The Column – Cyber Security Week
If you play poker you know that you can lose due to an unlucky hand, a successful bluff from your opponent or because, simply, you are less good than you think. All circumstances that, with a certain effort, can be accepted. It is more difficult to get over it when you discover that your opponent already knows the cards you have in your hand because at that point he is not playing poker, but is making a withdrawal from your bank account with a few more formalities. This is exactly what would happen in the world of online poker. This is revealed in an investigation published by Wired on October 29, according to which some players were systematically spied on through their computers. The economic result of the scam, based on estimates collected by the magazine, would range between 1.5 and 4 million dollars. Not exactly the change from the Saturday night match, even if the final balance remains to be ascertained.
The story comes to light on September 25, when a poker pro, named Alex, is analyzing his statistics. Following a database problem, a check on the computer leads to the discovery of MeshAgent, a program that allows you to remotely observe the screen and control the device. In practice, someone could virtually sit behind him and look at his cards. Alex reconstructs eleven sessions during which he was allegedly spied on and discovers that in ten he had met the same opponent. A particularly lucky player, capable of making decisions which, in light of the discovery, took on a decidedly different meaning. On the other hand, when you know the cards of others, even a mediocre player can transform into a champion and there is no need to train, much less have good luck at your side.
Now a question arises: how did the spy manage to get into the computer? The answer is the most interesting part of the story because it came through the front door, of course. The one that we all open with a certain satisfaction when the words “Update available” appear. The criminals had compromised Jurojin, a program used by professionals to manage multiple virtual tables simultaneously. Some users received modified updates that also installed remote control software. The infection had also involved IntuitiveTables, another application of the same kind, passing through its developer’s computer. In short, no need to hack poker platforms or convince victims to open unlikely attachments received from unknown African benefactors. It was enough to infiltrate the programs that players usually used and wait for them to do what all security experts, including myself, have been recommending for years: update the software. A rather embarrassing situation, one must admit.
The matter becomes even more curious when you observe the behavior of the malicious program. The criminals, evidently not interested in computer tourism, had no intention of spying on all users indiscriminately. In one of the compromised applications, the code checked whether the player’s name appeared in a list of objectives. If so, it activated further malicious functions, otherwise it continued to behave like a normal program for organizing windows on the screen. A clever solution, if you pass me by the term to describe criminal activity. Those who were not on the list did not notice anything strange and those who appeared on it had very little chance of noticing the intrusion. In other words, the thief didn’t just enter the house without being seen: he also took care not to disturb the neighbors.
Then there is one aspect to which I would like to draw attention. To carry out this fraud it was not necessary to rig the deck, manipulate the cards or alter the functioning of the gaming platforms. Everything could have been perfectly fine. The problem was that one of the players had information that he should have ignored. If you think about it, it is a situation that calls into question one of the fundamental assumptions of information security: the confidentiality of information. In this specific case, the cards were visible only to their legitimate owner, at least according to the rules of the game. Too bad someone had found a way to watch them through another program. The platform may have been an impregnable fortress, but it was of little use if the player had unknowingly invited the enemy to sit next to him.
However, the part of the story that I find most worrying concerns what happened before the discovery. Some players had already reported statistically anomalous results. According to Wired, some platforms had taken action and refunded victims, while others had argued that there was not enough evidence to intervene. Now, I don’t pretend that every unlikely sequence of victories should trigger an international investigation, but prudence is one thing, it’s another to consider luck a universal explanation. The numbers don’t automatically prove fraud, but they can suggest that something isn’t working as it should. Provided, of course, that someone wants to listen to them. Machines are pretty good at calculating probabilities; humans continue to demonstrate a certain ability to ignore them.
To conclude, there is a detail that deserves a few words. The spy program was identified by an artificial intelligence assistant engaged in a completely different task. Before anyone celebrates the advent of the foolproof digital detective, I would suggest some caution. A chance discovery doesn’t turn a tool into a detective. However, a curious irony of fate remains: while some software intended to help players had become unwitting accomplices of criminals, another software contributed to unmasking them. Once again, it’s not the technology itself that is good or bad, but what someone can make it do.
The story, in my opinion, offers a lesson that goes far beyond poker. We have built a digital world in which trust no longer concerns only the service we use, but also an unknown number of programs, developers and suppliers that make it possible to use it. Each represents a link in a chain that can be compromised without the others realizing it and, in any case, it is certainly not a good reason to stop updating our programs, because it would be like giving up on locking the front door after discovering that someone can duplicate the keys. Rather, it means acknowledging that correct behavior does not necessarily guarantee a safe result.
After all, bluffing is allowed in poker and lying to your opponent is part of the rules. What is not expected is being able to look at the cards. This time the cheater didn’t need to hide an ace up his sleeve. All he had to do was hide behind the “Update” button.
