1. Reverse Engineering >
  2. An Overview Of Online Poker Security [10 Apr 2013]


An Overview Of Online Poker Security [10 Apr 2013]

RSS Kategorie Pfeil Reverse Engineering vom | Quelle: revuln.blogspot.com Direktlink öffnen



10 April 2013

Abstract Security research conducted against a set of online poker solu-
tions, highlighting the current status of this lucrative industry.


Online Gaming (also known as Online Gambling and iGaming) is a successfully growing market, and Online Poker is its main sector with millions of players all around the world betting with real money.

Online gaming is a 30 billion US dollar market, and is highly regulated by gaming authorities of various countries in order to protect consumers, companies and its governments by making it transparent and secure. The main objectives of the gaming authorities are:
  • Protecting players’ rights
  • Promoting responsible gaming
  • Monitoring licensed companies
  • Deciding the minimal level of security that must be adopted
  • Collecting taxes on behalf of the governments
Companies that violate the rules, or don’t take appropriate measures for the security of their systems, may have their license revoked, and in some cases become sanctioned by the gaming authorities. This means each component of the online gaming network, client and server side, must be secure.


This paper provides a cursory overview of iGaming, and Client Poker Software security. Also, security vulnerabilities and design issues affecting some of the most widely used software on the market will be disclosed.

Online gaming companies and players should be aware of potential security issues in the products they provide and use respectively. The security issues and information disclosed in this document covers only part of the attack surface for Online Poker systems.

Software systems from different companies in various countries were examined, and in this paper we detail three case studies. Some features beyond the scope of the paper were not tested. Several details of the issues and proof-of-concept have not been included in this document.


There are various authorities and commissions that regulate iGaming in a given country or a set of countries, depending on the license. A full list of these authorities is available on the International Association of Gaming Regulators (IAGR) website.


The large iGaming market consists of many companies which provide one or more services for the infrastructure available to the end user. Companies can provide:
  • The client and server side software
  • The network
  • Web games for online casino
  • Additional technology
  • Websites, called Skins and Poker Rooms, which are accessed by the players.
Large operators such as PokerStars will cover all of the above, and even sponsor real poker events and tournaments for professional players. It is quite common to have an online gaming company that provides the software and the gaming network.


Understanding the role of Skins is important because a vulnerability in one software can affect multiple Skins and millions of players. Players are mistaken to believe Skins provide the entire infrastructure for the website. Skins also create the interface and software customization for the players.


One of the differences between online poker and the rest of the iGaming products is that it relies on client-side software, which runs directly on the player’s computer.
The client software is used to improve the players experience and granting them real-time data over customized protocols adopted by the Poker network.

Additionally the client software allows players to customize the interface, and the software functions the same way across different platforms (Windows, MacOS and Linux).

From an external attacker’s point of view, Client Software is interesting to analyze because it is the only part of the infrastructure which is fully available to an attacker. In fact, the software is deployed on the end-user systems, and without performing any unauthorized access to the server-side infrastructure, the security of these solutions can be analyzed. Serious client software issues include unauthorized access to players’ accounts.


The following sections describe the portion of the attack surface that was covered for this paper.


Software updates are very important for this kind of software. All Poker software must adhere to certain standards, and include an auto-update feature which is the first action performed by the software launcher. This mechanism can be used by attackers to inject malicious updates on the player’s system, while the software is performing the update operation. For example, this can be achieved with insecure public connections (like public Wi-Fi networks, LAN/WAN networks of a company), compromised connections (for example private Wi-Fi with weak passwords guessed by an attacker, compromised DNS servers), or malware.

Usually the main cause of malicious injection while performing an update is the lack of SSL connections or lack of digital signatures. Even if an update is signed, it’s still possible to take control over a victim’s system, as demonstrated by one of the vulnerabilities found in a particular Client Software that uses digital signatures.
The same consideration above also applies to the installer. The main task of the installer is to download additional content from the Internet. It doesn’t matter if the original setup.exe was correctly downloaded over an HTTPS connection from a trusted website because all of the remaining content downloaded by the installer from the internet, over HTTP, can be hijacked.


The player’s username and password is usually the only obstacle that keeps an attacker away from a player’s account.

All Poker software allows the password to be automatically saved on the player’s computer. Insecure implementation of this functionality may not be secure enough to prevent password leaking. The stored password is often just obfuscated or encrypted with fixed keys. Access to registry keys or the configuration file (even remote access is possible using directory traversal vulnerabilities in other software) allows attackers to steal stored passwords easily. It’s not easy to grant access to the network without effectively storing the password, but there are various levels of password security. For example, there is a difference between obfuscating a password and encrypting it with an unique key that identifies the computer.

