State Lottery Sector
A real-world purple team engagement inside a government lottery operation | Fully anonymised | ISO 17025 accredited methodology
ISO 17025 accredited · MITRE ATT&CK v15 · Conducted under explicit written authorisation.
Sector
Government Lottery
Engagement
Purple Team Exercise
ATT&CK Tactics
MITRE ATT&CK v15
Location
United States
Purple Team Case Studies — Gaming & Lottery
ISO 17025 Accredited
MITRE ATT&CK v15
Conducted under explicit written authorisation
Confidentiality Notice: These case studies are anonymised; any resemblance to specific organisations is coincidental.
CASE STUDY GAM-CS-06
Draw Integrity, Retailer Network Security, and Government Reporting Testing — State Lottery
Validating draw system integrity, retailer terminal security, and regulatory audit trail under adversarial conditions
Organisation
A state lottery operator with $3.2B in annual ticket sales, 6,800 licensed retailers, and a constitutional mandate for public funds distribution (anonymised)
Sector
Gaming — Government lottery, public sector mandate, B2C and B2B (retailer network)
Location
United States — State lottery jurisdiction
Engagement
Purple Team Exercise — Draw System Integrity, Retailer Terminal Network Security, and Audit Trail Validation
Duration
10 weeks (4-week scoping, 3-day exercise, 3-week remediation and reporting)
Frameworks
World Lottery Association Security Control Standard | GLI-11 | GLI-33 | State Lottery Act Cybersecurity Requirements | NIST CSF 2.0 | MITRE ATT&CK Enterprise v15 | FISMA (federal fund recipients)
Core Challenge
The state legislature had passed an amendment to the State Lottery Act requiring an independent adversarial test of draw system integrity and retailer network security as a condition of the lottery’s annual licence renewal. The constitutional mandate for public funds distribution made draw integrity the highest-stakes element: any evidence of draw manipulation, even simulated, would require immediate public disclosure and legislative notification.
The engagement required testing four areas: whether the draw system could be manipulated from within the network operations environment; whether the retailer terminal network could be accessed by an attacker who compromised a retailer account; whether the prize validation system could be deceived into authorising fraudulent high-value claims; and whether the audit trail was tamper-evident and reproducible for legislative examination.
Engagement Phases
Draw System Architecture Review and Access Testing
Mapped draw system network architecture and tested access controls from the network operations environment. Found:Â the draw system server was on a network segment accessible to network operations staff. Three operations staff accounts had read access to the draw parameter configuration directory. A directory traversal vulnerability in the draw management web interface allowed listing of all configuration files without authentication. The draw seed file was accessible via this pathway.
Retailer Terminal Network Penetration Testing
Tested lateral movement capability from a compromised retailer terminal account.Found:Â all 6,800 retailer terminals shared a single service account for central system authentication. The service account password had not been rotated in 31 months. From a compromised retailer terminal, the shared service account provided authentication to the central claim validation system. This account had privilege to query winning ticket status before public draw announcement.
Prize Validation System Integrity Testing
Tested the prize validation workflow for high-value prize claims.Found: the second-level validation required for prizes over $600 was a manual review process. Testing with a synthetically generated barcode that passed the automated check but failed the manual review took 14 minutes to identify. For the highest prize tier, testing found that the validation system queried a database table accessible to the shared retailer service account — creating a pathway from retailer compromise to jackpot validation status query.
Audit Trail Tamper Testing
Tested the tamper-evidence of the draw audit trail, required to be reproducible for legislative examination.Found: the audit log was stored in the same database as the draw system, accessible to the same accounts. Log entries could be modified using the draw management web interface SQL injection vulnerability identified in Phase 1. The audit log had no external anchoring — no third-party hash service, no blockchain anchoring, no off-site replication with integrity verification.
Public Communications System Testing
Tested the systems used for public draw broadcast and results publication.Found:Â the results publication API had no authentication requirement. An attacker with knowledge of the API format could publish incorrect results to the lottery website during the window between draw execution and official results push. The window was measured at 4 minutes and 18 seconds in the exercise.
Detection and Response Validation
Tested the SOC and draw integrity monitoring systems.Found:Â the draw integrity monitoring system was an air-gapped standalone system with no connection to the main SOC SIEM. Alerts from the draw system did not propagate to the SOC. The SOC detected the web interface directory traversal via WAF logging after 28 minutes. The shared service account abuse was not detected by any automated system.
MITRE ATT&CK Techniques Tested
| ATT&CK ID | TECHNIQUE | DETECTION RESULT |
|---|---|---|
| T1005 | Data from Local System (Draw Seed File via Directory Traversal) |
DETECTED
WAF alert in 28 minutes. Directory traversal signature triggered. |
| T1078 | Valid Accounts (Shared Retailer Service Account Abuse) |
NOT DETECTED
Shared account — no individual session anomaly detection possible. |
| T1190 | Exploit Public-Facing Application (Draw Management Web Interface SQLi) |
DETECTED
WAF flagged SQLi pattern. Alert not reviewed for 44 minutes. |
| T1530 | Data from Cloud Storage (Jackpot Validation Status Query) |
NOT DETECTED
Retailer service account had privilege to validation table. |
| T1565.001 | Data Manipulation (Audit Log Modification via SQLi) |
NOT DETECTED
Audit log in same database. No tamper detection. |
| T1491.002 | Defacement: External (Results API Unauthenticated Publication) |
NOT DETECTED
Results API had no authentication. 4-minute publication window. |
| T1485 | Data Destruction (Draw Integrity Monitor Isolation) |
NOT DETECTED
Draw monitor air-gapped from SOC — alerts did not propagate. |
Outcomes
| METRIC | BEFORE | AFTER |
|---|---|---|
| Draw seed file access | Accessible via unauthenticated directory traversal | Directory traversal remediated — draw system moved to isolated segment |
| Shared retailer service account | Single account for 6,800 terminals — 31-month-old password | Individual terminal certificates deployed — shared account retired |
| Jackpot validation table privilege | Retailer service account could query validation status | Privilege separation enforced — validation table access requires draw system role only |
| Audit log tamper-evidence | Same database — modifiable via SQL injection | Audit log replicated to external hash service — WLA SCS tamper-evident standard met |
| Results publication API | No authentication — 4-minute unauthenticated window | Authentication token required — publication window closed to 0 |
| Draw integrity monitor / SIEM integration | Air-gapped — no SOC visibility | Draw integrity monitor integrated into SIEM — alerts now propagate to SOC |
| Legislative audit trail | Not reproducible — modifiable logs | Tamper-evident audit trail produced for legislative examination evidence package |
“
The shared service account was the finding that went to the Governor’s office. Not because of what we found in the test — but because we could demonstrate exactly what an attacker would have been able to do with it, and when, and for how long. The legislature asked us to present the findings directly. That is the standard of evidence a lottery is held to, and it is the standard of testing you need to produce it.
Chief Compliance Officer, Regional P&C Carrier (anonymised)
Test your lottery security before your legislature requires it
Strengthen your cybersecurity posture today.
Strengthen your cybersecurity posture and protect your organization from evolving threats. Discover how GLI Secure reduces risk, simplifies compliance, and protects customer trust.