I follow the thread from the beginning and with all sidestories and other funny stuff.

We all sure about it, that two things are proved: CHEATING and CHIPDUMPING !!!

But some questions are left.......the WHO and HOW ???

Imo its important to take a look at a small, but important piece:

- one of the guys, who played DD, told Adanthar, DD plays 15 minutes and sit out 10 minutes every time !!!
Would a super account only work for 15 minutes ?
Is a function useful to observe 1 table for 15 minutes and then you have to wait 10 minutes ( for a Pit Boss) ?

The style of cheating reflects to me, they didn´t know how long the cheating will work and tried to create large profit as soon as possible and they are poor at poker.

I think its useful to have a time frame we can put all FACTS in and try to fill the empty places with new information.

If you have such a "Powertool" and you will use it..... how many hours a day will you spent with Poker (remember....not sure about how long this tool will work)???

So we are missing a lot of HH´s !!!!

I saw DD was chatting with some guys after the cheating was public, was there more chat before ? May be some hidden information ?

If you are an AP Manager and in this situation:
a. you are involved in this situation and know everything about it
b. you are not involved but know some of the staff is
c. someone cracked your Pokerroom and you know how he did it
d. someone cracked your Pokerroom and you didn´t know how he is acting

Witch official Statement would you release ??? Correct: NONE !!!

So don´t wait for an official Statement.....we never get the truth from AP, we have to do our own investigations.

Try to say it like Tony G. --> AP, you are GONE, GONE, GONE.....WE SENT YOU BACK TO KAHNAWAKE, you didn´t deserve any applause

YOU WILL FEEL THE POWER OF 2+2

(Sorry for that English)

I am no victim in this case. But I want still to play on Absolute. And I want to find a fair solution because of a couple of other reason.

If Absolute is ignoring the right of the victims this will result in an ongoing dispute, a never ending story. And as I said yesterday. I fight for Online-Poker in Germany. I will not fight for Absolute if nothing happens. I will do exactly the oposit instead. Because only fair Online-Poker will have a little chance to survive.
This means that fraudulent or questionable poker rooms have to be sorted out so that the good remaining ones can battle for their existence.

If Absolute would ask a certified audit company to examine this case in order to find the correct answer for the whole poker community than Absolute has a chance and also the right to survive, whatever the outcome will be. Perhaps nothing will be found, perhaps only measures for improvment will be found, perhaps the cheaters will be discovered, perhaps it can be found, that somebody within Absolute has stolen money. Even in worst case scenario Absolute will get a chance, because of the fact that most of poker players like Absolute, no thought about that.

I repeat me. I want to see an external audit done by experienced auditors. This might be seen unusual but in this case this is the only chance for Absolute and the whole poker community to stop this dispute.

I've been following this from the beginning and haven't had anything useful to add, I just wanted to give props to Josem for his site.

I agree that it would have much more impact if we could get a preface from a Mr. Greenstein or Raymer, any big name that the masses will respect.

Also, thank you Adanthar for pulling out your banstick. The trolling was getting unbearable.

Hi guys,

I know this is going to look like a schill account or a fake account or just someone who no-one cares about but I'm just a long-time lurker. I am genuinely someone who cares about this. Granted I'm not a very good poker player but I do know quite a bit about SEO and online marketing etc.

If anyone hasn't heard of a site called http://digg.com then I suggest that you go visit and acquaint yourself with it. Getting on the homepage of a site like this can drive over 40,000 unique visitors within hours. While a lot of these people are no-body's there are influential people out there and by spreading the word we'll get more coverage for the story.

Now, I was going to recommend digging http://www.absolutepokercheats.com/ but if it's on cheap hosting the site will just collapse instantly (the digg effect is remarkably similar to a DDOS due to the sheer volume of visitors). Therefore I suggest that we digg the freakonimics post: http://freakonomics.blogs.nytimes.co...-not-to-cheat/ and within the comments provide a link to http://www.absolutepokercheats.com/

Now, if the traffic is significant then even comment traffic might take the site down (i'm really not sure how robust your hosting is).

To hit the homepage of digg we would need approximately 40 - 50 diggs within about a 12 hour period (it's not an exact science I'm afraid but somewhere in this region I suspect should do it, maybe a few more) and THE VAST MAJORITY OF THESE SHOULD COME FROM ESTABLISHED ACCOUNTS. So please, if you already have an account then great. If not then please don't go and create one and then digg this story as this will be counter-productive and will almost certainly result in the story being classed as spam.

I have dugg the story here:

http://digg.com/world_news/Major_Onl...aught_Cheating

Please, anyone with an active and genuine account please swing by and digg this story.

Thanks

PS - I'm based in the UK and will be out for most of the day but should be back around 6-7 GMT. Please PM me or message me on digg for the best chance of a reply.

the website i created is hosted by google. i doubt that their servers are likely to collapse under any reasonable circumstances.

