Incident: Exploitation of Video Poker Machine Firmware Bug for Profit.

Published Date: 2013-05-07

Postmortem Analysis
Timeline 1. The software failure incident where two men took advantage of a software bug in a video poker machine happened in 2009 [18941].
System 1. IGT's Game King video poker machine firmware [Article 18941]
Responsible Organization 1. The software failure incident was caused by a firmware bug in IGT's Game King video poker machine, which allowed the individuals to exploit the bug and win a small fortune at video poker [18941].
Impacted Organization 1. Las Vegas prosecutors [Article 18941]
Software Causes 1. Exploitation of a firmware bug in IGT's Game King video poker machine that allowed the players to play back a prior winning hand at ten times the original value [18941].
Non-software Causes 1. Exploitation of a firmware bug in the IGT's Game King video poker machine [18941] 2. Alleged fraudulent scheme involving wire communications [18941]
Impacts 1. The impacts of the software failure incident included the dropping of hacking charges against the individuals who exploited a software bug to win at video poker, ending an 18-month legal battle over the applicability of the Computer Fraud and Abuse Act [18941].
Preventions 1. Proper testing and quality assurance procedures during the development of the video poker machine software could have potentially identified and fixed the firmware bug before it was exploited [18941]. 2. Implementing stricter security measures to prevent unauthorized access or exploitation of software vulnerabilities could have helped prevent the incident [18941]. 3. Regular software updates and patches to address known bugs and vulnerabilities could have mitigated the risk of such exploits [18941].
Fixes 1. Implementing a software update or patch to fix the firmware bug in IGT's Game King video poker machine that allowed the exploit to occur [18941].
References 1. Andre Nestor 2. John Kane 3. Assistant U.S. Attorney Michael Chu 4. U.S. District Judge Miranda Du 5. Kane's lawyer, Andrew Leavitt 6. 9th Circuit ruling

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident related to the exploitation of a software bug in video poker machines by John Kane and Andre Nestor happened at multiple casinos in Las Vegas. Kane discovered a firmware bug in IGT's Game King video poker machine that allowed him to replay a previous winning hand at a higher value. Nestor joined Kane in exploiting the bug at a string of casinos in Vegas, and Nestor later used the bug at a casino in Pennsylvania as well [18941]. (b) There is no specific mention in the provided article about the software failure incident happening again at other organizations or with their products and services.
Phase (Design/Operation) design, operation (a) The software failure incident in the article is related to the design phase. The incident occurred due to a firmware bug in IGT's Game King video poker machine that allowed the individuals to exploit the bug and win a significant amount of money at casinos [18941]. (b) The software failure incident in the article is also related to the operation phase. The individuals involved allegedly exploited the bug in the video poker machine by performing a complex sequence of button presses during the operation of the machine to trigger the bug and increase their winnings [18941].
Boundary (Internal/External) within_system (a) The software failure incident in this case can be categorized as within_system. The incident involved a firmware bug in IGT's Game King video poker machine that allowed the individuals to exploit it for financial gain. The bug was within the system of the video poker machine itself, enabling the players to replay a prior winning hand at a higher value [18941].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in this case was primarily due to non-human actions. The incident occurred because of a firmware bug in IGT's Game King video poker machine that allowed the individuals to exploit it for their advantage [18941]. The bug enabled the players to play back a prior winning hand at ten times the original value, leading to significant winnings. The defense argued that the players simply played by the rules imposed by the machine, indicating that the bug was a non-human factor that allowed them to exploit the system. (b) Human actions also played a role in the software failure incident. The individuals involved in the incident, John Kane and Andre Nestor, actively exploited the firmware bug in the video poker machine to win money. They were accused of conspiracy to commit wire fraud, indicating that their actions were a key contributing factor to the failure [18941]. Additionally, the prosecutors initially charged them with hacking under the Computer Fraud and Abuse Act, highlighting the human element in the exploitation of the software bug.
Dimension (Hardware/Software) software (a) The software failure incident in the article was not due to hardware issues but rather due to a software bug that allowed the individuals to exploit a firmware bug in the IGT's Game King video poker machine [18941]. The incident was related to the exploitation of a software vulnerability rather than any hardware-related factors.
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident in this case was considered non-malicious. The incident involved two men who took advantage of a software bug in a video poker machine to win a significant amount of money at casinos. The prosecutors dropped the hacking charges against them, and the remaining charge was conspiracy to commit wire fraud [18941]. The defense argued that the individuals were simply playing by the rules imposed by the machine and did not engage in hacking activities with malicious intent.
Intent (Poor/Accidental Decisions) unknown (a) The intent of the software failure incident was related to poor_decisions. The incident involved two men who took advantage of a software bug in a video poker machine to win a significant amount of money at casinos. Prosecutors initially charged them with hacking under the Computer Fraud and Abuse Act (CFAA), but later dropped those charges. The defense argued that the actions of the individuals were within the rules imposed by the machine, indicating that the software bug was exploited based on the machine's design rather than through hacking ([18941]).
Capability (Incompetence/Accidental) accidental (a) The software failure incident in the article was not due to development incompetence. The incident involved two men who took advantage of a software bug in a video poker machine to win a significant amount of money. The defense lawyers argued that the men only played by the rules imposed by the machine, indicating that the failure was not due to incompetence in development [18941]. (b) The software failure incident in the article can be categorized as accidental. The two men stumbled upon a firmware bug in the video poker machine that allowed them to exploit it for significant winnings. The incident was not intentional but rather a result of accidentally discovering the bug in the system [18941].
Duration temporary (a) The software failure incident in this case was temporary. The incident involved a software bug in IGT's Game King video poker machine that allowed the individuals to exploit it to win a significant amount of money. The bug was not a permanent issue but rather a specific vulnerability that was exploited by the individuals involved [18941].
Behaviour value (a) The software failure incident described in Article 18941 can be categorized as a value failure. The incident involved a firmware bug in IGT's Game King video poker machine that allowed the individuals to effectively play back a prior winning hand at ten times the original value, resulting in them winning a significant amount of money [18941].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (property) The software failure incident described in the article resulted in financial consequences for the individuals involved. John Kane and Andre Nestor were able to exploit a software bug in a video poker machine to win a significant amount of money, with Nestor alone winning $400,000 in winnings [18941]. The legal battle that ensued focused on charges related to hacking and wire fraud, indicating that the software failure incident had financial implications for the individuals involved.
Domain entertainment (a) The failed system in the incident was related to the entertainment industry. The software bug allowed individuals to exploit a video poker machine at casinos to win a significant amount of money [18941].

Sources

Back to List