Slashdot Mirror
Colorado Researchers Crack Internet Chess Club
edpin writes "University of Colorado at Boulder students hacked the 30,000-plus-member Internet Chess Club as part of research funded by the National Science Foundation. With guidance from University of
Colorado at Boulder computer security researcher John Black, two students reverse-engineered the service to up their ranks and steal passwords." Update: 10/10 23:05 GMT by T : Reader Bryan Rapp points out that this story duplicates the one posted last month -- sorry about that.
Internet Chess Club Security Defeated
As I'm Bobby Fischer.
It seems like only yesterday that the site was hacked, and now it has happened again?
Those admins need a good kick up the backside.
Kind of dick move, no?
They proved their point by putting themselves high up in the ranks.
A legitimate Research project should NOT have involved messing with other people's accounts.
If you want to do that, have some person known to the researchers make up an account with the express purpose of their team trying to steal the password.
...Also, I didn't know Buggalo could fly.
technically the story it links to is though new, but it's about an old thing.
now.. about these dupes.. just one thing makes me wonder, do the editors have extremely bad memory or don't they follow slashdot at all themselfs? since in most cases a regular reader remembers if he has seen the same story(or one with a lot of resemblance) before. and hell, theoretically they should have more time than 20 secs per a story they pass, so they could have put "chess" into the old stories search.
now, on things that need refreshing or something a 'follow-up' stories could be worth while doing, but not reporting them as totally new.
world was created 5 seconds before this post as it is.
by influencing crackers to dupe their cracks, thus saving other organisations from their unwanted attention.
Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
What truth?
There is no dupe
You don't have to give yourself all the trouble of defeating security to be a chess star on Internet. Just run a copy of fritz on another computer while you 'play'... instant skill!
This is why is stopped playing online. Nothing beats a real game of chess, in front of a real person anyway. Reactions from your opponent are almost as important as in poker!
Eureka Science News - automatically updated
I've seen way too many programmers who think they're the world's greatest gift to mankind, but don't know the FIRST RULE of developing web applications:
NEVER TRUST USER INPUT
This leads to stupid hacks like sql injection, html injection (leads to XSS), etc etc.
Not saying this is how it happened, but I wouldn't be the least bit surprised if this is how it happened.
eTrade SUCKS
what the U of C's attitude would be toward someone who hacked into their computers to, you know, just experiment and gain knowledge? Maybe up their grades or look at other peoples information?
Just wondering if the shoe fits the other foot.
Exactly why killing a man is part and parcel of becoming a homicide detective. Errr, wait, it's not.
Yes, you have to know how crimes are committed to solve/prevent them, but committing those crimes is not the only way to gain that knowledge.
ABSURDITY, n.: A statement or belief manifestly inconsistent with one's own opinion.
Internet Chess Club has more than 30,000 members worldwide and claims Madonna, Nicolas Cage, Will Smith and Gary Kasparov as players.
One of these things is not like the others,
One of these things just doesn't belong,
Can you tell which thing is not like the others
By the time I finish my song?
nah just get rid of timothy
In all those cases, they study past cases, study current events, and don't generally have to become like the things they're acting against in order to defeat them, and I have no idea why computer security should be different - as someone who used to work in banking, allow me to testify that we didn't go out and rob banks or kite checks in order to learn how to prevent others from doing the same. And in those few cases where hands-on experience is absolutely necessary, you don't need to go out into the world and involve innocent third-parties - you set up a controlled environment where they can play on the playground without actually attacking real people. The ethics of this sort of "white-hat" hacking are non-existent - this is absolutely unethical behavior on the part of these clowns, and in no way do the ends justify the means.
ABSURDITY, n.: A statement or belief manifestly inconsistent with one's own opinion.
The Internet Chess Club (ICC) has taken steps to improve security since this paper was published.
/blackpaper help file:
h p When you access the web form, your browser shows a 'locked padlock' icon that indicates your communication with ICC are encrypted and secure. ICC takes great care in protecting financial information. See http://www.chessclub.com/help/privacy for more information.
...
For details on the paper and ICC's response see the help file at:
http://www.chessclub.com/help/blackpaper
For details on how ICC protects user's security see:
http://www.chessclub.com/help/security
For details on how ICC protects user's privacy see:
http://www.chessclub.com/help/privacy
An excerpt from the
Question: What is ICC doing to improve security?
ICC is doing three main things to improve security:
1) ICC has changed our payment systems so that all online credit card payments go through secure web forms. You can check out our new secure web payment forms at https://www.chessclub.com/store/members/payment.p
2) ICC is updating Timestamp to close the cracks identified in the paper. This process will take some time to complete. As Black, Cochran, and Gardner show in their paper, getting Timestamp security right is a complex task. Ultimately, when we deploy a new version of Timestamp, ICC users will need to upgrade their chess client software to take advantage of the increased security.
3) ICC is doing an internal security review. ICC is committed to keeping confidential data secure through upgrades to our servers and client programs. We are actively engaged in improving our current security mechanisms, while at the same time, devoting substantial resources to catching cheaters.
If you have any questions or comments, you can ask a question in Channel 1, the Help Channel, send a message to ICC or send an email to icc@chessclub.com.
Also, ICC is not suing anyone over the paper by John Black, Martin Cochran, and Ryan Gardner.
George MacDonald
General Manager
Internet Chess Club