Without wanting to sound like a [censored], I think people should stop making up scenarios of how the cheating was actually facilitated because all they are doing is hurting the credibility of this story.

The following are not facts as I have no way of confirming any of this, but they are all based on my experience in the IT field and my knowledge of how to build secure systems. The assumption here is that AP is being regulated and audited by someone that can tell their ass from their elbow.

"Superuser account", "Pit boss account", etc.

The existence of such a type of account is highly unlikely. It offers absolutely nothing more than a detailed log produced after the hand has been concluded and would be deemed a major security risk. Even if AP tried to have such an account, no regulatory/auditing authority would allow it.

Even in the unlikely situation were such an account existed for a reason we are failing to conceive, there is no reason for allowing access to it remotely as once more it would be considered a major security risk.

If such an account did exist, it would be a contradiction to the reason for its existence to limit it to just one table at a time.

Super user account that lets you play at the table

I hope you are joking. There is no way this can be justified to any regulatory/auditing authority. As a matter of fact, if I was doing the auditing and I spotted something like that, I'd have them fail the evaluation and recommend the business is shut down.

Cracking the client software

First of all the term "hacking" means to code, not to take advantage of vulnerabilities. The media have once more taken one thing and twisted it to mean another. Anyway, what you are actually referring to here is cracking.

First of all the communication between the client and the server is encrypted. So to begin with you'd need to crack the encryption or somehow acquire the decryption key. Cracking the encryption would require far longer than a few seconds, but it is possible (depending on the architecture of the software) to only need to crack it once and then be able to re-use the information you have acquired. It is also possible for the decryption key to have been made available to you in some way. Either way, we will assume that someone could potentially work around the encryption.

Now someone has access to the communication between the client and the server. He can intercept messages, alter them, send spoofed messages etc. Well, they have achieved nothing. The server software would have absolute no reason to send the hole cards of player A to player B in the middle of the hand without a showdown. No matter what you send the server through your cracked client, the code that sends you back the hole cards of other player would never execute unless it thought a showdown was taking place. If you tricked the server into thinking a showdown as taking place, it would not just conveniently send you the hole cards of the other players and then proceed with the hand as normal, it would bring the hand to showdown on everyone's client.

Gaining access to a central network router and intercepting traffic

You need to be physically present to perform this attack. You need to be plugged into the local network, you cannot perform this type of attack remotely. Let me make it 100% clear. You will need to be siting next to the router, with one computer playing at the tables and the other computer capturing the raw data as it flows through the router.

Why is this hurting the story?

Absolute Poker knows all this. Their security and IT departments are well aware of all the possible ways their system could be attacked (its part of your system design to produce these scenarios). Can you see why people sending them emails claiming that they have allowed their system to be compromised through a "superuser account" is hurting this story? They know a superuser account does not exist. They know that cracking their client software would achieve nothing. They know their physical security has not been compromised.

Right, so what you are saying basically is that no cheating could have taken place

Absolutely (heh) not, I am not saying that at all. I am saying that we should not try and speculate how the cheating happened, we should just be stating the facts. I do have a couple of theories as to how this could have been technically achieved without being detected by regulatory/auditing/code review checks (e.g. debugging code that made its way into the production system) but elaborating on them adds no value to the story.

Great, hopefully it won't fall over then :-)

I've been thinking all the Time,why these guys (assuming it is more than 1 Person) made it so obv that they are cheating.
I dont think that it was an Inside Job because AP knew that it would Destroy their Image.
And would a Hacker behave that way,that he would play like a Maniac,Dump the Chips to at least 1 Player and the other crazy things?He would play maybe Looser and a little bit different than the rest of the Players.
So that leeds me to the Conclusion:
1.They were really that stupid (what a lot Posters think but doesnt make that much sense)

2.Or it was someone who wanted to be caught and wanted to Damage APs reputation.
That would make Sense why they played like a Maniac and did all these things.And maybe I has to do something with the Update of AP.
Maybe some Security Person who got Fired or something like that?
Would that be possible?

Fousekis, you make good points and it shows you have IT experience. I don't have a lot of security background, but I don't think you necessarily have to be near the router to do man-in-the middle attacks on the clients. You can hack the central server or the router remotely.

Also, just because you say having a superuser account or sending others' cards to the client would be totally stupid does not preclude Absolute from doing that.

Look at how they've handled this from a PR perspective and ask yourself why would they have the IT part in order?

Adanthar, i kind of think the way in which the hands were played makes it far less likely the perpetrator is affiliated w/ a poker site

That was a great post. I'd always thought the idea of a superuser account was a bit ludicrous and that it was much more likely that someone was capturing the data. If this is 100% true, this has MASSIVE implications because it HAS to be an inside job.

