The 800lb gorilla in the room

For general discussion of the Poker Mavens software
ftpjesus
Posts: 164
Joined: Fri Dec 30, 2016 1:54 am

The 800lb gorilla in the room

Post by ftpjesus »

Surprised nobodys posted it over here in support yet.. Im going to cut to the chase. WHO DID IT??? WHOS the clown that broke the security on PM and created a backdoor to see hole cards.. I and many others would like to say a big (THANK) you for causing a lot of consternation and likely destroying the trust customers could have in site owners.. The fact somebody put out a superuser exploit and then had the gall to try and sell it to who knows how many folks (I know I got an email soliciting me for the exploit early yesterday) is ridiculous to say the least.. Granted this exploit has to be installed by the site owners (as far as I know unless they hacked into a VPS I suppose then all bloody bets are off).. Im disgusted by whoever in this community did this.. I want to believe it was just somebody who hacked into the demo software and isn't a member and software owner but somehow I have my doubts sadly.. I already recall somebody before wanting an exploit for hole cards asking about it on here in 2019 sometime,so there was at least one person that wanted the ability to break the security and integrity of the software.. Im just totally beyond words right now after this and that's not easy to do.. I hope and pray somehow Kent can break whatever crap was created otherwise we might be stuck with this hanging over our heads for anybody wanting to run a legit site until 7.0 comes out (even a small club site could evoke concerns of insider cheating this isn't funny it isn't cute its BULLBLEEP and whoever is responsible needs to be outted and banhammered).
Owner Operator of (TBA)
http://www.( TBA ) .com (Home Page)
http://www. (TBA) .net (Play Money)
http://www. (TBA) .eu (BTC Token tied currency and Stable Coins through Crypto quasi real money play)
Kent Briggs
Site Admin
Posts: 5878
Joined: Wed Mar 19, 2008 8:47 pm

Re: The 800lb gorilla in the room

Post by Kent Briggs »

This type of thing isn't really anything new. See my comments over in the Poker Fraud Alert forum:

https://pokerfraudalert.com/forum/showt ... -operators
ftpjesus
Posts: 164
Joined: Fri Dec 30, 2016 1:54 am

Re: The 800lb gorilla in the room

Post by ftpjesus »

I know and I saw your comments and I agree with them sadly it once again is a black eye for honest operators out there because it harkens back to the SuperUser stuff on UB and what not.. In a way the scumbag did us a favor at least we know this exists now instead of it being kept hush hush and accusations get tossed around of superusing by some sneaky scummy operator.
Owner Operator of (TBA)
http://www.( TBA ) .com (Home Page)
http://www. (TBA) .net (Play Money)
http://www. (TBA) .eu (BTC Token tied currency and Stable Coins through Crypto quasi real money play)
ftpjesus
Posts: 164
Joined: Fri Dec 30, 2016 1:54 am

Re: The 800lb gorilla in the room

Post by ftpjesus »

I’ve sent some evidence or more accurately pointed it out to Kent that I’m sure he’s going to find interesting. Also the exploit was explained in PFAs podcast Friday night and it concerns me enough that I would be leery of any third party site control for any software owner <IE not having absolute control over their site> as the potential for a third party to install this on a site and abuse it without the owner knowing is significant. The exploit sends the hole cards info to a different URL. Not to mention the rather insane $10k price tag that’s being asked. I also believe the supposed affiliate who contacted Mr Witteles about the exploit not knowing his site isn’t a real money site isn’t an affiliate seller and indeed is likely very much involved in its creation and probably was the creator contacting him or one of the partners. Also it’s likely this forum had emails harvested off of it which is how I was contacted among others.

I’m not going to release any information publically, at this point, as to who the prime suspect is but rest assured you sir outted yourself it didn’t require any deep dive or investigating.
Owner Operator of (TBA)
http://www.( TBA ) .com (Home Page)
http://www. (TBA) .net (Play Money)
http://www. (TBA) .eu (BTC Token tied currency and Stable Coins through Crypto quasi real money play)
[email protected]
Posts: 5
Joined: Fri Feb 14, 2020 6:04 pm

Re: The 800lb gorilla in the room

Post by [email protected] »

I have heard of exploits for Poker Mavens for a long time. The facts are that EVERY single one I investigated was loading malware or a virus on the interested persons computer. Theoretically if you have access to the server you MAY figure out a hack. I have yet to actually see one. Obviously keep people off your server and it won't be hacked. Until I know for a FACT that somebody's site was hacked not going to be very worried about it.
ftpjesus
Posts: 164
Joined: Fri Dec 30, 2016 1:54 am

Re: The 800lb gorilla in the room

Post by ftpjesus »

Unfortunately this wasnt a hack like your thinking.. This was a reverse engineered exploit somebody paid for to be able to install on their PM Server and see all the hole cards at the table.. This isnt somebody being nefarious and sneaking it in the manner you suggested this was designed to be directly loaded onto a server either through RDP remotely or through just sitting down physically at the server itself.. I believe Kents going to have a fix for this in 6.15 very soon by updating the checking process he installed in 6.12.. Additionally its been confirmed the suspect who was trying to SELL the exploit is indeed a forum user on here which pisses me off.. Worse yet he apparently was trying to pull a fast one on anybody who was buying it because he never had the whole damn thing according to the actually person who engineered the hole card exploit.. I dont know if Kent has taken action against the user yet or not but I might suggest they either leave this forum immediately or soon before I do out them publically within the next 24-48hrs and never show their faces on this forum again.. its Banhammer time. (Ironically the user has a different registered email address for the forum then as I mentioned above the address they outted themselves using in a thread here which is exactly the same one the seller was using to solicite buyers.) again theirony they tried ot get 10k out of somebody for this and it wasnt even the full product making them a bloody scammer and criminal to boot in my eyes hence why they need to leave because I will be posting their identity on here real soon (Although if you go to the other forum where this story started its already there if you want to know now)
Owner Operator of (TBA)
http://www.( TBA ) .com (Home Page)
http://www. (TBA) .net (Play Money)
http://www. (TBA) .eu (BTC Token tied currency and Stable Coins through Crypto quasi real money play)
Kent Briggs
Site Admin
Posts: 5878
Joined: Wed Mar 19, 2008 8:47 pm

Re: The 800lb gorilla in the room

Post by Kent Briggs »

Unfortunately it's trivial to get a different email address and create a new forum account under a different name.
navels
Posts: 24
Joined: Fri Mar 17, 2017 11:19 am

Re: The 800lb gorilla in the room

Post by navels »

Since this has come up on PFA again . . . has this exploit been fixed? I'm having a hard time finding any mention that it has and I can't seem to easily find release notes of past releases either. Thanks.
Kent Briggs
Site Admin
Posts: 5878
Joined: Wed Mar 19, 2008 8:47 pm

Re: The 800lb gorilla in the room

Post by Kent Briggs »

navels wrote:Since this has come up on PFA again . . . has this exploit been fixed?
Fixed last year in 6.15:

viewtopic.php?f=7&t=2890
navels
Posts: 24
Joined: Fri Mar 17, 2017 11:19 am

Re: The 800lb gorilla in the room

Post by navels »

Do we know that this prevents the specific exploit that prompted this thread?
Post Reply