Slashdot Mirror
"Back Door" Cheating Scandal Rocks Online Poker
AcidAUS sends us the story of an online poker cheating ring that netted an estimated $10M for its perpetrators over almost 4 years. The article spotlights the role of an Australian player who first performed the statistical analyses that demonstrated that cheating had to be going on. "In two separate cases, Michael Josem, from Chatswood, analyzed detailed hand history data from Absolute Poker and UltimateBet and uncovered that certain player accounts won money at a rate too fast to be legitimate. His findings led to an internal investigation by the parent company that owns both sites. It found rogue employees had defrauded players over three years via a security hole that allowed the cheats to see other player's secret (or hole) cards." The (Mohawk) Kahnawake Gaming Commission, which licenses the two poker companies, has released its preliminary report. MSNBC reporting from a couple of weeks back gives deep background on the scandal.
Not a bad deal, but I'll want to see the flop.
You can't talk about Wikipedia's flaws on Wikipedia
Illicit high rollers get free room and board for the next 5-10 years.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I don't gamble.
I invest my money in the stock market.
I still don't understand why people do this. Are they really THAT desperate to place a bet, any bet? Might as well become a day-trader and play the stock market for your fix. It would be a lot more regulated than most online poker.
SJW: Someone who has run out of real oppression, and has to fake it.
Backdoor? That's nothing. What if I log into a table (which seats 10 people) with 1 friend... or worse, 8 friends -- and then work as a team.
Because they are always cheating? :)
The dangers of knowledge trigger emotional distress in human beings.
They played under the same accounts over and over for four years??
It's like they were begging to be caught.
In the words of the Stainless Steel Rat, "Learn to graft and walk away and live to graft another day."
If the masses can keep you down, you're not the Ubermensch.
This cheat required somebody on the 'inside' to perpetrate. As with most casino table games, if you have somebody on the inside, cheating is easy.
This is how I cheated at various online poker sites. Me and two buddies would join a table, and have a VNC connection setup to view each others hands. two of us would play dummy hands based on whom had the best hand of the bunch. We cleaned out every table we played at.
"The price good men pay for indifference to public affairs is to be ruled by evil men." ~Plato (427-347 BC)
For those who don't know, Kahnawake is Mohawk territory claimed by the aboriginals (aka Indians) in Canada.
The Mohawks claim to sovereignty over the land, and do not allow the provincial & national police to enter.
To avoid stirring up trouble, the Canadian government usually doesn't send police to Kahnawake, even though the Canadian government doesn't recognize the Mohawk claim to exclusive sovereignty.
Without any real police force, crime flourishes in Kahnawake. Drug smuggling, gun smuggling, people smuggling, cigarette smuggling, you name it.
Don't trust any business in Kahnawake, let alone a business attractive to crime, like gambling.
Not long ago, there was a Mohawk criminal driving at high speed (off-reserve) trying to get to the Mohawk territory before getting caught by the police chasing him. He made it on to the Mohawk territory, and the police abandoned their pursuit. Sadly, the Mohawk driver ran a stop sign and killed a Mohawk teenager.
For the people of Kahnawake, it seems that it is more important to be the victims of aboriginal criminals than to cooperate with non-aboriginal law enforcement. Sad.
From what I gather from the articles, they didn't actually write any code that tapped into the server... it was just getting information from the client app that was residing in memory but was not displayed to the screen.
This is just an enormous case study suggesting why strict client/server separation is essential, and that clients only get the information on a "need to know" basis.
Isn't this a fairly standard design practice? How did this happen?
--
Hey code monkey... learn electronics! Powerful microcontroller kits for the digital generation.
o my....story time...
The phrase of the day is "superuser"
This data was given to many professional online poker players who analyzed the data in late 2007 (see 1 year ago, 10/16/07 to be exact) when they requested the data from the online site "Absolute Poker".
Instead of the site giving them the usual data which hid the opponents cards unless they had shown them during the hand, they sent all the raw data which included the opponents hole cards, and specifically every player and spectators player number. One of the spectators was player number "363" I believe which was incredibly low (one of the first ever to register on the site).
When designing the software they must have used several "superuser" accounts to make sure that it was working correctly, so they let it see all the cards on the table. Someone inside Absolute Bet discovered(or knew they entire time) that the loophole was still open and used multiple accounts to siphon hundreds of thousands if not millions of dollars off of their high stakes users. This was used also over other websites running the same backend software.
What made this so obvious, simply put, to the high stakes players was that these players were playing perfectly over thousands of hands which isn't possible unless you know all the cards on the table.
For more reading see:
http://freakonomics.blogs.nytimes.com/2007/10/17/the-absolute-poker-cheating-scandal-blown-wide-open/
or for more poker talk:
http://archives1.twoplustwo.com/showflat.php?Cat=0&Number=12523924&page=0&fpart=1&vc=1
Liquor in the front,
Poker in the rear.
"I bless every day that I continue to live, for every day is pure profit."
I am shocked, SHOCKED, to learn that there is cheating occurring in online poker!
Round up the usual suspects . . .
Ron Rivest and others have built many good systems for creating secure online poker games. It's possible to deal the cards in a way that the server can't eavesdrop. Now, of course, these can't do anything about n-1 people at the table working together through outside channels. And a good algorithm can still be defeated by bugs in the client software. But the point is that there are good algorithms out there.
seem to be from people that know absolutely nothing about poker and ultimately nothing about how the sites make their money, so let's clear up a few things.
1. It would never be in the best interests of the company to try to allow this to happen to anyone, as the cost would be too high. If players had a hint that they were being cheated they would never play there. That $10MM figure is nothing compared to what the sites generate from rake alone. The only people who could benefit would be hired contractors who wrote the code and got paid some small amount of money to do so. To them, it would be worth the risk to try to cheat somehow, and they obviously did.
2. To the few people who seem to think that they were getting information that was already on their systems from memory that was encrypted or something, well, that's false. The "special" accounts were sent information that other players do not get sent. You only get your hole cards, and it's not until a showdown where anyone but you and a random server out there know what anyone has.
I guess that's it, aside from the extreme unlikelihood that anyone would try to cheat in this manner at a small (say 30-60 or less) game. The risk/benefit doesn't add up at those stakes.
A few random points: high stakes poker can be shady at times, and collusion in the smaller games can be defended against to some extent (by either not playing, or using the style of collusion against the colluders. At times games can appear to be collusive due to excessive raising, but the majority of the time that's just strategy.
I SAID NO CONSEQUENCES!
You better watch out, there may be dogs about . .