Another hole in UB and AP security - Page 11 - Poker News

JustSomeGuy · 05-07-2010, 12:29 AM

Was the latest update UB's attempt a a cure?

bape x dunKs · 05-07-2010, 12:29 AM

Quote:

Originally Posted by SenatorKevin

They were probably curious more than anything. I analyzed Full Tilt's network traffic a few years ago for such a vulnerability and was pleased to see they had fully encrypted traffic which made me feel more comfortable playing there. I never looked at UB, cause I didn't play there at the time.

EDIT: Errrrrr. I take that back. They were probally analyzing traffic to improve their hand grabbing rates. Total f'n scumbags. It almost sounds like they went public with this vulnerability before contacting UB as well. What a joke.

I don't think anyone would want them to contact UB first anyway, this way we get the real information and not a massive cover up. As much as I oppose data mining, I oppose people looking at hole cards a little more.

McGrift · 05-07-2010, 12:35 AM

Quote:

Originally Posted by Interpleader

What is Sebok saying?

He's tired of the witch hunt obv.

Hood · 05-07-2010, 12:38 AM

Quote:

Originally Posted by JustSomeGuy

Was the latest update UB's attempt a a cure?

If UB have really implemented SSL security within hours, it mean they already had this implemented prior, and they've just flipped a switch. To be honest that looks even worse.

**Kevmath** · 05-07-2010, 12:39 AM

From @joesebok:

Quote:

Heya, I'll be looking into recent issues at @ultimate_bet and try to get some more answers by next week. Wish I knew more now. Apologies...

I thought the latest update was to fix the issue with seeing player's hole cards after a hand ended?

King Fish · 05-07-2010, 12:43 AM

Quote:

Originally Posted by Hood

If UB have really implemented SSL security within hours, it mean they already had this implemented prior, and they've just flipped a switch. To be honest that looks even worse.

This.

JustSomeGuy · 05-07-2010, 12:44 AM

Quote:

Originally Posted by Kevmath

From @joesebok:

I thought the latest update was to fix the issue with seeing player's hole cards after a hand ended?

I thought that came in the update 2 days ago or so? There was a new one in the past few hours

RolloTomasi · 05-07-2010, 12:45 AM

Quote:

Originally Posted by SenatorKevin

They were probably curious more than anything. I analyzed Full Tilt's network traffic a few years ago for such a vulnerability and was pleased to see they had fully encrypted traffic which made me feel more comfortable playing there. I never looked at UB, cause I didn't play there at the time.

EDIT: Errrrrr. I take that back. They were probally analyzing traffic to improve their hand grabbing rates. Total f'n scumbags. It almost sounds like they went public with this vulnerability before contacting UB as well. What a joke.

http://blog.ultimatebet.com/2010/05/encryption-issue/

Paul Leggett:
"We are currently working on implementing a new encryption method and we expect to have it live in a matter of hours."

Kevin is this possible

MelchyBeau · 05-07-2010, 01:00 AM

Quote:

Originally Posted by RolloTomasi

http://blog.ultimatebet.com/2010/05/encryption-issue/

Paul Leggett:
"We are currently working on implementing a new encryption method and we expect to have it live in a matter of hours."

Kevin is this possible

unless it was already being developed well before this scandal broke no.

Sjors · 05-07-2010, 01:00 AM

Quote:

Heya, I'll be looking into recent issues at @ultimate_bet and try to get some more answers by next week. Wish I knew more now. Apologies...

yeah or by next month...or by next year if I still remember...(will remember my paychecks yo)

SenatorKevin · 05-07-2010, 01:05 AM

Quote:

Originally Posted by bape x dunKs

I don't think anyone would want them to contact UB first anyway, this way we get the real information and not a massive cover up. As much as I oppose data mining, I oppose people looking at hole cards a little more.

No, if you're a white hat security professional you should notify the vendor ahead of making it public so they can begin work to remedy the issue. Irregardless of UB's actions in the past, it's the proper thing to do.

**Bobo Fett** · 05-07-2010, 01:05 AM

Quote:

Originally Posted by scratchy1

So what led to PTR finding this vulnerability? Were they tipped off or doing their own investigation on suspicious play there?

Well, there was a thread started here on 2+2 over a week ago about issues there:

http://forumserver.twoplustwo.com/19...e-fold-772028/

SenatorKevin · 05-07-2010, 01:09 AM

Quote:

Originally Posted by MelchyBeau

unless it was already being developed well before this scandal broke no.

Yeah, there's no way this gets fixed for a few days. Rushing out a fix would be a mistake because it'd likely break another thing. Do the proper QA cycle and make sure this fix doesn't break another thing.

**Bobo Fett** · 05-07-2010, 01:11 AM

Anyone else amused that Cereus is an anagram of secure?

rookiepsu · 05-07-2010, 01:14 AM

I'm a software engineer and my company was tasked with adding FIPS 140-2 encryption to our client-server application. It took us approximately 5-6 months to properly implement and test it. Admittedly, we had a small team of 4-5 developers, but having this done "within hours" of it being discovered by an outside source is laughable at best. Basically, what others have stated is accurate: If it is done within hours, it means it was already implemented and a switch was turned on once it was discovered. No chance that proper encryption can be implemented that fast.