Internet Chess Club Security Defeated

Scott_F writes "Researchers at the University of Colorado at Boulder have been able to defeat the security mechanisms of the Internet Chess Club and can effectively play a zero-time match, as well as have complete control over the game. The paper is titled How to Cheat at Chess: A Security Analysis of the Internet Chess Club. If you're not familiar with the ICC, it is where many Grandmasters play regularly, with rumors of Bobby Fischer making an occasional appearance. It appears that the ICC has relied on security through obscurity, but we all know how poorly that works. Chess, anyone?" Update: 09/08 21:08 GMT by J : In totally unrelated chess news, I found today's commentary on Zermelo's Theorem interesting, both for the math of the game and the look at a mistaken echo chamber.

Comments

Greetings Dr. Falken

[Anonymous Coward]

Shall we play a game?

Re:Greetings Dr. Falken

[Anonymous Coward]

Ok, what kind of sick homosexual joke is this?

Btw: is this site really ugly or has someone shat on my monitor?

Re:Greetings Dr. Falken

[Anonymous Coward]

Wargames's citation

Re:Greetings Dr. Falken

[professorfalcon]

Only if it's tic-tac-toe, Joshua.

Re:Greetings Dr. Falken

[Anonymous Coward]

I'd love to, but the slashdot IT section color scheme struck me blind. Why is a security article under IT?

Re:Greetings Dr. Falken

[strider44]

Just let me read the article before I say "yes"

Obviously

[rf0]

Check Mate in 1 then..

Rus

Re:Obviously

[Anonymous Coward]

Check Mate in 1 then..

We're just waiting for a white knight to come to our rescue.

Re:Obviously

[Zork the Almighty]

PAwned!

Joke?

[odano]

Searching for Bobby Fischer.... on the internet?

Re:Joke?

[Anonymous Coward]

Much better search

Pawn to Kings King 1

[ravenspear]

Checkmate.

Doh! No Fair!

Gah!

[Anonymous Coward]

Damn wallhackers!

Security through obscurity..

[Karamchand]

..is not as bad as its reputation. Of course it is not enough and you should not rely solely on it. But it can be a helpful part of your whole security-plan. Read more in this interesting paper by Jay Beale, the Lead Developer of the Bastille Linux Project.

Re:Security through obscurity..

[Mateito]

Security through obscurity is not as bad as its reputation.

That's why I post to /. as AC.

Re:Security through obscurity..

[Nos.]

I understand what he's saying... it doesn't hurt to be obscure. And, he's right, but its like having an umbrella in a hurricane. Sure, it won't hurt, but its not really doing anything for you either.

Re:Security through obscurity..

[Anonymous Coward]

Let us put this debacle to rest on what seem to think is all right to say. Now some security systems will prompt you for a username and password to get to say a file or page that represents an instance in time (a temporary file) being a bank info, email, home page, etc...

Now lets pretend that you no longer enter a password and user name but it is in URL that represents an encrypted path. Example: /AC/guest. Ok I have the same security as a Username and Password. Ah, I hear someone saying hey it's encrypted. Ok so now lets use the crypt function to take AC now pUAjVnmmdfKd. and guest now Tkp.huQKKw5R. and have a url of /pUAjVnmmdfKd./Tkp.huQKKw5R. this would be encrypted as above. Yet someone could sniff the URL therefore, it should only work once or some mechanism based on url.

Therefore, security through obscurity is just a play on words that may not be so bad.

Re:Security through obscurity..

[MrPoopyPants]

An umbrella can quickly be turned inside-out or get loose and hit you in the face...

Re:Security through obscurity..

[Anonymous Coward]

it can be a helpful part of your whole security-plan

This is patently incorrect. People who claim that obscurity can in any way be effecting have no understanding of human psychology.

It's not that obscurity isn't effective, it's that *relying on* obscurity, by design *decreases* security, in every case, because it leads you to believe that you are doing something, when you are not.

Mr Beale's paper states exactly this - although he tries to phrase it differently, he says this:

so long as you understand that the server location and port number can't serve as a method of authentication, you haven't harmed your security in the slightest

Which misses the point that someone who would attempt to change the server address and port *must* believe that it is effective, otherwise why do it? This is the biggest flaw in security through obscurity, because it leads you to a false sense of security by making you think you're doing something effective when you're not.

The biggest tell in this comes from his next paragraph, which reads:

What have we accomplished? Well, for starters, we've blocked some number of attacks.

Which is the false "this is effective" argument. Even though he gives an example of keeping script kiddies out because they use "simple" tools, he misses the point that as soon as those tools start doing service identification on open ports, he has just fallen into the obscurity trap by giving him self the false sense that he's accomplished something when he really hasn't. The question he should have asked is "will this stop someone from finding it?" The answer, of course, is a resouning "NO."

Re:Security through obscurity..

[Frizzle Fry]

Which misses the point that someone who would attempt to change the server address and port *must* believe that it is effective, otherwise why do it?

It's called defense in depth. Just because you believe that your underlying security is solid and you know that obscurity by itself wouldn't be a complete solution doesn't mean that adding some obscurity on top of what you have as an extra level of security is a bad idea. Just because I know that you can cross a moat doesn't mean I'm not going to put a moat full of alligators around my castle in addition to the guys on top of the walls with boiling oil and so forth.

And if you really believe that obscurity never has a place in security, does that mean you will happily give out all your passwords, etc., because they were useless anyway?

In other news (offtopic), where did my "Older Stuff" slashbox on the home page go? I went to my home page preferences to add a Politics slashbox when they added that section (which retroactively contains old politics stories, very nice) and now I don't have "Older Stuff" anymore. It's there when I'm not logged in. But I don't see it listed anymore as a choice in preferences (it should be in bold since it's one of the defaults for non-logged-in users). I'm so confused. Any help? Thanks.

Re:Security through obscurity..

[Anonymous Coward]

Thanks for exploring that haystack of a metaphor and finding yet another precious needle!

Re:Security through obscurity..

[gl4ss]

yes obscurity will help.. but only if your other bits are sound.

if you just trust that nobody will ever capture your packets and peek in you're totally screwed if the application relies on any security at all.

(i'm taking that there was actual game logic on the end clients.. which I seriously must ask what the fuck for? the server could very well just ask which piece to move and where to and then check the validity of that move before doing it - what secutiry through obscurity would that need?)

after all you can have chess game with pure email without problems..

Re:Security through obscurity..

[arvindn]

Wrong. I've read Jay Beale's paper, and he argues that while "security implemented solely through obscurity is bad", obscurity can be a useful extra layer to improve security. But "security implemented solely through obscurity" is precisely what is happening in the ICC case, and a little reverse engineering renders the system completely defenseless. The theoretical reason why the reverse engg. was inevitable is the impossibility of obfuscating programs.

Re:Security through obscurity..

[vadim_t]

Security by obscurity has nothing to do with passwords. A password is an unknown information that changes for every user. Obscurity in a system is constant.

Security by obscurity means your system relies on that the mechanism is unknown. For example, this timestamp program. As soon as it was found how it worked, it could be instantly broken.

Good security is when an attacker can't break your system faster than brute force, even when given all the computing power, knowledge of how it was built and tools on the planet.

A really secure lock is one you have to brute force by trying every possible key, or breaking the door. Security by obscurity is when you hope nobody will ever find that your door can be easily opened by kicking it in the right place, so you paint the door with a different color, hoping nobody will recognize that it's the vulnerable kind.

Your example doesn't work, by the way. A moat with alligators provides real security. Security by obscurity would be if your castle had a secret tunnel ending in a dark cave, that'd let you get directly inside. That kind of thing only protects you as long as nobody finds about it.

Re:Security through obscurity..

[Anonymous Coward]

The term itself is an oxymoron - that's why it became an adage. The arguments provided in the link are mostly valid, but the reality is that security is helped very little by obscure methods. Obscurity can only help in a very insignificant way, and to such a small degree that it is rarely worth it to implement.

The Caesar cipher wasn't security through obscurity in its time. The key for a Caesar cipher WAS the cryptosystem itself... and that was the state of the art then. Just because we all now know how it works and have since developed advanced methods of cryptanalysis does not mean that it was security through obscurity any more than RSA is in a time where QC and factoring shortcuts are yet undiscovered.

Script kiddies == not serious threat unless you have a bonafide vulnerability. Diverting script kiddies has little to do with security and everything to do with convenience. If you are running a vulnerable web server on an obscure port, and a script kiddie scan misses it because he is inept, you are not any more secure. If you are secure, it doesn't matter what port you are on and script kiddies are the least dangerous threat posed to you anyway.

Running a port scan detector doesn't necessarily force a port scan from a skilled cracker, nor are port scans difficult to hide. This is the same point - stopping script kiddies is convenient, but it is not any more secure than running on a known port if your server has a vulnerability.

Slowing down an attacker is also not security unless you are actually looking. The "security" comes almost entirely from actually paying attention in the first place. Besides, time is free for script kiddies. Professional-level crackers with expensive time would not be thwarted by such a small obstacle.

Intrusion detection might be slightly easier using obscure methods, but then again intrusion detection does not constitute security. It's only a minor piece, despite what IDS vendors may tell you - intrusion prevention is much more important. Overall, security is ultimately about cost: making it more costly to get at your stuff than what it is worth, at little cost to you. You have to spend time=money obscuring your setup; if it's only to filter out script kiddies from your intrusion detection results, you may find that you've netted very little time, and therefore very little security.

Re:Security through obscurity..

[Frizzle Fry]

You completely misunderstood my analogy. I said that even if you already have security you believe to be effective (like the guards with the oil) adding extra security precautions on top of that (like the moat) can be a good idea. The point is that just because you have security you believe to be solid, extra security on top of that can't hurt, even if by itself that extra security wouldn't be adequate. Your tunnel doesn't demonstrate this at all; it just explains what the word "obscurity" means, which wasn't the point.

Re:Security through obscurity..

[vadim_t]

Adding layers of security does help, but obscurity still isn't security.

The castle walls, moat and alligators continue to work just fine even if your attacker has a full plan of the whole castle. On the other hand, the whole castle will be compromised if somebody ever notices the tunnel.

Even when you can add obscurity as an additional layer, it still has dangers. Say, you keep your alligators in a pond inside the castle, hoping that you'll catch some attackers off guard that way. The danger in that is that it's quite possible that you'll spend some time thinking about your incredible cleverness instead of concentrating on something useful.

Re:Security through obscurity..

