Online Casino News

Absolute Poker and Ultimate Bet: more cheating or a security flaw? Security so weak that hole cards were easily read.

A few days ago, Poker Table Ratings published an article advising that Cereus Poker Network uses weak encryption:

Cereus Poker Network uses weak encryption, poor security practices


Release Date: 2010-05-06

Last Update: 2010-05-06

Severity: Critical

Impact: Exposure of sensitive information

Where: Network access required

Solution Status: None

Poker Sites: Absolute Poker, Ultimate Bet


Description:

The Cereus poker network uses a weak xor based encryption mechanism for all network transmissions instead of the industry standard SSL. The encryption key can be easily identified from a network dump and used to decrypt all information transmitted between the client application and the Cereus servers.

In our lab we are able to intercept and decode the user's login name, and receive an MD5 hash of their password, as well as their seat number and hole cards. Once the MD5 password hash has been intercepted, we've been able to log in using the intercepted login name by overwriting the outgoing login packet with the intercepted MD5 hash – thus logging in the victim's poker account without their knowledge, remotely.

In other words: the Cereus Poker data encryption system is below industry standard, and can be hacked into, with shared networks being the most vulnerable.

In the Cyreus Poker companion article, PTR goes into more details about the relative simplicity of gaining access:

Testing

In our lab, using a dummy cracked wireless network, we’ve been able to successfully hijack our own test poker accounts without being connected to the network the test victim is playing on. We’ve also been able to observe hole cards as they were dealt in real time from a test victim, using the same mechanisms.

All of our tests were done in a lab environment, using cheap commercial grade hardware. There is some custom software involved in actually logging in a hijacked account, and decrypting the hole cards. The source for all of the testing totals less than 500 lines.

The wireless network cracking and snooping was done using freely available open source software.

You can also watch their Absolute Poker Network Encryption Vulnerability video on Youtube.


It's astonishing that Cereus Network opted for this easily hacked OXR system in the first place, particularly in light of these comments from PTR:

Almost every poker network uses some implementation of the SSL protocol, which is the same type of security mechanism that everyone from banks to government agencies use to secure their data.

There are several freely available implementations of this protocol including the open source OpenSSL.

SSL is the industry standard, and is generally regarded as best practice for encrypting network transmissions.

Why in the world would Cereus use a hackable encryption system, when a secure system - and the industry standard to boot - is freely available, and wouldn't cost a penny?



PTR reported on the Cereus Poker security response later the same day:

I'm expecting to have a solution in place in a matter of hours and I would really like to discuss engaging your company to help us test the solution, if your company provides such services.

It's also surprising that a solution could be put in place "in a matter of hours" - did Cereus have a backup secure system to implement in the event of detection? A poster in the 2+2 Poker Another hole in UB and AP security thread had this to say:

05-06-2010, 09:31 PM

Let me make this clear. This level of **** up can't be fixed in a matter of hours. Properly fixing this in a secure tested way would take weeks.

Anything put together within the next few days will be some botched unsecured, untrustworthy hack.

The Kahnawake Gaming Commission issued a Cereus Poker advisory notice the next day, the poker rooms in question being two of their permit holders:

Based on information available at this time, it appears unlikely that player gaming data was actually compromised. However, this possibility will be reviewed further and, if necessary, the Commission will direct that the appropriate remedial actions be taken.

Until a solution to the security issue is fully implemented, the Commission recommends that players use caution when accessing the Absolute Poker or Ultimate Bet sites, in particular when using a public network (wired or wireless) or a private wireless network.

As noted in the KGC comments, Cereus Poker Network powers Absolute Poker and Ultimate Bet. These two poker rooms have a notorious and well-documented history of cheating after the exposure of the "superuser" scandal, in which employees of the two poker rooms gained an insurmountable advantage over players by reading their hole cards.


The AP situtaion is summarised in the Absolute Poker thread at 2+2 Poker, and the almost identical Ultimate Bet affair can be read about in the UltimateBet let players get cheated for millions discussion at the same forum.


Although this latest incident is a different kettle of fish to the superuser scandals of a couple of years ago, there are remarkable essential similarities: players at Absolute Poker and Ultimate Bet appear destined, come what may, to have their hole cards read.


