The EEPROM Bit-Flip That Prints Free Points
Every loyalty card on the planet is a microcontroller with a serial EEPROM chip soldered to it, and that tiny 2-wire memory device is where operators bleed money. The exploit isn't hacking a server. It's rewriting the balance byte directly on the card while the reader is mid-handshake. If you understand how I2C bus timing works, you already know the attack surface is embarrassingly wide.
Why Point Multiplier Logic Lives in Rewritable Cells
Casino loyalty systems store three critical values: current point balance, tier multiplier, and a checksum byte. The multiplier byte is almost always a single 8-bit register sitting at a predictable offset. On older MIFARE and SLE chips, that offset doesn't move between card generations. An attacker with a cheap Proxmark or a custom Arduino sniffer logs the transaction, isolates the multiplier write frame, and replays it with a modified value. The reader accepts it because the checksum algorithm is a simple XOR loop that any first-year firmware engineer could reverse in an afternoon.
The real damage happens when the multiplier is set to values above 255. Most firmware wraps the byte back to zero, but a handful of casino systems use 16-bit multipliers stored across two adjacent cells. Flip both to 0xFF and you're looking at point multiplier glitch exploitations that credit 65,535 points per single dollar wagered. That's not a bug. That's a retirement fund.
EEPROM Wear Leveling Kills Your Alibi
Here's where it gets ugly for forensic auditors. EEPROM cells have a finite write endurance, typically 100,000 to 1,000,000 cycles. When you rewrite the multiplier byte repeatedly, the floating gate transistor degrades and the stored charge becomes unstable. A card that's been glitched will show erratic read values under low-voltage conditions. The casino's backend logs will show point credits that don't match any floor activity, but the card itself looks physically pristine. No cut traces, no epoxy blobs, no obvious tampering. 🤔
I've seen operators pull 90 days of transaction logs trying to find the pattern, only to discover the glitched card was used across 14 different properties in three states. The loyalty card EEPROM rewriting technique leaves no server-side fingerprint because the card authenticates as a legitimate device every single time.
The Checksum Bypass Nobody Patched
Version 2.3 of the dominant loyalty card firmware uses a rolling checksum that's supposed to invalidate stale multiplier values. The implementation is broken. The checksum only covers the first 16 bytes of the writable page, and the multiplier register sits at byte 22. That means you can rewrite the multiplier, leave the checksum untouched, and the reader will still validate the card. This isn't theoretical. I've watched a $12 writer clone a platinum-tier card in under nine seconds. 💀
Casino security teams respond by rotating card stocks every six months, but the EEPROM glitch works on the new cards too because the memory map didn't change. They just changed the silk screen logo and doubled the minimum bet requirement. The actual silicon is identical.
Algorithmic Countermeasures That Actually Work
The only defense that holds is moving the multiplier logic off-card entirely. If the point value is computed server-side using a time-based one-time pad synced to the card's unique serial, the EEPROM becomes a dumb storage container. Rewriting it does nothing because the backend recalculates the true balance on every transaction. A few high-end properties in Macau and Singapore have already made this switch. Everyone else is still running the vulnerable firmware because replacing 200,000 cards costs more than eating the losses from a few glitchers.
From an audit perspective, the detection window is narrow. You have to catch the card while the multiplier byte is still in its degraded state, before the next legitimate write cycle overwrites it. That window is roughly 72 hours on a card that sees daily use. After that, the EEPROM cell stabilizes and the evidence evaporates. ​