[EvanED]

Okay, how 'bout this?

You add (in addition to the moat) a field of land mines. There is a path through the minefield.

Are you saying that this provides no security over just the moat?

Re:Security through obscurity..

[vadim_t]

Almost certainly yes.

From the point of view of security, if you didn't think the mines would be good for something, you wouldn't put them there. Since there is a path, as soon as one enemy figures it out, the whole army can get through it. This is bad because perhaps you didn't add enough defence to stop the attackers if the mines don't work. Probably you spent money on it too, that could have went instead to something not so easily avoided. It's as simple as an enemy spying somebody walking into the castle by that path, or watching as they're being set up.

From the practical point of view, it's also a bad idea because sooner or later somebody from your team, perhaps even you will get blown up. The mines could also become your prison. You can always leave a heavily guarded castle from the front door without problems. But if there are mines around you risk giving the enemy information on their position.

This is where the analogy breaks down. In real combat you could lay mines in such a way that the hidden path would lead right through the best defended place. But that doesn't really apply to computers. In computer programs, security could be mostly be viewed as a set of concentric rings. Once you figure out how to bypass one of them, it's as if the whole ring vanished.

Re:Security through obscurity..

[Anonymous Coward]

Come on, look at it from a realistic perspective. Obscurity is part of almost every security plan, and rightfully so. Do you tell your possible intruders what security mechanisms you have, safe in the feeling that they won't be able to break them? Or do you keep that info to yourself?

You keep it to yourself, of course! What possible gain is there to tell someone what you're doing? It's the same reason that your password authentication doesn't tell the user that the ID he's using doesn't exist. You're obscuring the list of known users.

The reason for obscurity is that if there IS a flaw in the actual implementation (hey, it happens), the attacker may not know about it and you may be saved a huge headache.

The less an attacker knows about your security, the better.

Re:Security through obscurity..

[kaschei]

Neither of you are acknowledging what you're really arguing; vadim is presupposing that obscurity involves compromisable parts, which is wise for anything that hasn't been field tested extensively--assuming that the tunnel exists. Obscurity might be achieved by using a different kind of lock on the door; the method used may produce equivalently resilient locks, or better or worse; but the fact that they are unknown to attackers is a slight advantage.

Re:Security through obscurity..

[cpeikert]

The theoretical reason why the reverse engg. was inevitable is the impossibility of obfuscating programs.

You're overselling the paper you cite. It says nothing affirmative about reverse engineering, nor does it disprove the existence of an obfuscated program. It does prove that there is no universal obfuscator, i.e. one which can obfuscate any program successfully. But it very well may be that there are some programs which can be obfuscated. And it may be that among other "unobfuscatable" programs, the code doesn't give any "useful" information. Personally I don't believe this, but it has yet to be proven.

Re:Security through obscurity..

[jrockway]

Wrong. That's not what the expression is referring to. Security through obscurity in that case would be, instead of writing "Password: " as a password prompt, you wrote "Square root of nine: ". You're obscuring the fact that the program wants a password.

Obscuring the login token is obviously necessary for it to work. Hence, it doesn't fall into the category of "security through obscurity".

Re:Security through obscurity..

[vadim_t]

Well, it's just hard to make exact analogies.

Obscurity is always compromisable, that's why it's obscurity. Sure, I could visit every shop I can think of, and choose the weirdest lock I can find. But all the attacker has to do is to come take a look at it, and if they still don't know how it works, buy one of their own. I will get a false sense of security hoping that the attacker will lose hope after finding this wonderfully strange lock. Even worse, this lock might be crap, and it'd be hard to find since it's so uncommon.

You might think this won't happen with you, but believe me, it does. Humans are horribly prone to pick some completely stupid thing and think of it as the best thing since sliced bread. This is demostrated by this same article. It'd have been easy to just use the SSL library, or some well known algorhitm, but the author just had to write their own, either because they didn't know better, or because they mistakenly thought making their own lock would make it harder to attack.

On the other hand, I could easily go the lock everybody knows about (say, 3DES), which while not terribly pretty is known to be impossible to pick, and concentrate on other things, like getting a heavy and ugly but secure door made of solid steel.

This also goes for computer system. You can mess all day making FTP run on port 666, and have the root user renamed to "shiva", and even rename /bin/bash to /bin/foobar, but in the end, all this stuff is of very little use. Now, things like grsecurity, SELinux, NX and well configured permissions are the really effective things.

Re:Security through obscurity..

[stephanruby]

...script kiddies are the least dangerous threat posed to you anyway

What danger? It's only chess. Noone is going to get killed over this. If someone cheats, I avoid playing them (if I detect it). If only a few people cheat for every thousand games I play, it doesn't really alter the enjoyment I get from those games.

"Security through obscurity" is not necessarily bad, in this case "security through obscurity" is good enough. It's online chess for pete's sake, there is no guarantee that the person I'm playing isn't using his buddies or a computer program for additional help. Online chess is inherently insecure.

Re:Security through obscurity..

[Fulcrum of Evil]

Look at it this way - do you tell all your coworkers your login password? No? Then you're practising security through obscurity.

Are you daft? Security through obscurity refers to not telling people the access method. It has nothing to do with protecting a shared secret. Good luck inventing a security system that lacks a shared secret.

Re:Security through obscurity..

[ottothecow]

I've got one (patent pending)

I sit in a room and I have a button to open a door (for the purpose of this, my room is completely secure except for that door and the door can only admit one individual at once because of some fancy system that removes excess space around the person). If I want to let someone in, I press the button. If I don't want someone coming in, I don't press the button.

Now of course I could never ever leave the room, and if I fell asleep or somethign happened, nobody else would be able to enter.

It does lack a shared secret though.

Re:Security through obscurity..

[Anonymous Coward]

Personally I don't believe this, but it has yet to be proven.

It's easy enough to prove. Since you can emulate the whole PC in a VMWare-like fashion, or even Bochs, you will always be able to check the execution flow and trap the hackable parts when they surface, which they have to on non-DRM hardware.

Another example is how NO game or software application to date has managed to stop crackers, unless they incorporate some server-side measures like CD-KEY checks. Even then, there pop up generators for it very quickly and they have to change their algorithms and ban keys.

Yes, it may take some time, but there's litterally nothing you can do to prevent users from hacking their own machines. But with Palladium and Janus from Microsoft, DRM-hardware will give corporations control over the machines of the users. With so many ignorant people in this world, it's like stealing candy from a child.

Re:Security through obscurity..

[Fulcrum of Evil]

Could you come up with something that could potentially be deployed widely? I'm having trouble seeing 'Nightclub doorman' as an actual security system.

Re:Security through obscurity..

[ottothecow]

I'm having trouble seeing a nightclub as a viable use...

god forbid I would actually press the button and let anyone in...what if they came in and pressed the button for someone I didn't want?

Summary of story

[ricotest]

Chess club relies on security through obscurity; got cracked. Therefore security through obscurity sucks and its polar opposite, open source security, rules. Therefore open source rules. Therefore Linux rules. Therefore Microsoft sucks. Apple, we don't yet have an established opinion on.

Re:Summary of story

[nkh]

Security through obscurity sucks just because it provides no security at all once everything is cracked. On the other side, security with cryptography/cyphers is mathematically proven to be safe. If Microsoft were to write its own or implement famous algorithms, I would be really happy, and wouldn't spit on them.

Re:Summary of story

[Anonymous Coward]

Chess club relies on security through obscurity

First rule of chess club: Do NOT talk about chess club!

Re:Summary of story

[Anonymous Coward]

Wasn't there a Mozilla security bug which they kept hidden for 4 years and fixed it only when it was
found out?

There is a hidden option in the Mozilla bug database option - what's that other than security by obscurity.

The story was covered in slashdot, but I can't find a link.

Re:Summary of story

[Frankie70]

[ Previously posted without logging in]

Wasn't there a Mozilla security bug which they kept hidden for 4 years and fixed it only when it was found out?

There is a hidden option in the Mozilla bug database option - what's that other than security by obscurity.

The story was covered in slashdot, but I can't find a link.

Re:Summary of story

[kfg]

The story was covered in slashdot, but I can't find a link.

See how well they hide?

KFG

Re:Summary of story

[Anonymous Coward]

As they have done... LONG ago! The application of said algs are generally the users responsibility, as it is in UNIX.

Most people find managing private keys to bee "way hard". Even if that management is nothing more that making sure you store a backup of the key offline in case your computer goes poof.

Oh well for the world when lazy people are 99% of the people out there...

Re:Summary of story

[kfg]

Apple, we don't yet have an established opinion on.

Ooooooooooooooo, Shiny!

KFG

Re:Summary of story

[bunratty]

On the other side, security with cryptography/cyphers is mathematically proven to be safe.

Can you point me to such a proof? A mathematical cryptographic system that can be decrypted in a reasonable amount of time, but is proven unable be cracked in a reasonable amount of time, would amount to a proof that P != NP. Then I can collect my $1000000!

Re:Summary of story

[pokeyburro]

By your reasoning, it's obvious: black iMacs suck the most, because they're opaque, and opaque == obscure. Clear iMacs rule.

Re:Summary of story

[ComputerSlicer23]

I'm guessing, you've confused the "Firebird" database, with the Mozilla codenamed "Firebird".

http://www.securityfocus.com/news/136

I'm not saying that your wrong, but I know this Interbase (the original name of the database, before it was Open Sourced) bug was published on slashdot (I'm not going to bother trying to find the link), and fits the description you give (other then the "hide" portion of the Buzilla DB).

I read slashdot pretty religiously, but don't remember ever hearing such a story about Mozilla. However, it's possible I missed it. A number of bug tracking software uses an "Internal/Hide" option, for a variety of reasons, including keeping the details of a crack secret. So the source for the crack, and details of how to exploit it can be posted for internal use, but not external. Sometimes, it's just a bug that only affects internal versions that have never been released to the public so you want to keep people who've never seen the code with the bug from being able to comment on it.

Kirby

Re:Summary of story

[Sigma 7]

Security through obscurity sucks just because it provides no security at all once everything is cracked. On the other side, security with cryptography/cyphers is mathematically proven to be safe.

Security with cryptography/cyphers is no different than ecurity through obscurity. Once you know what the key for encryption (it must be located in the timestamp client, meaning that it will be extracted), then the crypto layer has no advantage at all.

As long as there is some component trusting an untrustable client, the system will never be secure.

Re:Summary of story

[randomiam]

Apple, we don't yet have an established opinion on.