To end on a marginally entertaining note: Cereus Poker Network is, not unsurprisingly, eCOGRA approved:

The independent standards authority of the online gaming industry, eCOGRA, has announced that the CEREUS online poker network has achieved the required standards for its Certified Software accreditation seal. eCOGRA is specifically known for their focus on fair gaming and player protection.

It's remarkable that eCOGRA failed to notice, while investigting Cereus for these "required standards of accredition", that they used a weak, vulnerable and non-standard encryption method that could result in compromise to player security potentially costing many millions of dollars, as was the case with Absolute Poker and Ultimate Bet.

Post a Comment

Rushmore Casino: theft of winnings with no proof of player wrongdoing

The Rushmore Casino group is no stranger to questionable behaviour with regard to player payment issues and others - you can see details of everything I've reported in my Rushmore, Cherry Red and Slots Oasis warnings.


In February this year, Hungarian player Balazs M reported on another Rushmore incident in the Rushmore Casino doesn't pay thread at Winneronline.


In summary:

After cashing out $9500, including $7500 in winnings, the player was independently investigated by two private investigators who had been hired by Rushmore as a result of an identity fraud issue perpetrated with stolen passports. The reason given by the casino was that the player had registered as his address a house which was not his actual residence.

The reason for the discrepancy was that his parental home was his permanent address, and since the casino requested this information, he supplied it. He currently lives in rented accomodation, a different address.


The player was initially investigated, via standard means, by the people employed by Rushmore - an investigation he satisfied completely. The investigators established that he lived where he claimed, and that his family home was also correctly listed.

Rushmore refused to pay, saying as follows:

This is actually the address of his mother. We can not verify this player and refuse the right to pay the player.

False information was provided, and this is not his residence.

The address the player supplied was the address the casino had asked for - his permanent residence. As such, Rushmore appears to have required him to supply an address that would ultimately illegitimise any cashout. This is an absurd situation, created by the casino and resulting in absolutely no sinister or fraudulent activity on the part of the player.


The rejection of the findings was a surprise to the investigators, and also something of a professional slant, as it appeared to cast doubt on the integrity of their work. The Hungarian colleague had this to say;

To put you in the picture, similar kind of problems occured in the case of three other Hungarian citizens. They have a permanent address but they rent a flat elsewhere. I have described the Hungarian circumstances extensively and in detail to my British connection (temporary address, but the required utility bills go to the permanent address etc.).

My task was to undoubtedly identify you. This was done, and I forwarded this in this manner to my British partner, who forwarded the identifications to the casino, word-for-word.

My personal opinion is that the casino doesn't play with honest cards.

The investigators decided to go one step further, and verify the player physically. This they did, with a face-to-face meeting, which was also fully satisfactory.


Rushmore continued to refuse to pay, and carried on with same bogus insistance about "misleading information" which they themselves had requested.

The investigator finally gave up in frustration:

I'm very sorry that this is their decision, which is incomprehensible for me and for my colleague, too. My possibilities are exhausted with this, unfortunately.

So, as a result of supplying the information specifically requested by Rushmore Casino, the casino refused to pay - even after the player had fully satisfied all aspects of the independent investiagtion which the casino itself had instigated.


The player then publicised the matter in the Rushmore issues thread at the GIA. He gave every indication of being genuine, and the casino was invited to take part in a private examination of the issue.

They refused.


Previous to this, the player had attempted to air the matter at Casinomeister, Rushmore being a Casinomeister accredited casino. According to his testimony in the GIA thread above, he received short shrift from self-proclaimed player watchdog Bryan Bailey:

03-11-2010, 06:17 PM

Some weeks later Casinomeister banned me. I asked him why I was banned and he informed me that the reason of banning is that I gave false information when signing up at Rushmore and the address is not mine but my mother's.

I had an account at Casinomeister and Rushmore informed CM about their "findings". I think everyone was banned from Casinomeister who was called "guilty" by Rushmore.

Banned indeed he was:






Bailey appears to have done little more than read and repeat back what the casino told him - his response was an almost exact copy of the casino's response to the player.


