The Art of Intrusion: The Real Stories Behind the Exploits of Hackers, Intruders and Deceivers by Kevin D. Mitnick, William L. Simon Read Free Book Online Page B

pulled. "The reason is they don't want to publicize that they have these vulnerabilities," Alex explains. So it's usually, "Get out of town before sundown. And if you agree never to set foot in a casino again, then we'll let you go."

    Aftermath About six months later, Marco received a letter saying that charges against him were not being pressed.

    The four are still friends, though they aren't as close these days. Alex figures he made $300,000 from the adventure, part of which went to Larry as they had agreed. The three casino-going partners, who took all Chapter 1 Hacking the Casinos for a Million Bucks 19

    the risk, had initially said they would split equally with each other, but Alex thinks Mike and Marco probably took $400,000 to half a million each. Mike wouldn't acknowledge walking away with any more than $300,000 but admits that Alex probably got less than he did.

    They had had a run of about three years. Despite the money, Alex was glad it was over: "In a sense, I was relieved. The fun had worn off. It had become sort of a job. A risky job." Mike, too, wasn't sorry to see it end, lightly complaining that "it got kind of grueling."

    Both of them had been reluctant at first about telling their story but then took to the task with relish. And why not -- in the 10 or so years since it happened, none of the four has ever before shared even a whis- per of the events with anyone except the wives and the girlfriend who were part of it. Telling it for the first time, protected by the agreement of absolute anonymity, seemed to come as a relief. They obviously enjoyed reliving the details, with Mike admitting that it had been "one of the most exciting things I've ever done."

    Alex probably speaks for them all when he expresses his attitude toward their escapade:

    I don't feel that bad about the money we won. It's a drop in the

    bucket for that industry. I have to be honest: we never felt morally

    compromised, because these are the casinos.

    It was easy to rationalize. We were stealing from the casinos that

    steal from old ladies by offering games they can't win. Vegas felt

    like people plugged into money-sucking machines, dripping their

    life away quarter by quarter. So we felt like we were getting back

    at Big Brother, not ripping off some poor old lady's jackpot.

    They put a game out there that says, "If you pick the right cards,

    you win." We picked the right cards. They just didn't expect any-

    body to be able to do it.

    He wouldn't try something like this again today, Alex says. But his rea- son may not be what you expect: "I have other ways of making money. If I were financially in the same position I was in then, I probably would try it again." He sees what they did as quite justified.

    In this cat-and-mouse game, the cat continually learns the mouse's new tricks and takes appropriate measures. The slot machines these days use software of much better design; the guys aren't sure they would be suc- cessful if they did try to take another crack at it.

    Still, there will never be a perfect solution to any techno-security issue. Alex puts the issue very well: "Every time some [developer] says, 20 The Art of Intrusion

    `Nobody will go to the trouble of doing that,' there's some kid in Finland who will go to the trouble."

    And not just in Finland but in America, as well.

    INSIGHT In the 1990s, the casinos and the designers of gambling machines hadn't yet figured out some things that later became obvious. A pseudo random number generator doesn't actually generate random numbers. Instead, it in effect warehouses a list of numbers in a random order. In this case, a very long list: 2 to the 32nd power, or over four billion numbers. At the start of a cycle, the software randomly selects a place in the list. But after that, until it starts a new cycle of play, it uses the ensuing numbers from the list one after the other.

    By reverse-engineering the software, the guys had obtained the list. From any known point