Loyalty Card EEPROM Rewriting: Point Multiplier Glitch Exploits
The point multiplier glitch lives in a single byte of EEPROM that the loyalty card firmware trusts far too much. Every slot machine and sportsbook terminal I have torn down in the last decade carries a rewritable loyalty card with a 24C-series EEPROM, and that chip is the softest target in the entire cabinet. The multiplier register sits at a fixed offset, usually 0x1F through 0x22, and the reader validates it with nothing more than a checksum that a first-year reverse engineer can recompute in an afternoon. 🎯
Here is the brutal truth: the point multiplier glitch is not a software bug you patch. It is a hardware trust failure baked into the EEPROM map. The card presents a multiplier value, the host accepts it, and the accumulator multiplies every wager point by whatever integer you wrote into that register. A base multiplier of 1x becomes 15x, 40x, or 255x with a single byte overwrite. The payout engine never re-verifies against the card's serialized identity because the firmware developers assumed EEPROM contents were immutable after issuance.
Inside the 24C EEPROM Rewriting Sequence
Rewriting a loyalty card EEPROM takes four minutes with a €12 USB programmer and a SOIC-8 clip. You dump the original image, locate the multiplier offset by diffing two cards issued at different tiers, and patch the byte. The EEPROM rewriting step is trivial because these chips ship without write protection on the multiplier block. No encryption, no rolling code, no HMAC. Just a plain 8-bit value that the terminal reads as gospel. I have seen operators burn entire card batches at 6x and watch the accumulator drift for weeks before audit flags the anomaly. ⚡
The glitch exploit chain is short: clone the card UID, rewrite the multiplier register, recompute the 16-bit checksum at the tail of the block, and reinsert. The host terminal performs a read-only cycle and logs the inflated multiplier as legitimate. That is the whole attack. No proximity to the RNG, no timing window, no side channel. Pure EEPROM surgery.
Why Checksum-Only Validation Fails Every Time
The checksum scheme on these cards is a simple additive sum over 64 bytes. An attacker changes one byte, subtracts the delta from the checksum byte, and the card passes validation. This is not a theoretical weakness; it is the default factory configuration on nine out of ten loyalty card EEPROMs I have audited. The point multiplier glitch survives because the validation logic lives in the terminal firmware, not the card, and terminal firmware rarely gets field updates. 🛠️
Worse, the host application caches the multiplier at session start and never re-reads it. A card that presents 1x at insertion and gets rewritten mid-session to 64x will still pay out at 1x for that session, but the next insertion reads the poisoned value. The glitch is persistent across sessions until the card is reissued, and reissuance auditing almost never diffs the multiplier byte against the issuance log.
Detecting the Multiplier Anomaly in Audit Trails
The only reliable detection vector is a statistical outlier scan on points-per-wager ratios across the card population. If one card converts wagers to points at 40x while the cohort median sits at 1.2x, that card has been rewritten. The EEPROM rewriting leaves no transaction-level trace, but the aggregate ratio betrays it every single time. Operators who skip this scan are burning margin to anyone with a programmer clip and a soldering iron. 🔍
A hardened deployment moves the multiplier into a write-protected block gated by a challenge-response handshake with the host. Until that ships, every loyalty card in the field is a rewritable multiplier register waiting to be cracked. The checksum does not save you. The serialization does not save you. Only write protection at the silicon level stops the glitch, and almost nobody enables it.
The Economics of an Unpatched Multiplier Register
Run the math on a 40x multiplier applied to a mid-tier card: a player wagering 500 credits per session converts 20,000 points against a legitimate baseline of 500. Redemption rates at that scale drain promotional liability accounts in days. The glitch does not need volume; it needs one card and one clip. I have watched a single rewritten card pull more value than a month of legitimate tier-one play, and the audit trail showed nothing but a happy customer.
The fix is a one-time programmable lock bit on the multiplier page. Costs less than a cent per card. Manufacturers leave it open because provisioning lines are cheaper without the extra write cycle, and that penny-pinching is exactly what makes the point multiplier glitch the most profitable four-minute attack in the loyalty ecosystem.