Cereus poker security alerts

[onebourbon]

Oh well...C'est la Vie as tthe french would say....at the end of the month I'll be on a feeding frenzie trying to blow my bankroll there....if I don't succeed I'll have to cash out I guess....lol

 

[cAPSLOCK]

Still broken, after being "fixed".

http://www.pokertableratings.com/blog/2010/05/cereus-patch-adds-ssl-audit-underway/

 

[kidkvno1]

What the take-away from this that everybody should understand is that Network Security and Applications Security is really, really hard to do well. It is very EASY to do it badly (as in the MD5 offset hash) for people who are not well trained in the arts. So they put a band-aid in place (stronger keys). Big deal. The fact that there was nobody either in the company or in the Auditors that had any clue on how to do SSL or TLS is riddiculous. Any bonehead can go to FoundStone, Nessus, or SecureScout and have their servers and applications put through a security scan - which would have caught this problem in about 30 seconds. I know - I'm on the receiving end of a scan every quarter and I'm under the gun to upgrade my OpenSSL and NTP libraries because of it.

The fact that they have "hackers" employed trying to break it is a bit funny. No self-respecting company would use the term "hacker" to describe a decent Security Consulting firm. There are many out there that are well qualified to evaluate the security of the system, but they are expensive. This tells me that Cereus is taking a half-assed approach to the problem and attempting to make itself look good in the process.

Thanks for posting it Kid.

Your welcome, the GOV uses hackers, to test their security system, they even say so.

I realize that there is not a lot of love between this forum and cereus.

I am not a computer expert but I have had responsibility to purchase and administer systems. You just don’t know all your weak spots until one is exploited.

Is it possible that this was done on purpose to steal player dollars by the firm’s executives? Yes possible but when contrasted to the damage done to the value of the firm and the stock options held by executives rather unlikely.

I have spoken with various personnel at Absolute a few were solid most were questionable. I have had occasion to communicate with personnel at a dozen other sites and found the quality equally dubious. Quality needs improvement across the poker world.

A few weeks ago my computer was attacked while on the Google server. This has happened in the past. Fortunately, my security saved my backside. Google personnel are top drawer yet their security has been compromised several times. I guess I best remove that site and toolbar it is no longer clean.

This month I also had an opportunity to talk with several layers of security at Chase Bank. The bad news is that they would fit in better at customer support at Absolute Poker than the corner 1 branch bank. Most major banks worldwide have been attacked electronically and with counterfeit. Best get the shovels ready since we can’t trust the banks moving forward. Yes its time to bury your ducats in the back yard.

The Bad Truth is that Cyber InSecurity is an evolving rapidly changing animal and you best take some responsibility to cover your backside. India has stopped importing many electronics from China fearing electronic espionage in multiple forms.

Any institution or individual with assets is under attack and all have flaws or openings. I think we need to see how firms react to adversity before issuing final condemnation. That does not mean that I feel that these sites are clean; it means that their actions require greater and further scrutiny. I am willing to see what management is going to do now to make this system right for their players.

I see these same accusations of rigged games, cheating, and super hands to max pot sizes at every site I have ever played.

My guess is that every site of any scale has been compromised at some time. Some sites have been hit by smarter crooks and superior managements.

Online poker needs top quality support, management, and integrity I hope that the industry moves to deliver what their clients deserve.

Since this is a poker forum i can't post some some of what i know how to do... as long as your network has a great firewall you are safe. To know what a hacker does, you have to get inside of a hackers mind.

Still broken, after being "fixed".

http://www.pokertableratings.com/blog/2010/05/cereus-patch-adds-ssl-audit-underway/

Out of anything i am reporting PTR for hacking to the FBI, Who knows how many accounts they have hacked.
The only thing PTR has been doing is hacking... Is your FT or Stars account safe with them.

 

[arahel_jazz]

Your welcome, the GOV uses hackers, to test their security system, they even say so.

Not exactly... And yes, I know.

Since this is a poker forum i can't post some some of what i know how to do... as long as your network has a great firewall you are safe. To know what a hacker does, you have to get inside of a hackers mind.

That is a common misconception. A firewall is only the start of a good security policy.

 

[kidkvno1]

Not exactly... And yes, I know.



That is a common misconception. A firewall is only the start of a good security policy.

Well a firewall in a router is better then a software one.
I've been getting hacking attacks and the only thing that has stopped them is the firewall in the router. The crappy software one at the ISP did not stop them...

 

[onebourbon]

I use Panda Securty - so far so good.....I'll alert them tho.