Which is OK, 'cause we all know they're going out of business Real Soon Now.

Re:Summary of story

[DMUTPeregrine]

Yes, we do. Apple sucks at ruling. They are part open, part closed. And microsoft rules financially (and in terms of market share) so Apple sucks at ruling. Nothing wrong with that.

Re:Summary of story

[strider44]

Yes. It is located behind this 1 megabit encryption.

Re:Summary of story

[Anonymous Coward]

Can you point me to such a proof? A mathematical cryptographic system that can be decrypted in a reasonable amount of time, but is proven unable be cracked in a reasonable amount of time, would amount to a proof that P != NP. Then I can collect my $1000000!

Note to the moderators: the above is not insightful. If you want to moderate it up, use +1 funny.

And for the poster: google for "one time pad" for a mathematical cryptosystem that cannot be cracked at all (excepting, of course, social engineering). Sure, it is not usable for everyday encryption but it meets your demands.

Re:Summary of story

[d34thm0nk3y]

no kidding, in fact it could be said that public key crypto systems have been mathematically proven to be unsafe given sufficient time.

Re:Summary of story

[karlm]

Can you point me to such a proof?

XOR one-time pads are proovably secure, given that they are used properly. The proof does not rely on P != NP. The proof is rather simple: the ciphertext could be absolutely any of the possible plaintexts of the same length and an attacker has no way of deciding amoung plausible decryptions.

Now, the grandparent probably meant something very different, such as large modulus RSA and 3DES are conjectured to require several decades to crack. However, there are a whole class of one-time-pad ciphers that are provably secure. (Although they are impractical for most uses.)

I've heard that some governments send diplomatic couriers with breifcases full of DVD-RWs (containing OTP keys) to their embassies for their most secret traffic. Bits of the keys are burned over as they are read from the DVD-RWs and once a DVD is used up, it is shreaded. Periodically, the shreds are incinerated. As a rough estimate, a courier could probably inconspicuously carry 250 DVD-RWs, which works out to encryption keys enough to cover 1 TB of the most sensitive secrets.

Now, given that the US government allows tripple-wrapped SECRET documents (but not TOP SECRET) to be sent via regular mail, one could argue that sending website subcribers a few DVD-RWs full of OTP keys once a month could be considered a solution to the key distribution problem for low-level secrets, such as everyday chess game moves.

Oh no!

[panth0r]

Whatever shall we do, I'll never play online chess again!

No drug tests required

[Datagod]

Chess is about the only sport out there that isn't susceptible to performance enhancing drugs, or blood doping. But it is really annoying to play against people who end up being computer programs.

Re:No drug tests required

[name773]

does caffeine count?

Re:No drug tests required

[daveashcroft]

Hmmmm, i have to say that i think calling chess a "sport" is stretching the term somewhat. "competitive game" yes.......but surely NOONE thinks of it as a sport?

Awaiting the negative mods from fellow chessplayers.

Re:No drug tests required

[joranbelar]

sport (spôrt, sprt) n.
1. Physical activity that is governed by a set of rules or customs and often engaged in competitively.

2. An activity involving physical exertion and skill that is governed by a set of rules or customs and often undertaken competitively.

3. An active pastime; recreation.

May not fit either of the first two perfectly, but the third seems a good match.

Re:No drug tests required

[daveashcroft]

Yeah, but to use definition 3 - you could argue that someone making sculpture, or knitting is engaged in sport.

Re:No drug tests required

[Anonymous Coward]

Haev u ever seen the movie Ghost?! Patrik Swayze!

Chess is the fairest games of all

[civilengineer]

as there are no referees to make wrong calls, and judges to give wrong scores.
But, cheating is still possible with the help of latest technology. In an on board match, you could have some person watching your game and suggest moves after checking in a computer. This is more true of non Grandmaster games. Its almost impossible to do this in GrandMaster games as necessary precautions are taken.
Now, in internet chess, cheating is even more likely to occur. It is very difficult to hold a fair tournament completely online anytime soon. Something like our elections.

Re:Chess is the fairest games of all

[VendingMenace]

wouldn't this be the case for more than just chess? Such as checkers, chinese checkers, chineese chess, strategeo, risk, ect.

(Dare i mention the infamous GO in a chess story?)

While i am attempting to drop my karma like a rock, i would also add that chess is NOT the fairest of all games, becuase there is a definate difference/advantage depending on what color you are, and thus who goes first. A game in wich this is not the case (or it is compensated for would be even more fair. (here is where my karma takes nose dive :) ) GO is just such a game. The komi (points awarded to the player that goes second) helps eliminate this advantage. As such, i belive that GO is a fairer game.

I should say that i am not trying to trash talk chess. I enjoy chess just as much as the next guy, and it is terrific game to play -- both for enjoyment and as mental excersise. Above, i was just trying to point out what i thought was wrong with the parent.

Re:Chess is the fairest games of all

[azaris]

as there are no referees to make wrong calls, and judges to give wrong scores.

Actually, tournaments have people called arbiters who assist the players and rule on any unclear cases or when the players disagree on something. And it's not uncommon that an arbiter makes a wrong call.

But, cheating is still possible with the help of latest technology. In an on board match, you could have some person watching your game and suggest moves after checking in a computer. This is more true of non Grandmaster games. Its almost impossible to do this in GrandMaster games as necessary precautions are taken.

The traditional method is to take frequent bathroom breaks and then flip through an opening book in the stall. Nowadays that's been replaced with a pocket computer.

Now, in internet chess, cheating is even more likely to occur. It is very difficult to hold a fair tournament completely online anytime soon. Something like our elections.

You don't even need hacks like this to do it. Having another computer running analysis and entering moves in real time allows almost perfect play and if you're not stupid about it, it's probably very hard to get caught.

Re:Chess is the fairest games of all

[HeghmoH]

There's an easy way to fix the unfairness in Chess. Play an even number of games, alternating sides, and see who comes out on top in the end. I think it's no coincidence that this is what's actually done in tournaments.

Re:Chess is the fairest games of all

[Anonymous Coward]

oh man, you've really done it now!

All those chess guys are going to be so angry with you.

Holy cow!

Re:Chess is the fairest games of all

[quetzalc0atl]

even more to the point, how is the fairness affected by the openings? chessmasters now must memorize dozens of openings dozens of moves deep or else the game is lost.

it is this fact that has led some chessmasters like fischer and capablanca to propose their own games. (in a "fischer game" the starting positions of the pieces is random).

Re:Chess is the fairest games of all

[Have Blue]

Actually, this would be much more difficult with Go, as the best Go-playing AIs are not really better than the average player.

Re:Chess is the fairest games of all

[timeOday]

wouldn't this be the case for more than just chess? Such as checkers, chinese checkers, chineese chess, strategeo, risk, ect.

(Dare i mention the infamous GO in a chess story?)

I don't see how you could cheat in an online GO game at championship levels. I don't play, but as I understand it playbooks aren't helpful and the computer is no help (no known algorithm plays a good game).

Re:Chess is the fairest games of all

[ToreTS]

The traditional method is to take frequent bathroom breaks and then flip through an opening book in the stall. Nowadays that's been replaced with a pocket computer.

Another method I've thought of would be to place a small, radio-activated vibrating device in your shoe and have someone send you moves using a simplified Morse-like system. The guy who got busted cheating on "Who wants to be a millionaire" used a system of audience members coughing. If he'd used the radio foot vibrator technique, he might have gotten away with it.

Re:Chess is the fairest games of all

[ComputerSlicer23]

Actually it's an open question if chess is a fair game or not. You are actually making the implicity assumption that moving first is an advantage. There are games where going second is an advantage.

Risk isn't a fair game, in the sense that it involves random elements, rather then purely skill. Checkers is probably a fair game, however, there are some varitions to it's standard rules.

http://en.wikipedia.org/wiki/Solved_board_games

According to that page, reversi is just such a game.

It's entirely possible that Chess is just such a game, that Black and run the perfect counter to whatever it is that White does. Most people believe that playing White is an advantage (in practice it appears to be), however, it theory it isn't in any way. Go is also another open question as to it's fairness in the end.

Kirby

Re:Chess is the fairest games of all

[VStrider]

I believe chess is a fair game. White has the initiative, black defends and tries to steal the initiative. With perfect play on both sides, it is believed that the game would end in a draw. But chess is too complicated (the number of mathematicaly possible positions that can appear on the board are estimated at 10^120 - that's alot of zeros), so the absolute "truth" hasn't been found yet.

So that tiny advantage that white has, isn't enough to give you a win. Infact there are certain grandmasters that prefer defending (eg. Karpov).

In chess things are not as black and white as they appear to be. :-)

Re:Chess is the fairest games of all

[VendingMenace]

Actually, i would still claim that RISK is a fair game.

There is no need for a game to contain purely skill for it to be fair. In RISK, the odds of rolling a certain number are the same for all involved (1/6 per die). ALl players are exposed to the exact same odds. Of course, someone still gets to go first, and so that may skew it in one direction or another. I don't know. But i think as far as fairness goes, there is no random event that inherintly favors one player over another.

How is this different that in sports that have luck? WEll, in such cases there are human judges and they are not intirely impartial. that is why such games are not quite fair. ONce you remove any partiality, the game becomes fair. that is to say -- if all players are equally at an advantage, the game is fair.

I suppose it does depend on whether or not going first is an advantage (or disadvantage) in chess. Perhaps it is not. However, the game is differnt depending on whether you go first or not, and, as there is no handicapping system to make up for this, it seems hard to imigine taht both players have an exactly equal advantage.

It may be that the advatage that one player has over the other is so small as to be negligible -- and then i would agree that chess is indeed a fair game. In fact, i would go as far as to say that for MOST people, chess is essentially a fair game.

What i was taking issue with mostly is the post that chess is the fairest of ALL games. A claim that must certainly be false. In reality, there are many games that are just as fair a chess is, and perhaps a very few that are even more fair.

Either way, for myself, and 99.9% of the earth's polulation, it is still a fun game to play :)

Re:Chess is the fairest games of all

[VendingMenace]

This is a good point, and i had thougth of that. But then to desribe chess as a fair game, a game of chess would actually have to consist of 2 games of chess. Thus, the base unit of play that one would have to partake in (in order to claim that one had played chess) would have to be 2 games.

I am not sure that many people would agree with this boundry. That is, if you played a single game of chess, you would feel safe claiming that you had played a game of chess. If soemone came up to you and said, "No way!, you have only played 1/2 a game of chess!", you would look at that guy like he was an idiot.

