How to Secure Gaming Machine Operation Data From Tampering and Unauthorized Access
Gaming machine operation data includes revenue figures, payout records, player behavior statistics, configuration settings, and error logs. This data is valuable to the operator for business analysis and to attackers for covering their tracks after a compromise. Securing the data from tampering and unauthorized access requires a layered approach: physical security, data integrity protection, access control, and audit logging of data access events. This article explains how to implement each layer.
Layer 1: Physical Security of Data Storage
The machine’s data is stored on a physical medium — a hard drive, a memory card, or an internal flash chip. Physical security prevents unauthorized physical access to this storage medium. Install a lock on the cabinet panel that provides access to the storage medium. Use a tamper-evident seal in addition to the lock — the seal breaks when the panel is opened, providing visible evidence of unauthorized access. Photograph the seal daily as part of the external inspection checklist. If the seal is broken, investigate immediately. The physical security layer is the foundation — if an attacker can physically access the storage medium, they can bypass all software-based protections.
For venues where the machine is in a publicly accessible area, use a cabinet with a high-security lock (a tubular lock or a dimple lock that is difficult to pick). Avoid standard cam locks which are easily opened with generic tools. The lock upgrade costs 20-50 dollars per machine. For high-value machines, consider a cabinet with an electronic lock that logs each opening event with a timestamp and the key or code used. The electronic lock provides an access log that is stored in the machine’s audit trail — any unauthorized opening is recorded.
Layer 2: Data Integrity Protection
Data integrity protection ensures that the data has not been modified after it was recorded. The two most effective methods are write-once memory (WOM) and cryptographic hashing. WOM stores data on a chip that cannot be overwritten — the data can be read but not modified. Cryptographic hashing calculates a hash value (a digital fingerprint) of each data record and stores the hash separately from the record. If the record is modified, the hash no longer matches and the modification is detected.
Implementation: for WOM, install a WOM module on the machine’s mainboard at the audit trail output (as described in the previous article). For cryptographic hashing, configure the machine’s firmware to calculate a SHA-256 hash of each audit record and store the hash in a separate memory area or send it to a remote server. Verify the hashes periodically (weekly) by recalculating the hash of stored records and comparing against the stored hash values. Any mismatch indicates data tampering. The integrity protection layer detects tampering that bypasses the physical security layer.
Layer 3: Access Control for Data Retrieval
Access control restricts who can view and export the machine’s operation data. The machine’s service menu (where the data is accessed) should be protected with a password — not the default manufacturer password, which is widely known. Change the password to a strong password (12 or more characters, mixed case, numbers, and symbols). Store the password in a password manager — do not write it on a sticky note attached to the machine. Limit knowledge of the password to the operator and one backup person. If the machine supports multiple user accounts with different permission levels, configure accounts so that venue staff can view revenue data but cannot modify or export audit trails.
For machines with network connectivity and remote data access, configure the firewall to allow data access only from specific IP addresses (the operator’s office, the remote server). Block all other inbound and outbound connections except the data replication connection to the authorized remote server. The access control layer prevents remote attackers from accessing the machine’s data over the network. For machines without network connectivity, the access control is physical — the machine’s data port should be disabled or locked when not in use for maintenance.
Layer 4: Audit Logging of Data Access Events
Audit logging records every event where the machine’s operation data was accessed — viewing the service menu, exporting data to USB, connecting a laptop to the data port, or accessing data remotely over the network. The log includes the timestamp, the user or device that accessed the data, and the type of access (view, export, modify). Review the access log weekly. Any access event that is not associated with a scheduled maintenance or data review is unauthorized and requires investigation.
Implementation: the machine’s firmware must support access logging (many newer machines log service menu access; older machines may require a firmware update). For network-accessible machines, configure the network firewall or the machine’s network service to log all connection attempts. Store the access logs on the remote server (along with the replicated data) so that an attacker who compromises the machine cannot delete the access logs. The audit logging layer provides the evidence needed to investigate unauthorized access and to identify the timing and method of the compromise.
Frequently Asked Questions
Q: Do I need all four layers for every machine?
A: Layer 1 (physical security) is mandatory for every machine. Layer 2 (integrity) is recommended for machines with revenue above 200 dollars per day. Layer 3 (access control) is recommended for all machines. Layer 4 (audit logging) is recommended for machines with network connectivity or for high-value machines where forensic evidence is important. The appropriate layers depend on the machine’s value, location, and connectivity.
Q: How much does the four-layer security cost per machine?
A: Layer 1: 20-50 dollars (lock upgrade). Layer 2: 30-80 dollars (WOM) or 0 dollars (hashing, if firmware supports it). Layer 3: 0 dollars (password change and network configuration). Layer 4: 0 dollars (if firmware supports logging) or 10-50 dollars per month (cloud log storage). Total: 50-130 dollars per machine plus optional monthly costs. This is less than the revenue loss from one month of data tampering on most machines.
Q: Can an attacker bypass all four layers?
A: A sophisticated attacker with physical access, technical skills, time, and knowledge of the specific machine model can potentially bypass all four layers. However, the four layers significantly raise the attack cost — the attacker needs more time, more skills, and more specialized equipment. Most attackers are opportunistic and will move to an easier target when they encounter layered security. The four layers deter the majority of attacks and significantly delay sophisticated attacks.