Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When Random Isn't Random Enough: Lessons from an Online Poker Exploit

lauradhamilton.com

Post reply on HN
Print view View original

21–30 of 90 posts

Re: When Random Isn't Random Enough: Lessons from an Online Poker Exploit

#21

Post by jlgaddis »

bloodmoney wrote: post #12

I admit I am a total noob here, but couldn't you make something with a TV turned to a station with just static? I have often wondered about this but lack the 'propriate schoolin'.

> That's where this program is for: adding entropy-data to the kernel-driver. It does that by fetching 2 images from a video4linux-device (with a random delay in between), calculating the difference between those two and then calculating the number of information-bits in that data. After that, the data with the number-of-entropy-bits is submitted to the kernel-random-driver.

http://www.vanheusden.com/ved/

There's also an "audio" version of, basically, the same thing [0] that I intend on using in the near future. It's as simple as tuning an FM radio to "nothing" and connecting its headphone/line out to your sound card's input line.

[0]: http://www.vanheusden.com/aed/

Re: When Random Isn't Random Enough: Lessons from an Online Poker Exploit

#22

Post by sanswork »

gedrap wrote: post #9

I'm curious how actually random are current generators in online poker? I mean, some rather subtle patterns, situations would generate larger pots, therefore more rake. Or being on the new players side in 50/50 situations would 'help' to get him addicted. I am not talking about 100% of the time dealing someone pocket kings, and someone else pocket aces and king on the flop. Something subtle and very rare would be eno…

Since the odds of getting certain hands is known and there are a lot of professionals with very large databases of hands any manipulation like that would stand out pretty quickly as a statistical anomaly.

Re: When Random Isn't Random Enough: Lessons from an Online Poker Exploit

#23

Post by kawsper »

SeanDav wrote: post #18
aelaguiz wrote: post #15

As recent as 2010 we were finding major flaws in online poker security, here are a couple of videos I did of us sniffing hole cards out of the air because sites were lying about their use of SSL. They were using xOR encryption. Insane. http://www.youtube.com/watch?v=4HBUe8Fb73Q http://www.youtube.com/watch?v=AAQDEXJdbQc

Ouch, I suppose the moral of the story is don't play poker for money using a wireless connection.

The moral of the story is don't play poker for money where you suspect MITM to be in effect, because the connection is not secure.

Re: When Random Isn't Random Enough: Lessons from an Online Poker Exploit

#24

Post by letstryagain »

gedrap wrote: post #9

I'm curious how actually random are current generators in online poker? I mean, some rather subtle patterns, situations would generate larger pots, therefore more rake. Or being on the new players side in 50/50 situations would 'help' to get him addicted. I am not talking about 100% of the time dealing someone pocket kings, and someone else pocket aces and king on the flop. Something subtle and very rare would be eno…

The major sites don't do this. We know because many people out there collect literally millions of poker hands observed on these sites and mine the data for every kind of statistic you can think of. If anything significant was out of whack they would have picked it up. Look at the 'online poker' section of the twoplustwo forums for example.

The random number generators used by these sites are hardware systems that use micro fluctuations in ambient temperature (for example) as a source of entropy and they are very careful to use enough bits of entropy for every card shuffled.

Re: When Random Isn't Random Enough: Lessons from an Online Poker Exploit

#25

Post by sillysaurus2 »

letstryagain wrote: post #24
gedrap wrote: post #9

I'm curious how actually random are current generators in online poker? I mean, some rather subtle patterns, situations would generate larger pots, therefore more rake. Or being on the new players side in 50/50 situations would 'help' to get him addicted. I am not talking about 100% of the time dealing someone pocket kings, and someone else pocket aces and king on the flop. Something subtle and very rare would be eno…

The major sites don't do this. We know because many people out there collect literally millions of poker hands observed on these sites and mine the data for every kind of statistic you can think of. If anything significant was out of whack they would have picked it up. Look at the 'online poker' section of the twoplustwo forums for example. The random number generators used by these sites are hardware systems that us…

The random number generators used by these sites are hardware systems that use micro fluctuations in ambient temperature (for example) as a source of entropy and they are very careful to use enough bits of entropy for every card shuffled.

It's amusing to realize that they could just read from dev/urandom with zero risk. They're probably not running Linux, but still.

So, for anyone who's wondering if you need this, or if this adds any extra security: probably not. There's no reason not to use the extremely well-tested and well-understood /dev/urandom.

Re: When Random Isn't Random Enough: Lessons from an Online Poker Exploit

#26

Post by aelaguiz »

kawsper wrote: post #23
SeanDav wrote: post #18

Earlier quoted context omitted.

Ouch, I suppose the moral of the story is don't play poker for money using a wireless connection.

The moral of the story is don't play poker for money where you suspect MITM to be in effect, because the connection is not secure.

It wasn't a MITM. Although I've done that too, ARP flood the router and redirect the traffic through myself. Only works on sites where they didn't peer validate the SSL cert.

These were just packet dumps, wasn't associated with the WAP. It's hard to remember the exact details but I believe I was dumping the packets and decrypting them with the WEP key then piping them into a C program which just applied the decryption key to the packets.

Re: When Random Isn't Random Enough: Lessons from an Online Poker Exploit

#27

Post by notduncansmith »

DanBC wrote: post #6

This was an interesting article. (Font size is tiny using Chrome on iOS). > If your business or technology depends on using random numbers, your best bet is to use a hardware random number generator. Some hardware RNGs would be hopeless for this task. It'd be scary to have to buy one of these things and trust the output.

News/YC is my favorite iOS HackerNews client, it's free and beautiful, and comes with Readability so I never run into this problem. So many sites are either not responsive or do it badly, so it's a lifesaver.

Re: When Random Isn't Random Enough: Lessons from an Online Poker Exploit

#28

Post by tboneatx »

aelaguiz wrote: post #15

As recent as 2010 we were finding major flaws in online poker security, here are a couple of videos I did of us sniffing hole cards out of the air because sites were lying about their use of SSL. They were using xOR encryption. Insane. http://www.youtube.com/watch?v=4HBUe8Fb73Q http://www.youtube.com/watch?v=AAQDEXJdbQc

Yeah, I remember that. :)

Re: When Random Isn't Random Enough: Lessons from an Online Poker Exploit

#29

Post by comex »

I understand that "swap with entire deck" can't possibly be uniform because it has 52^n input possibilities, which is not divisible by 52! (and that the correct Fisher-Yates having 52! input possibilities and being able to generate every possible outcome is one way to prove that it is uniform). However, I'm not sure I can come up with an intuition for why any particular bias should exist, or why there is a discontinuity that makes it much more likely for a card to end up a short distance after its starting position:

http://en.wikipedia.org/wiki/File:Orderbias.png

Anyone have a good explanation?

Re: When Random Isn't Random Enough: Lessons from an Online Poker Exploit

#30

Post by krexit »

DerpDerpDerp wrote: post #2

This is one of those times you'd really want to use an actual random number generator, rather than a pseudo-random number generator.

Many regulatory licensing authorities of online gambling companies mandate the use of certified Hardware RNGs. Example: Alderney Gaming Commission. Certification includes Monte Carlo testing of the output, amongst other things.
Post reply on HN