Some companies like PokerStars have adopted RSA tokens and PIN to increase the security of the authentication mechanism for their Client Software.


There are many other possibilities to perform attacks against the software. See the following sections for examples.


A number of different security issues were found, and some of them are described in the following sections. A proof-of-concept video for some of the issues is available on our Vimeo channel.


The following table gives an overview about DEP,ASLR and Digital Signed Executable for the tested solutions:
            EXE                     DLLs
Software    ASLR DEP Digital signed ASLR DEP Digital signed
B3W         no   no  yes            -    -   -
Microgaming yes  yes no            no    no  no
Playtech    yes  yes yes           no    yes no


The client software developed by B3W is used in many Skins such as Yachting Poker and PKRaise.

The update mechanism is performed over an insecure HTTP connection to b3w.fileburstcdn.net where the list of updates and the files are stored without signatures and the EXEs (which are digitally signed) are not verified before their execution. In this situation at least three types of issues were identified:
  • Injecting of malicious EXEs, which are executed immediately by the software for auto-updating itself: "c:\path\tmp_executable.exe" "c:\path\executable.exe" update

Figure 1: Yachting Poker launcher in action
  • Directory traversal that allows any files where the software is installed to be created or overwritten.
  • Stack based buffer-overflow while copying the newly generated update link containing the filename provided by the attacker:
  stack_buffer ,

Figure 2: Malicious code executed on the victim’s system

The password is stored in the %APPDATA%\SKIN_NAME\settings.ini file as last_password and is simply obfuscated, and the following algorithm can be used to read it:
len = hex2byte(password);
x = password[0];
for(i = 0; i < (len - 1); i++) {
  password[i] = password[i + 1] ^ x;
  x = password[i] + i;
password[i] = 0;


The Microgaming software is available on various important and well known Skins like Unibet and Ladbrokes Poker.

Figure 3: Microgaming

This software is also an interesting example of a signed update system made ineffective by the exploiting of a security vulnerability. The digital signature available at the end of the main update list file which is verified by the software, is stored as a base64 string. The problem is that the function that decodes the password doesn’t verify the length of the output stack buffer resulting in a buffer-overflow that may be used to execute malicious code.

The password stored in the registry key:
HKEY_CURRENT_USER\Software\MGS\Thumper\Casino\SKIN_NAME\key is encrypted using the same mechanism adopted also for some of the files in the software folder:
  • SHA1 hash of one of the following keys (the fifth one for passwords)
  1. "C75A7F71-797A-11d2-8255-00A02455A490"
  2. "AE24F415-C51D-4aa2-9943-C1DD9EA33DFE"
  3. "{D545EBD1-BD92-11CF-8772-00A0C9039735}"
  4. "Cats know how we feel. They don’t care, but they know."
  5. "BlindCaffineSubstituteFamousCurtainTrickKingTinHalcyonDaysArapaho"
  6. "C75A7F70-797A-11d2-8255-00A02455A490"
  • Swapping of the 5 DWORDs composing the hash, although only 16 of the 20 bytes available will be used for the encryption
  • RC4(hash, 16, data, length)


Playtech software and its iPoker network are widely used by many Skins. The most famous are Titan Poker, William Hill Poker and Bet365 Poker.

Figure 4: Playtech widgetbar injection

The software installation and the updates are handled all via HTTP, but the signatures of the signed EXEs and DLLs to install are verified. This is good only partially because all the other files (including HTML files) can be modified without any problems. For example to exploit security vulnerabilities in the software or redirecting the user on malicious websites. More interestingly is the presence of EXEs and DLLs that are not digitally signed located in the widgetbar folder. An attacker can use them to inject malicious code on the software.

The following is a perfect example of an update system implemented incorrectly. The password is automatically stored in the registry key:
A key is composed of the hash of the HDSLN value of Windows Genuine Advantage, plus three values of format, "%ld%ld%ld", are obtained via GetSystemInfo, where the arguments of this function are dwProcessorType,wProcessorLevel and wProcessorRevision.
Then the hexadecimal MD5 hash of the key and the first byte of the password are used to XOR the encrypted keyword:
len = hex2byte(password);
x = password[0];
for(i = 0; i < (len - 1); i++) {
  password[i] = password[i + 1] ^ hex_hash[i % 32] ^ x;
password[i] = 0;


The following examples weren’t part of this research but they are a personal work of one of our researchers for his password recovery tools. The following content can be used to get a better understanding of the algorithms used in the iGaming software.


