1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

An inside look to an online casino cheating

Discussion in 'BlackHat Lounge' started by Elliot305, Oct 26, 2014.

  1. Elliot305

    Elliot305 Jr. VIP Jr. VIP

    Joined:
    Jul 21, 2010
    Messages:
    509
    Likes Received:
    1,328
    Occupation:
    Loophole/Exploit Specialist
    Location:
    In The Sun
    Upon finding a vulnerability within a casino's system, I also noticed something else...the casino cheating. http://vimeo.com/110040994 (password: dreamland). Made a video last night demonstrating that even when I can isolate the cards and give myself the best possible scenario, the game will always manufacture a losing situation. Normal game play would never pick this kind of thing up as there are too many card possibilities but since I was able to isolate the cards I wanted, it magnified the cheating. The "cheating code" is probably executed under many different circumstances and games on their site but the video shows it isolated under just one game, bet denomination and bonus round in order to show it at work.
     
    • Thanks Thanks x 8
  2. Patel

    Patel Senior Member

    Joined:
    Mar 1, 2011
    Messages:
    1,116
    Likes Received:
    1,503
    Location:
    On the coast
    That's why bitcoin gambling is getting so big. The reputable websites have "provably fair", and people can calculate & verify the fairness themselves
     
  3. Elliot305

    Elliot305 Jr. VIP Jr. VIP

    Joined:
    Jul 21, 2010
    Messages:
    509
    Likes Received:
    1,328
    Occupation:
    Loophole/Exploit Specialist
    Location:
    In The Sun
    Very true. Fortunately for me, provably fair casinos still have weaknesses just like any other casino. It's not so much about altering the cards or outcomes of the games, but rather the game functionality and sequence (i.e., using game functions that should be disabled or resetting the entire game to be played again, etc.)
     
  4. Syzpe

    Syzpe Registered Member

    Joined:
    Oct 25, 2014
    Messages:
    81
    Likes Received:
    100
    First off it's certainly a fascinating find that exploit, so well done.

    But it makes sense that systems ''cheat'' in this way. There is very little regulation in online gambling and so while the systems do pay out on occasion, it's always in the houses favor by a steep margin. They can control their profits.

    To be fair, real casinos are not far off. The games are always designed in the houses favor - they do have to be winnable but that certainly doesn't mean the odds aren't staked!

    Online Casinos are just a seedy bunch - thats why for online gambling I stick to betting on real world events.
     
    • Thanks Thanks x 1
  5. TrafficWizard

    TrafficWizard Junior Member

    Joined:
    Aug 22, 2014
    Messages:
    160
    Likes Received:
    26
    Nice find OP ! Tho don't mess or submit it there is no point - back in days I was playing around with poker and online roulette and I did reversing on few casino clients ALL were riged (talking about roullete) poker one was not it's people vs people not people vs house.

    House always win ! back in day I reported it and got banned and my funds were gone.
     
    • Thanks Thanks x 1
  6. ItsBlinkHere

    ItsBlinkHere Regular Member

    Joined:
    Apr 27, 2014
    Messages:
    409
    Likes Received:
    150
    Location:
    At Large
    Yup...systems that cheat like that need to be exploited.
     
  7. Ricky Roma

    Ricky Roma Regular Member

    Joined:
    Sep 23, 2011
    Messages:
    289
    Likes Received:
    392
    Wow great find! When you intercept response with fiddler and abort session, is it registered on their server? Can they see that many responses are aborted?
    Also did you tried to modify response and directly get #3 without waiting for right card? IF you can send modified response what about putting #2?

    BTW this reminds me a bit of this movie: http://www.youtube.com/watch?v=HAz_oUxUuDg
     
  8. HoNeYBiRD

    HoNeYBiRD Jr. VIP Jr. VIP

    Joined:
    May 1, 2009
    Messages:
    5,902
    Likes Received:
    7,138
    Gender:
    Male
    Occupation:
    Geographer, Tourism Manager
    Location:
    Ghosted
  9. Elliot305

