One of the biggest lottery scams in the history of the US is coming to a close as the mastermind behind the operation has pleaded guilty in an Iowa court, at the end of last month.
Eddie Tipton, 54, admitted to creating malware in the form of a DLL file, which he loaded on the secure computers of the Multi-State Lottery Association (MSLA), a company that runs lotteries in 33 states, but also in the District of Columbia, Puerto Rico and the U.S. Virgin Islands.
Tipton was able to do this because he served as the company’s computer information security director in its Urbandale, Iowa headquarters, and was one of the five persons that had access to those computers, situated in the “draw room.”
Tipton used a DLL to hijack RNG algorithm
According to officials, Tipton uploaded the DLL file on secure computers that were charged with randomly choosing winning tickets for MSLA’s various draws.
These computers were housed in a secure room with 24-hour security camera surveillance, but prosecutors said Tipton was able to go around this inconvenience by altering the surveillance system so that cameras would record only one second for each minute.
Investigators suspect that this gave Tipton the time he needed to insert a USB thumb drive into MSLA’s computer and upload a malicious DLL file.
Investigators said this DLL was identical to the original one found on the computer, except two code blocks.
The extra code allowed Tipton to hijack the standard random number generator (RNG) algorithm and produce predictable winning numbers if the lottery draw took place on three days of the year (May 27, November 22, and December 29), on two particular days of the week (Wednesdays or Saturdays), and after a certain time of day (after 20:00).
This malicious DLL also contained code that would delete the file after a certain period of time. Nonetheless, investigators were lucky as one of these files failed to self-delete.
Tipton used a network of intermediaries to cash in prizes
Once Tipton had this system in place, he recruited two friends to cash out winning tickets. The first was Tommy Tipton, 53, his brother, a former Texas magistrate judge and police officer; and Robert Rhodes, a Texas businessman and Tipton’s former colleague at an IT company. These two cashed in winning tickets themselves but also recruited other intermediaries.
Tipton admitted that his scheme allowed him to provide winning numbers for his two accomplices for lottery draws in Colorado, Iowa, Kansas, Oklahoma, and Wisconsin.
The group operated since 2005, but they made a mistake in 2011 when they repeatedly tried to cash in a winning Hot Lotto lottery ticket of $16.5 million in Iowa. The winning ticket was from the from the December 29, 2010, draw.
State rules dictate that all lottery winners must be made public, but Rhodes and a few accomplices repeatedly tried to cash in the ticket anonymously or through intermediaries. Iowa officials suspected that something was wrong and started an investigation, which eventually led to formal charges.
Tipton faces 25 years in prison
In July 2015, Tipton pleaded guilty to two counts of fraud and was sentenced to ten years in prison, but Iowa’s Supreme Court overturned his conviction.
As new evidence surfaced on how Tipton planned and executed his attack, new charges were brought forward. In late June 2017, Tipton signed a multi-state plea agreement, admitting to his role in the entire scheme. A day later, Tipton’s brother pleaded guilty to two counts of conspiracy to commit theft.
Before the guilty plea, the Tipton brothers and Rhodes were under investigation for rigging and cashing in winning tickets in three other cases:
December 2007 – $783,257 Megabucks prize in a Wisconsin Lottery draw
November 2011 – $1.2 million Hot Lotto prize in an Oklahoma Lottery draw
Tipton faces up to 25 years in prison for his role in the hacking scheme. A judge also ordered that Tipton should pay $1.4 million in restitution, while his brother should pay $800,000. The money represents the sum authorities managed to prove the two were able to cash in from winning lottery tickets across five states.
Source:https://www.bleepingcomputer.com/news/legal/man-pleads-guilty-to-manipulating-lottery-winning-tickets-via-hacked-computer/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
