Home >> News >> Superusers Possible Under Old Encryption at ...

Superusers Possible Under Old Encryption at Cake Poker

The vulnerability from a security issue at Cake Poker was apparently worse than originally thought, as the possibility of “superuser” accounts during an 18-month period at the online poker site has arisen in the course of a discussion at poker forum 2+2.

The story started in late July, when the website pokertableratings.com discovered a security vulnerability at Cake Poker. A weak form of encryption could allow a hacker to see a player’s password and hole cards, among other information. Last week, Cake Poker implemented SSL encryption that patched any holes in its security, as verified by PTR.

However, questions have been raised in the interim about exactly how secure Cake was before this new encryption system was put into place. Cake Poker and card room manager Lee Jones had been keeping its customers abreast of its progress in fixing the security issue in a feedback thread. During that thread, questions arose about ow long Cake had been vulnerable, and the possibility of “superusers” who could see all players’ hole cards and use that information to play winning poker. (A superuser scandal surfaced several years ago on the Cereus network (UB.com and Absolute Poker), in which it was proven that there were superuser accounts that could see all other players’ cards.)

From that feedback thread, a new thread was started at 2+2 to discuss the security issue and the possibility of superusers at Cake. Here’s the crux of the issues being talked about in the thread, from the original poster:

There has been no real encryption for a period Lee does not want to disclose.
As a result of this lack of encryption, anyone with access to a connection from a user to Cake could tap into that connection and read all card data.
The Cake programmers, who, according to Lee himself, lied to him about the encryption when Lee asked them about it, have access to the network the servers are on.
Therefore, the Cake programmers could have superusered.
Cake does not allow datamining, does allow name changes, making it pretty much impossible for the community to check for superusers ourselves.

While Cake had been very forthcoming in talking about its original security problems, there apparently had been some stonewalling as the discussion moved into the realm of superuser possibilities. After some back and forth, Jones finally issued a lengthy statement addressing the issue. You can read his entire post here, and here are some of the highlights:

–The encryption at Cake was weak for a period of about 18 months, until it was fixed last week. Here’s Jones, with some technical jargon about encryption:

Approximately 18 months ago, the TwoFish code stopped working because of a change in an unrelated part of the client. One of our programmers, under a schedule crunch, replaced the TwoFish implementation with the XOR encoding. Obviously, that was a bad idea. There was some technical discussion about this change, but unfortunately we didn’t go back and redeploy the TwoFish (or an SSL) encryption in the code. Equally badly, nobody thought to update the website to reflect the fact that the TwoFish implementation had been removed. That was a classic lack of communication between the technical people and the people who maintain the website. Again, no excuses; we dropped the ball.

–Audits are being done to try to determine if anyone was able to exploit the security vulnerability to profit. Jones again:

While we believe that nobody has lost any money to an exploitation of this vulnerability, we are taking no chances. We are doing a full audit of the top winners since July 26th (when the vulnerability was first reported) and also the largest pots that were played. Once we have completed that audit, we are going to expand the search and investigate back to the time that the TwoFish implementation was removed. Again, I don’t believe we’re going to find any player losses, but we have a responsibility to do the audit. Serge Ravitch (adanthar) is heading up that audit. You may recall that he’s one of the people who uncovered the PotRipper problem; he’s an expert at these things.

Right now, Cake is focusing its audits on the period of time from when PTR announced the security vulnerability to when it was finally fixed last week. Of course, many wonder why Cake was operational at all during this period off vulnerability, although Jones contends the risk to Cake clients was minimal. After that audit is done, a larger audit for the full 18 months will be done to look for patterns that would be in line with a superuser account.

We will keep you updated on this story as events warrant.

Get your daily dose of poker news with the PTP Hit and Run.

Do You Want Free CardRunners? Choose: Yes | No

Get your daily dose of poker news with the PTP Hit and Run.

Props Get Paid up to 125% Rakeback. Click for Offers >>>