    Elliot305 Jr. VIP Jr. VIP

    Joined:
    Jul 21, 2010
    Messages:
    509
    Likes Received:
    1,328
    Occupation:
    Loophole/Exploit Specialist
    Location:
    In The Sun
    Well I do a lot of different techniques and aborting the session is just one of them. That particular example I call the "Skip." To answer your questions, it may register on their server as an aborted session, but it probably doesn't since it's a side bonus game and their server gives me a new session altogether. I've done techniques where I've played games only using fiddler and was able to play beyond what the interface showed for options. This included depleting the entire deck of cards to isolate the last few (kind of like card counting I suppose) or using game functions well past their intended limits. In some of those instances the casinos were able to see my actions even though I wasn't using the interface at all. But by that time it was already too late for them since the "damage" was already done. That's why forming correct deployment and exit strategies is very important for executing exploits...to catch them when they're not looking.

    As for modifying actual game results such as switching the 3 to a 2, well, that's a whole other ballgame and most casinos don't allow that unless they really expose themselves. As such, I came up with techniques that dealt with manipulating game functionality and game structure rather than the cards themselves. A lot of casinos are weak in these areas. The end result is the same...I have the advantage instead of the casino.
     
    • Thanks Thanks x 3
    Last edited: Oct 26, 2014
  10. Lodestar

    Lodestar Newbie

    Joined:
    Oct 29, 2014
    Messages:
    0
    Likes Received:
    1
    That's awesome. Good job bro. I was trying to find a vulnerable website for three hours last night, but to no avail. Do you have any tips on finding sites?
     
    • Thanks Thanks x 1
  11. ZennoBlaster

    ZennoBlaster Senior Member

    Joined:
    Jan 17, 2014
    Messages:
    1,025
    Likes Received:
    306
    Time and money.
     
  12. ShadeDream

    ShadeDream Elite Member

    Joined:
    Nov 27, 2008
    Messages:
    2,209
    Likes Received:
    5,230
    Location:
    He who laughs last, laughs longest.
    And this is why I do not gamble. Unfortunately I don't have the skills to exploit.

    I'm sure it must be worthwhile to you if you're willing to waste money like that?
     
    • Thanks Thanks x 1
  13. hatblackguy

    hatblackguy Regular Member

    Joined:
    Jun 8, 2011
    Messages:
    252
    Likes Received:
    61
    Occupation:
    kicking Big G's fat Mug
    Location:
    1% Percent of wealthiest people
    I dunno why but this come to me at no surprise, its good to let those who gamble know of this.
     
  14. Free Man

    Free Man Junior Member

    Joined:
    Mar 31, 2013
    Messages:
    165
    Likes Received:
    115
    I read that old ebook you wrote, it was quite of movie like story lol. I despise these parasites very much, but you really went an extra mile or two than an average joe would. Well done.
     
    • Thanks Thanks x 1
  15. Elliot305

    Elliot305 Jr. VIP Jr. VIP

    Joined:
    Jul 21, 2010
    Messages:
    509
    Likes Received:
    1,328
    Occupation:
    Loophole/Exploit Specialist
    Location:
    In The Sun
    Its worth it monetary speaking if I find something, lol. But intellectually its always worth it.
     
    • Thanks Thanks x 1
  16. Vic Sage

    Vic Sage Jr. VIP Jr. VIP

    Joined:
    Sep 5, 2010
    Messages:
    1,716
    Likes Received:
    2,110
    Gender:
    Male
    Occupation:
    Scientist Performing Marketing Experiments
    I wonder when did online casinos became part of IM...........
     
    • Thanks Thanks x 1
  17. Elliot305

    Elliot305 Jr. VIP Jr. VIP

    Joined:
    Jul 21, 2010
    Messages:
    509
    Likes Received:
    1,328
    Occupation:
    Loophole/Exploit Specialist
    Location:
    In The Sun
    I wonder how many douchebags are on BHW hating when someone is sharing something in the LOUNGE! hmm, I see a couple already.
     
  18. Asif WILSON Khan

    Asif WILSON Khan Executive VIP Premium Member

    Joined:
    Nov 10, 2012
    Messages:
    10,119
    Likes Received:
    28,559
    Gender:
    Male
    Occupation:
    Fun Lovin' Criminal
    Location:
    London
    Home Page:
    Downloads Fiddler, then calls himself Exploit Specialist Extraordinaire LMAO
    Even a script kiddie has more sense than to post this stuff on a PUBLIC board.