Schneier on Security
A blog covering security and security technology.
« Hacking of 911 Emergency Phone System |
| New TSA Report »
October 19, 2007
Cheating in Online Poker
Fascinating story of insider cheating:
Some opponents became suspicious of how a certain player was playing. He seemed to know what the opponents' hole cards were. The suspicious players provided examples of these hands, which were so outrageous that virtually all serious poker players were convinced that cheating had occurred. One of the players who'd been cheated requested that Absolute Poker provide hand histories from the tournament (which is standard practice for online sites). In this case, Absolute Poker "accidentally" did not send the usual hand histories, but instead sent a file that contained all sorts of private information that the poker site would never release. The file contained every player's hole cards, observations of the tables, and even the IP addresses of every person playing. (I put "accidentally" in quotes because the mistake seems like too great a coincidence when you learn what followed.) I suspect that someone at Absolute knew about the cheating and how it happened, and was acting as a whistleblower by sending these data. If that is the case, I hope whomever "accidentally" sent the file gets their proper hero's welcome in the end.
Then the poker players went to work analyzing the data -- not the hand histories themselves, but other, more subtle information contained in the file. What these players-turned-detectives noticed was that, starting with the third hand of the tournament, there was an observer who watched every subsequent hand played by the cheater. (For those of you who don't know much about online poker, anyone who wants can observe a particular table, although, of course, the observers can't see any of the players' hole cards.) Interestingly, the cheater folded the first two hands before this observer showed up, then did not fold a single hand before the flop for the next 20 minutes, and then folded his hand pre-flop when another player had a pair of kings as hole cards! This sort of cheating went on throughout the tournament.
So the poker detectives turned their attention to this observer. They traced the observer's IP address and account name to the same set of servers that host Absolute Poker, and also, apparently, to a particular individual named Scott Tom, who seems to be a part-owner of Absolute Poker! If all of this is correct, it shows exactly how the cheating would have transpired: an insider at the Web site had real-time access to all of the hole cards (it is not hard to believe that this capability would exist) and was relaying this information to an outside accomplice.
More details here.
EDITED TO ADD (10/20): More information.
EDITED TO ADD (11/13): This graph of players' river aggression is a great piece of evidence. Note the single outlying point.
Posted on October 19, 2007 at 11:44 AM
• 50 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
There's an even dirtier part to this story, that's buried in the thread at 2+2:
"The guy who was on the same IP as the user 363 had his email set to an email that is hosted by Kahnawake Gaming Commission. "
This is going to get a lot uglier in the next few days. It's also going to destroy any chance of legalization here in the US (hearing scheduled for next week).
I can't be bothered to read that entire thread where each message needs to be clicked-
But using this situation as "evidence of cheating" is absolutely absurd:
Interestingly, the cheater folded the first two hands before this observer showed up, then did not fold a single hand before the flop for the next 20 minutes, and then folded his hand pre-flop when another player had a pair of kings as hole cards!
I'm not denying that cheating may have occured, but is there a situation where cheating is obvious?
As in- cheater has KK hole cards, and folds pre-flop because he has inside info of someone else's AA or something?
The suspicious players provided examples of these hands, which were so outrageous that virtually all serious poker players were convinced that cheating had occurred.
Yeah- show me *those* hands...
I know this is obvious, but why not delay the observer output until the critical information is no longer useful.
That way, if you want to observer you can, but the observer's knowledge can't be used to alter the play.
scosol: from reading the article, it sounds like that was just one example in a whole string of suspicious games. If that happened once? Sure - it's going to happen that people are either lucky or they're just good players, or a combination of the two factors. But if something like this example happens continuously with the same player, that certainly warrants investigation.
There's a (fairly) reasonable summary of a 93-hand segment from one of the playback tapes at http://wizardofodds.com/software/... if you want some direct hand evidence.
The cheating here is blindingly obvious, and I am usually a strong skeptic of online cheating claims.
Not knowing the precise statistics of poker, but isn't it possible to "cheat" as an outsider by signing up for the same table multiple times?
E.g., if you were playing four hands at a five-person table, wouldn't you have an advantage over the fifth?
That way, you could rip off unsuspecting players without insider help.
There's detailed analysis of this at many poker forums, some digging deep into the data. But for a shortcut, anyone who wants to see the outrageousness of the play hand-by-hand can view a movie generated from the leaked data:
(You can find blurrier versions on youtube if you can't stand to register on the site.)
