Superuser Caught on GGPoker - "MoneyTaker69" Thread
01-01-2024
, 10:20 PM
01-02-2024
, 04:13 AM
01-02-2024
, 04:35 AM
Quote:
Tried to summarize it all, cause #GGcare 
MoneyTaker69 exploited a vulnerability in the software, which made it possible for him to see the equity in real-time. He wouldn’t see the hole cards of the other players, but he’d always know his chance of winning the hand. Simply put, the server would know what cards the other players were holding, it’d calculate the equity based on this, regardless of whether there was an all-in situation, and MoneyTaker69 would tap into this info, always knowing whether he was ahead or behind. It’s possible the client-side hack by MoneyTaker69 would trigger additional equity calculations – that server side normally wouldn’t do it, unless there’s an all-in – but that’s equally bad, as it means GG never bothered putting an all-in condition in place for equity calculation.
MoneyTaker69 chose to make use of this exploit in such a moronic fashion that thereÂ’re only two possible explanations:
Firstly, GG’s use of Adobe AIR is a concern on its own. As they said in their statement: “since part of our desktop client leverages the Adobe Air framework, which has attack vectors that other frameworks do not”. Adobe AIR is part of the problem here, but it’s a symptom of a more severe issue: GG are prioritizing getting new features and games out, over the integrity and security of their games. There’s no good reason for using Adobe AIR, other than it enables them to release stuff faster than would have otherwise been possible, but it's at the cost of additional “attack vendors”/vulnerabilities. This is something they’re obviously aware of, and they’ve simply made the decision that game integrity can’t take priority.
It's not just about Adobe AIR though. ThereÂ’re more concerns related to what seems to be a general trend of prioritizing time to market over everything else. As a another member wrote earlier:
So many security flaws in the GG design:
Is it likely that MoneyTaker69 just doesn’t have the faintest idea about poker, that he simply didn’t want to become rich and that there’s no one else that took advantage of the issue? Millions could have been made – and perhaps have been made? – with this exploit. It must be considered unlikely that an individual who had the technical know-how to hack the all-in equity was such a dumbass when it comes to taking financial advantage of it. There’s at least a real possibility of this being significantly bigger than the one account.
MoneyTaker69 exploited a vulnerability in the software, which made it possible for him to see the equity in real-time. He wouldn’t see the hole cards of the other players, but he’d always know his chance of winning the hand. Simply put, the server would know what cards the other players were holding, it’d calculate the equity based on this, regardless of whether there was an all-in situation, and MoneyTaker69 would tap into this info, always knowing whether he was ahead or behind. It’s possible the client-side hack by MoneyTaker69 would trigger additional equity calculations – that server side normally wouldn’t do it, unless there’s an all-in – but that’s equally bad, as it means GG never bothered putting an all-in condition in place for equity calculation.
MoneyTaker69 chose to make use of this exploit in such a moronic fashion that thereÂ’re only two possible explanations:
- He didnÂ’t have the faintest idea about poker.
- He wanted to get caught and/or expose the GG security, or rather lack thereof.
Firstly, GG’s use of Adobe AIR is a concern on its own. As they said in their statement: “since part of our desktop client leverages the Adobe Air framework, which has attack vectors that other frameworks do not”. Adobe AIR is part of the problem here, but it’s a symptom of a more severe issue: GG are prioritizing getting new features and games out, over the integrity and security of their games. There’s no good reason for using Adobe AIR, other than it enables them to release stuff faster than would have otherwise been possible, but it's at the cost of additional “attack vendors”/vulnerabilities. This is something they’re obviously aware of, and they’ve simply made the decision that game integrity can’t take priority.
It's not just about Adobe AIR though. ThereÂ’re more concerns related to what seems to be a general trend of prioritizing time to market over everything else. As a another member wrote earlier:
So many security flaws in the GG design:
- Calculating all-in equity prior to all-in state;
- Communicating all-in equity to client prior to all-in state;
- Communicating all-in equity in unencrypted format;
- Failing to force security updates to client before allowing further play;
- Concealing a known vulnerability from users even after it was apparent that it was known and exploited;
- Failing to conduct regular audits of accounts with extreme variance
- According to their statement, they became aware of the issue on the 16th of December but never announced it. Only after public outcry, 13 DAYS LATER, they issued a statement. GG were aware their game integrity could be compromised but did not deem it necessary to let the players know. Or, almost worse: they had no idea how the vulnerability could be exploited.
