Absolute Poker Scandal: An Inside Job

[mmbt0ne]

[ QUOTE ]
from dan druff in that thread


[ QUOTE ]
Actually there was a very good reason for me to Jew up the staff there.


[/ QUOTE ]

and now I remember why I don't post on neverwin poker

[/ QUOTE ]

Shut up Christ Killer

[earck]

[ QUOTE ]
[ QUOTE ]
I wonder how ppl are that dumb and cheat in such an obvious way while they. Seriously if I could see my opponents holecards Id just play my normal Game making that extra valuebet bluff and fold every now then and ill have an constant income.

[/ QUOTE ]

I think he was probably justified in thinking he could get away with a lot, before this any 'poker is rigged' complaints were laughed at by most players, and especially because his massive river agression means you often wouldn't see his cards. Also, the way he was caught (AP accidently sending Marco all the holecards and IPs of players/observers) was very unlikely, leading many to believe that the log was sent deliberately by a whistleblower. Having said that his over-the-top play, expecially the ten-high all-in call in the last hand, was probably a factor in Marco asking for the hand history anyway.

The buyin was $1000 plus fee. I believe there were around 20 players.

[/ QUOTE ]

It was a $1000+50 tournament with 98 players. POTRIPPER won 30k with the victory.

It is funny to pokerdb him, he played a total of 4 tournaments on AP, a $5, a $20, a $50 and the $1000. He didn't even cash in any of the other tournaments.

[earck]

Nat, can you tell if any other player/observer was on the same subnet which might indicate if any more computers with AP based IP addresses were used?

i.e. if 363's ip was 111.222.X.X were there any other 111.222 ips logged?

[rubixxcube]

[ QUOTE ]
[ QUOTE ]
Can someone comment on the actual likelihood of an account that was created SO early in the Absolute alpha-testing process (so early as to be account ID 363) CONTINUING to possess "superuser" capabilities over the course of nearly 8 or 10 years (what with all the various software upgrades / fixes, etc)?

It's not that I'm not 100% convinced with all the evidence that we've collected to date. It's just that nearly every explanation given to this point starts with the premise that there's an account that was created VERY early on in the game that has hole-card viewing capability. It's possible that it's the original creator of that account who is a rogue programmer, but more likely that the real rogue guy is a more recently-employed programmer who just "discovered" this older superuser testing account (otherwise we'd have to believe that the original rogue programmer just "sat on" the superuser account for nearly 8 years before exploiting it). But can some systems-admin guys comment on the just how realistic an assumption it is that a testing account that was created 8 whole years ago, when the Absolute software looked and functioned very, very differently than it does now would CONTINUE to "work" through all the various upgrades, patches, software overhauls, etc, that have happened since Absolute's inception?

[/ QUOTE ]



Teddy - I know nothing of poker software security, but I do have plenty of experience as an SAP security consultant. In SAP and many other software platforms the "User" is a separate component than their "access" within the system. This is referred to as Role-based Access Control

http://en.wikipedia.org/wiki/Role-Based_Access_Control

Roles or functions are maintained separately than the Users. Users must be assigned a role to be able to do anything within the system.

Purely speculating, if poker software used RBAC security - there would be a "End-User Role" that would be automatically assigned to every user id created through the normal sign-up process. This role would allow you to log-in to the client, open a table, and perform all the functions necessary to play poker. Similarly, there could be other roles that provide more significant access - a developer role (allows access to source code), super-user role (can do anything), configuration role (allows changes to system settings), etc. The # and different types of roles would match the number of different functions needed to be performed within the system. Ideally, any powerful roles would be monitored closely and only exist within the dev and QA systems.

To avoid ranting too much, if the poker software uses RBAC security, the user may not have been "all-powerful" since the beginning of AP. This could be a support user id that was assigned the "Super-User" role at a later date giving the user id access beyond what it normally has.

Again, this is just a speculative scenario - I have no knowledge if poker software uses the RBAC security methodology.