I found sitting through just the first 30 or so hands out of 130 totally convincing. This player may start with the worst hand heaps of times and try to bluff people off better hands, but he *never* makes the wrong decision at the end of the hand (fold vs. raise/call). If his opponent makes a hand on the flop, he folds immediately. And by all accounts, it just keeps going.
scosol: The evidence of cheating comes from multiple hands among several different accounts. In this tournament, POTRIPPER typically will bet furiously no matter what their hole cards are -- *unless* their opponent is sitting on high pocket cards, in which case POTRIPPER will fold with cards like KJ. Also, POTRIPPER always raises or folds on the river, never calls. That only makes sense if you know what your opponents hole cards are -- and POTRIPPER always guesses right.
Jim Ramsey: Delaying the observers information wouldn't help; observers can't see any of the hole cards of any of the players (and thus have less information than any of the individual players in the hand). This observer account seems to be a "superuser" account, probably intended for internal testing purposes. Apparently, it *can* see the hole cards.
FP: You could certainly cheat by signing up for the same table multiple times, but it's relatively easy to track, and would get noticed. If you sit 4 collaborators at a 5 person table, for example, you can only steal from a single person and it's easier to get caught. And the more often it happens, the more chances people have to notice patterns. I have no doubt that kind of cheating goes on, but it's simply not in the same league as this.
"I know this is obvious, but why not delay the observer output until the critical information is no longer useful."
It's not the observer that was the problem. It's that the observer had access to the server, and information not normally given to observers.
I guess 'flop' means when everyone reveals their hole cards? What's 'the river'?
you play poker, you expect to get screwed.
@Rich Wilson: "The flop" is when the first three community cards are dealt (in the middle of the table). "The turn" is the fourth community card, and "the river" is the fifth and last community card.
thx for the links all- it's just that i'd heard this story from about six different places and there were never any details about the actual hands-
you'd think these people would be smart enough to lose on purpose every now and again to make it look legit... but i guess that's why they're criminals.
Something's fishy here.
1. Even a "part owner" of Absolute has enough income not to be interested in what can be made at the tables.
2. Since when do the "owners" have root access to computers (in any company)
3. Even a mediocre poker player will understand that making that many faultless decisions in a row will very soon become suspicious.
So... Competition found a way to bring Absolute down?
Sounds like the program should be illegal; I can tell you that back when I worked for the "Gaming" (i.e. gambling) industry, this sort of thing would likely have gotten us run out of the jurisdiction (and quite possibly the country). It should not be possible to have a privileged account grant access to undisclosed cards on a live system. Any such test code should be strictly off-line, never touching the release code or live systems. Release protocols should have strict enough controls to guarantee that this can't happen without collusion by multiple independent entities, and independent reviews are needed to ensure that there probably aren't back doors (intentional or unintentional).
Frankly, insider attackers were considered the norm against which we had to defend. I gather that their section of the industry isn't well regulated.
"1. Even a "part owner" of Absolute has enough income not to be interested in what can be made at the tables."
Gambling addiction or compulsive cheating doesn't differentiate between high and low incomes.
"2. Since when do the "owners" have root access to computers (in any company)"
Since they can either hire a crooked IT stooge for 10% off the profits, or inform someone with a family that they'll be terminated for a trumped-up cause if they don't cooperate.
PokerFree: 1. The cash games in question were the largest on the site and could have a million dollars or more on the table at one time.
2. The "superuser" in question was most likely a user left over from alpha-testing.
3. It looks like from what I've read, the cheater played it cagey for quite some time before greed took over. Generally, smart people with good impulse control don't scam others for assloads of money.
I very much doubt the "competition" found a way to "bring Absolute down." Most companies have no interest in destroying their rivals, as a healthy and competitive sector is essential for profit and growth. This scandal hurts all the sites, especially with the Internet Gambling Bill being reassessed soon.
Gambling on-line is probably one of the DUMBEST thing anyone can do.
If you ever thought these games were honest you deserve what you get (got).
It's interesting someone blew the whistle; but zillions of lazy dumb xxks will never hear it!
@scosol: Here is a thought for you.
You come here to read Bruce, and Bruce is a pretty good security guy; I bet you, he won't design a game that can't be rigged for ANY amount of money.