- Once they issued a statement, they made sure to only do it on their .com blog, making the content unavailable to the majority of players, due to a redirect being in place.
- MoneyTaker69 was allegedly reported already on the 25th, but the report was dismissed. Only after it became a thing on 2+2 and X did GG act.
- They’ve proudly announced they’ll double the size of their “technical security team”. Great, but that means they’ve either had way too small a team (despite claiming to take security extremely seriously) or they’ve already got a big team but realize there’ve been operating with a fundamentally flawed model for the past year and foresee bigger challenges in the future, i.e. state of security is terrible. Regardless of the size of their security team, they must change their way of working. A bigger team will help, sure, but if time to market continues to be priority number one, it won’t be a fix.
Is it likely that MoneyTaker69 just doesn’t have the faintest idea about poker, that he simply didn’t want to become rich and that there’s no one else that took advantage of the issue? Millions could have been made – and perhaps have been made? – with this exploit. It must be considered unlikely that an individual who had the technical know-how to hack the all-in equity was such a dumbass when it comes to taking financial advantage of it. There’s at least a real possibility of this being significantly bigger than the one account.
- GG have still to publish any info about the incident on their local sites. In other words, they don't consider it significant enough of an incident to share the info with the wider network. It's not a huge surprise they'd try to bury it as much as possible and not make it a thing in jurisdictions where the regulators might want to look further into it (Isle of Man and Kahnawake are complete jokes and don't care about player protection).
- GG are still to publish further clarifications (realistically, it probably won't happen). It's just as much about what wasn't said. GG have not confirmed, that this is an isolated incident. They say that they "spotted abnormal game client packets", and if it was the case that server side didn't constantly make the equity available (call from client to server needed to calculate), then surely GG would be able to identify whether additional abuse has taken place? Why is there no confirmation that such hasn't happened? It could of course be the case that GG were stupid enough to constantly have equity available server side, and there would be no way to identify abuse in server logs. Or, it could be that it isn't an isolated incident and GG will sweep it under the rug.
01-02-2024
, 09:32 AM
01-02-2024
, 09:58 AM
Some authority should demand all the data from GG to start a proper investigation.
For example, when did MoneyTaker69 register his account? Did he ever change his username?
Regarding leader boards, i'm micro stakes player so i won't be on there, but imagine you are number 6 and MoneyTaker is number 1, then i think its reasonable to correct that so that you become number 5.
I'm part of a Dutch facebook community for GG Poker and i mentioned this incident multiple times but don't get much reaction. Only one Dutch player confirmed he got back .63 cents. He's offended by this and claims that because of he got cheated he often went on tilt, losing much more money. It's hard to calculate how much but i think GG should take blame for this and refund more generously. After all, they are responsible for the safety of all players.
Last but not least i feel part of the blame is for the Dutch government, as they officially allow GG but not Party and Stars.
More than 10 years ago Party was legal in the Netherlands and i remember i made $200 in two years starting with the minimum ($10). Just slowly building bankroll. Now compare this to GG these days and i feel a great difference. From 20 to 0 3 times in a row
For example, when did MoneyTaker69 register his account? Did he ever change his username?
Regarding leader boards, i'm micro stakes player so i won't be on there, but imagine you are number 6 and MoneyTaker is number 1, then i think its reasonable to correct that so that you become number 5.
I'm part of a Dutch facebook community for GG Poker and i mentioned this incident multiple times but don't get much reaction. Only one Dutch player confirmed he got back .63 cents. He's offended by this and claims that because of he got cheated he often went on tilt, losing much more money. It's hard to calculate how much but i think GG should take blame for this and refund more generously. After all, they are responsible for the safety of all players.
Last but not least i feel part of the blame is for the Dutch government, as they officially allow GG but not Party and Stars.
More than 10 years ago Party was legal in the Netherlands and i remember i made $200 in two years starting with the minimum ($10). Just slowly building bankroll. Now compare this to GG these days and i feel a great difference. From 20 to 0 3 times in a row