The player also filed a complaint at Gambling Grumbles, which was written up in the No payment but for a different reason report. Here, the casino appears to have started weakening and trying a different tactic:

We would have not paid him even if the residential address issue would have been cleared. This is due to other investigations which were carried out which show connections between several players which in most cases were connected by e-wallet account.

So to summarise the situation so far:

The player was investigated on the basis of an accusation that was proven groundless; the casino continued to insist that the player was in the wrong, and refused to pay him, long after he had already been proven right. Once it became apparent that this tactic was dead in the water, they threw some further bogus and entirely unsubstantiated accusations into the mix, none of which had previously seen the light of day and which, in the light of the full and clear investigation carried out by independent professionals at the behest of the casino, appear not a little desperate.


I have also publicised the matter in the GPWA Rushmore Casino steals $7444 thread, and have encouraged the player to follow this up further with another complaint service.

Post a Comment

Ask Gamblers online casino help service

I recently came across Ask Gamblers, an affiliate portal which offers a casino complaints service where you can ask for help with a problem.


Before posting a complaint, you need to first register. Having registered, read the rules in the help section, and also read the terms & conditions.


Post about your problem in the create new complaint section.

The casino is given four days to respond, and you will receive email notification when they do so. If the casino fails to respond, they will be given "negative points", though I have no idea what this means.

Crucially, the player is required to respond to any casino feedback also within four days. Failure to do so will result in the complaint lapsing into "inactive" status and its removal from the public complaints page:

Member who posted a complaint also have a 4 days to answer to the complaint, but in case they reply after that period, they will not be credited with negative points, but their complaint will be removed from home page and from the Active complaints section.

As such, you need to remain proactive with your complaint, or you risk losing it.


The discussions / exchanges between casino and player are public, which is a fundamental condition of transparency. The service also appears to have achieved some success, as evidenced by the "solved successfully" status of many complaints.

I note, however, that many cases have "closed due to inactivity of submitter" status; this may effectively lead to a situation in which the casino simply has to post responses until such a time as the player gives up in frustration, at which point the player unjustifiably appears to be at fault.


Useful or otherwise, any service which helps to spread the word of casino malpractice in an independent and transparent manner is a worthwhile addition to the generally ineffectual and compromised crop of services which masquerade as "player protection" entities.

Post a Comment

Intercasino bonus terms improved and clarified

I raised the matter of slightly ambiguous bonus terms in my Intercasino video poker article a few days ago. The issue in question was that although the terms limit bet size to 25% of the amount of the bonus given, they did not specifically disclude bets made using the video poker double up feature:

In the interests of fair gaming, players may not place individual bets equal to or in excess of 25% or more of the value of the bonus credited to their account until such time as the wagering requirements for that bonus have been met.

For clarity an individual bet relates to the total amount wagered on one spin of the roulette wheel, one individual hand against the house in table games or blackjack (double up in any individual hand is permitted), one deal of the cards in video poker (no matter how many hands are chosen to play with) and one spin of slots.

I was concerned this was leading to confusion, as a player reported losing a £2000 cashout as a result of infringing the rule, which he apparently had not interpreted as relating to the double up game. I exchanged emails with them on the matter, suggesting that a clarification be made.


Intercasino has now added this clause:

Individual bet also relates to the total amount risked on any round played within both the bonus feature offered in bonus video poker, including winnings brought forward from subsequent rounds, and also any and all bets using the video poker double up feature, or one spin of slots.

There is now no room whatsoever for doubt. It's the sign of a good casino when they listen to suggestions and implement them.

Job well done, Intercasino.

Post a Comment

Gambling industry profitting from poverty, says government minister

David Lammy, minister for higher education, is concerned about the proliferation of gambling outlets on the streets of London, which he considers a "barely concealed attempt by the industry to profit from poverty":

Our high streets don’t need the Las Vegas gambling effect

They're the new face of London's neighbourhood high streets: the garish plastic window sheets that stop people looking inside bookmakers.

I see it in Tottenham. But in just over five years, London has gained 350 new gambling establishments, from bookmakers to adult gaming centres and bingo halls.

(more)

There is certainly a correlation between gambling and poverty, as gamblers tend to be from less educated social strata with correspondingly lower incomes.