Alternatively -- You can try to design one and see where it takes you.
Bruce: A comment from you will be appreciated much ..after all I have put you on a pedestal :-)
catsclaw ... Sorry, I hadn't realized that a privileged account had been compromised.
Why bother cheating. Running a poker site should be a license to print money even if you're totally legit anyway.
I just seems to be that gambling on anything where a computer controls or observes is dumb. I don't even trust video poker machines in Vegas.
Gambling is just a tax on stupid people. There is simply too much temptation to cheat, and too many ways to do it. It is not a question of IF there is cheating. It is only a question of HOW MUCH cheating is going on.
Perhaps POTRIPPER was merely making a point (as well as a little money). His username warns everyone he plans to rip off the pot. A number of the regular players who say they almost never believe accusations of cheating said it was obvious in this case, as indeed it is. Others also said if POTRIPPER wasn't so blatant, he could have continued the fraud for a long time. So maybe POTRIPPER was a proof of concept: the guys who say absence of statistical proof of cheating is proof of absence of cheating are wrong. Is that what Joe Thomas was saying? (The msnbc id/2138102 link is dead).
Ron: Gambling is a tax on stupid people even without cheating. The odds favor the house, always - otherwise the house wouldn't stay in business. Of course, with poker and other games where skill plays a role as well as luck, the odds against stupid/mathematically ignorant/overconfident/addicted people are just that much worse.
People wonder why online gambling is illegal in the US. This is a perfect example. I have no doubt in my mind that many of these “off shore��? gambling sites are in one form or another scams their clients.
I have a friend who works for a very very large name in online poker and he tells me that play Bots as cash tables and sometimes even multiple bots at a single table.
Cheating in some form or another happens - that is why I love the game, but only ever play live and even then you have to be careful.
amazing how poker stars had 40k to 50k players less than 3 years ago. and after all the complaining of rigged dealing in the chat lines, they now have over 100k every night at prime time! seems like they know how to advertise to morons faster than the others catch on and quit feeding these rigged vacuum bags. i got millions in months in play money games there starting from 1k twice, but garbage beats in real money are totally automatic. like they can put a cold deck in to thieve anytime they want. and you lose that way alot in play money and 100 million in chip account is only 16 million. but for real money you cannot make a profit to the dumbest players ever, at every $ level, 2cent is the same as $30. in the real world, these azzholes could not warm a seat. but never lose online, after they were the biggest, fastest losers ever seen in live games.
also, it seems to me, to stack a deck you would have to know where the cards are first before you put them where you want them. but in a fair game you wasted your time not learning how to play when they really chop em up or reshufflle and you now don't know where you put them. i would like to see these winners online and tv take my money live in a fair game. it would be very revealing or i would pay to learn something different, like how to play now after winning all my life with different way of playing than these because i woulda done nothing but lose plauying like these.
also, on chat privileges. i think these sites are not interested in cards, only in getting paid for running a nice kiss azz get together which the fools pay for the privilege of being in. all chat should be ok no matter what or no chat for everyone. that would be the only fair way of doing it. some find this verbal kiss azz nicety as offensive as the others don't like crude or cussing remarks , namecalling, or what ever
now, back to rigged sites. i had as many as 23 -29 sites downloaded. they all deal without a full deck. here is why i say that, with a full deck the odds of losing is so much greater than the % of losers that are dealt online. at pacific poker i counted and hit a flush on the last 2 cards only 7 of 100 times, and 3-4 of those lost.
also a friend of mine was reading the odds of poker hands. he told me that ace ace wins 40% of the time in true random number generation live . with a full table calling all bets. but online i couldn't get 50% against 1 caller no matter what that 1 had.
more site bullshit(fact). every time i am in a tournament and am close to making the money they deal me the best cards i seen all game, and if i play , i lose. ace ace is a dead hand close to 100% of the time, even in play money tourneys. and the caller is always a big stack calling on losing garbage. they stop the game when i fold aa with 12 - 50 players left to make the money, like they can't believe i sense what they are up to.the game freezes compared to it keeps running right along.hahahahahaha is what i type at them.but how do you get a stack like that playing that crap in the 1st place?
nobody can do that.
