Investigating Gaming Fraud: The Hustler Casino Live Scandal

The standard investigating procedure for our gaming clients typically involves specialized forensic software for analyzing servers and desktops, analyzing logs, and more. Something that is covered by certifications and academia very well and follows a written procedure. However, to investigate a wide variety of ways to cheat, including radio signaling devices, rigged card shufflers, and capturing RFID playing cards remotely, not to mention unique methods never thought possible, the tactics are not covered in any books or classes. This is where a White Hat Hacker comes into play, and this is what separates Bulletproof from others in the gaming industry. Our Security Research Division has diverse expertise not only in gaming but in dealing with the new, the unknown, and a wide range of technologies.

One of the most popular theories as to how Lew pulled off this controversial win was that the RFID playing cards were being read by the player through her ring or water bottle on the table. This is where our investigator, Principal, Security Research & Development, Scott Melnick began, and one of the first theories he debunked. Read on to learn more, in Melnick’s own words.

One of the services we perform at Bulletproof for all types of clients is physical penetration (pen) testing against one method of sneaking into buildings where employee RFID access badges are captured with a special cloning device. One such device that is currently making news headlines is the Flipper Zero and of course, the poker community latched onto that instantly. Going into the investigation, I knew this wasn’t possible.

Why? Reading RFID, specifically the MiFare Ultralight that the poker cards used, takes a very close proximity of around 10cm to capture. But when the stakes are this high and the scandal this public, just knowing this information is not enough. For a public report that will reach thousands of viewers, a scientific method must be used.

With the scientific method, I must not only research what I know to be true but research counterarguments as well.

After a thorough analysis of many different possible ways cheating could have been accomplished, and after reviewing all the data from standard forensic images, and investigating hypotheses on strange ways to cheat, and even some new ways he discovered were possible, Melnick could not determine conclusively if cheating occurred. He issued a report summarizing his findings and outlining a course of action for HCL to further tighten its security controls and broadcast booth.

Bulletproof has more than 20 years of experience securing the gaming and lottery industry. Our Research and Development department handles cases such as catching and investigating internal fraud, examining foreign electronic devices found in your organization, software and hardware reverse engineering, and testing advanced security. As stated in the HCL report, “With security practices and policies, there should always be a balance between security and usability.” The experts at Bulletproof are here to help you find that balance. To learn more about how Bulletproof can help you with these projects, complete the contact form below.