AP, rigged, etc. #8981.4 - the plot thickens

[ur2barredout]

Apefish here are 3 tournament IDs that I was refunded for. Im certain of the first two and the third is one of the 150k unknowns.
1871149-75k gtd that Steamroller luckboxed to victory
1873059-Payup again gets lucky to win 100k gtd
1871011-

[Zorglub]

I emailed pokerstars asking why they kept quiet and if they had taken steps to make sure it couldn't happen at their site, the answer sounds convincing and reassuring:

We are of course aware of the discussion online about Absolute Poker. We
have no more information about the situation than you do; we can only read
the threads posted online. Absolute Poker is not affiliated with PokerStars
in any way, and we do not use the same software. It would be inappropriate
for us to comment on this situation.

However, we recognize that the online discussion may make some people
generally doubt the security of other online poker sites. PokerStars'
software was developed under strict security controls. Here are some facts
about the PokerStars software and its development.

> In the early days of software development, the concept of having a program
that could view hole cards live in order to help testing was discussed. It
was explicitly decided against that idea, specifically to avoid any
potential problems like the one that is being discussed in the forums. That
decision stands, and no such software has ever been developed in PokerStars
software to view hole cards live in real time.

> PokerStars does record all of the hole cards in all real money hands. This
is an important tool to help us investigate fraud and collusion. However
this information is not accessible to anyone until after the conclusion of
the hand; it is not transmitted to our database until all action is
completed and the pot has been awarded.

> To be clear: Nobody at PokerStars can see or know the hole cards of any
hand in progress. Nobody in senior management, none of the software
developers, no support representatives. Nobody at all.

> All software updates are reviewed by several people before being deployed.
All sensitive changes are also personally reviewed by the chief software
architect to help ensure they are stable and secure.

> In our company history of more than six years, we have had no indication
of any breach that would allow anyone to see the hole cards of other players.

> We are aware that there are some programs that claim to make it possible
to see other players' cards. We have investigated many of these programs,
and have not found any that do what they claim to do. Some of them are
actually malware, programs that compromise the security of whoever installs
the software. But mostly they are simply scams; attempts to steal money
from people who believe incorrectly that they will get a competitive edge.
In truth, they do not compromise PokerStars security.

> We have a large team of Poker Specialists in our Support Team who review
all suspicious situations and escalate to the Game Security team if they
find anything, which in turn will escalate to the senior management team if
any serious problems are found.

The security and integrity of our games is of paramount importance to
PokerStars. I hope that I have been able to alleviate your concerns.

Please let us know if you have any more questions or concerns.

[Josem]

[ QUOTE ]
[ QUOTE ]
[ QUOTE ]
According to my inside source, the internal investigation has revealed that there was very little if any cheating on the .net site.

[/ QUOTE ]
that'll be a big relief to the play money players

[/ QUOTE ]
It's significant b/c they expected to see the most cheating in games where the cheaters were least likely to get caught, i.e. against the least skillful players. So far it seems like that pattern was not followed.

[/ QUOTE ]

Hang on a tick - you're not serious, are you?

[runout_mick]

[ QUOTE ]
[ QUOTE ]
[ QUOTE ]
[ QUOTE ]
According to my inside source, the internal investigation has revealed that there was very little if any cheating on the .net site.

[/ QUOTE ]
that'll be a big relief to the play money players

[/ QUOTE ]
It's significant b/c they expected to see the most cheating in games where the cheaters were least likely to get caught, i.e. against the least skillful players. So far it seems like that pattern was not followed.

[/ QUOTE ]

Hang on a tick - you're not serious, are you?

[/ QUOTE ]

Has anyone seen Josem's sense of irony laying around?

[Arnold_O]

[ QUOTE ]


It only takes one coked-up retard to ruin it for everyone.

This type of pattern has been repeated 1258458345872345 times throughout history:

- Amazingly awesome scam that will never be detected
- Inner circle widens a bit
- Some noob gets cocky/cokey, does something idiotic to "blow" it for everyone

[/ QUOTE ]

nail hit directly on head. in fact i had to laugh because this has been my exact thought the past 4 days or so

[FoxInTheHenHouse]

[ QUOTE ]
[ QUOTE ]
[ QUOTE ]
[ QUOTE ]
According to my inside source, the internal investigation has revealed that there was very little if any cheating on the .net site.

[/ QUOTE ]
that'll be a big relief to the play money players

[/ QUOTE ]
It's significant b/c they expected to see the most cheating in games where the cheaters were least likely to get caught, i.e. against the least skillful players. So far it seems like that pattern was not followed.

[/ QUOTE ]

Hang on a tick - you're not serious, are you?

[/ QUOTE ]

[img]/images/graemlins/confused.gif[/img] [img]/images/graemlins/grin.gif[/img]

[GaryTheGoat]

http://forumserver.twoplustwo.com/showfl...e=0&fpart=1
[ QUOTE ]
...initial AP Statement...
October 21, 2007

Dear AP Player:

I am the former Grand Chief of the Mohawk Territory of Kahnawake and the owner of Tokwiro Enterprises ENRG, which holds a 100% interest in Absolute Poker .

...yada, yada, yada...