the reAl kicker comes next
dweemson is my playing name, at all sites. some might be with extras like dweemsonx, those sites are merged with others i downloaded first. you see how even i could play 2 seats on the same table with that 1? pokerroom.com, hollywoodpoker, and dsi poker are all related and i have 3 different dweemsons and these all run the same tables at the same stakes in ring games.dweemson comes from dweeming on and on of a real poker game that i have never found online. i do believe if these names in the seats are real people and with faster dealing online but with fair unrigged dealing like in the live world i would make $1,000,000 a year at $10 limit(any game) due to the quality of the players as seen. that would be if these are people and have real money and play the way they play online.
oops got sidetracked. i started onkline in sept.2004 and 7 days ago approx. at stars i got a site to check out from a player at the table. www.pokerrankings.com. it listed non-gambling poker. it showed an ad for a cheating system i heard about 2 years ago. the one where you can see all the cards for $49.95. the ad was there all week but has been taken off for the weekend if not permanently. that ad had a copywrite of 2004 to 2007. no wonder these play like this and never lose is obvious to me.
my friend said 2 years ago he went to motor city cassino in detroit (70 miles away) and a player there told him that he knew a computer whiz that showed him for a fact that the players could see all the cards on the table. so he only plays live to keep from being crooked.
i think everyone should get the cheating system and have the same advantage nullifying the phony crooks advantage and that would be some game-haha, where everyone on the table knows whats up instead of the dumbest make no sense slobs winning(if you call thiving winning) on what would be dropping off there money in a very brief appearance at a card gasme they were never in like in the real world since the beginning of time.
there are now 2 guys in this dinky town that used to deal in vegas. they said they were shown by the other dealers all kind of tricks at stacking the deck. magic tricks like david copperfield and doug hennig do. can you play cards against these guys? maybe, but a fool would on their deal.but the issue is why would these play with that when they are only getting paid for dealing the game?try this one, a player at poker4ever said his brother is a magician and every casino that knows that has offered him a job. at higher than the going rate(minimum wage for unskilled workers-cotton pickers or snow shovelers)and with commissions for incentive bonuses for more profits generated. no wonder i never played in a casino, i now know it was more than the rake which never made any sense anyway.when you are after money you don't have, you don't get it giving what you got away. you shovel your own snow so you can spend your money. not pay for shoveling to stay home.
All Poker Sites Cheat, Meaning
1.Have House Players
2.Have Standard Flops With Certain Pairs
3.Can Dislike You For Cussing Etc And Make You Lose ! Trust Me Been There ! It Got So Obvious What Hands Were Coming I Would Cry Laughing !
This Goes For Any Site, Poker Stars, Absolute Poker, Ultimate Bet, Full Tilt, etc
Play Live ! Its Less Rigged ! ;)
this last guy-D on jul 28 KNOWS what i know, or is guessing accurately. he is on the right track
also, you can make it totally unrigged as well. write to see if you guess as good as i do at how. firstname.lastname@example.org. why play with people who refuse to obviously be right and above suspician? idiot replies to the obvious says they atre not worth anyones time, especially those that want a real and fair game.
on poker stars the last 60 times i have had queens have gone all in and have gotting 1 caller i have won 3 times 3 times floped a set and lost to a runner runner flush so i know that poker stars is rigged so if u want to give your money away just give in to charity not to poker stars the usa will never let theses poker sites to be legal because they just dont play fair cheers to the usa goverment
If you want to know what is happening on
a poker site,use comodo firewall and watch certian ports open while playing.You will notice port 80,443 along with others depending on the site you play.I have not found a poker site yet, that i would play a real money game.
Port 80 is used by internet browsers to connect to web servers.
Port 443 is used by https - that is, secure web browsing.
