Commercial Casino Resort
A real-world purple team engagement inside a land-based commercial casino resort | Fully anonymised | ISO 17025 accredited methodology
ISO 17025 accredited · MITRE ATT&CK v15 · Conducted under explicit written authorisation.
Sector
Commercial Casino
Engagement
Purple Team Exercise
ATT&CK Tactics
MITRE ATT&CK v15
Location
United States
Purple Team Case Studies — Gaming & Lottery
ISO 17025 Accredited
MITRE ATT&CK v15
Conducted under explicit written authorisation
Confidentiality Notice: These case studies are anonymised; any resemblance to specific organisations is coincidental.
CASE STUDY GAM-CS-01
Player Account Takeover & Financial Fraud Simulation — Commercial Casino Resort
Testing casino cage, digital wallet, and player loyalty programme security under realistic attack conditions
Organisation
A commercial casino resort with 4,200 slot machines, 180 table games, and an integrated hotel, spa, and entertainment complex (anonymised)
Sector
Gaming — Commercial casino resort, land-based
Location
United States — Commercial gaming jurisdiction
Engagement
Purple Team Exercise — Player Account Takeover, Financial Systems, and Cage Security Simulation
Duration
6 weeks (2-week scoping, 2-day exercise, 2-week remediation and reporting)
Frameworks
| GLI-11 | GLI-33 | Gaming Commission Minimum Internal Control Standards | PCI DSS v4.0 | MITRE ATT&CK Enterprise v15 | NIST CSF 2.0
Core Challenge
A state gaming commission examination had flagged concerns about the resort’s player account security following an industry-wide pattern of account takeover fraud. The commission required an independent adversarial test of the loyalty programme portal, digital wallet, and cage redemption controls before licence renewal.
The engagement needed to determine whether an attacker who compromised a single player account could escalate to financial fraud, whether the cage’s internal controls would detect fraudulent redemption, and whether the SIEM would identify coordinated account takeover patterns before significant losses occurred.
Engagement Phases
External Attack Surface Mapping
Enumerated all internet-facing systems associated with the resort brand. Found:Â 3 loyalty portal hostnames, 2 API subdomains, 1 mobile app API gateway, and 14 third-party integrations (hotel booking, restaurant reservations, entertainment ticketing). Identified 6 API endpoints with no authentication requirement returning partial player account data including tier status and point balances.
Player Account Credential Attack Simulation
Tested loyalty portal credential defences against realistic attack techniques. Found: no CAPTCHA on login endpoint, no rate limiting after 50 failed attempts, no account lockout. Credential stuffing simulation using a 10,000-entry synthetic dataset achieved a 3.2% success rate — the equivalent of 3,200 compromised accounts in a 100,000-member programme.
Account Takeover and Privilege Escalation
From a compromised loyalty account, tested whether an attacker could modify redemption details, add bank accounts, or escalate to tier status manipulation. Found: email address and redemption destination could be changed without secondary authentication. Password reset flow used a 6-digit numeric token sent to the original email — brute-forceable in under 4 minutes with no rate limiting.
Digital Wallet and Points Redemption Testing
Tested the digital wallet integration for race conditions and double-spend vulnerabilities. Found:Â a race condition in the points redemption API allowed the same point balance to be redeemed twice when two requests were submitted within a 200ms window. Simulated loss on a single account: $847 in duplicate gift card redemptions before the transaction system reconciled.
Casino Cage Internal Controls Testing
With the cooperation of the cage manager (purple team exercise), tested whether cage staff procedures would detect a fraudulent redemption scenario using a compromised high-tier account. Found:Â cage staff verified photo ID but did not cross-reference the account's registered address or flag the account modification timestamp from 47 minutes prior. The fraudulent redemption of $4,200 in chips was completed without detection.
Detection and Response Validation
Tested whether the SIEM, fraud monitoring system, and gaming commission reporting workflows detected coordinated account takeover at scale. The fraud monitoring system was calibrated for individual transaction anomalies, not coordinated account modification patterns. Simulation of 50 simultaneous account takeovers generated no automated alert.
MITRE ATT&CK Detection Results
| ATT&CK ID | Technique | Detection Result |
|---|---|---|
| T1110.004 | Credential Stuffing (Loyalty Portal) |
NOT DETECTED
No rate limiting or stuffing pattern detection on login endpoint. |
| T1212 | Exploitation for Credential Access (Reset Token Brute-Force) |
NOT DETECTED
No rate limiting on token validation endpoint. |
| T1531 | Account Access Removal (Email Modification) |
NOT DETECTED
No alert on account detail modification without secondary authentication. |
| T1657 | Financial Theft (Race Condition Double-Spend) |
NOT DETECTED
Transaction system reconciled after the fact. No real-time prevention. |
| T1485 | Data Destruction (Account Modification Audit Trail) |
Partial
Audit log captured changes but no alert triggered on modification. |
| T1078 | Valid Accounts (Compromised Cage Redemption) |
NOT DETECTED
Cage procedure did not flag account modified 47 minutes prior to redemption. |
| T1588 | Obtain Capabilities (Credential Stuffing List) |
DETECTED
Threat intelligence feed flagged synthetic credential list domain after 18 minutes. |
Outcomes
| Metric | Before | After |
|---|---|---|
| Loyalty portal rate limiting | None — unlimited attempts | Rate limiting deployed: 5 attempts, 30-minute lockout |
| Account modification authentication | Email change with no secondary auth | MFA required for all account detail changes |
| Digital wallet race condition | Double-spend possible within 200ms window | Idempotency key implemented — race condition eliminated |
| Cage redemption controls | No cross-reference of modification timestamp | Cage system flags accounts modified within 24 hours for supervisor review |
| SIEM fraud detection | Individual transaction focus only | Coordinated account takeover detection rule deployed |
| Gaming Commission report | Not produced before engagement | Independent test report submitted for licence renewal examination |
| PCI DSS scope | Partial — wallet API excluded from scope | Full PCI DSS v4.0 scope confirmed; remediation items logged |
“
We assumed our fraud monitoring was looking for the right things because it had caught individual cases before. What we had not built was any detection for coordinated account takeover — the attack that costs ten times more because by the time you notice, it is already across hundreds of accounts. The cage finding was the hardest conversation we had with our compliance team, because it showed us that our paper controls and our operational controls were not the same thing.
Chief Compliance Officer, Regional P&C Carrier (anonymised)
Test your casino security before your gaming commission does
Strengthen your cybersecurity posture and protect your organization from evolving threats. Discover how GLI Secure reduces risk, simplifies compliance, and protects customer trust.