Yeah, except it's not true. It depends on their physical network setup (which we don't know), but it's quite possible it can be done remotely.

StephenNUTS, is that you?

They are completely unregulated, so basically they can do what they want. And that is just what lots of online casinos and poker sites have been doing from day one.

I agree that a superuser account is a dumb idea. Like, who is supposed to have lodged the money into it? How could there be an account that lets you see everyone's cards, which I think is a possiblity for security reasons, AND let you deposit money and buyin to tables.

But I don't see why a security or master account isn't possible due to regulatory reasons as you mention. These sites are self regulated that's why it's so hard to get something done about the current situation.

You are talking about two different things here, "man-in-the-middle" and "router take over" attacks.

Man-in-the-middle attack

A man in the middle attack requires you to be in the middle of a communication. It requires you to have physical access to the data that flows between the sender and the recepient. Such an attack (in the context of the current scenario) would require you to have physical access to one of these three places

The sender's network (this would be Absolute Poker's local network)
The recipient's network (this would be the other player's local network)
A central point somewhere in between the communication (e.g. the other player's ISP local network)

You cannot perform this type of attack remotely.

What Wikipedia has to say about man-in-the-middle attacks

Router take over

This type of attack allows you to exploit a vulnerability in the router's software (typically a buffer over/under run) to take the router over. Yes, this type of attack is possible to occur remotely, but the "remotely" part has to be put in context. You do not have to be physically plugged into the router, but you need a way of sending the attack to the router. In the context of the current scenario we are exploring, this would require physical access to Absolute Poker's local network.

Also keep in mind that these type of vulnerabilities are extremely rare and complicated. Most of the times all the attack can achieve is bring the router down rather than gain access to all of the information that flows through it.

The assumption being made here is that Absolute Poker are being regulated and audited by someone that knows how to regulate and audit. This is the kind of thing that is obvious to anyone that has a look at the system's architecture.

The point of my post was to demonstrate that speculating how the cheating was facilitated is only hurting this story. Although its nice to speculate and come up with theories, in the log run this could end up being the reason the story gets discredited. We do not have the necessary information to determine how the cheating was done, so let's focus on the things that add value to the story which is coming up with facts and evidence.

P.S. I guess I should have mentioned this earlier ... I play at AP

Hi guys, as well as digging the story

(which can be done here:

http://digg.com/security/Online_Poke...redible_source

or here:

http://digg.com/world_news/Major_Onl...aught_Cheating )

I have created an online petition:

http://www.ipetitions.com/petition/absolutepoker/

While none of this will impact absolute poker, it will help spread the word and if either of these things becomes popular enough then the mainstream media will start to take more notice of this.

Thanks

Tom

Someone in this thread (could have been one of the other two threads actually) said that they are regulated and audited by PWC and pointed to this website

http://grpoker.com/absolutepoker/

Is this incorrect?

Edit: Looking more into this, it turns out that this is a financial audit. Security audit is performed by Gaming Associates.

I've also created a facebook group:

http://www.facebook.com/group.php?gid=4999108811

Again - if enough traction can be gained then it will help spread the word.

Ps - if anyone can please photoshop a better logo (like absolute poker with cheat scrawled across it or something) then leave a message on the group

Thanks

Tom

Well it doesn't mention pwc anywhere on their site. I'd imagine it would if they were actually audited by them.

As far as I can see they are 'regulated' by the Kahnawake Gaming Commission, a body that has never taken any action against any site's under their remit and is known to be basically just a front to deflect complaints agaisnt it's members.

Looking further into this, it turns out that PWC only perform financial auditing.

According to the website of Kahnawake Gaming Commission

Here is the link to Gaming Associates' web site
http://www.gamingassociates.com/

Agree. It is silly to think that this would be in GUI form unless it was a superuser account created by Absolute I will admit that I have no hacking experience, but it would seem to me that if you were trying to hack the holecards that it might be a lot more complicated than simply running a program that points to a specific table and just spits out the packets that are sent to other players. I would think that you would have to continually be adjusting the attack, maybe each hand if you are attacking a vulnerability in that the HHs are saved to Absolute's servers in real time (which also might explain away a few of the questionable preflop actions from EP e.g. 99 vs QQ), maybe whenever new players join the table. I don't know, but none of it seems conducive to multitabling. I still don't buy that it has to be an inside job because of the non multitabling.

Fell

Maybe they are waiting for "How to Cheat for Advanced Players"?

Fell

I see no reason why there couldn't be a remote system on Absolute's network to take over from which to sniff packets and thus do man-in-the-middle attacks.

They're incompetent in every other way, why couldn't they be incompetent in setting secure firewalls, etc.?

okay, thread over, report to thread #4