Predicting a Slot Machine's PRNG

Wired is reporting on a new slot machine hack. A Russian group has reverse-engineered a particular brand of slot machine — from Austrian company Novomatic — and can simulate and predict the pseudo-random number generator.

Slot machines probably inspire so many cheating attempts simply because of the volatile gameplay they offer. When winners can come few and far between, and losing by session’s end is a statistical certainty barring a big jackpot, grinding the slots can get downright depressing in the worst of times.
This is another invention for hacking gambling machines excellent in its simplicity. The coin is attached to a thin wire. A scammer inserts it into the slot receiver and pulls it out as soon as the device registers the insertion of the chip. So, the cheater can endlessly play for just one chip.

Dan from Communication Group 34 takes you through the rules and mathematics of Casino slot Machines!Hub Video: https://www.youtube.com/watch?v=bOl-ycNvSE. Knowing the secret arithmetic that a slot machine uses to create pseudorandom results isn’t enough to help hackers, though. That’s because the inputs for a PRNG vary depending on the temporal state. If one knew the pRNG formula and knew where the pRNG was in the sequence, one could predict the numbers returned by the pRNG function. This scenario may seem far-fetched, but slot cheats known as RNG cheats have been able to cheat slots using knowledge of the RNG function.

The cell phones from Pechanga, combined with intelligence from investigations in Missouri and Europe, revealed key details. According to Willy Allison, a Las Vegas-based casino security consultant who has been tracking the Russian scam for years, the operatives use their phones to record about two dozen spins on a game they aim to cheat. They upload that footage to a technical staff in St. Petersburg, who analyze the video and calculate the machine’s pattern based on what they know about the model’s pseudorandom number generator. Finally, the St. Petersburg team transmits a list of timing markers to a custom app on the operative’s phone; those markers cause the handset to vibrate roughly 0.25 seconds before the operative should press the spin button.

“The normal reaction time for a human is about a quarter of a second, which is why they do that,” says Allison, who is also the founder of the annual World Game Protection Conference. The timed spins are not always successful, but they result in far more payouts than a machine normally awards: Individual scammers typically win more than $10,000 per day. (Allison notes that those operatives try to keep their winnings on each machine to less than $1,000, to avoid arousing suspicion.) A four-person team working multiple casinos can earn upwards of $250,000 in a single week.

The easy solution is to use a random-number generator that accepts local entropy, like Fortuna. But there’s probably no way to easily reprogram those old machines.

Posted on February 8, 2017 at 6:48 AM • 31 Comments

In the late ’80s, a real game-changer took place in casinos that would forever change the landscape and opportunities in the gambling industry. Slot machines went from being mechanical devices to being electronic devices.

In order to provide randomness and bigger payouts, a new computerized process was introduced that utilized a random number generator (RNG). The RNG is an algorithm programmed into the machine that is designed to generate a large sequence of numbers or symbols that cannot be reasonably predicted.

The use of computers and RNGs is now common in the gambling industry as a means of providing randomness for various games. In casinos, RNGs are used to determine results on slot machines, keno ball drawings and card dispersion from automatic shuffle machines. RNGs are also used in online gaming and state lottery operations.

Arguably, RNGs are a big reason for the continued success and growth of the gambling industry worldwide, and the reliance on them does not appear to be waning with the increased demand for computerized and hybrid electronic table games.

So What’s The Problem?

Random number generators are not random. They’re “pseudo random number generators,” or PRNGs. The outcomes generated by a PRNG are deterministic. The PRNG constantly generates a sequence of simulated random numbers at high speeds. As soon as the “Play” button is pressed, the most recent random number is used to determine the result. This means that the result varies depending on exactly when the game is played.

All PRNGs must eventually repeat their number sequence, so in theory, if players had access to the PRNG code and seed value, they could possibly predict future results. And that’s exactly what has happened.

Incidents of players using RNG prediction techniques started to surface not long after computerized slot machines entered the casino market. In 1993, computer engineer Leo Weeks was caught in the Horizon Casino in Lake Tahoe using a wearable computer he designed to predict royal flushes on IGT Fortune I video poker machines. Weeks obtained a Fortune I machine and reverse-engineered how the random number generator worked to create his device. It is not known how Weeks obtained the Fortune I, but it is possible he just purchased one, because the Fortune I was an extremely common type of machine at the time.

The Fortune I used a system which many modern video poker and slot machines still use. The internal random number generator in the machine cycles constantly, so the player’s results depend on exactly when the player presses the button on the machine. To use his device, Weeks would play a Fortune I machine and enter the values of the cards dealt to him into the device. This enabled the device to synchronize with the cycles of the random number generator in the Fortune I machine. Weeks’ device would then beep through a hidden earphone to tell him exactly when to push the button on the machine to get a royal flush.

When Weeks was caught, an electronics engineer/computer programmer working for the Nevada Gaming Control Board, Ron Harris, was able to reverse-engineer Weeks’ device and show how it worked. Based partially on Harris’ demonstration, Weeks pleaded guilty. Weeks received no jail time, and only had to serve 200 hours of community service in addition to paying back the money he won.

Harris was responsible for finding flaws and gaffes in software that runs computerized casino games. It turns out that he took advantage of his own expertise, reputation and access to source codes to illegally modify certain slot machines to pay out large sums of money when a specific sequence and number of coins were inserted. From 1993 to 1995, Harris and an accomplice stole thousands of dollars from Las Vegas casinos, accomplishing one of the most successful and undetected scams in casino history.

Toward the end of his stint, Harris shifted his focus to keno, for which he developed a program that would determine which numbers the game’s pseudo random number generator would select. In January 1995, Harris used a program to enable an accomplice to win $100,000 on an Imagineering Systems electronic keno game in Atlantic City.

This was a traditional keno game with paper slips, but used a computer to select the numbers. His accomplice went into the casino to play the game while Harris stayed upstairs in a hotel room where he could read the keno numbers on the TV and enter them into his computer. Once Harris had entered around 10 numbers, he ran his program to predict the next likely set of numbers the keno computer would pick.

However, Harris could only predict the outcome with 3 percent accuracy. Harris relayed these numbers to his accomplice, who used an algorithm they had worked out to put possible permutations of the numbers on 10 different keno slips, raising chances of selecting the correct number to 30 percent. Unfortunately for Harris and his accomplice, they hit the top jackpot the very first time he played, which had never been done before. The resulting attention caused the authorities to become suspicious, and eventually they arrested Harris and his accomplice.

Pie in the Sky

Another team of unnamed players used similar devices and purportedly won around $1 million from various Las Vegas casinos in the early 1990s. The team, inspired by a book published in 1985 about a roulette prediction computer team called the E

Cracking Prng In Slot Machines