Would a question on hacking gambling software be on scope?

My question would be on the recent hacking of Chinese Open Face Poker.

I am not looking to hack it. Want to get more information.

It appears the client was hacked not the site. It is in poker news but I am not finding it anywhere technical. Some of the players making the allegation are top respected players. One was a former developer. In defense of the software it was not designed for gambling. There are no sites that take money. Players agree on a $ value of a point.

I wanted to know if anyone had any specifics on the hack. One vulnerability is you get 13 cards but have to play (place) 5 and them 1 at a time. If you can see all 13 up front then you can better play them. Another allegation / vulnerability is even see other players hands.

| |
  • Are you asking how to hack the site, or to ask a specific question about the hack that was done? Second, have you performed some research on the event? – schroeder Feb 28 '17 at 15:44
  • @schroeder I am trying to find out more about the hack. Right now it is just being reported in poker news (that I know of). – paparazzo Feb 28 '17 at 15:54
  • 3
    Possible duplicate of Is it on topic to ask about specific attack events? – Anders Mar 1 '17 at 8:51

I'm not sure it would be on-topic, but it is borderline.

Asking how we think the hack was done from user reports would be opinion-based. Asking for sources of more info would also be off-topic (basically: "where's the link to info about X"). Asking for a secure code review would also be off-topic.

After a quick Google search, it appears to be a known vulnerability with multiple different ways to hack it. It's not a 'security' issue but just a really weak coding issue that hasn't been addressed. Crappy code is crappy code.

I appreciate that you asked!

| |
  • 1
    OK I will not post on the regular site but leave it here on meta. – paparazzo Feb 28 '17 at 16:16

It wouldn't not be on-topic, gambling software is software.

That said, the specifics of your question might not make it a good one - if the information is public, then asking for that is pointless; if it has not been made public then it is just asking for conjecture and subjective opinions.

If there are details you can share, then you could ask details about consequences or exploits. Or there is room for higher-level questions, such as how to threat model such an application...

| |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .