Loyalty Card EEPROM Rewriting: Account Point Glitch Exploitation
Every loyalty card sitting in a player's wallet is a tiny embedded computer, and its EEPROM is the vault holding the balance — a vault that gets rewritten thousands of times without anyone watching the write cycle. That is the exact seam where loyalty card EEPROM rewriting turns from a maintenance routine into a live exploit surface. The glitch does not live in the front-end app. It lives in the raw byte-level update path, and most casino floor operators have no idea how exposed it is.
Why EEPROM Rewrite Cycles Are the Real Attack Vector
EEPROM stores each account point record as a fixed-address block. When a card is swiped at a kiosk or slot reader, the host issues a write command, verifies the checksum, and moves on. The fatal assumption is that the write completes atomically. Cut power mid-cycle, or inject a brownout at the precise millisecond the address latch fires, and you get a torn write — a half-committed block where the old point balance and the new one coexist in adjacent nibbles. 🎰 That torn state is the account point glitch in its purest form.
An attacker with a bench rig and a logic analyzer doesn't need to break encryption. They need to map the rewrite timing window. Once the timing offset is known, a cheap microcontroller can replay a truncated write sequence and leave the card reporting a balance that never debited from the house ledger. This is not theoretical. Field audits routinely find cards whose point counters increment faster than the transaction log — a silent divergence that only surfaces when the EEPROM dump is pulled and compared byte for byte.
The Glitch Exploitation Chain in Practice
Here is the chain, stripped of fluff. Step one: capture the legitimate rewrite frame for a known transaction value. Step two: identify the address bytes and the trailing checksum word. Step three: craft a rewrite payload that sets the point field high while leaving the checksum computed over the corrupted block — so the reader's verification passes on the next read-back. Step four: trigger the rewrite, pull the card, and reinsert. The reader now trusts a balance the back-end never authorized. 💥
The reason this survives is compensation logic. Most loyalty firmware treats EEPROM as the source of truth and the central ledger as a reconciliation afterthought. When the two disagree, the embedded record wins at the point of use. That inversion is the whole game: corrupt the EEPROM, and the glitch propagates upward into the point economy before any batch reconciliation job ever fires.
Where the Firmware Defenses Actually Fail
Vendors will tell you they use wear-leveling and redundant blocks. Wear-leveling spreads writes and actually widens the attack window because it introduces address remapping — more addresses to enumerate, more timing states to glitch. Redundant blocks only help if the redundancy check runs on every read, and in real deployments it is often sampled, not enforced. A sampled integrity check is a welcome mat. 😤
The credible fix is monotonic counters bound to hardware, plus a per-write nonce that the host must supply and the card must consume. Without a nonce, any captured rewrite frame is replayable. Without a monotonic counter, a rolled-back EEPROM block is indistinguishable from a legitimate one. Pair that with a hard power-loss interrupt that aborts and rolls back torn writes, and the glitch surface collapses. The operators who skip this are running point balances on the honor system of a memory chip.
Timing Analysis and the Margin Nobody Measures
Run a logic capture across ten thousand rewrite cycles on the same card family and you will find a jitter distribution, not a fixed window. The exploitable margin is the tail of that distribution where the write-enable signal and the internal charge pump fall out of sync. On older 24-series EEPROMs that tail is wide enough to hit with a $12 glitcher rig. On newer parts it narrows but never vanishes, because the physics of floating-gate charge injection does not care about your threat model. The operators who treat EEPROM rewriting as a solved embedded problem are the ones bleeding points unnoticed, transaction after transaction, while the ledger quietly falls out of alignment with the silicon.