Teen Suspect Surrenders in 2023 Las Vegas Casino Cyberattack Case
Posted3 months agoActive3 months ago
casino.orgTechstory
calmmixed
Debate
70/100
CyberattackLas VegasCasinos
Key topics
Cyberattack
Las Vegas
Casinos
A teenager has surrendered in connection with a 2023 cyberattack on Las Vegas casinos, sparking discussion on the attack's methods, the victims' responses, and the implications for cybersecurity.
Snapshot generated from the HN discussion
Discussion Activity
Very active discussionFirst comment
2h
Peak period
24
6-9h
Avg / period
6.2
Comment distribution62 data points
Loading chart...
Based on 62 loaded comments
Key moments
- 01Story posted
Sep 20, 2025 at 7:29 PM EDT
3 months ago
Step 01 - 02First comment
Sep 20, 2025 at 9:26 PM EDT
2h after posting
Step 02 - 03Peak activity
24 comments in 6-9h
Hottest window of the conversation
Step 03 - 04Latest activity
Sep 22, 2025 at 7:07 AM EDT
3 months ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
ID: 45318559Type: storyLast synced: 11/20/2025, 3:38:03 PM
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.
First time I’ve heard the term “vishing” to describe the attack we’ve all seen coming.
Then there's even subcategories that further define some of these, like Spear Phishing, Whaling.
The industry loves its fun naming.
uh that's something completely different (and not Monty Python)
Long story short, I've always felt like I stole from the casino that day too! :-)
Now the real question is why do prank videos mesmerize people?
The chimp troupes handles randomness and unpredictability, with the 3 inch chimp brain whose hardware hasn't been updated in 100K years, only one way - tell stories. It's our randomness handling hack.
The stories breakdown all the time.
Access to this page is disabled The law prohibits participation in games of chance organized by unauthorized persons through means of electronic communication.
The authorized organizers of games of chance via means of electronic communication are the State Lottery of Serbia and persons authorized by the Ministry of Finance.
That said, I'd assume governments have access to root certificates, anyway, but they're only broken out for big investigations or secret dragnet stuff we'll find out about in five decades, if ever.
> but they're only broken out for big investigations or secret dragnet stuff we'll find out about in five decades, if ever.
Certificate Transparency, where required, makes certificates unusable if they're not published... But that might not be enough information.
If the user doesn't click through the certificate error, the user will only know it's blocked (or the server is misconfigured), they won't get information on why it's blocked; perhaps details of the certificate might help narrow down the cause of the block or the agency implementing it.
If the user loads the https page and sees "Access to this page is disabled The law prohibits participation in games of chance organized by unauthorized persons through means of electronic communication." as suggested earlier in this thread, and the user did not click through a certificate error, then the MITM must have obtained an acceptable certificate somehow or broken TLS. Since Sep 2024, multi-perspective issuance corroboration has been required by the CA/Browser Forum [1] and it was a best practice for many years, DNS takeover in a single country should be not sufficient to establish domain control for certificate issuance.
[1] https://cabforum.org/2024/08/05/ballot-sc067v3-require-domai...
Ah right, obviously the browser would still try to connect via TLS to the new IP. Not sure why I missed that.
If not, then maybe your browser vendor has been pressured to add some root certificate controlled by the Serbian police, which it approves to issue certificates to impersonate dodgy-casino.games.
How can it be a planned conspiracy if only one person was involved? US law is so weird when it comes to bogus charges just to blow up the case artificially.
Is the offender a person with multiple identity disorder or what's the reasoning here?
On the flip side, I knew someone who interrupted a car burglary and was murdered by the burglar. Imagine what might happen if someone came upon the guy you know of who was doing a robbery while holding a stolen gun?
The person you knew made a lot of choices that led to this, any of which had they not chosen to do would have led to not being an armed robber: don't do a robbery, don't steal a gun, don't do a robbery while holding a gun.
> Robbery, in turn, was simply a "compound" form of larceny. For Blackstone, "compound larciny is such as has all the properties of former, but is accompanied with one of, or both, the aggravations of a taking from one's house or person," id. at *240, and "[l]arciny from the person is either privately stealing; or by open and violent assault, which is usually called robbery,"
I'm not really making a judgement about the rights and wrongs of the actual case (because I'm not only not a lawyer, but also not a witness, juror, etc.), but as described it doesn't sound like robbery at all.
[0] https://web.archive.org/web/20060903163713/http://docket.med...
The way you get there is prosecuting the victims of cybercrime for paying a ransom, if any are stupid enough to break the law.
I'm not even arguing for a specific policy, but I didn't like how the framing of the post was about being "stupid" enough to break the proposed law. It wouldn't be that simple.
3 more comments available on Hacker News