 

[onebourbon]

I might actually see if I can sell Panda...I've been using them for like 5 years now...nobody can bust into it.....and we've tried...lol

 

[slycbnew]

Just a suggestion, but maybe one of you guys who are very good w internet security might do a post/thread on how to secure your identity? That'd be really great for the forum imo.

This thread is getting off topic imo, though, let's keep it on topic...

 

[onebourbon]

I've just sent Panda Security a request, so the reply will go into a new thread.

 

[Poultry_cat]

Sorry if this isn't the right place to ask this question...

But yesterday after the software update, I got an error message when I tried to log into AP. I did some research on the error, and I discovered that the solution was for me to disable my anti-virus software. I use Avira and AVG, and all the other poker rooms' software (FT, PS, etc) works fine with the anti-virus. This bothers me, because I have no intention of disabling my security software to play at AP, but nothing else has worked. Just wondering if anyone else has run into that problem.

 

[Dorkus Malorkus]

The easiest and best solution would be to just not play at Absolute.

 

[Jepulator]

omgoodness, why can't AP and UB just spend some of that ridiculous money they make and put an end to all this bs. AP was the first poker site I ever downloaded so I tend to like it more than others even tho I play everywhere these days. I just hate hearing these things...makes me pull out most of my money everywhere. this kind of thing is almost as bad as a site closing down and keeping your cash! *shakes fist at Dynamic Gaming* communists!

 

[forsakenone]

i have never deposit on any of these sites, however i did manage to win a CC freerol on UB and now i have 20$. i will try to build it to 50$ so i can redraw (this is the minimum). other than that i will stick to pokerstars no matter how fishy these small sites are.

 

[forsakenone]

Sorry if this isn't the right place to ask this question...

But yesterday after the software update, I got an error message when I tried to log into Absolute Poker. I did some research on the error, and I discovered that the solution was for me to disable my anti-virus software. I use Avira and AVG, and all the other poker rooms' software (FT, PS, etc) works fine with the anti-virus. This bothers me, because I have no intention of disabling my security software to play at Absolute Poker, but nothing else has worked. Just wondering if anyone else has run into that problem.

this did not happen to me, anyways do not do it, first write absolute poker an email, ask them about this or try reinstaling the program see if keep happening. you can never be too sure these days.

 

[Pothole]

Still broken, after being "fixed".

http://www.pokertableratings.com/blog/2010/05/cereus-patch-adds-ssl-audit-underway/

Update 2 @ 5/14/2010: We’ve re-run all tests and can confirm that we are still able to hijack logins by sniffing the network, this is not by hacking someones individual computer, but the same exact security hole as before. We can confirm that it is now impossible to steal hole cards using the previous exploit

Seems like they fixed it to me.
As I have said before i'm not as computer savvy as many people on here but it looks to me after reading all the info posted on PTR that what the problem re seeing hole cards was not that they had 'hacked' the site but were in their words 'sniffing' the info their network was sending to your computer, they could only do it IF they were on the same Wi-Fi network that you use and they could only see YOUR hole cards not the whole table. This communication has now been encrypted and fixed although they still say they can 'sniff' your log in details not by hacking AP/UB, but by 'hijacking' the info and getting to your account with the same proviso re your method of connection to the internet. They have been asked MANY times in the two threads "could this happen at PS or FT" and have NEVER answered the question !, so I will ask someone who seems to know a great deal about internet security.

KIDKVNO1
1/ I have never been redirected to a designated 'secure' page to log in to ANY kind of web based business, is it therefore possible for someone on the same Wi-Fi network ( not that I use one ) to 'sniff' the information I send to said business and obtain my log in information?
2/ Until you actually log in to business site, is it fair to say that you are not protected by their security system?
3/ These poker ratings and player stat sites freely data mine poker sites, is it fair to say that just by doing this they have effectively 'hacked' the site?

Many people have questioned PTR's motives in 'exposing' this event incuding questions posed on their own site. I would have asked 'Daemon' myself directly but you have to 'log in' to their site to be able to do this and I sure as hell don't trust any of my information to PTR. It is valid though that they are about to start charging users for searches etc so there an is appearance of an ulterior motive to making themselves out to be the gaurdians of online poker. Many people have said that events like this one will weaken the argument for legalizing online poker, IMO it will strengthen it as legalized online poker will give players an avenue of recourse where they currently have none.

 

[The Dr]

Great to see their numbers dropping. At peak hours there have been 4-8 thousand less players online than usual. Maybe one day it will reach 2 and that would be Russ Hamilton trying to superuse the bot

 

[bhood1776]

Great to see their numbers dropping. At peak hours there have been 4-8 thousand less players online than usual. Maybe one day it will reach 2 and that would be Russ Hamilton trying to superuse the bot

I haven't seen a difference. I play most of the same tournies everyday and it's been the same amount of players. Their GTD tounies have all been clearing the GTD. Can't tell about cash games though, no way to tell on that.

