Slashdot Mirror
Internet Chess Club Security Defeated
Scott_F writes "Researchers at the University of Colorado at Boulder have been able to defeat the security mechanisms of the Internet Chess Club and can effectively play a zero-time match, as well as have complete control over the game. The paper is titled How to Cheat at Chess: A Security Analysis of the Internet Chess Club. If you're not familiar with the ICC, it is where many Grandmasters play regularly, with rumors of Bobby Fischer making an occasional appearance. It appears that the ICC has relied on security through obscurity, but we all know how poorly that works. Chess, anyone?" Update: 09/08 21:08 GMT by J : In totally unrelated chess news, I found today's commentary on Zermelo's Theorem interesting, both for the math of the game and the look at a mistaken echo chamber.
Shall we play a game?
Check Mate in 1 then..
Rus
Cheap UK and US VPS
Checkmate.
Doh! No Fair!
..is not as bad as its reputation. Of course it is not enough and you should not rely solely on it. But it can be a helpful part of your whole security-plan. Read more in this interesting paper by Jay Beale, the Lead Developer of the Bastille Linux Project.
Chess club relies on security through obscurity; got cracked. Therefore security through obscurity sucks and its polar opposite, open source security, rules. Therefore open source rules. Therefore Linux rules. Therefore Microsoft sucks. Apple, we don't yet have an established opinion on.
Would Yahoo! Games be more secure than ICC? If so, why?
I'm always up for a nice game of global thermonuclear war...
Cheating at chess online?? Like how, an aimbot or something? It isn't like the other player isn't going to notice when your Queen bunnyhops across the board and headshots 4 pawns in a row without missing. Feh.
Speak truth to power.
security protocol used between client and server provides sufficient security
If two guys are playing and the game randomly changes, a review of the play list can confirm someone cheated. Therefore, they do have sufficient security. There is a big distinction between having sufficient security and being ultra-secure. You don't secure a pool with armed guards to prevent kids from falling in, you simply build a taller fence.
HOLLY: Prawn takes Horsie.
QUEEG: Bishop-Pawn takes Pawn.
HOLLY: Bish takes Prawn.
QUEEG: Bishop to Knight Five. Double Check and Mate, sucker!
HOLLY: Oh yeah, I didn't see that...
LISTER: Holly, man, what have you done!?
RIMMER: He's lost.
QUEEG: And the loser gets erased.
HOLLY: Noughts and Crosses?
That's how Deep Blue won...
At long last we have proof that Go is better than Chess. Nobody compromised their server : )
Matches are timed, you have x minutes or seconds to complete your game, sometimes with an increment where after each move y seconds are added to your time remaining.
A Zero-Time match would mean you've hacked the clock and your moves never take any time.
Wait, an online chess club doesn't have a good defence? Their server has an opening? The whole web site is one big gambit?
Is creating a _really_ secure equivalent of the internet chess club. I see this as a serious opportunity for an open source team to demonstrate how they can do security _right_.
I can imagine that it _would_ be possible to do some really intersting things that would make remote matches _much_ harder to cheat at(i.e. do things like authenticate who is observing each of the remote players).
Why no HTML version? Grrr.
Get your own free personal location tracker
This adds a whole new meaning to
"y3r p4wn i5 0wn3d!!!"
Norman Cook's Ode to Sl
I'm all for it, but...
Was this legal?
Aren't there local, state, federal, and international laws against exposing the vulnerability of a private system? Haven't many people already been harassed by the FBI for doing much the same thing with corporate systems? Or do these people get a free pass because they're from a University?
+++ATHZ 99:5:80
Bobby Fischer certainly has a very interesting and complex personality....
Rainer
Windows 2000 - from the guys who brought us edlin
wouldn't this be the case for more than just chess? Such as checkers, chinese checkers, chineese chess, strategeo, risk, ect.
:) ) GO is just such a game. The komi (points awarded to the player that goes second) helps eliminate this advantage. As such, i belive that GO is a fairer game.
(Dare i mention the infamous GO in a chess story?)
