Absolute Soulreading/Rigged thread #3

[futuredoc85]

Adanthar, i kind of think the way in which the hands were played makes it far less likely the perpetrator is affiliated w/ a poker site

[marimba man]

[ QUOTE ]

You need to be physically present to perform this attack. You need to be plugged into the local network, you cannot perform this type of attack remotely. Let me make it 100% clear. You will need to be siting next to the router, with one computer playing at the tables and the other computer capturing the raw data as it flows through the router.

[/ QUOTE ]

That was a great post. I'd always thought the idea of a superuser account was a bit ludicrous and that it was much more likely that someone was capturing the data. If this is 100% true, this has MASSIVE implications because it HAS to be an inside job.

[Janis N.]

Yeah, except it's not true. It depends on their physical network setup (which we don't know), but it's quite possible it can be done remotely.

[Injection]

[ QUOTE ]
I've been thinking all the Time,why these guys (assuming it is more than 1 Person) made it so obv that they are cheating.
I dont think that it was an Inside Job because AP knew that it would Destroy their Image.
And would a Hacker behave that way,that he would play like a Maniac,Dump the Chips to at least 1 Player and the other crazy things?He would play maybe Looser and a little bit different than the rest of the Players.
So that leeds me to the Conclusion:
1.They were really that stupid (what a lot Posters think but doesnt make that much sense)

2.Or it was someone who wanted to be caught and wanted to Damage APs reputation.
That would make Sense why they played like a Maniac and did all these things.And maybe I has to do something with the Update of AP.
Maybe some Security Person who got Fired or something like that?
Would that be possible?

[/ QUOTE ]

StephenNUTS, is that you?

[PokerStorm]

[ QUOTE ]

The existence of such a type of account is highly unlikely. It offers absolutely nothing more than a detailed log produced after the hand has been concluded and would be deemed a major security risk. Even if AP tried to have such an account, no regulatory/auditing authority would allow it.


[/ QUOTE ]

They are completely unregulated, so basically they can do what they want. And that is just what lots of online casinos and poker sites have been doing from day one.

[PokerStorm]

[ QUOTE ]

"Superuser account", "Pit boss account", etc.

The existence of such a type of account is highly unlikely. It offers absolutely nothing more than a detailed log produced after the hand has been concluded and would be deemed a major security risk. Even if AP tried to have such an account, no regulatory/auditing authority would allow it.


[/ QUOTE ]

I agree that a superuser account is a dumb idea. Like, who is supposed to have lodged the money into it? How could there be an account that lets you see everyone's cards, which I think is a possiblity for security reasons, AND let you deposit money and buyin to tables.

But I don't see why a security or master account isn't possible due to regulatory reasons as you mention. These sites are self regulated that's why it's so hard to get something done about the current situation.

[Fousekis]

[ QUOTE ]
Fousekis, you make good points and it shows you have IT experience. I don't have a lot of security background, but I don't think you necessarily have to be near the router to do man-in-the middle attacks on the clients. You can hack the central server or the router remotely.

[/ QUOTE ]

You are talking about two different things here, "man-in-the-middle" and "router take over" attacks.

Man-in-the-middle attack

A man in the middle attack requires you to be in the middle of a communication. It requires you to have physical access to the data that flows between the sender and the recepient. Such an attack (in the context of the current scenario) would require you to have physical access to one of these three places

The sender's network (this would be Absolute Poker's local network)
The recipient's network (this would be the other player's local network)
A central point somewhere in between the communication (e.g. the other player's ISP local network)

You cannot perform this type of attack remotely.

What Wikipedia has to say about man-in-the-middle attacks

Router take over

This type of attack allows you to exploit a vulnerability in the router's software (typically a buffer over/under run) to take the router over. Yes, this type of attack is possible to occur remotely, but the "remotely" part has to be put in context. You do not have to be physically plugged into the router, but you need a way of sending the attack to the router. In the context of the current scenario we are exploring, this would require physical access to Absolute Poker's local network.

Also keep in mind that these type of vulnerabilities are extremely rare and complicated. Most of the times all the attack can achieve is bring the router down rather than gain access to all of the information that flows through it.

[ QUOTE ]
Also, just because you say having a superuser account or sending others' cards to the client would be totally stupid does not preclude Absolute from doing that.

Look at how they've handled this from a PR perspective and ask yourself why would they have the IT part in order?

[/ QUOTE ]

The assumption being made here is that Absolute Poker are being regulated and audited by someone that knows how to regulate and audit. This is the kind of thing that is obvious to anyone that has a look at the system's architecture.

[ QUOTE ]
If this is 100% true, this has MASSIVE implications because it HAS to be an inside job.

[/ QUOTE ]

The point of my post was to demonstrate that speculating how the cheating was facilitated is only hurting this story. Although its nice to speculate and come up with theories, in the log run this could end up being the reason the story gets discredited. We do not have the necessary information to determine how the cheating was done, so let's focus on the things that add value to the story which is coming up with facts and evidence.

P.S. I guess I should have mentioned this earlier ... I play at AP

[TomC]

Hi guys, as well as digging the story

(which can be done here:

http://digg.com/security/Online_Poke...redible_source

or here:

http://digg.com/world_news/Major_Onl...aught_Cheating )

I have created an online petition:

http://www.ipetitions.com/petition/absolutepoker/

While none of this will impact absolute poker, it will help spread the word and if either of these things becomes popular enough then the mainstream media will start to take more notice of this.

Thanks

Tom

[Fousekis]

[ QUOTE ]
They are completely unregulated, so basically they can do what they want. And that is just what lots of online casinos and poker sites have been doing from day one.

[/ QUOTE ]

Someone in this thread (could have been one of the other two threads actually) said that they are regulated and audited by PWC and pointed to this website

http://grpoker.com/absolutepoker/

Is this incorrect?

Edit: Looking more into this, it turns out that this is a financial audit. Security audit is performed by Gaming Associates.

[TomC]

I've also created a facebook group:

http://www.facebook.com/group.php?gid=4999108811

Again - if enough traction can be gained then it will help spread the word.

Ps - if anyone can please photoshop a better logo (like absolute poker with cheat scrawled across it or something) then leave a message on the group

Thanks

Tom