Risk
7/2/2008
07:07 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

High-Tech Card Cheat Pleads Guilty

One of the devices used by the group was a wireless transmitter to anticipate the cards players would be dealt, according to a Justice Department indictment.

Between March 2003 and July 2006, the Tran Organization -- a group of high-tech card cheats -- scammed casinos around the country for about $7 million. On one occasion, they made $868,000 in about 90 minutes.

On Tuesday, the U.S. Department of Justice said that Son Hong Johnson, one of the members of the group, had pleaded guilty to cheating casinos around the country. He is the 11th defendant to plead guilty out of 13 individuals named in an indictment returned on May 22, 2007.

One of the defendants, Han Truong Nguyen, was sentenced in May to 27 months in prison and ordered to pay $1,896,659 in restitution. The remanding defendants await sentencing. Johnson is scheduled to be sentenced in December.

According to the indictment, the group would bribe card dealers at casinos to create a false shuffle that returned a group of cards to the deck in a known order. This "slug" of cards enabled Tran members to anticipate the cards players would be dealt.

One member of the group would act as "card recorder" and would note at least some of the cards dealt during the course of play. "During mini-baccarat games, the card recorder usually would record the value of the cards on a paper form the casino provided to mini-baccarat players in the normal course of play," the indictment said. "In blackjack games, the card recorder would use a hidden transmitter or microphone and a cellular telephone to relay the order of the cards to an enterprise member or associate, who would enter the order of the cards into a computer program loaded with a specially designed card tracking computer program."

One of the devices used by the group was a wireless transmitter purchased from the Spy Shops of the U.S. and Canada. The indictment does not specifically name the device used, but it may have been what the site calls the wireless in-ear cellular communicator ($950), which is designed for covert communication.

The group didn't always win. Indeed, the indictment said that the group sometimes lost intentionally to deflect suspicion. In addition, members sometimes made mistakes in the execution of their scheme, resulting in losses.

Members of the group often cashed out with gambling winnings of less than $10,000 to avoid federal reporting requirements.

Still, they weren't careful enough. The indictment does not specify how the group was finally identified and caught, but it may have had something to do with an attempt to fleece the Imperial Palace Casino in Biloxi, Miss., that went awry.

In June 2006, one of the defendants attempted to bribe an undercover agent at the Imperial Palace. That's the sort of misstep that's likely to bring unwanted attention from law enforcement authorities.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4793
Published: 2014-12-27
The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to execute arbitrary ASP.NET code via a crafted SOAP request.

CVE-2013-5958
Published: 2014-12-27
The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a si...

CVE-2013-6041
Published: 2014-12-27
index.php in Softaculous Webuzo before 2.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in a SOFTCookies sid cookie within a login action.

CVE-2013-6043
Published: 2014-12-27
The login function in Softaculous Webuzo before 2.1.4 provides different error messages for invalid authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of requests.

CVE-2013-6227
Published: 2014-12-27
Unrestricted file upload vulnerability in plugins/editor.zoho/agent/save_zoho.php in the Zoho plugin in Pydio (formerly AjaXplorer) before 5.0.4 allows remote attackers to execute arbitrary code by uploading an executable file, and then accessing this file at a location specified by the format param...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.