ReVuln is an international company providing various security services ranging from penetration testing to consulting, from training to vulnerability research and, last but not least, feeds regarding 0-days security vulnerabilities.
Additionally ReVuln is a Maltese company, and Malta is one of the most important countries involved in iGaming.


We would like to thank our friend Salvatore Fresta for the additional overview of the iGaming sector.


  • 12 April 2013: Version 1.1 released.
  • 10 April 2013: Version 1.0 released.

Webseite öffnen Komplette Webseite öffnen


Kommentiere zu An Overview Of Online Poker Security [10 Apr 2013]

Ähnliche Beiträge

  • 1. Azure Marketplace new offers–Volume 40 vom 1172.91 Punkte ic_school_black_18dp
    We continue to expand the Azure Marketplace ecosystem. For this volume, 212 new offers successfully met the onboarding criteria and went live. See details of the new offers below: Applications 2Care: 2CARE is a healthcare solution that easily captures th
  • 2. Azure Marketplace new offers – Volume 41 vom 1104.98 Punkte ic_school_black_18dp
    We continue to expand the Azure Marketplace ecosystem. For this volume, 109 new offers successfully met the onboarding criteria and went live. See details of the new offers below: Applications Active Directory Domain Controller 2019: This virtual machine
  • 3. CentOS Blog: CentOS Pulse Newsletter, May 2019 (#1905) vom 634.02 Punkte ic_school_black_18dp
    Dear CentOS enthusiast, Another month into 2019, and we have a lot to tell you about. Releases and updates SIG updates Events Contributing to the newsletter #CentOS15 Yes, we've mentioned this before, but we're still pretty stoked about it. On the 15
  • 4. CentOS Blog: CentOS Pulse Newsletter, May 2019 (#1905) vom 634.02 Punkte ic_school_black_18dp
    Dear CentOS enthusiast, Another month into 2019, and we have a lot to tell you about. Releases and updates SIG updates Events Contributing to the newsletter #CentOS15 Yes, we've mentioned this before, but we're still pretty stoked about it. On the 15
  • 5. An Overview Of Online Poker Security [10 Apr 2013] vom 495.14 Punkte ic_school_black_18dp
    Original PDF https://revuln.com/files/ReVuln_Overview_Online_Poker_Security.pdf   AN OVERVIEW OF ONLINE POKER SECURITY Luigi Auriemma and Donato Ferrante ReVuln http://revuln.com [email protected] http://twitter.com/revuln 10 April 2013 Abstract Security
  • 6. Big Tech Firms Agree on 'Data Portability' Plan vom 184.7 Punkte ic_school_black_18dp
    Facebook, Google, Microsoft and Twitter unveiled plans Friday to make it easier for users to take their personal data and leave one online service for another. read more
  • 7. AI Decisively Defeats Four Pro Poker Players In 'Brains Vs AI' Tournament vom 153.06 Punkte ic_school_black_18dp
    Halfway through the "Brains vs. AI" poker competition, it was pretty clear the artificial intelligence named Libratus would end up victorious against its human opponents, who are four of the world's top professional players. Lo and behold, Libratus lived
  • 8. Another country-sponsored #malware: Vietnam APT Campaign vom 128.42 Punkte ic_school_black_18dp
    The background This is a team work analysis, we have at least 5 (five) members involved with this investigation. The case that is about to be explained here is an APT case. Until now, we were (actually) avoiding APT cases for publicity in Malware Must Die!
  • 9. Facebook AI Pluribus Defeats Top Poker Pros In 6-Player Texas Hold 'Em vom 122.45 Punkte ic_school_black_18dp
    Carnegie Mellon University and Facebook AI research scientists have developed an AI dubbed Pluribus that took on 15 professional human players in six-player no-limit Texas Hold 'em and won. The researchers describe how they achieved this feat in a new
  • 10. USN-3415-1: tcpdump vulnerabilities vom 110.51 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-3415-1 13th September, 2017 tcpdump vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.04 Ubuntu 16.04 LTS Ubuntu 14.04 LTS Summary Several security issues were fixed
  • 11. USN-3415-2: tcpdump vulnerabilities vom 110.51 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-3415-2 13th September, 2017 tcpdump vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.04 LTS Summary Several security issues were fixed in tcpdump Software description tcpdump
  • 12. AI Wins $290,000 in Chinese Poker Competition vom 107.14 Punkte ic_school_black_18dp
    An AI program has beaten a team of six poker players at a series of exhibition matches in China. From a report on BBC: The AI system, called Lengpudashi, won a landslide victory and $290,000 in the five-day competition. It is the second time this year