I know that AP poker, and Poker Stars is RIGGED!!! HANDS DOWN!!!!!! My husband got an invitation to play at AP and they deposited 10 bucks to his account after he had not been playing there for a while. Well, I will tell you that he WON EVERY HAND!!! He then had to go to work and he gave me his account to play, and there were 80 people left and I told him after 15 minutes of play that it was TOTALLY RIGGED in his favor!!!!!! I won EVERY FUCKING HAND!!! I even called all in bluffs on the river b/c I knew no matter what I had the best hand!!! I even called with no pair on the board to an all in with 4,6 offsuited!!!! That's right peeps!!!! You heard me right!!!! The dude tried to bluff for all his marbles on a suckout draw!!! He missed and when all in!!! In any other game, I would have folded 4,6 b/c there was NO pair for me. I called, and he showed 2,5 suited!!! LOL!!! They RIGGED it so my husband would get all the cards!!! My own personal account is also rigged! Both sites do NOT want me back!! I go on to tell people just how the sites are rigged. Ever since then, they have me lose every hand! It took me 3 years of 40 hours per week of playing to figure the whole thing out!! They will rig the site against you bigger then shit!! Especially if you "bad" mouth them, and say that they are rigged, etc. In one instance I was telling everybody in the rooms how it was rigged. Suddenly, I was "magically ejected" from the room!! LOL! I mean it closed me out of the tourney!!! I went back to the same room again, and they separated everybody!!! Then the guy I was talking to started losing bad. I guess they wanted him out so that I wouldn't continue to talk to him for all to see.
I have played on almost every poker site online.I will tell you that they are all rigged.The 2 most rigged sites are AP and poker stars.They will let you win about ten percent of the time you play and if you dont cash out right then I promise you you will lose that money too.I have emailed them acusing them of cheating,called them.They say the same thing over and over, that there site is the most secure.How is it that no matter how good a poker player you are you cant win there.Its because only a certain amount of people win there and they are somehow tied into absolute.They all work together to make all the money.They could play fair and make so much money they would never be able to spend it all but they are greedy and evil.They are crooks.
The fact that cheating is plaguing online poker rooms should not come as a surprise to anyone who has any idea what the true origins of poker are.
Most of today's poker players were just trapped by the big "infomercials" that are officially called the World Series of Poker, the World Poker Tour, and so on. The problem with all the players that were inspired by televised poker is that they really have no idea what they are getting themselves into. Television is not a media that portrays facts. They are in the business of selling illusions. So, when TV folks put together a program on the history of poker, it's all just a big illusion. In reality poker has always been a dirty game, always infested with cheats. That is precisely one of the reasons why casinos were never keen on hosting poker games. Basically they never really wanted to attract poker cheats to their casinos, because once the cheats are there, they may start getting other ideas.
So, When poker was booming, in the early years 2000, the internet was also growing at rapid speed. It was just logical that poker would find its way to the internet. But the internet is yet another illusion. We all know what happened to all the .com companies that were trading on the stock market in the late 1990's. Just a fancy looking web site, and "investors" believe they find a great company to invest in. Poker sites are very similar. Their slick interfaces create the illusion that this is a serious company. But in reality it's just a web interface of a virtual company that is hiding somewhere in some country where they cannot be subject to US laws and regulations. I am not exactly a fan of all the laws and regulations, but when an industry is completely deregulated they can basically get away with anything. And what industry are we talking about? Gambling.
In the words of David Johnston (author of Temples of Chance) gambling is "an industry build on greed." This so-called "industry" produces nothing and gives nothing to the society. All that this industry does is creates an illusion (again, we are talking about illusions) that it is possible to win money without working. This is undoubtedly a dream for many people. But that is all smoke and mirrors. The casinos always have an edge and anyone trying to make money by gambling is just pouring cash into a bottomless well.
Having considered all that it should come as no surprise that a scam has finally been uncovered in the world of online poker. What is surprising (or I guess not) is how many people just refuse to believe that online poker rooms (all operating at the edge of law and unregulated) have every incentive to be crooked. Not only do they have the incentive, they have the means and the opportunity, too. There is no actual deck that is being shuffled, there are no actual cards that are being dealt. All that really happens is some images of playing cards appear on several screens around the world. Some of the players are definitely real. But statistically speaking there must be at least an average of 10% of fake identities on the internet at large. Why don't people that play online poker just use some common sense and see that cheating is just inevitable under such circumstances. In the old days the poker hustlers used to say: "In poker you're either in or out." Nothing's different about internet poker. So, if you are not part of some online poker scam, than you must be one just of the suckers.
After playing for some years online, and live. I honestly believe that the deck online is set to have more runner runner cards. It is balanced to keep the money right where they want it to be, on the site and never cashed out. I can fold hands for hours and play only premium hands and the stats say I should be making money. Not how it happens alot of miracle's happen to often to keep my bankroll right where it started. O well you either realize it or you don't I will still play online because I love the game just not expect anything out of it.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.