iGaming Platform
A real-world purple team engagement inside a multi-jurisdiction online casino | Fully anonymised | ISO 17025 accredited methodology
ISO 17025 accredited · MITRE ATT&CK v15 · Conducted under explicit written authorisation.
Sector
iGaming
Engagement
Purple Team Exercise
ATT&CK Tactics
MITRE ATT&CK v15
Location
United States
Purple Team Case Studies — Gaming & Lottery
ISO 17025 Accredited
MITRE ATT&CK v15
Conducted under explicit written authorisation
Confidentiality Notice: These case studies are anonymised; any resemblance to specific organisations is coincidental.
CASE STUDY GAM-CS-03
API Security, Bonus Abuse, and Licence Jurisdiction Testing — iGaming Platform
Testing player-facing APIs, bonus engine integrity, and multi-jurisdiction regulatory notification capability
Organisation
A B2C iGaming platform licensed in 7 jurisdictions including UKGC, Malta Gaming Authority, and three US state iGaming licences (anonymised)
Sector
Gaming — iGaming, online casino, licensed across multiple jurisdictions
Location
Multi-jurisdiction — Gibraltar HQ, US state operations
Engagement
Purple Team Exercise — API Security, Bonus Engine Integrity, and Responsible Gaming System Bypass Testing
Duration
8 weeks (3-week scoping, 3-day exercise, 2-week remediation and reporting)
Frameworks
UKGC Licence Conditions and Codes of Practice | MGA Remote Gaming Regulations |Â GLI-33 | OWASP API Security Top 10 2023 | PCI DSS v4.0 | MITRE ATT&CK Enterprise v15
Core Challenge
The platform had received a UKGC information notice following industry-wide concerns about bonus abuse and responsible gaming system bypass techniques being shared on dark web forums.
The engagement required testing four specific areas: whether the bonus engine could be manipulated by a sophisticated player to extract value beyond documented limits; whether the responsible gaming self-exclusion system could be bypassed using account duplication techniques; whether the platform’s multi-jurisdiction API served the correct regulatory configuration to each jurisdiction without cross-contamination; and whether a compromised employee account could access player financial data across all seven licence jurisdictions simultaneously.
Engagement Phases
API Architecture Mapping and Jurisdiction Segmentation Testing
Mapped all player-facing APIs across 7 licence jurisdictions. Found:Â a shared API gateway served requests for all jurisdictions using a single tenant configuration. The jurisdiction parameter was passed as a client-side header rather than enforced server-side. Testing confirmed that a UKGC-jurisdiction session could access MGA-jurisdiction player data by modifying the header value. This was a cross-jurisdictional data isolation failure.
Bonus Engine Integrity Testing
Tested the bonus engine for race conditions, stacking vulnerabilities, and parameter manipulation. Found:Â (1) a race condition in the welcome bonus activation allowed double-claiming with simultaneous requests; (2) bonus wagering requirements could be partially bypassed by exploiting a rounding error in the wagering calculator; (3) the bonus engine accepted retroactive wagering contributions from game types explicitly excluded in the bonus terms when the game was loaded via the API rather than the UI.
Responsible Gaming Self-Exclusion Bypass Testing
Tested whether self-excluded players could re-register using variation techniques. Found:Â the self-exclusion matching used name and date of birth only. Testing with variations of the self-excluded test account (middle name added, date transposed) bypassed the check in 4 of 6 attempts. GAMSTOP integration was active for UK players but not verified for non-UK EU players on the MGA licence.
Employee Account Privilege and Cross-Jurisdiction Access Testing
From a compromised customer service representative account (lowest privilege), tested lateral movement to financial data. Found:Â the CS representative role had read access to player financial transaction records across all jurisdictions, not just the jurisdiction they were assigned to. This was undocumented and inconsistent with the stated data access policy.
Payment Processing and Fraud Detection Testing
Tested the payment fraud detection system under simulated card testing attacks. Found:Â card testing detection flagged individual velocity patterns but did not detect distributed card testing across multiple accounts created within the same session. The payment processor's fraud score was accessible via the API response and could be used to calibrate testing attacks.
Detection and Response Validation
Tested the SOC's detection of coordinated account manipulation at scale. The platform operated a 24/7 SOC. Found:Â the SOC alert queue had a 94-minute average response time due to alert volume from the responsible gaming monitoring system generating false positives. The genuine attack simulation alerts were present but buried.
MITRE ATT&CK Detection Results
| ATT&CK ID | Technique | Detection Result |
|---|---|---|
| T1565.001 | Data Manipulation (Jurisdiction Header Modification) |
NOT DETECTED
No server-side enforcement of jurisdiction parameter. |
| T1657 | Financial Theft (Bonus Race Condition) |
NOT DETECTED
No idempotency enforcement on bonus activation endpoint. |
| T1078 | Valid Accounts (Self-Exclusion Bypass via Name Variation) |
NOT DETECTED
Name-only matching with no fuzzy logic or document verification. |
| T1530 | Data from Cloud Storage (Cross-Jurisdiction Player Data) |
NOT DETECTED
CS role access to all jurisdictions not monitored or alerted. |
| T1110.003 | Password Spraying (Card Testing Pattern) |
Partial
Individual velocity detected. Distributed pattern not detected. |
| T1114 | Email Collection (API Fraud Score Disclosure) |
NOT DETECTED
Fraud score returned in API response to authenticated sessions. |
| T1204 | User Execution (SOC Alert Fatigue) |
Partial
Alerts present but 94-minute response time due to queue volume. |
Outcomes
| Metric | Before | After |
|---|---|---|
| Jurisdiction segmentation | Client-side header — no server-side enforcement | Server-side enforcement implemented — cross-jurisdiction access eliminated |
| Bonus engine race condition | Double-claim possible with simultaneous requests | Idempotency key deployed on all bonus activation endpoints |
| Self-exclusion matching | Name and DOB only — 4/6 bypass attempts successful | Fuzzy name matching + document verification for UKGC and MGA players |
| CS representative data access | Read access to all 7 jurisdictions’ player data | Access scoped to assigned jurisdiction only |
| SOC alert response time | 94-minute average — genuine alerts buried | False positive reduction programme: response time reduced to 22 minutes |
| UKGC information notice | Open | Remediation evidence submitted — notice closed |
| GAMSTOP scope | UK players only | Extended to all EU players on MGA licence |
“
We knew the API had grown fast and that jurisdiction enforcement was on the roadmap. What we did not know was that the roadmap item was already a live breach — a UK player session could read another jurisdiction’s player records right now, not hypothetically. The UKGC would have found that in their next technical audit. We found it first.
Chief Compliance Officer, Regional P&C Carrier (anonymised)
Test your iGaming platform before your
regulator does
Strengthen your cybersecurity posture and protect your organization from evolving threats. Discover how GLI Secure reduces risk, simplifies compliance, and protects customer trust.