Online Gambling and the Lurking Security Threat

                                                              

 

Online Gambling is an industry seemingly ripe for the picking in regards to extortion attempts by those seeking to cash in on the industry’s growing fortune.  Traditionally, as big events such as the Superbowl approach, online casinos brace themselves hoping for the best as they too gamble in a different sense.  Indeed, at any moment an online casino could receive an e-mail stating a myriad of undesirable outcomes that could befall them, unless a large amount of money is deposited in a particular anonymous account.  Like all gambling, the online casinos are playing a numbers game, optimizing their chances for success, while trying to minimize any potential security weaknesses that hackers may try to exploit.  

 

According to gaming analysts River City Group, estimated revenues for online gaming reached more than 7 billion dollars in 2004; an amount that is simply too enticing a target for some less savory individuals to ignore. Currently, there are approximately 350 companies that run over 1700 gaming sites.  This provides these individuals with a multitude of targets, as they “feel out” the various casinos, probing them for potential security lapses.  Then, much like a predator in the animal kingdom, they choose the weaker ones to extort. 

 

One of the principle problems in regards to the gaming industry’s response to this threat is that the industry itself is largely unregulated.  Many of the online gaming corporations are based offshore in countries whose police and law enforcement capabilities are less than stellar to say the least.  Without the option available to pursue the extortionists located thousands of miles away in any meaningful way, many online casinos feel pressure to pay.

 

The security firm Symantec reported in its recent Internet Security Threat Report that e-commerce was the most targeted industry in regards to cyber-attacks.  Further, Symantec found that the number of bots available to hackers is growing steadily, from two thousand a day in early 2004 to 30,000 a day in late September of 2004.  Indeed, the threat is only growing as the FBI 2004 Computer Crime and Security Survey determined that aside from viruses, denial of service (DOS) attacks caused more financial losses than any other cyber-security security breach.  There are numerous variations of DOS attacks. Yet they either over tax the processing power of the servers of the gaming sites or completely jam the pipelines. However, the end result is the same with digital gridlock ensuing.  This effectively shuts down all communications between the sites and their customers, shortly followed by a payment demand for the ability to continue their online service.

 

Surprisingly, one source of the extortion is one that might not readily be thought of when pondering online casino tampering; the Russian mafia.  In fact, the FBI has stated that Russian crime syndicates have extorted millions of dollars from online gaming corporations by hacking into their websites and shutting down their ability to operate.   Often unable to pursue their distant attackers, losing money by the minute, and fearful that they will lose profitable accounts as gamblers scramble to place their bets elsewhere with a functioning online casino, many casinos simply pay to make the problem go away.  It is this time-specific nature of online gambling that in fact makes it so susceptible to attack.  Whereas someone looking to purchase something from an online store may return to make a purchase later if the site is experiencing technical difficulties, a gambler must get his bet in now, before the sporting event takes place, the line changes, etc. 

 

The issue of how online casinos respond to these attacks is complicated.  Firstly, under the 1961 wagering act it is illegal for Americans to place bets for monetary gain over wire transfer.   Since many online casinos owned by American entrepreneurs are technically illegal, fighting back becomes very difficult indeed, as police and government agencies do not put helping illegal gambling enterprises high on their list of priorities. Another hindrance is that the computers the hackers use are usually not their own, so tracing the internet protocol addresses can prove quite worthless and time consuming.

 

However, there are some success stories.  Last November, British police arrested and charged 10 suspects in Latvia with collecting payments from British gaming sites. Online gambling is legal in Britain, and this is why the country's National Hi-Tech crime unit leads the global hunt for cyber-criminals.  On the technology front, service companies like Porticullis and DigiDefense International provide a tech-box that diverts attacks onto their own networks, where technicians can filter out the malicious messages.

 

Ultimately, to stop these extortion attacks owners of sports books and online casinos must network together.  They must further their collective efforts in expending money on technology defense as well as expand their cooperation with law enforcement to fight back and not give in to demands by online extortionists.

 

 Matthew Alan Freer,  January 2005