[/ QUOTE ]


I'm going to agree with the above statement as well. More than likely each account has possible roles it can possess as stated above and it is very likely simply adding a role in the database can change the role of any account.

The email account for the 363 account probably is fake/not really the person't actualy email address. Where i work we have tons of test accounts with fake email addresses/logins for testing purposes only.

Being in programming my self this is how most systems now a days work. You would be surprised about how much information some developers have access to. I have been in entry level all the way up to senior programming positions and you would be amazed as to how much access i have had at some places.
One company i had access to live credit card information at my fingertips after being employed for a very very short period of time.



On another note, has anyone tried to use the email for user 363 to login to absolute. I doubt this account is active or probably even in the system any longer.
N82 i'm not saying that you should try to do this but has anyone tried to log in with the email address of user 363. Many accounts in test environments have silly password such as "password" or "test" or something else very basic. I would not be surprised that if anyone with brute force/dictionary attacks could figure out the password of the 363 user account if they knew the email address.
N82 i'm not saying to try it but i wouldn't be surprised if someone could get in, and the off chance that they haven't changed anything on the account. That would be a great youtube video, you in account 363 watching peoples hole cards.

Ruby

[greggg230]

They advertise for their play-money .net sites, at least in the US

[N 82 50 24]

[ QUOTE ]
Nat, can you tell if any other player/observer was on the same subnet which might indicate if any more computers with AP based IP addresses were used?

i.e. if 363's ip was 111.222.X.X were there any other 111.222 ips logged?

[/ QUOTE ]
There aren't any similar ones.

[tarheeljks]

[ QUOTE ]
[ QUOTE ]
[ QUOTE ]
from dan druff in that thread


[ QUOTE ]
Actually there was a very good reason for me to Jew up the staff there.


[/ QUOTE ]

and now I remember why I don't post on neverwin poker

[/ QUOTE ]

Yeah Dan Druff making a joke about his own race. ZOMG TERRIBLE. I THINK ONCE I SAW A BOOBIE ON TV.

[/ QUOTE ]

Jews are not a "race". Judaism is a religion.

[/ QUOTE ]


how dare you make a derogatory mark about the chosen. ban for anti-semitism

[KurtSF]

OK, just a few things.

(1) This link to the pxf hand re-player needs to be included in this thread. Watching that should convince just about anyone that cheating was going on.

(2) The fact that the name in the excel file is a known sys-admin in Costa Rica makes it more likely he just installed Excel on the computer and less likely he is the one who posted the data into the file. Is a sys admin more likely to have a job as a computer-guy or as a customer service hack?

(3) No account of this debacle is complete without the inclusion of AP's response. They spend a month reviewing the accounts and their play (the same hands leaked in the tournament, and more) and then make an OFFICIAL, PUBLIC statement saying everything was fine and there was no cheating. Not only is this an inside job, but AP is lying to us and trying to cover it all up.

My $0.02. Carry on.

[N 82 50 24]

[ QUOTE ]
(2) The fact that the name in the excel file is a known sys-admin in Costa Rica makes it more likely he just installed Excel on the computer and less likely he is the one who posted the data into the file. Is a sys admin more likely to have a job as a computer-guy or as a customer service hack?

[/ QUOTE ]
I showed that this isn't the case in the other file. I know it's a beast to read, but it's a good idea to read it.

[KurtSF]

[ QUOTE ]
[ QUOTE ]
(2) The fact that the name in the excel file is a known sys-admin in Costa Rica makes it more likely he just installed Excel on the computer and less likely he is the one who posted the data into the file. Is a sys admin more likely to have a job as a computer-guy or as a customer service hack?

[/ QUOTE ]
I showed that this isn't the case in the other file. I know it's a beast to read, but it's a good idea to read it.

[/ QUOTE ]

I was wrong. I'm happy to concede.

Please to be letting us know if any of your AP contacts get back to you.