You question, as currently worded, is more of a physiological question. Can human respond to a stimuli in a quarter of a second?
Yes. From this journal article is appears that the mean is around 230ms (controlling for equipment latency) for young, healthy adults. This online poll(?) gives 268ms, which may or may not control for latency.
These individuals probably practice reacting to their stimuli so it becomes second nature.
We will probably not ever know exactly how they did it but make educated guesses as to how they did it from known techniques and prior examples. This question cannot have a definitive yes or no given restricted knowledge about this particular case. but its is very much a plausible reality that Russian hackers used phone apps and reaction times cheat using a particular brand and model of slot machine.
There is probably going to be a decent amount of assumptions on how this process works given the sensitive and confidential nature of the casino business and that the courts sealed the record, probably because of the sensitive nature of the subject.
A solid IT rule is once a hacker has physical access to your machine, it is game over. No amount of security is going to keep your process or machine safe. The Russian crime ring (probably, though not confirmed) bought at least one machine from a bankrupt casino, specifically the Aristocrat Mark VI Electronic Gaming Device, to practice their technique.
The machines are described having pseudo-number generators (PRNG) to create their randomness. But PRNGs are inherently deterministic or flawed (more), hence the pseudo. Some PRNGs are good but some are broken.
But not only do you need a good algorithm but you need a good implementation of the algorithm. The algorithm needs a good source of entropy to make the output more secure. Using a static value as your entropy, for example say your birthday, the output from the PRNG will show a pattern, it becomes deterministic.
Warning Conjecture
Having physical access to the machine, the hackers probably took the machine apart, examined the code looking for weaknesses. They evidently found a weakness in the Aristocrat Mark VI, hence why they specifically targeted the machine when using their technique. The creators of the slot machine could have used a static value for entropy, or the entropy is only gathered when the machine in turned on, or only gathers new entropy and reseeds every hour. There are numerous ways their algorithm could be weak, having the machine at your complete disposal allows you to find that weakness.
They additionally may have created a database of possible outcomes by the PRNG for given entropy; similar to rainbow tables. Now for any particular outcome, they could reference their database, determine the entropy used to seed the PRNG, and therefore predict the outcome for any subsequent outcomes (because PRNG are deterministic once the seed/entropy is known).
So the process probably went down like this:
while furtively holding his iPhone close to the screen
The hacker approached the machine and spent a few dollars rolling the slot machine sending the video of the outcomes to his partners. Once enough samples had been recorded he walked away for several minutes.
...then return a bit later to give the game a second chance.
During this time his partners where plugging the outcomes from consecutive rolls into their database. The rolls are analysed and the probable entropy or seed values are returned. The partners feed back the value to the hacker at the casino.
That’s when he’d get lucky.
Using a custom-built app, probably reverse engineered from the slot machine's own code, the seed is inputted and ran. The app signals the hacker to pull the handle and gives a signal when to pull push the button a quarter second before the winning values arrive by the roll.
The above process is more or less consistent with the articles description of what was happening.
They upload that footage to a technical staff in St. Petersburg, who analyze the video and calculate the machine’s pattern based on what they know about the model’s pseudorandom number generator. Finally, the St. Petersburg team transmits a list of timing markers to a custom app on the operative’s phone; those markers cause the handset to vibrate roughly 0.25 seconds before the operative should press the spin button.
Neither the hacker nor the app have to be accurate 100% of the time but just enough that the odds tilt in their favour. Even if they tilt the odds by 1% in their favour, over the course of thousands of pulls by four men over a week, that 1% adds up.
Again the case was sealed, so much of the evidence is not available. (Offical search here; login required)