Thus we see that the basic unit of chess is a single game. Thus, the game of chess is unfair (or could be, depending on what you think the advantage may be for going first). You can FIX the game of chess, by trying to average out the flaw (again, if it exists). But the idea, i think, is that in the end, the basic game remains unfair.

I hope that makes some sense. I am not sure that it does, but that is what i was thinking at the time :D

Re:Chess is the fairest games of all

[pompomtom]

as there are no referees to make wrong calls

Not entirely true

Re:Chess is the fairest games of all

[Anonymous Coward]

The game of chess may be unfair, but a chess match is not.

Re:Chess is the fairest games of all

[strike2867]

Color only matters at the very top level. The current World Champ, Kramnik goes all out with white and just tries to draw with black. Every other level below that doesn't matter. Even Kasparov, the former World Champ didn't care. This is why when it's a match for world championship, they will play an even number of games at a rate of about a game per day. At all other levels, and in tournaments, the directors just alternate. And in tournaments its basicly the people who have the same number of wins play against each other. Personally I don't care which color I am in any version of chess.

Re:Chess is the fairest games of all

[Anonymous Coward]

GO is just such a game. The komi (points awarded to the player that goes second) helps eliminate this advantage. As such, i belive that GO is a fairer game.

You haven't been to my Go club, then. Instead of arguing about who gets black (that's easy), us Go players argue about what komi should be.

Re:Chess is the fairest games of all

[Anonymous Coward]

not so.

when I play chess, and lose as black, I would feel cheated if my opponent did not offer a rematch with switched sides. I wouldn't feel totally beaten (unless I was crushed and knew I hade no hope with white anyway). equally, I'd accept that I hadn't really won if I won just a single game with white.

offering to switch and play again is part of the etiquette surrounding the game, for the very reason you give - a meaningful result is at minimum 2 games.

this is universally accepted everywhere chess is played, except perhaps where the contract surrounding challenges is deliberately altered, such as hustling for games in the park.

Re:Chess is the fairest games of all

[arose]

Or maybe he didn't cheat at all...

Re:Chess is the fairest games of all

[Anonymous Coward]

Alas it is, because someone has to ultimately go first as white and thus have a better chance of winning. Thus they have the psychological advantage; in the second game the other play must now win to maintain parity.

Greetings, Doctor Falken.

[scowling]

Would you like to play a game?

Some of the top analytical and intuitive problem solvers in the world, and they can still get their credit cards hacked. Bravo.

But why oh why couldn't the researchers have researched a hack on, say, Everquest? Thirty thousand startled and whiny chess players wouldn't be nearly as entertaining as three hundred thousand startled and whiny mob grinders.

THE ANSWER IS: NO

[Anonymous Coward]

yuo fail it.

Please return to your Windows(tm) machine promptly, Sir.

Zero-Time match?

[wowbagger]

Could somebody explain the meaning and significance of the term "zero-time match"?

Re:Zero-Time match?

[Anonymous Coward]

Matches are timed, you have x minutes or seconds to complete your game, sometimes with an increment where after each move y seconds are added to your time remaining.

A Zero-Time match would mean you've hacked the clock and your moves never take any time.

Re:Zero-Time match?

[Anonymous Coward]

It's not anything technical, you know. It just means chess matches were recorded that were played in no time at all.

Re:Zero-Time match?

[stratjakt]

It means you hack it so it looks like it took 0 seconds to make your moves.

It means absolutely nothing to people who play conventional chess, where a match could last for years. People have played chess by snailmail.

I guess if you're into that slam the clock "speed-chess", it's a cheat.

Re:Zero-Time match?

[phearlez]

The article mentions, in fact, that the minimum 'charge' is 0.1 seconds even if the client returns '0' so an exactly 0 time match is impossible.

Another poster's implied dismissal of low time games as 'smack-the-clock' speed chess seems to disregard what is implied in the article - that many people play low-time games because it's commonly believed that you cannot cheat on them. It's not what I think of as chess but if it's widely used for that reason this find is significant.

Just a thought

[phaetonic]

Would Yahoo! Games be more secure than ICC? If so, why?

Re:Just a thought

[magefile]

Yes. Because of the whole "you can't make it perfectly secure" thing. Thus, from the defender's point of view (ICC or Yahoo!), [cost of broken security] > [cost of implementing security], all is well. If, from the attacker's point of view, [reward of breaking security]
A special case of this is the "don't run faster than the bear - run faster than the slowest guy you're with" - if the bear doesn't get anything to reward him (her?) for running past the slowest guy in order to get you, then he (she?) won't, and thus, you're safe.

Re:Just a thought

[puppetman]

I play Yahoo Towers, and once in a while you would come across some guy that played super fast, making perfect Yahoos, etc. Obviously a bot. Yah, there's cheating at Yahoo.

Do I really care? No, I go play someone else.

Re:Just a thought

[DavidTC]

Luckily, the bot didn't agree to the AUP.

Re:Just a thought

[wamatt]

No and besides Yahoo dont do timestamping and hence lag costs you bigtime :(

I love ICC and the paper makes a valid argument, however its very academic. A few extra seconds here or there is no big deal in gamea longer than 3 minutes. Much better ways to cheat, like using a computer (just on a few crucial moves - impossible to detect).

Also its easy to detect a cheater. If he claims (2 second lang), server can ping him (literally with ICMP) and compare. Course he could firewall it, but still..

Are the alternatives safer?

[GMFTatsujin]

I'm always up for a nice game of global thermonuclear war...

To bad it isnt go...

[imsabbel]

There would be so many possible Sai jokes....

Re:To bad it isnt go...

[Sabaki]

I read this page just to find the first mention of Go.

Thanks!

PWND

[Anonymous Coward]

U PWND MY PAWN.

cheat at chess??

[spoonyfork]

Cheating at chess online?? Like how, an aimbot or something? It isn't like the other player isn't going to notice when your Queen bunnyhops across the board and headshots 4 pawns in a row without missing. Feh.

Re:cheat at chess??

[CGP314]

Cheating at chess online?? Like how, an aimbot or something? It isn't like the other player isn't going to notice when your Queen bunnyhops across the board and headshots 4 pawns in a row without missing

Nah, it's nothing that obvious. The cheat takes away the fog of war, just like every 13-year-old bastard I play on battle.net : (

Re:cheat at chess??

[Anonymous Coward]

No, you silly person, it's not an aimbot.

You know the wise saying, "In the game of chess, you can never let your opponent see all your pieces"? Well, that's what this hack does: it lets a player see the whole board, including the enemy side.

You know that exciting feeling you get, when your rook rushes across the board and takes an exposed bishop that stuck it's nose out of the obscured black area .. and you don't know yet, whether the square you just moved into, is exposed to fire from an enemy piece? Well, now that excitement is gone. Now you can move across the board and know exactly what you're getting into. If an enemy moves his knight to cover some pawns, you see it and in real time!

Totally takes the fun out of chess.

Re:cheat at chess??

[Daniel]

Most serious chess games are played with a clock; this analysis shows how to rig the clock on ICC.

Daniel

Re:cheat at chess??

[Mr. Bad Example]

That'd sure make chess more...interesting.

White: (castles)

Black: OMG WTF CAMPING L5M3R N00B

Re:cheat at chess??

[csritchie]

Cheating online at chess is much less sophisticated.

1. Open chess program
2. Input Opponent's move
3. Chess program offers best possible countermove

You never need to know why the move works, how it will help you win or even when mate is near. The program does it all...

Of course online veterans can spot someone using a program fairly quickly. Some sites even try to discourage it by not letting you move your mouse off the app. If you do your opponent is notified and they can adjourn the game.

Even then, all you would need is a laptop and some creative timing skills. But if you need to cheat at chess that badly, when it doesn't effect any legitimate rank you may have for the "traditional" clubs, you need are in desperate need of getting laid and should put away the computer...

Re:cheat at chess??

[addaon]

Chess program offers best possible countermove

Um?

Re:cheat at chess??

[fafalone]

The mouse lock thing is easily defeated by using a TI-89 and TI-Chess, which is surprisingly strong and fast for running on a 14mhz 68000 processor. I've played it against computer programs, and it usually wins.

Re:cheat at chess??

[Anonymous Coward]

This just got my vote for funniest post on Slashdot ever.

Sufficient..

[some2]

security protocol used between client and server provides sufficient security

If two guys are playing and the game randomly changes, a review of the play list can confirm someone cheated. Therefore, they do have sufficient security. There is a big distinction between having sufficient security and being ultra-secure. You don't secure a pool with armed guards to prevent kids from falling in, you simply build a taller fence.

Ob. Red Dwarf reference

[Anonymous Coward]

HOLLY: Prawn takes Horsie.
QUEEG: Bishop-Pawn takes Pawn.
HOLLY: Bish takes Prawn.
QUEEG: Bishop to Knight Five. Double Check and Mate, sucker!
HOLLY: Oh yeah, I didn't see that...
LISTER: Holly, man, what have you done!?
RIMMER: He's lost.
QUEEG: And the loser gets erased.
HOLLY: Noughts and Crosses?

Re:Ob. Red Dwarf reference

[jayhawk88]

And here I thought British humor was dry and impenetrable...

Re:Ob. Red Dwarf reference

[Anonymous Coward]

Red Dwarf,
Monty Python,
Dougles Adams (HHGTTG, and others)
Terry Pratchet (Discworld, and others)

Yes some of it is, but the above is very good.

Re:Ob. Red Dwarf reference

[shirai]

And in a dramatic reversal, Shrimp takes Prawn (twice no less). Before you mod me down, read the parent.

Ah ha!

[jszep]

That's how Deep Blue won...

Ha!

[CGP314]

At long last we have proof that Go is better than Chess. Nobody compromised their server : )

Re:Ha!

[Anonymous Coward]

Didn't compromise their server because in IGS the protocol is open and all timestamps are sent unencrypted. So cheating is everyday behaviour there, although pandanet apparently asked (forced) to change license of gGo from GPL to closed source to prevent cheating. Just because they noticed that most of the cheaters used gGo, as if changing the license would help anything.

Can't believe it

[Nick of NSTime]

Wait, an online chess club doesn't have a good defence? Their server has an opening? The whole web site is one big gambit?

Re:Can't believe it

[Anonymous Coward]

Very punny.

Re:Can't believe it

[DarkMan]

I think that a fork of the codebase is in order. I hope that they're not pinned to the curent version. Something to check, I suspect.

