Yeah, I've hear as much before. That's one of the things that makes this worse, these cabinets are (were?) a loophole that allows fleecing people without oversight. It's not like gambling is in your favor when you do it at a casino, but you can usually trust that the state has kept it from being egregiously unfair.

> checking the EEProms MD5 Hash* to make sure that it was in a list of 'approved' code hashes.

> This was 15 years ago, I -really- hope they use something better nowadays.

I dunno. If the hash is generated and displayed by the hardware on a separate LCD display (or a serial you attach) and maybe a bit of non-flashable code, that seems pretty good to me, especially that it's regularly spot checked in person. Something like that is far harder to fake and fool real people with successfully for an extended period, IMO.