News for hackers. Stuff that matters.

A comment on ‘Jackpotting’ Attacks Hit U.S. ATMs. Parent comment

Re:‘Jackpotting’ Attacks Hit U.S. ATMs by jacquesm on Sunday January 28, 2018 @12:30PM (#16252166)
Except that that is not allowed. It's individual machines tested in isolation that should perform exactly as legally mandated. The only kind of remote interaction there is is logging to make sure they can prove that the machine performed as advertised and to know when to empty the coin box.
[ Parent | on HN ]
Re:‘Jackpotting’ Attacks Hit U.S. ATMs by fjsolwmv on Sunday January 28, 2018 @12:53PM (#16252319)
Modern slot machines don't use just local rngs, they essentially obtain lottery tickets from a central computer. That's how you get building-wide jackpots.
[ Parent | on HN ]
Re:‘Jackpotting’ Attacks Hit U.S. ATMs by xg15 on Sunday January 28, 2018 @02:23PM (#16252910)
But that's the point. If the provision lets me withhold part of the source code from inspection, there is no way to actually verify that I don't do that.

I could hide the above manipulations in some component I don't have to expose and have the machine play nice under testing conditions. (See certain automakers for examples)

[ Parent | on HN ]