Let me guess...

[Gudlyf]

The password was "JOSHUA".

The Real Challenge

[randall_burns]

Is creating a _really_ secure equivalent of the internet chess club. I see this as a serious opportunity for an open source team to demonstrate how they can do security _right_.

I can imagine that it _would_ be possible to do some really intersting things that would make remote matches _much_ harder to cheat at(i.e. do things like authenticate who is observing each of the remote players).

Re:The Real Challenge

[Anonymous Coward]

Authenticating the observers would help how, exactly?

Re:The Real Challenge

[Scarblac]

Is creating a _really_ secure equivalent of the internet chess club. I see this as a serious opportunity for an open source team to demonstrate how they can do security _right_.

Short history, from memory: Way way back, there was only ICS, the Internet chess server. In 1995, it was turned into the commercial server ICC, the Internet Chess Club, which is still around and going strong. It's closed source and costs money unless you're a grandmaster.

As a protest to this, FICS, the Free ICS was started. It is, to this day, free "as in beer" (if for a moment we assume that beer is free of charge). It used to be Free as in GPL and avilable from the FTP site.

However, after others downloaded the Free code and started their own commercial servers with it (and they don't have to distribute their own changes under the GPL, since the software isn't distributed at all, it only runs the server), the code was closed as the developers didn't like working for free for a commercial server. I believe that server was Chess.net.

Later, FICS new main developer recoded all of FICS, so that none of the GPL code remained - or so he claimed when he sold a copy to a company named GamesParlour during the Internet boom, under some license other than the GPL. He also worked for them for a while. Endless FICS flamewars ensued. There is actually a reasonable chance that his claim is true, since he's been the sole developer for many years now.

Anyway, some people thought this was reason enough to start a new, open source chess server. The one I know of is chessd. I have no idea about its status.

To this day, FICS is still the best place to play chess for free for non-GMs, while talking about AI in the religion channel and politics in the politics channel, and everything else in ch 50.

Oh, and keeping track of time client side, and sending the times to ICC is done there with a utility called "timestamp". On FICS, the equivalent is called "timeseal", and I would be really really surprised if it wasn't at least as vulnerable. I believe there is actually some exploit in the wild. Not many people care though.

(I'm ElOso on FICS.)

Re:The Real Challenge

[1_interest_1]

you stole my sig..... :(

Re:The Real Challenge

[bugg]

Due to my terrible inactivity, sourceforge took away my chessd project page a long time ago, and there is now a new project that's using the same name (grumble) which is bound to create some confusion.

As for timestamp, anyone who thought about it for a second knew it was a horribly insecure model, however, we decided it would be better for all of us not to address it. Not until we could come up with a better model- something I haven't yet seen.

I have all of the sources for chessd and fischer (the server that used an irc-like protocol) around here somewhere...

Re:The Real Challenge

[Anonymous Coward]

The one I know of is chessd. I have no idea about its status.

Let me see.

On the site main page, there is a rendered image of a chessboard.

The bottom right square is black.

Closed window. Rotflmao.

Re:The Real Challenge

[Anonymous Coward]

Several years ago (soon after FICS also implemented the 0.1s minimum time policy) I found a way to play games using that minimum time.

Instead of attacking the client, I just tried to keep my system clock stand still. Setting it backwards made the FICS server disconnect me immediately, but I found I could just constantly set it to the same time, and it never noticed. Meanwhile all my games were 0.1s for every move. It only took about 10 minutes from start to finish...

Of course, I play a lot of lightening, and I don't really need that advantage since there's barely anyone on FICS who can actually move physically faster than I can. ; )

Before they had the .1s limit, I could make almost 20 moves/second with premove. (One person once made 23 in one second against me).

No HTML version. :(

[caluml]

Why no HTML version? Grrr.

Bah!

[zhevek]

I've been a member of the ICC since 1995ish, when you used telnet, and quick typing skills to put your moves in. Leave my favorite work past time alone!! I don't want to have to doubt who I play... and I have played 8000+ games in the past three years on ICC

Adds a whole new meaning...

[Mateito]

This adds a whole new meaning to

"y3r p4wn i5 0wn3d!!!"

Re:Adds a whole new meaning...

[Skidge]

"y3r p4wn i5 0wn3d!!!"

y3r p4wn i5 pwn3d.

Re:Adds a whole new meaning...

[Ratface]

Dags att skriva lite mer svenska på din sajt eller hur? :-D

Security Through Obscurity...

[Paster Of Muppets]

...didn't a little software company called Microsoft try that once?

Legality?

[maximilln]

I'm all for it, but...

Was this legal?

Aren't there local, state, federal, and international laws against exposing the vulnerability of a private system? Haven't many people already been harassed by the FBI for doing much the same thing with corporate systems? Or do these people get a free pass because they're from a University?

Re:Legality?

[MrMr]

Aren't there local, state, federal, and international laws against exposing the vulnerability of a private system?Haven't many people already been harassed by the FBI for doing much the same thing with corporate systems? Or do these people get a free pass because they're from a University?

How about:

No Yes Yes No Yes No

But then, IANAL

timestamp

[xiphy]

The article writes that time stamping can be easily defeated.. yes it can (using User Mode Linux usually works better than intercepting the kernel calls) but playing a chess game on a bad connection without timestamping just sucks.. (I tried it with FICS.. it's the free internet chess server http://www.freechess.org ). Being able to steal credit card numbers is naturally not the same category.

Will they ever learn...

[aj50]

Why don't companies/organisations learn from each other. Security through obscurity never works unless you're so small/worthless that no one can be bothered to try to crack you.

Any company/organisation that feels itself to have any value should invest in good security measures.

Bobby Fischer in the ICC ?

[rainer_d]

Well, not currently. He's detained in Japan and has just fought of (temporarily) his deportation to the US.
Bobby Fischer certainly has a very interesting and complex personality....

Rainer

I'm not surprised

[stratjakt]

If you ever rub elbows with the crowds that really get into chess, you'll find them an honorable bunch.

There's nothing for them to gain by cheating at chess. There's no reason to expect anyone else to cheat at chess. Thus, little reason for security.

Re:I'm not surprised

[Anonymous Coward]

You do not count for the possibility of someone sabotaging the game for their own purposes.

Re:I'm not surprised

[stratjakt]

No, why would you?

People play chess because they enjoy chess. Why would someone play just to cheat? What's the reward?

"Time chess" aside, how could you cheat anyways? As soon as I see a rook move diagonally, or two pieces move at a time, I know theres cheating. How exactly do you "cheat" at chess without it being blatantly obvious?

Now if they found out how to "cheat" at blackjack or poker on an online Casino, that's something to talk about. There's cash money involved. People generally secure things where there's something to lose.

You want to come over and play chess, and start knocking my pieces off when I'm not looking and shit, go ahead. It just makes you an idiot.

I just don't see the big whoop with this story. It makes sense that the ICC isn't the Fort Knox of the internet, why would it be?

Re:I'm not surprised

[azaris]

If you ever rub elbows with the crowds that really get into chess, you'll find them an honorable bunch.

I've found that there are three kinds of Chess players: nice guys, deep thinkers and assholes. Chess ability seems to be independent of which group the player belongs in.

Re:I'm not surprised

[pjt33]

I have a book entitled "How to cheat at chess".

Stale news

[Anonymous Coward]

I haven't read the paper, but my bet is that it's an exploit of timestamp, a program that adds time to the clock to compensate for lag. This was exploited two years ago on FICS, and such an exploit for ICC (they run off of similar codebases, including timeseal/timestamp IIRC) was inevitable. The hacked copy of timestamp rolls back the system clock a few milliseconds each move, thus making the server see it as lag.
Now, they just ban users that use the exploit.
If you're going to post a story, at least make sure it's recent.

What happened exactly?

[Old Wolf]

ICC's game security relies on a program called 'timestamp' that accurately records how much time you used for the move (so that players with more internet latency than others don't get penalised).
This timestamp program is not open source but they publish a binary version for various operating systems.
It sounds as if someone has hacked this (ie. so you can tell it that your move took 0.1 seconds -- the server deliberately does not allow moves to be faster than 0.1 seconds). If you have ever played a timed chess game (especially, one with short times, eg. 1 minute per game), you will know that this represents a huge advantage.

I don't know what the article means about "complete control over the game", the server does not allow illegal moves etc. -- unless they have somehow hacked into the server, or managed to insert packets into the TCP/IP connections between the server and the opponent (which would be a problem with FreeBSD or the opponent's OS).

Also the article mentions 'network security protocol', which is odd given that you can play games there by a plain telnet connection (telnet to chessclub.com:23 or chessclub.com:5080) or any 3rd party clients with no security.

The Windows client software supplied by ICC includes some un-documented security to validate itself (ie. let the server know you are using this piece of software and not a 3rd-party client), this is useful for detecting if people are trying to cheat by getting a chess-playing program to automatically play their moves for them.

And finally, I fear that a "robustification" of timestamp, to use accepted open security mechanisms, would end up in greater lag for the players -- either due to greater packet sizes, or greater processing power required by the client or the server (which has to do this for 4000+ connections at once), which is a pity (even 20ms is noticeable in a speed game of chess).

Anyone have more information?

Re:What happened exactly?

[14erCleaner]

Anyone have more information?

You could read the actual paper, but this is Slashdot, after all...

Yes, they hacked the Linux version of the timestamp client to send zero move times. They also reverse-engineered the timestamp protocol.

Security is an issue because they're exchanging passwords and credit-card numbers with the client. The authors were able to crack the "encryption" being used to transmit this stuff (a 100-byte one-time pad) by sniffing only 10 bytes (it was a very predictable sequence). The client and server also exchange two 64-bit keys in the open when the session is opened, which are used to generate the 100-byte pad.

Re:What happened exactly?

[Old Wolf]

(-5 Lame, for replying to my own post)

Having read the researcher's paper more fully: there are two "network security protocol"s in question:
1) 'timestamp' encrypts its messages to prevent tampering; this is obviously useless if you have already reverse-engineered the timestamp program
2) the Windows client uses some weak security to identify itself and allow credit-card processing.

Obviously the solution to (2) is, as the researchers suggest, only allowing credit card by a secure web-based system (which are known to work as well as possible).

As far as (1) goes, the paper highlights some possible improvements. Also note that this only applies to speed games -- in a long game (eg. 15 minutes per side), a couple of extra seconds won't make a difference, and ICC offers the facility to prevent people from playing games with you if their lag is above a certain limit you can specify.

