Lottery official alleged to have deployed self-destructing rootkit via USB drive to tamper w RNG, scoring $14m ticket

asswipe · April 8, 2016

Prosecutors suspect man hacked lottery computers to score winning ticket
Former security director may have tampered with number generator to win $14.3M.

Prosecutors say they have evidence indicating the former head of computer security for a state lottery association tampered with lottery computers prior to him buying a ticket that won a $14.3 million jackpot, according to a media report.

Eddie Raymond Tipton, 51, may have inserted a thumbdrive into a highly locked-down computer that's supposed to generate the random numbers used to determine lottery winners, The Des Moines Register reported, citing court documents filed by prosecutors. At the time, Tipton was the information security director of the Multi-State Lottery Association, and he was later videotaped purchasing a Hot Lotto ticket that went on to fetch the winning $14.3 million payout.

In court documents filed last week, prosecutors said there is evidence to support the theory Tipton used his privileged position inside the lottery association to enter a locked room that housed the random number generating computers and infect them with software that allowed him to control the winning numbers. The room was enclosed in glass, could only be entered by two people at a time, and was monitored by a video camera. To prevent outside attacks, the computers aren't connected to the Internet. Prosecutors said Tipton entered the so-called draw room on November 20, 2010, ostensibly to change the time on the computers. The cameras on that date recorded only one second per minute rather than running continuously like normal.

"Four of the five individuals who have access to control the camera's settings will testify they did not change the cameras' recording instructions," prosecutors wrote. "The fifth person is defendant. It is a reasonable deduction to infer that defendant tampered with the camera equipment to have an opportunity to insert a thumbdrive into the RNG tower without detection."

Tipton has pleaded not guilty to all charges, and his attorney has said the theory about computer tampering isn't "factually viable."

On December 23, a little more than a month after Tipton allegedly tampered with the computers, a man at a convenience store was video taped buying a Hot Lotto ticket that later won the $14.3 million payout. Authorities identified the man as Tipton, but as an employee of the association that administered the lottery, he was barred by law from buying lotto tickets or claiming lottery prizes. The winning ticket went unclaimed for almost a year. Hours before it was scheduled to expire, a company incorporated in Belize tried to claim the prize through a New York attorney. In January, Tipton was charged with two counts of fraud. The allegations that he used his insider access to tamper with the RNG were first made in the court documents filed last week.

Besides the event in the draw room on November 20, prosecutors offered other evidence supporting the theory Tipton tampered with Hot Lotto computers. The former security director "was 'obsessed' with root kits, a type of computer program that can be installed quickly, set to do just about anything, and then self-destruct without a trace," prosecutors wrote. They went on to say a witness would testify at trial that Tipton told him before December 2010 that he had a self-destructing rootkit.

The trial had been scheduled to start Monday, but it was delayed before jury selection could get underway after defense attorneys asked for a continuance. The trial is now scheduled for July 13.

http://arstechnica.com/tech-policy/2015/04/prosecutors-suspect-man-hacked-lottery-computers-to-score-winning-ticket/