While i am attempting to drop my karma like a rock, i would also add that chess is NOT the fairest of all games, becuase there is a definate difference/advantage depending on what color you are, and thus who goes first. A game in wich this is not the case (or it is compensated for would be even more fair. (here is where my karma takes nose dive
I should say that i am not trying to trash talk chess. I enjoy chess just as much as the next guy, and it is terrific game to play -- both for enjoyment and as mental excersise. Above, i was just trying to point out what i thought was wrong with the parent.
ICC's game security relies on a program called 'timestamp' that accurately records how much time you used for the move (so that players with more internet latency than others don't get penalised).
This timestamp program is not open source but they publish a binary version for various operating systems.
It sounds as if someone has hacked this (ie. so you can tell it that your move took 0.1 seconds -- the server deliberately does not allow moves to be faster than 0.1 seconds). If you have ever played a timed chess game (especially, one with short times, eg. 1 minute per game), you will know that this represents a huge advantage.
I don't know what the article means about "complete control over the game", the server does not allow illegal moves etc. -- unless they have somehow hacked into the server, or managed to insert packets into the TCP/IP connections between the server and the opponent (which would be a problem with FreeBSD or the opponent's OS).
Also the article mentions 'network security protocol', which is odd given that you can play games there by a plain telnet connection (telnet to chessclub.com:23 or chessclub.com:5080) or any 3rd party clients with no security.
The Windows client software supplied by ICC includes some un-documented security to validate itself (ie. let the server know you are using this piece of software and not a 3rd-party client), this is useful for detecting if people are trying to cheat by getting a chess-playing program to automatically play their moves for them.
And finally, I fear that a "robustification" of timestamp, to use accepted open security mechanisms, would end up in greater lag for the players -- either due to greater packet sizes, or greater processing power required by the client or the server (which has to do this for 4000+ connections at once), which is a pity (even 20ms is noticeable in a speed game of chess).
Anyone have more information?
The first rule of Chess Club is - you do not talk about Chess Club.
Dogma - "let's just say we'd like to avoid any empirical entanglements."
The RSA company created the "security through obscurity is useless" meme as a way to sell their product (public key cryptosystems).
... you get the idea.
However, in reality all security is through obscurity. For one you need to keep the (private) key secret.
In practice, good security is composed of several layers, one of which should be obscurity. For example, you might RSA/ssh restrict access to a host, but it still pays to (a) not advertise its existence (b) make it insconpicuous (c) close logins to an account after more than three failed attempts (d) keep the communication protocol secret (e) place a good lock on the door to the computer room (f) not write the password on a post it note and place it in your drawer (g)
Notice how many of those listed above derive security from obscurity in practical, effective ways.
In chess on Yahoo many of the top players use a chess program it's really simple:
set it to super hard
move as your oponent
lose to computer you win.
In FPS' Anyone who's been to a lan cafe has seen screen watching but it's little brother talking on the phone or using a voice comm program to communicate with teamates (while alive and dead).
The worst part about cheats like these is that the cheater doesn't think they are cheating, if you ask they won't know what you are talking about.
It's fine in matches where both teams are doing it but in public servers it's definitly cheating, in some games like quake or CS(With death cams it's kind of a problem it's not always obvious but in games that rely heavily on knowledge such as raven shield knowing where your teamate was shot from after he dies can be decisive.
Please people if you have access to information your opponents cannot possibly have access to consider what you are doing to the game.
I like things like death cams and teamwork but I'd have to take steps against this kind of thing if I was running a server, though usually the people running servers are the worst offenders, Ventrillo anyone?
There's an easy way to fix the unfairness in Chess. Play an even number of games, alternating sides, and see who comes out on top in the end. I think it's no coincidence that this is what's actually done in tournaments.
Mod down posts with a "Free Mac Mini/iPod" sig, they're spam!
No, why would you?
People play chess because they enjoy chess. Why would someone play just to cheat? What's the reward?
"Time chess" aside, how could you cheat anyways? As soon as I see a rook move diagonally, or two pieces move at a time, I know theres cheating. How exactly do you "cheat" at chess without it being blatantly obvious?
Now if they found out how to "cheat" at blackjack or poker on an online Casino, that's something to talk about. There's cash money involved. People generally secure things where there's something to lose.
