Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Possibly, existing kiosks are registered by MAC address in the API. By querying the API for registered kiosks, you can pretend to be one by spoofing the MAC


I wonder if Casino's run their machines, etc on the same network as guests are on at the hotel, etc...

I'd think they'd at least isolate the networks to at least make things a bit harder... Maybe you could be sneaky and unplug an ethernet cable and plug in a device but apparently, the eye in the sky would catch you, and end up in serious trouble.

I know some probably have apps to check your rewards, etc but that probably would run on the public internet with some sort of proxy into their private databases.

I'm not really into gambling, the family took me once when I turned 21 and was kinda boring. I just waited around while everyone else played video pocket. Free Mt. Dew though...

Also, all the woman seem to wear something to show off their breasts more, I guess more tips... So stereotypical like you'd see on television.

At least they banned smoking in casinos, I guess in the old day's people would be smoking right next to you. Oh, Google'd it and it seems like they allow it in Vegas at the casino and bar, just not restaurants. Wow. I believe in my state it's a standard ban inside completely of any public building.

Also, reports of Atlantic City dying now since more and more states have allowed Casino's to open. I seem to associate gambling with Vegas though over any other city.

I wouldn't mind going to just play the slots someday again, but really not into wasting money right now.


I still don't understand it, TCP/IP doesn't transmit MAC addresses. Your knowledge of it ends at the next router... Therefore you definitely can't authenticate/authorize by MAC address.


> Therefore you definitely can't authenticate/authorize by MAC address.

I would be entirely unsurprised to see that the device is calling out to the API with it's MAC address as some kind of authenticator.

eg: http://foo.example.com/api/prizes?id=xx:xx:xx:xx:xx


I've used quite a few systems where the MAC address is used as a secondary password to verify that someone didn't just steal the hard drive out of a kiosk.


I thought of this. But the OP stated that the traffic is unprotected making this security measure moot.


Exactly, and then the stored MAC is exposed in its un/or-poorly-authenticated API




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: