then use that time instead of .25 seconds. Would be less successful, but would seem to be almost impossible to detect.

I knew some of the people involved and actually saw some of the code if anyone's interested.

https://en.wikipedia.org/wiki/Michael_Larson

https://news.ycombinator.com/item?id=9570713

If the scammers get too big the casinos will replace the compromised machines and the scam ends. The scammers seem to know this: they are targeting more an more casinos around the world in an apparent effort to make sure it is worth the risk.

Actually you don't need hardware random number generators. There is enough variance in human input to feed a cryptograhic random number generator. The code to add this probably wouldn't be that hard to write (they might be 8 bit CPUs or some such limit that makes it impossible though). However all code changes have to be certified by regulatory bodies (for good reason) which makes it not worth the effort to fix old machines.