FWIW the claim by ICC that they don't keep a record of credit cards is FALSE, as one time, I was accused of cheating by an administrator, whose evidence was that I paid my account with the same credit card as my creditcard-less friend's account (and the dumb admin thought that therefore I had 2 accounts).

Re:What happened exactly?

[Anonymous Coward]

FWIW the claim by ICC that they don't keep a record of credit cards is FALSE, as one time, I was accused of cheating by an administrator, whose evidence was that I paid my account with the same credit card as my creditcard-less friend's account (and the dumb admin thought that therefore I had 2 accounts).

It is possible, though unlikely given the current revelations, that ICC stored a hash of your credit card info, which would allow them to perform this check for cheaters while protecting your info.

Re:What happened exactly?

[vadim_t]

If it's a predictable sequence, then it's not a one time pad.

An OTP needs to be only used once, and to be completely random. Besides, it can't be generated in place. I wrote a small chat program that used an OTP once.

The way you do it is to use some good random number generator, such as /dev/hwrandom on boards that support it, wait until enough data has accumulated, and send a copy to the person you want to talk to. Then you need some kind of protocol to agree on which part of the file you're using.

Re:What happened exactly?

[AMystery]

There is nothing saying an OTP HAS to be random, it just has to be used only once. You can use any series of characters, including 'aaaaaaa'. Of course if you do that then you are a fool, but chess experts are often considered fools, just highly intelligent fools, which are the best kind.

This has made me want a good game of chess, i was never as good as I'd like, but I did enjoy it. If only the computer would let me win occassionally, it is very hard on my ego.

Re:What happened exactly?

[eison]

Not a perfect idea, unfortunately; hashes are not guaranteed to not have collisions.

They are most useful for indicating it is extraordinarily unlikely that a given message was modified from its original. They are unfortunately not clearly useful for indicating one 16 digit number is not another 16 digit number; two 16 digit numbers may or may not hash to the same value. I am not aware of a solution beyond hashing all possible 13 to 16 digit numbers and looking for collissions; but that brings us around to the problem that once you've admitted you can make a full dictionary, if you prove there are no collisions in the relevant space you now have a 1-to-1 mapping and your 'unbreakable' encryption can be decrypted, and if there are collisions then storing hashes doesn't do much good.

I don't know a good solution, unfortunately.

Re:What happened exactly?

[vadim_t]

Well, the concept of an OTP always has "truly random" mentioned somewhere in it. It's because the whole thing works on the idea that by adding truly random noise to a message produces something that looks like more noise.

Re:What happened exactly?

[mistersooreams]

I don't know what the article means about "complete control over the game", the server does not allow illegal moves

But the server does allow bad moves. Perhaps the idea is that you can intercept your opponents moves and change them to something worse. I agree that this seems a bit silly because it's not like they aren't going to notice.

And finally, I fear that a "robustification" of timestamp, to use accepted open security mechanisms, would end up in greater lag for the players

It wouldn't. The time required to encrypt and decrypt with OpenSSL et al is barely perceptible.

Even 20ms is noticeable in a speed game of chess

I really doubt that. 20ms is about the human reaction time. Over 50 moves, it adds up to one whole second. Even in speed chess, that seems like pittance to me. The point of timestamp is that this extra delay wouldn't matter anyway.

Re:What happened exactly?

[Old Wolf]

Well the human reaction time is about 400ms (eg. this figure is used in drag racing timing -- if your car moves less than 400ms after the light goes green, you are disqualified).

So you can actually move the piece in anticipation that the opponent's move will arrive in the next 300ms or so, and so achieve an actual move time of even as low as 100ms. Obviously this technique is best when your plan isn't affected by what the opponent's move might be.
Incidentally this is a common cause of losing speed games: if you are both down to under 1 second, under perfect net conditions you can each move every 100ms (the server-imposed limit). But if there is a slight bit of lag (causing the opponent's move to not come in that window when you are expecting it), you will make your move too soon (so the client will ignore it), and you have to reposition the mouse and move again, so your move may take 400ms+ to go through, so you lose on time.

Let's say 100ms instead of 20ms then: when I change ISPs and have 400ms lag instead of 300ms, I can really tell the difference (in fact I play worse since I am not used to having to move that bit much faster).

But you're right: on the client end the calculation time would be neglibigle. (In fact I think the existing timestamp is slow: ICMP pings are consistently about 60ms faster than pings over the timestamp connection).

Re:What happened exactly?

[Minna Kirai]

Well the human reaction time is about 400ms (eg. this figure is used in drag racing timing -- if your car moves less than 400ms after the light goes green,

No, it's closer to 200ms. The racing board must add in some time to account for the motor's acceleration.

Kind enough ?

[Cygnus78]

But were they kind enough to let ICC fix their security hole before they published the article ?

Security Rule # 1

[UrgleHoth]

The first rule of Chess Club is - you do not talk about Chess Club.

Security through obscurity meme...

[Alomex]

The RSA company created the "security through obscurity is useless" meme as a way to sell their product (public key cryptosystems).

However, in reality all security is through obscurity. For one you need to keep the (private) key secret.

In practice, good security is composed of several layers, one of which should be obscurity. For example, you might RSA/ssh restrict access to a host, but it still pays to (a) not advertise its existence (b) make it insconpicuous (c) close logins to an account after more than three failed attempts (d) keep the communication protocol secret (e) place a good lock on the door to the computer room (f) not write the password on a post it note and place it in your drawer (g) ... you get the idea.

Notice how many of those listed above derive security from obscurity in practical, effective ways.

Re:Security through obscurity meme...

[HeghmoH]

However, in reality all security is through obscurity. For one you need to keep the (private) key secret.

That is not what "security through obscurity" means. The term refers to keep things other than the key secret, such as the algorithm, the magic key combination needed to get the password prompt, etc.

Re:Security through obscurity meme...

[sholden]

Don't let the fact that Auguste Kerckhoffs came up with the principle in the 1880s interfere with your "RSA made it up to make money" FUD.

Re:Security through obscurity meme...

[vadim_t]

But that's not what security by obscurity is.

Security by obscurity means the security of your system depends on its implementation being secret. Say, some program claiming to be secure that sends "encrypted" data by XOR'ing it with the string "password" which is fixed. Same goes for a chat server I reverse-engineered which tried to make it difficult to write different clients by sending you a number, and requiring you to apply some math on it and send it back. As soon as somebody decompiled it, the math that had to be done was found, so it was broken and anybody could write their own client.

Now, real security is something like ssh, where even if you have the source, know how all the encryption works, and are Bruce Schneier, and you still can't do anything better than to try every possible key

Re:Security through obscurity meme...

[Alomex]

Kerckhoffs might have been the first to say it, but in practice nobody paid attention until PKC became a reality. Don't believe me? Look at the Enigma and DES, both of which used security through obscurity (in the case of the enigma, the entire encrypting device was secret, in DES the content of the S-boxes was classified).

Re:Security through obscurity meme...

[Peter H.S.]

Kerckhoffs might have been the first to say it, but in practice nobody paid attention until PKC became a reality. Don't believe me? Look at the Enigma and DES, both of which used security through obscurity (in the case of the enigma, the entire encrypting device was secret, in DES the content of the S-boxes was classified).

I don't know about DES, but I can assure you that Kerckhoffs principles were primary design parameters for the German development of the Enigma or any other important German ciphermachines like the (more important) SZ/42. The German Heer counted on, that its enemies would/could have full knowledge about how the Enigma machine worked. And with more than 100.000 Enigmas build and issued to even low level units it was reasonable assumption to make.

An obscure reference; Kerckhoff along with the use of different ciphersystems during World War One is mentionend in Jaroslav Haseks classic novel "The Good Soldier Svejk". Yet another reason to read this fantastic book.

Re:Security through obscurity meme...

[Alomex]

The capture of the enigmas was a big step towards breaking them, both by the Polish cryptographers before WWII as well as by Blechtley Park in the UK.

Re:Security through obscurity meme...

[Peter H.S.]

The capture of the enigmas was a big step towards breaking them, both by the Polish cryptographers before WWII as well as by Blechtley Park in the UK.

That is not the point. The point is that the Germans were paying close attention to Kerckhoffs principles in the design of the Enigma. The strength of the Enigma relied on secrecy of the keys not in keeping the Enigma machine a secret.

The primary reason that the Enigma was broken was because of bad German procedures and sloppy use of the machine. Had the Germans made better procedures for the use of the Enigma and been less sloppy with its use, it is highly improbable that the allies would broken the Enigma cipher, no matter how many Enigma machines and code wheels they captured.

Re:Security through obscurity meme...

[jetmarc]

> > However, in reality all security is through obscurity. For one you need to keep the (private) key secret.
>
> That is not what "security through obscurity" means. The term refers to keep things other than
> the key secret, such as the algorithm, the magic key combination needed to get the password prompt, etc.

To elaborate a bit on this:

Its difficult to keep things secret, and even more so if there is A LOT to keep secret.
Staying with the example of the server, theres the electrician who wired the secret
server closet. Theres the cleaning woman who has a key to it. The air condicion guys
know about it, and the ISP as well. Etc

The idea is to peel off layer by layer, moving things from the "secret" side of the
project to the "public" side of it. If the server is encrypted, even with a keyless
algorithm, the aircondition guys are out of the game. You dont have to worry about
them anymore. The worries are now reduced to your technicians who installed the key
less program and thus might have a copy of it. And the manufacturer of the program
of course. Etc.

The next step is obviously to use a keyed algorithm. Then the manufacturer is also
pushed to the "public" side of things, and the "secret" is easier kept secret.

At this level you gain even another advantage: you can have your algorithm inspected
for flaws without giving away the secret.

Thats whats meant by "security through obscurity doesnt work" - it CAN work, but its
helluva difficult to achieve in reality. Miss a single link and the chain breaks,
revealing all the secrets. It happens with keys too (all the time), but a lot less.
Its so much easier to keep a key secret than a whole server infrastructure and its
user base and the network connecting them.

Re:Security through obscurity meme...

[Alomex]

The point is that the Germans were paying close attention to Kerckhoffs principles in the design of the Enigma.

Do you have a reference for this? The Germans certainly went to great lengths trying to prevent the capture of enigma machines by the allies.

Re:Security through obscurity meme...

[Peter H.S.]