You want to come over and play chess, and start knocking my pieces off when I'm not looking and shit, go ahead. It just makes you an idiot.
I just don't see the big whoop with this story. It makes sense that the ICC isn't the Fort Knox of the internet, why would it be?
I don't need no instructions to know how to rock!!!!
Looks like the only winning move is not to play.
"Destroy science and religion. Science would re-emerge exactly the same; but not religion." - Penn Jillette, paraphrased
FICS is better than ICC anway. FICS is free. ICC makes you pay.
Find free books.
The article says that no unix chess client comes with integrated timestamping, which is a good reason to plug mine - Jin, which does.
Also, I'm an ICC admin and I can tell you that we're looking into the issue and will probably publish an official response later.
The article mentions, in fact, that the minimum 'charge' is 0.1 seconds even if the client returns '0' so an exactly 0 time match is impossible.
Another poster's implied dismissal of low time games as 'smack-the-clock' speed chess seems to disregard what is implied in the article - that many people play low-time games because it's commonly believed that you cannot cheat on them. It's not what I think of as chess but if it's widely used for that reason this find is significant.
Bad management trumps ideology - Show the world you want better leadership. http://www.timefornewmanagement.com
he don't play chess anymore, only 'FisherRandom', special chess with altered rules he invented. Basically, you shuffle backrank pieces identically for both players
And why doesn't he shuffle the front pieces, too? That would make it even more interesting.
(I know only just enough about chess to make this post.)
In general the timestamping problem is clearly an insoluble one, because the server has no way to tell if the human took only as much time to think as the client software claims. Obfuscation is a stopgap solution that deters the casual attacker, but there is no cryptographic solution apart from "trusted" hardware (yikes).
The way the music/movie industry has tackled the problem is to go on the offensive and call everyone a criminal. Let's see what the ICC does.
FICS is not better on the timestamping front though. Their own algorithm, called timeseal is not any more secure than timestamping. I know because I wrote a client for both ICC and FICS.
There are several new stories today about Bobby Fischer winning a deportation injunction in Japan.
Risk isn't a fair game, in the sense that it involves random elements, rather then purely skill. Checkers is probably a fair game, however, there are some varitions to it's standard rules.
http://en.wikipedia.org/wiki/Solved_board_games
According to that page, reversi is just such a game.
It's entirely possible that Chess is just such a game, that Black and run the perfect counter to whatever it is that White does. Most people believe that playing White is an advantage (in practice it appears to be), however, it theory it isn't in any way. Go is also another open question as to it's fairness in the end.
Kirby
Authors of that analysis took really hard way to crack icc binary timestamp. Takes about 2 hours to get ICC java client, find java timeseal class and disassemble it. Same is true for FICS (freechess.org).
Been there, done that (also once wrote a client app for both servers).
While writing timestamp version with public/private key authentication would work against snooping CC numbers, lag info can always be altered with simpler means then cracking timestamp. For apps using local clock system calls can always be hooked/intercepted (someone did that in Linux about a year ago)
Looks like you gave yourself away there. Now we know Anonymous Coward is really Mateito (746185).
Lately democracy seems to be based on the skybox, the Happy Meal box, the X-box, and the idiot box.
"Queen takes Bishop"
You insensitive clod!
I'll...uh...challenge you to a game of chess for such an insult!
Don'y you mean professor? At least quote it correctly.
This is a good point, and i had thougth of that. But then to desribe chess as a fair game, a game of chess would actually have to consist of 2 games of chess. Thus, the base unit of play that one would have to partake in (in order to claim that one had played chess) would have to be 2 games.
:D
I am not sure that many people would agree with this boundry. That is, if you played a single game of chess, you would feel safe claiming that you had played a game of chess. If soemone came up to you and said, "No way!, you have only played 1/2 a game of chess!", you would look at that guy like he was an idiot.
Thus we see that the basic unit of chess is a single game. Thus, the game of chess is unfair (or could be, depending on what you think the advantage may be for going first). You can FIX the game of chess, by trying to average out the flaw (again, if it exists). But the idea, i think, is that in the end, the basic game remains unfair.
I hope that makes some sense. I am not sure that it does, but that is what i was thinking at the time