Sincerely,

Joe Norton

[/ QUOTE ]


http://pokerati.com/2007/10/21/mark-...poker-scandal/
[ QUOTE ]
...I caught up with Mark Seif yesterday at the Poker Bowl, being held at the Palms, where the the Absolute minority owner ...

[/ QUOTE ]

Does anybody have a copy of this Seif interview or a written transcript thereof?


I am trying to reconcile these statements made on 10/21/07.

I have mucho good information to research already in my files. I don't mind having more if my computer can handle it. lol

I'm thinkin' stuff like:

Absolute
Absolute Poker
Absolute Poker Management Company
Absolute Entertainment
Yada,Yada,Yada

All name variations in various entity types ie Corporations, Sub S Corporations, Ltd's, general partnerships, limited partnerships, sole proprietorships, yada in various jurisdictions ie Indian Territories(200+), US, Canada, Costa Rica, Panama, Columbia, Germany, Bahamas,yada.


Hypotheticals:

Joe Tokwiro Norton is the sole proprietor of Tokwiro Enterprises ENRG. Joe probably lives and works on tribal land and files no Canadian income tax returns.

Tokwiro Enterprises ENRG owns 100% of the common stock in Absolute Poker, Inc., a Delaware Corporation, consisting of 2000 shares.

Absolute Poker, Inc. has a 12 year management agreement with Absolute Poker Entertainment, SA, whereby


Anybody can pm or post any additional information or brainstorms.

Thanks

Edit bolded

gg

[Arnold_O]

[ QUOTE ]


I'm suggesting that using the term "superuser account" may not be sufficiently precise, and using that term may give AP some wiggle room, if it turms out the hole card reading was accomplished through other means.

[/ QUOTE ]

dude, give it up. you are wrong. you don't have a clue.

like the one guy before me said, it's the cornerstone of programming. the accounting software that i use has it.

[RedBean]

[ QUOTE ]
[ QUOTE ]
Just FYI, someone actually decompiled the AP client and told me that there was not a mechanism in the client for receiving hole cards. I don't know if he wants me to mention him by name, so I'll err on the safe side and not reveal it.

I am pretty sure that the hole cards were not received by the client. What the de-compilation told me lined up with what my sources told me.

[/ QUOTE ]

We don't really need to trust sources. There is just no way anybody making a poker client would ever send all the hole cards. While retards are apparently running the company, there is no way any software developer would ever do that.

I think it is likely there exists a "backdoor" or "superuser" account, and common sense would put it all server side. The authenticated user gets his/her own hole cards, however if certain "superuser" accounts are observing a table it is very possible the server sends them all the hole cards.


[/ QUOTE ]

The main goal in decompiling the client was to eliminate the possibility that the v8 client or later had malicious code that sent each player's hole cards to a third party source that could then be accessed independent of comprimising the server. This was not the case.

That leaves the following possibilities:

1. Custom client that can see hole cards, but is also verified by the AP server for use, despite not being the standard client.
2. Standard client may recieve all hole cards when a certain user account logs in that the server verifies to have sufficient privileges to send all hole cards.
3. Server is comprimised directly and hole cards are grepped real-time from logs or other means outside of client.

Either way, the security was comprimised internally by someone with access to the AP server and the ability to manipulate it in an ongoing fashion. This was obvious to many based on evidence, but it was necessary to do the legwork on the client to eliminate other possibilities.

Decompiling the client, in my opinion, eliminated the possibility of a "rogue software geek" inserting malicious code into an AP client update that sent hole card information to a third party.....as what looked to be one of the many versions of the story AP had appeared to try to throw against the wall initially....in effect to blame it on an isolated client version with malicious code, rather than admit a consistent and ongoing comprimise of their game servers located at MIT.

Another possibility, of course, albeit more remote... is the RivieraLtd.com server, which sits on the same subnet as the AP server, most likely in the same rack, but either way, behind the same switch....if it were to sniff packets in promiscious mode and then use the same decryption routines as the client, it could see every card going in and out of the game server for every table on AP. It would be quite an undertaking to employ this method when they just as easily seem to have had access to the AP server itself....but either way it's a little fishy when the guy sitting across the table from you has his profile information registered from a domain that sits inside the same protection boundary as the "secure" game server.

A true forensics audit on the Mohawk servers would answer all questions, but I highly doubt they would submit or agree to allowing this to happen, and I'm sure they'll give the appearance of one through their many close relationships with other "independent" companies.

But either way, knowing that Mr. Tom still has his own Riviera servers sitting alongside the AP game servers, and within the IP range assigned to AP by the Mohawks...that tells me that this guy is definately still involved on some level, and anyone who tells me otherwise is trying to blow smoke up my ass.

[El_Hombre_Grande]

I understand the need for clarity that some of you who are far more programming literate than I will ever be seem to be be focusing on. And I respect that when you look at this from certain angles and degrees of geekdom, Superuser may not as accurate as some other term you might choose.

But I respectfully submit that it is an entirely accurate name for an an account of a player that sits across from you at a virtual poker table and knows your hole cards.
And that the what matters, not the logistics of how the security breach was accomplished. At least, if our goal is to help the general poker playing public understand the situation.