How we learned to cheat at online poker: a story of software security

Before you get all excited and start writing your own pseudo-random number generator, make sure to take a stroll through some CodeSOD over at the Daily WTF. There are plenty of examples of people trying to out-smart the built-in generators and failing miserably. This stuff ain't easy.

Keep in mind that this happened in the late 1990s. The major players in online poker (PokerStars and Full Tilt Poker) have millions of dollars to lose if someone discovered a flaw in their random number system. Accordingly, they have invested a lot of money and time into ensuring that their systems are secure to avoid something like this happening agin.

That being said, there are still problems.

Several months ago the 2+2 poker community discovered people using "superuser" accounts on Absolute Poker, which could see everyone else's holecards. Fortunately, the perpetrator wildly abused his powers and was discovered in time.

And who knows, you could discover some zero day exploit that gets you the same thing. All you have to do is spend thousands of hours attempting something that you probably won't succeed at and even if you did, you'd probably be discovered quickly because of inconsistencies in your play.

And oldie but a goodie. I remember when this first happened. A lot of people thought the industry would never recover. My opinion was always that half of the people thought it was rigged anyway (even when it wasn't) and still played, so what was the difference?

I think I've since been proven right by the fact that Ultimate Bet and Absolute Poker still exist.

I remember a casino where the communication between player and server was done using SSL. I compiled a custom OpenSSL DLL and was able to intercept the roulette commands!

Unfortunately whether it was a winning bet was done on the server, and the communication was just sending the bet to the server, and the other way, the result to the player.