How would one cheat at online poker? (Party) (long)

[Exsubmariner]

From the party website... [ QUOTE ]
Because the numbers the RNG generates are completely random, both the player and the online poker room are assured of complete fairness.

PartyPoker.com uses a secure RNG (SHA-1 cryptographic hash algorithm) implemented by SUN which is cryptographically certified. SUN's SeedGenerator class generates the initial seed. The seed is produced by counting the number of times the VM manages to loop in a given period.The samples are translated using a permutation (s-box) and then XORed together. This process is non linear and prevents the samples from "averaging out".

The s-box is designed to have even statistical distribution. A number of sleeper threads are also created which add entropy to the system by keeping the scheduler busy.These are gathered in the background by a daemon thread thus allowing the system to continue performing it's different activities, which in turn add entropy to the random seed.The class also gathers miscellaneous system information, some machine dependent, some not.

This updated seed is then used for dealing cards during each card dealing round. Cards in all subsequent hands will be dealt using a seed which is completely random and which is completely unrelated to the seed used to deal the previous hands of cards, thus ensuring total randomness and hence, complete fairness.


[/ QUOTE ]

I have been reading 2+2 for some time now. In that time, I have heard numerous bad beat stories, stories of epic downswings & bad runs where everything always goes wrong. These things make players question themselves, their strategy, probability theory, and the fairness of the game.
I myself have dealt with numerous 10K+ hand downswings in the 300K or so hands I have logged in my databases. There are lots of things that can go wrong riding the waves of probability. You can miss your draws an inordinate number of times, your opponents can make theirs an inordinate number of times, you can get every AA-JJ cracked everytime you have them, you can go long spells without getting a playable hand. Every online poker player goes through this very same thing. I sometimes wonder with the streaks being what they are, how would one do this live? A losing streak of 10K hands at 50 hands an hour could take months to play out, but that's a different post.
As you might suspect, I am in the midst of one of those 10K hand downswings, so I am naturally asking myself questions. I have pretty much dismissed the idea that things are rigged against me. I have come to believe in luck, to some degree, in that one can make his own luck by being prepared to exploit opportunity when it arises, but the opposite can manifest itself when the universe presents no opportunity or turns every one sour. That leaves cheating. I have never really delved into the exercise of learning how one would go about cheating at online poker.
I have seen a few postings refering to the incident that happened at Planet Poker sometime back. I do not have the links, but know the material is out there if one searches google. I seem to recall that a group of software engineers hacked the psuedoRNG algorithm being used by the software and by sharing their hole cards with one another were able to, by process of elimination determine the shuffle of the cards and therefore what their opponents held and the remaining cards to come. Planet Poker is no longer the premiere site on the net for poker, Party is, making them the biggest target, so I got to thinking specifically about them.
Of course, the easiest method of cheating at any form of poker is collusion and signaling. Matador placing his chips so that he could communicate with his cohorts. The online equivalent to this would be IMs. OF course this isn't that hard to spot from a poker site's stand point. All you have to do is look for accounts that play together over and over and consistent betting patterns between them. Not hard at all. This leaves hacking the software.
From what I read on Party's website, I was left with the impression that the algorithm they use will determine a deal for a specific game, then deal the cards out to that game in sequence. If the shuffle of the cards is determined before a game is dealt, this must mean that that information is stored in a log or memory location somewhere. That could be read. Alternatively, if the deal is simply another card excluding the cards already dealt, then one could concievably copy the clock and the seed generator, sync the two, and know what was coming. The cards dealt to the opponents, if you knew their IP's could be intecepted and decrypted using the cypher already present in the program. I have even heard conjecture out there that opponents screens could be read, revealing their cards.
The above is just my vague conception of how I might approach the problem if I had the know how to attempt to do so. I don't. I am speaking a little above my level of understanding about how things work in the world of computers and the internet. I am hoping to incite some discussion as to what might be possible to do given the knowledge and resources. The motivation (money) is certainly present. I seriously think that one team of programmers can be out thunk by a team of motivated hackers and am not confident that they would even be able to know it. How good is Anurag Dikshit at what he does?
If you could crack the algorithms, copy the RNG and sync with it, you could even couple that with a bot and you would have an unstoppable money vacuum. I'm not saying this has been done. But I can think of it, and that means that someone somewhere with more know how about how to go about it than me has also thought about it. I find that somewhat unsettling.
Discussions? Wrinkle my brain please.
X

[HesseJam]

[ QUOTE ]

If you could crack the algorithms, copy the RNG and sync with it, you could even couple that with a bot and you would have an unstoppable money vacuum.

[/ QUOTE ]

Even if you had the algorithm you would still not know the independent variables the algorithm uses (like Party's main server system clock)

[Exsubmariner]

Would these things really be that impossible to know/ discover/copy?

[Sifmole]

If done right, yeah pretty much.

[BlueBear]

Even if you knew the entire algorithm, it is impossible to beat the RNG as it obtains "entropy" (disorder) from external sources such as user mouse movements, and other sources.

[Overdrive]

I cheat by playing quality cards, staying away from baby pairs; except if I can see the flop cheaply like in the BB or SB. I stay away from the stupid connecters - some people call them suited connecters - except for the good ones like AKs, and the like. I also don't chase on the flop. This method of cheating works great for me on-line and I have also found that this method works just as well in a B&M or a home game.

[itsmarty]

</font><blockquote><font class="small">In Antwort auf:</font><hr />
If you could crack the algorithms

[/ QUOTE ]

The algorithm in use (SHA-1) was broken in February of this year. I'll explain the technical aspects at the end of this message, after the layman's version:

The reason this is not a problem is because SHA-1 is a one-way hash, meaning you can make a hash from a message but not a message from a hash. Breaking it in the way it was broken only affects it's use in situations where the same hash is used over and over (website security certificates, for example) and there is plenty of time to break it.

In situations like you have with online gambling's use of SHA-1, where a new hash is computed for each hand, there's no time to break it before it's discarded and a new hash is generated for the next hand.

Now the technical part of breaking the hash: Hashes, as mentioned above, are one way. This distinguishes them from what most people think of when they consider encryption, where you use some form of "substitute A for B and C for D", and once you break the code you can instantly decrypt any message created with it.

Because hashes have a limited size (SHA-1 produces up to 160 bits) and an unlimited number of different messages could be encrypted, there will always be 'collisions', a situation where two distinct messages have identical hashes.

Hashes are broken if you can show that they're not one way (a drastic failure, and NOT the case for SHA-1), or if you can find a collision in less than the expected number of tries.

In SHA-1's case, that expected number was 2**80. It turned out to be 2**69 (2,000 times faster), still not fast enough (by an incredibly wide margin) to be a problem for hashes created and discarded as quickly as a hand of poker is played.

It's not actually a problem for any use of SHA-1 at the moment. It's just a signal that it's time to develop a new hash.

Martin

[Exsubmariner]

LOL,
That would be that bot program weaktightrock, son of saabpo.
X

[Jurollo]

Ask PITTM how he did.
~Justin

[Exsubmariner]

Wow,
Thank you for the detailed reply. I did not know about the SHA-1 hash being broken.
What is your opinion about someone's potential ability to see other player's hole cards?
X