I think David Kahns "The Code Breakers" is the best source, but I can't find my copy of it:(

But Simon Sings "Codebook" has something about it. See also
http://www.simonsingh.net/History_of_the_Science_o f_Secrecy.html
and
http://www.open2.net/ictportal/comm/security/singh 3.htm

Also see the section: "Security properties" in http://en.wikipedia.org/wiki/Cryptanalysis_of_the_ Enigma

Nostalgia.

[e9th]

Beating up on the chess club (when the AV club wasn't available) really brings me back to those good ol' high-school days.

Re:Bobby Fischer in the ICC ?

[FiReaNGeL]

Well, even when he was not detained, I doubt that he would play there. In a recent interview (while in captivity) at ChessBase (www.chessbase.com), he said he don't play chess anymore, only 'FisherRandom', special chess with altered rules he invented. Basically, you shuffle backrank pieces identically for both players (there's one or two more minor rules I think). Makes the game more interesting (for him!) at his level of play.

This has been going on for ages!

[aardwolf204]

What is it with chess playing computers using security through obscurity? First a high school kid breaks into the chess playing WOPR by guessing the password, Joshua, deceased son of programmer Dr. Falcon, now this? Next thing you know someone is going to post an article about how some kids figured out how to make free phone calls by shorting a payphone handset with a cola can tab, a cptn. crunch wistle, and a 6.5536Mhz crystal.

How to fix it!

[d41d8cd98f00b204e980]

...and can effectively play a zero-time match...

That should be easy to patch doesn't it?

if($gameOver && $matchTime eq 0) Response.Redirect("niceTrySmartPants.jsp");

or something along those lines.

Cheating through outside programs

[Deliveranc3]

In chess on Yahoo many of the top players use a chess program it's really simple:
set it to super hard
move as your oponent
lose to computer you win.

In FPS' Anyone who's been to a lan cafe has seen screen watching but it's little brother talking on the phone or using a voice comm program to communicate with teamates (while alive and dead).

The worst part about cheats like these is that the cheater doesn't think they are cheating, if you ask they won't know what you are talking about.

It's fine in matches where both teams are doing it but in public servers it's definitly cheating, in some games like quake or CS(With death cams it's kind of a problem it's not always obvious but in games that rely heavily on knowledge such as raven shield knowing where your teamate was shot from after he dies can be decisive.

Please people if you have access to information your opponents cannot possibly have access to consider what you are doing to the game.

I like things like death cams and teamwork but I'd have to take steps against this kind of thing if I was running a server, though usually the people running servers are the worst offenders, Ventrillo anyone?

Re:Cheating through outside programs

[VStrider]

Thats exactly the reason why most people play 1 or 2 mins games only. It's sad. I'd like to play 5, 10 or 15 mins but i'm quite sure i'll face fritz or crafty most of the times. Heh, I've even lost many 2 min games cause of cheaters. I don't know how they manage to do it on 2 mins. I suppose they use some modified client and the engine plays the moves without their intervention.

But what's the point in playing chess on autopilot?

Re:Cheating through outside programs

[Sigma 7]

In FPS' Anyone who's been to a lan cafe has seen screen watching but it's little brother talking on the phone or using a voice comm program to communicate with teamates (while alive and dead).

I've seen some games that have fixed this problem. Firearms, for example, causes the screen to turn black as soon as you get killed (although you can still hear sounds.)

While Firearms is still vulnerable to the spectator issue where players can scout the map for last pieces of resistance, it's a simple change to require the players to do first-person spectating as well. These two systems combined will prevent any player from gaining knowledge that he should not have.

FICS

[nebulus4]

Does anyone know if FICS (Free Internet Chess Server) uses the same security scheme and therefor also compromised?

Re:FICS

[SashaM]

FICS is not better on the timestamping front though. Their own algorithm, called timeseal is not any more secure than timestamping. I know because I wrote a client for both ICC and FICS.

Re:FICS

[Hollins]

I prefer ICC because I have to play. While there are a few exceptions, the players on ICC tend to be far more mature than any free chess service. I suspect this is because there is a cost of entry.

Re:FICS

[Hollins]

that should have read 'because I have to pay'.

Re:FICS

[Anonymous Coward]

Did you have to sign a NDA to not release the timeseal/timestamp code? A quick octal dump
of the limux timeseal does not show any of the
symbols they mention. I am quicker to believe
that they got the source and found those names.
They could pretend to be a new interface coder,
ICC gives them what they need to finish their interface and ... whammo! This paper.

Security by Obscurity...

[Anonymous Coward]

How poorly that works, I'm sure plenty of american agents working over the border during the cold were were damn glad of how good it does work.

It's a bad idea to rely on it, but then it's a bad idea to rely on any one thing to provide all your security.

Karate Kid Security

[BurritoJ]

aka... Him throw punch, you no be there.

Re:Bobby Fischer in the ICC ?

[rainer_d]

> Well, even when he was not detained, I doubt
> that he would play there.

Yeah, I have my doubts, too (and I don't play chess).
But it was fun while it lasted.
Every other year, he sort of appeared in some random part of the world (was - supposedly - even spotted in Germany once, some years ago) and disappeared immediately.

Apparently, there's a Japanes woman who wants to marry him...

Rainer

In marginally related news...

[TheMonkeyDepartment]

Next week I'll be publishing a paper about my neighbor's house, entitled "How to Get Free Jewelry: A Security Analysis of the Robinson Estate". I'll be posting this paper on all the telephone poles in the neighborhood.

It seems as though the Robinsons, who live down the street from me, relied on security through obscurity. I guess they were asking for it! I sure am doing them a favor by exposing this vulnerability.

Hmm

[Dirtside]

Looks like the only winning move is not to play.

Not quite research

[Gyorg_Lavode]

Honestly this paper sounds a bit childish. It seems as if the write is either very proud of himself or very unhappy with ICC. It seems that reasonable efforts were made for security though not wonderful. The server should compare calculated network lag to tracrt network lag, and should remove the symbols, but there is only so much you can do to keep someone from reverse engineering a small binary. The 64 bit seed seems to need an asymetrical encryption, but really what else is needed? And is there a HUGE worry that there will be a man-in-the-middle attack against your chess game? These are paying customers of a chess server, not bnet and CS script kiddies. The critisism of ICC is way too harsh. (And undeserving of a slashdot front page article I might add.)

ObTrek

[red floyd]

But do they know the proper response to Queen to Queen's Level 3?

More accurate summary

[munch117]

Security through obscurity rocks! Hence MS Windows is better than Linux because it is more obscure.

And we owe it all to Steve Ballmer: "Developers! Developers! Developers!" Thrice the developers, thrice the line count, thrice the obscurity, thrice the security.

Or something like that.

Re:More accurate summary

[Anonymous Coward]

actually, I would take that as an argument that linux rocks because windows' ubiquity makes linux far more obscure in the desktop market.

FICS

[bcrowell]

FICS is better than ICC anway. FICS is free. ICC makes you pay.

Integrated timestamping

[SashaM]

The article says that no unix chess client comes with integrated timestamping, which is a good reason to plug mine - Jin, which does.

Also, I'm an ICC admin and I can tell you that we're looking into the issue and will probably publish an official response later.

Re:Integrated timestamping

[shdragon]

When an official response is posted, please let us know. Thank you!

Re:Integrated timestamping

[Anonymous Coward]

I can tell you that we're looking into the issue and will probably publish an official response later.

You just did ;)

Re:Integrated timestamping

[Anonymous Coward]

Official, dumbass.

Re:Integrated timestamping

[Old Wolf]

Jin users are allowed to play rated games now?

Re:Integrated timestamping

[SashaM]

They always were, unless you're on your free week (or on the force list, which forces you to use Blitzin).

Re:Integrated timestamping

[jez9999]

Mr. ICC admin, I don't wish to pay money to use a chess server when it takes less processing power/bandwidth to run one than your average IRC server. Could you tell me what happened to FICS (It seems dead now :-( ) and whether there are any ICC-like free chess servers around, other than Yahoo?

Re:Integrated timestamping

[SashaM]

FICS is not dead. ICC does have its advantages over a free server though (and even more over one you run yourself) - GM games/lectures, prize tournaments, an expert anti-computer-cheating team etc.

Re:Integrated timestamping

[jez9999]

With the exception of prize tournaments (the money's got to come from somewhere), I fail to see why all this cannot be done on a free server. GMs can play on free servers, anti-computer cheating systems can be donated/developed for free (FOSS), etc. It may be more likely to happen on ICS, but there's no thing other than, IMHO, a general feeling of smugness ('I've got the money to PAY for my chess!') that prevents stuff like GMs playing on FICS.

Re:Integrated timestamping

[Anonymous Coward]

It's like the office application wars.

Chess players just want to play chess. They don't give a crap about free software, open source, having to pay $50/year, the politics of what happened in the past.

They want to play chess against the strongest players possible. So "Everybody" decided ICC was the place to be at one point, so that is where everyone is now.

Maybe there's no reason why it couldn't be done on a (mostly) free server (there are bandwidth costs, and other expenses, FICS had some problems with this for a little while), but you're not going to move everybody simultaneously.

No one cares. Tough love.

Security through Obscurity == Rule Number One?

[PinchDuck]

Rule # 1:
You don't talk about Chess Club

If a nerd does something and no one cares

[gelfling]

does it still really happen in the forest?

Better Server

[strike2867]

A better place is freechess.org. I suggest using the Thief interface, especially for bughouse games. There are about 10 times more people on there playing bug than on ICC. Don't know about normal chess, but I've seen quite a few GM's on there. Played a couple too(it's not fun).

Old ICC Flaw

[PingPongBoy]

It was possible to win a game just by refreshing the board so much that the opponent's timer ran out. Later the ICC had timestamping which should reduce effects of net lag.

Pink Elephant

[Cryogenes]

The pink elephant overlooked in this discussion is that cheating in online chess is trivial anyway - just let Fritz make the moves for you and you win every time (except, perhaps, against Kasparov and, of course, other cheaters).

So, no point in reverse engineering the client and cracking the protocol just to fake some latency in order to gain some extra seconds. Which only help in blitz games anyway. Which are a lot more fun to play offline anyway.

Re:Pink Elephant

[TheLink]

Don't need to use Fritz.

If you are ranked #14225, play against the #1 and the #2 at the same time - just different colours.

Use their moves against each other. You'd win one game and lose another game, but your rank should go up. :)

Re:Bobby Fischer in the ICC ?

[poot_rootbeer]

he don't play chess anymore, only 'FisherRandom', special chess with altered rules he invented. Basically, you shuffle backrank pieces identically for both players

And why doesn't he shuffle the front pieces, too? That would make it even more interesting.