 

[kardmania]

A couple of issues as far as removing antivirus to play on the site I have to hope that you are trying to be funny.

I do know that Thursday and Friday that there servers have been messed up trying to make updates work.

If they are legitimately striving to make the system right there are going to many disruptions over the next month.

I look for these issues to result in numbers being down as people try to play get disconnected and just log off.

This has happened on this system before and on others where I have played.

By the way I think that are also issues with these guys making everything work correctly when new Microsoft updates hit.

As far as Jep's comments about sites stealing playing money; I say snare these thiefs and put them in Gitmo.

 

[Pothole]

Great to see their numbers dropping. At peak hours there have been 4-8 thousand less players online than usual. Maybe one day it will reach 2 and that would be Russ Hamilton trying to superuse the bot

Proof please,,,,,,,,,,below is true data supplied by pokerscout.

6th April peak cash game traffic at PS 45,207, 6thMay 45,157, 14thMay 41,850.
Same dates for FT, 25,256, 21,528, 20,334
Same dates for PP, 8688, 8791, 7547
Same dates for UB 3320, 3221, 3201

This 'event' broke on the 6th May so I took data from a month before and the latest day. I excluded 15th May ( last night ) as traffic on Saturdays is always significantly down on that day at every site. If they had "lost" in excess of 4000 players they would be playing with themselves.

seems to me that Cerius lost less traffic than anyone.

 

[Poultry_cat]

Just a quick note about the problems the update was causing with my anti-virus software - it seems to be fixed. I was able to log on and play today with my virus software fully functional, so I'm guessing it was a problem with one of the earlier updates that got straightened out with one of the later updates.

However, I only play at AP and UB because I received free bankrolls there from a promotional site. I'd never deposit money on either of those sites given their history. It just seems as if there's too many problems and too many excuses and the solutions always come only after a loud outcry from the poker community. When it comes to depositing my own money, I'll stick with poker stars and FT, thank you very much.

 

[The Gent]

Oh so you're greedy and only care about yourself? How about caring about the poker community in general? Alot of people do have $1000's of dollars on that site, so just because you don't, who cares?

You are the kind of people that give the community a bad name.

Don't be an idiot.

I play poker because I like it, I also contribute to this forum as and when I feel I can provide input.

I am not some do gooder who is trying to right wrongs and save 'the blessed community'.

I will take your money or the next guys without fear of disruption to 'the community' and as sure as eggs are eggs if I win a large amount at some point I will be paying my mortgage and buying a nice car, NOT giving it back to the community.

The Gent :eviltongu

 

[Dorkus Malorkus]

Don't be an idiot.

I play poker because I like it, I also contribute to this forum as and when I feel I can provide input.

I am not some do gooder who is trying to right wrongs and save 'the blessed community'.

I will take your money or the next guys without fear of disruption to 'the community' and as sure as eggs are eggs if I win a large amount at some point I will be paying my mortgage and buying a nice car, NOT giving it back to the community.

The Gent :eviltongu

point status: completely missed

 

[The Gent]

No real point, just felt like venting as it annoys me when people who know nothing about me decide in their wisdom what I am about

 

[Pothole]

From PTL's website.

Update 5 @ 5/16/2010: We can confirm that SSL is now being used everywhere for Cereus. The login vulnerability no longer exists. We’re now ensuring a proper implementation, but it seems like the biggest problems have been addressed.
Share and Enjoy:

 

[slycbnew]

While I'm glad to see that unsuspecting players are not susceptible to this security flaw, I'll suggest one more time - the problems associated w Cereus go beyond the existence of this specific security flaw, and it's preferable that Cereus be held accountable for the broader issues of which this security flaw is a single example.

The Cereus network was created as a result of the potripper scandal (if you're not familiar w it, you can google "potripper") to ensure consumers that they could play at UB and AP comfortable that the strictest security measures possible were being taken to prevent the possibility of such scandals again.

Implementing custom security protocols that do not meet industry standards is a pretty bad idea imo, regardless of whether the resulting security flaw is only applicable to wi-fi or to someone who doesn't use firewalls etc. It's bad business/management to create a platform (the Cereus network) to ensure the security of players without using the highest industry standards to ensure the security of the players.

If I keep typing, I'll just repeat things being said above and elsewhere, so I'll stop now. Again, happy that the specific flaw has been resolved, but still believe that Cereus has demonstrated poor management skills/gross indifference that still puts players at risk beyond this security flaw.