Coupling this with the clear demographics of betting shops outlined in the article, and the gambling industry does not emerge with much credit, with David Lammy's unflattering comments about "profitting from poverty" seeming to hit the nail squarely on the head.

Post a Comment

Gambling dooms UK to ruin

This is the doom-laden pronouncement from a columnist writing in The Guardian a couple of days ago:

Muddled manifestos mean gambling will thrive

British gambling policy dooms your nation to ruin. I know because I'm an American. The Clegg surge provided fresh hope: maybe the Lib Dems are proposing sensible new moves vis-a-vis gambling with their manifesto, I thought. Labour and the Conservatives are useless on the issue.

(more)

Are we "doomed to ruin"? Although I empathise a lot with the tone of the article, it seems an exaggeration on the face of. The Labour government is now dissolved, pending a general election, and it's unlikely to be re-elected. Although they certainly had a love affair with gambling, much of the proposed change was not successfully followed through on, largely through sheer lack of interest.


Hopefully the election of a new government will also help to keep in check the gambling bomb whose touch paper Labour never really successfully lit, and common sense will generally prevail.


However, the article raises valid concerns.

Post a Comment

Want To Stop Gambling

Want To Stop Gambling is engagingly, entertainingly and amusingly written by Brighton-based problem gambler Jake Brindell, and covers his own journey from problem gambling to health, and advice based on those personal experiences.


Jake's life story tells us, in brief, how he started as a problem gambler, the brush with death he experienced and its cathartic effect in starting him on the road to recovery.


How to stop gambling is a hotch-potch of ideas on how to tackle problem gambling, including keeping a diary, varying your routines, reading, alternative therapies and others.


The Problem Gamblers Federation is a proposed project to push the issue of problem gambling into the public consciousness, which the author defines thus:

The problem gambler federation is a call to you to help change the status quo - to join the fight against the greedy ignorant captains of the gambling industry who only care about profits and use lies and spin to say that they care about responsible gambling.

I can only say that I completely empathise with this jaundiced view of the gambling industry.


However, far and away the most thorough and useful part of this site is the Want To Stop Gambling ebook Jake has written. It's worth a review in its own right, but here I'll limit myself to some brief notes of content summary:


• How to identify a gambling problem.

• Some famous problem gamblers (Marie Antoinette??)

• Gambling and debt.

• Reasons for problem gambling.

• Errant beliefs / superstitions.

• The effects of problem gambling.

• A "motivation to change" agreement.

• How to go about changing.

• The simple power of beliefs.

• Triggers that might cause a lapse back into old habits.

• Relaxation activities and excercises.

• The true value of money.

• The power of the human spirit.


This little ebook is very comprehensive and written in a conversational and engaging manner. It's very easy to read, and I highly recommend it for anyone interested in the subject. I've saved a backup copy should it go offline for any reason.


Of the handful of sites I've reviewed over the past few days, this one was an unexpected little gem to come across. Worth reading from top to toe.

Post a Comment

May 2005 | June 2005 | July 2005 | September 2005 | October 2005 | November 2005 | December 2005 | January 2006 | February 2006 | March 2006 | April 2006 | May 2006 | August 2006 | October 2006 | January 2007 | February 2007 | March 2007 | May 2007 | June 2007 | July 2007 | January 2008 | February 2008 | March 2008 | April 2008 | June 2008 | July 2008 | September 2008 | October 2008 | December 2008 | January 2009 | February 2009 | March 2009 | May 2009 | June 2009 | July 2009 | August 2009 | September 2009 | October 2009 | November 2009 | December 2009 | January 2010 | February 2010 | March 2010 | April 2010 | May 2010 | June 2010 | July 2010 | August 2010 | October 2010 | November 2010 | December 2010 | January 2011 | February 2011 | March 2011 | April 2011 | May 2011 | June 2011 | July 2011 | August 2011 | September 2011 | December 2011 | February 2012 | May 2012 | July 2012 | August 2012 | March 2016 | April 2016 | June 2016 | November 2016 | December 2016 | March 2017 | May 2017 | June 2017 | August 2017 | August 2021 | October 2021 | May 2022 | December 2023 | May 2024 | Atom feed