(I know only just enough about chess to make this post.)

I cheated YEARS before he wrote the paper

[Anonymous Coward]

I cheated YEARS before he wrote the paper.

I merely play on a processor lacking a 64 bit Time Base register stamp (or claiming to no via virtual machinet), and use a system driver to alter system tick clocks and sync with time of day, then AFTER every send i speed-correct time to match real time clock, but when Its my move i hit CAPS-LOCK key and my code makes the system clock tick not advance.

out of band cheating.

no need to modify code

worked well

that guy who wrote the paper has no imagination, and lacks true hacking skills

Checkmate

[slavemowgli]

Check and checkmate. :) If they relied on security through obscurity, they got what they asked for.

Heard the talk

[arvindn]

John Black (first author) presented this at the Crypto 2004 rump session. It was a fantastic talk, and I was fortunate to be there.

In general the timestamping problem is clearly an insoluble one, because the server has no way to tell if the human took only as much time to think as the client software claims. Obfuscation is a stopgap solution that deters the casual attacker, but there is no cryptographic solution apart from "trusted" hardware (yikes).

The way the music/movie industry has tackled the problem is to go on the offensive and call everyone a criminal. Let's see what the ICC does.

Re:Heard the talk

[HawkingMattress]

Don't understand, where's the insoluble problem ?
The server could issue a timestamp when the new turn instruction is sent to the player, and stop it once the move is received. The client doesn't have to send a timestamp, the timestamp is the moment when the move is received serverside. Why can't they simply do that ?
Ah, unless they want to start counting only when the client effectively received the packet, and sent an ack to the server ?

Re:Heard the talk

[mikec]

The whole point of the timestamp business is to compensate for message latency. My opponent might live in South Africa, Brazil, or Siberia, at the far end of a slow connection. Even if my opponent responds instantly to every move, absent timestamping, he or she will get charged a second or two (or more) on every move. If we're trying to play 40 moves or so in 3 minutes, that is significant.

Did anyone ACTUALLY read the paper?

[Spy der Mann]

We already know that security thru obscurity is no security.
Still, the paper was very insightful regarding security protocols. I think we should all download it and learn how (and how NOT) to implement a security mechanism.

In Related Chess News...

[evilninja]

There are several new stories today about Bobby Fischer winning a deportation injunction in Japan.

Dungeons and Dragons club still secure

[Anonymous Coward]

still no word from the guys who dress up in home made armor.

the solution to this cheating..

[Suppafly]

So when is PunkBuster going to come out with a new version that supports all the popular chess clients?

Not Risk

[unicorn]

The dice are too fickle. Fairness would involve reducing it to a pure strategy game. The dice and teh cards in Risk make it much less than pure strategy.

Re:Not Risk

[VendingMenace]

I am curious to hear why you think that a fair game must be reduced to a pure strategy game. I would think that as long as everyone is exposed to the same probabilities, then the game is fair. (ie. everyone has the same chance to roll a certain number)

Am i wrong in thinking this? I would be quite interested to hear.

I am serious here. I really want to know if my thinking is wrong.

Hackers games

[frakir]

Authors of that analysis took really hard way to crack icc binary timestamp. Takes about 2 hours to get ICC java client, find java timeseal class and disassemble it. Same is true for FICS (freechess.org).
Been there, done that (also once wrote a client app for both servers).

While writing timestamp version with public/private key authentication would work against snooping CC numbers, lag info can always be altered with simpler means then cracking timestamp. For apps using local clock system calls can always be hooked/intercepted (someone did that in Linux about a year ago)

Favourite article quote

[cwernli]

"Since rearchitecting the Internet is both infeasible and falls short of a full solution (...)"

I couldn't agree more.

Re:Bobby Fischer in the ICC ?

[Rosonowski]

You might have been trying to funny, but I wonder about moving the peices in both dimensions?

Busted.

[pokeyburro]

Looks like you gave yourself away there. Now we know Anonymous Coward is really Mateito (746185).

Re:Busted.

[Anonymous Coward]

Oh... that asshole...!

Re:Bobby Fischer in the ICC ?

[hunterx11]

They had been living together for a while and didn't feel the need to get married. They're getting married now to try to prevent his deportation.

Visual pun at the end of Aliens...

[vudufixit]

"Queen takes Bishop"

Re:Bobby Fischer in the ICC ?

[Anonymous Coward]

I have my own variant where I play chess on a Go board. I call it "Guess."

hey!

[Zilfondel2]

You insensitive clod!

I'll...uh...challenge you to a game of chess for such an insult!

Re:Um...

[itriedeverythingelse]

Don'y you mean professor? At least quote it correctly.

Using chess-playing program impossible to prevent?

[Ghostgate]

this is useful for detecting if people are trying to cheat by getting a chess-playing program to automatically play their moves for them.

Isn't this unavoidable, though? I mean, couldn't someone just switch back and forth between the ICC client, and say, one of the Chessmaster programs for example? (or if the client detects switching away and reports it, then have Chessmaster on another computer) Then, set the Chessmaster computer opponent to a high level, and play your opponent's moves against Chessmaster. And whatever moves Chessmaster makes, you play on ICC.

So to me, there is no possible way of preventing people from cheating in online chess. I mean this could even work in speed chess if you are fast enough, and set the timer low in Chessmaster (or whatever other program). Ideally, set it lower than the real match time, to make up for the "lag" of seeing what move to make and then making it yourself. Of course you'd have to be pretty damn fast to win a 1 minute game that way, but it could be done.

worldwinner.com's security

[unk1911]

now if only worldwinner's security could be defeated.. one could make quite a buck through that system.

The First Rule of Internet Chess Club is...

[Anonymous Coward]

Never admit to being a member of Internet Chess Club.

The second rule of internet chess club is...

Never admit to being a member of Internet Chess Club.

There's hope?

[CBob]

For me to actually win a game again then?

(it is possible to forget enough basic chess to lose to most any program, let alone human. it just takes 20 years of neglect)

I wonder if AE DT'ing pawns are considered tasteless? (obEQ)

Re:Bobby Fischer in the ICC ?

[Anonymous Coward]

Try it, and you'll soon discover why that doesn't work.

Why not just checksum the "timestamp" program?

[Captain McCrank]

So, if timestamp is a seperate binary, why doesn't the app just do a checksum of the timestamp binary and verify against a central server. Is there something I'm missing?

The recommendations in the whitepaper seem overly complicated. Anyone care to explain why a checksum would be inadequate?

Re:Why not just checksum the "timestamp" program?

[Anonymous Coward]

1) Because the code to Calculate the checksum can be hacked.
2) Because the code to Transmit the checksum can be hacked.

Re:Why not just checksum the "timestamp" program?

[russx2]

If you think about what you're suggesting, you'll realise you're only 'protecting' one hackable program with another.

Right, so our timestamp binary can easily be modified. So we'll get another client-side program to check the validity of the binary and send us the checksum so we can be sure. See? It would just mean an extra (simple) step to hack. Just crack the checking app to send back a faked checksum.

Who cares?

[sokoban]

I like FICS better than ICC, but anyways...
Why does it matter that much about someone breaking timeseal? If you're cheating on ICC, then you truly must have no life. Yes, there are some prizes available for their tournaments, but to play on ICC just to win stuff is silly. Chess is a game. If you cheat so that you can win some rinky-dink prize or, even more deplorably, to just boost your rating then you are truly a pathetic individual. Any win by cheating is essentially hollow and meaningless. Chess is fun, but cheating seeems like one way to make it un-fun really fast. When chess stops being fun, what's the point?

Re:Who cares?

[Anonymous Coward]

FICS already forbids xboard/winboard connections, requiring the clunky java app.
Why? rampant cheating!

Re:Who cares?

[gnoblins]

This is totally inaccurate. FICS allows anyone to connect with any client, provided they have registered. Unregistered users have to use the clunky hava app.

Joshua

[aggiefalcon01]

Yes, maybe Bobby Fischer has played on the ICC. But has Joshua a.k.a. WOPR made an appearance? That would be something.

Completely broken, not just the timestamp.

[Eric Seppanen]

Why is everyone obsessing about the timestamping problem? Didn't anyone read past page 6? The entire encryption system is broken, meaning there's a man-in-the-middle attack to sniff or alter any game traffic on the wire. The paper seems to vaguely suggest that even ICC credit card payments get sent using this completely bogus cipher.

Firefox

[tqft]

http://slashdot.org/articles/04/07/08/2159244.shtm l?tid=126&tid=128&tid=154&tid=172&tid= 95

There is a confidential flag in bugzilla and is used to keep those currently unfixed security bugs out of the public eye

Interesting

[Pan T. Hose]

Would it be equally easy with Go?

Kriegspiel

[Anonymous Coward]

Interestingly, there is a variant of chess which plays just like you describe: Kriegspiel. Each player sees their own pieces and not their opponent's pieces.

I've never actually played it; regular chess is enough for one lifetime!

Researchers?

[MrMrBen]

Since when does figuring out that someone else's software isn't secure count as "research"? We keep reading about "security researchers" finding this or that exploit, but that doesn't sound like research to me. All these researchers are doing is figuring out that somebody didn't write very good code or didn't think about the security enough. Sure, if you figure out that a widely accepted approach to security had a flaw, that would be research, but finding a problem with a specific case just sounds like QA to me. I'm curious why universities would fund people to tryg to break into any random piece of software.

Re:Bobby Fischer in the ICC ?

[Anonymous Coward]

well, his personality isn't *that* interesting.

he's an insecure, paranoid, raging anti-semite.

some of his chess results will probably never be equalled, however.

Also playchess...

[arafel]

As the subject says, there are other chess servers. The other large one I know about is PlayChess, which is run by ChessBase (the same company who produce [Deep] Fritz and others).

I realise you probably know this, but I'm guessing other people probably wouldn't. :)

Technically, you're right

[unicorn]

At some base level, you're right. When both players are equally exposed to the same random functions, then it's technically fair.

At the same time, being subject to the vagarities of fate seems unfair on some level. And for that reason I wouldn't classify a game that uses random functions in any way, as being on quite the same level as one that is a "pure" strategy game.

Sad

[Cyclone_TBW]

My dad play there pretty regular. He is world rated master (2100+) and there reason he loves that site is because it is secure and has good talent that comes through there. I play every once in a while and do enjoy the site. Hope you get everything fixed before their is any permanent damage.