How Digital Cardsharps Operate
People have been cheating at card games since they were first invented
in 9th century China. The way the cheating has gone down hasn’t changed
much: sleight of hand, collusion and marking cards. But in the digital
age, poker has come to mean a very different game. When played online,
poker now comes with a set of rules that has all new avenues for play,
as well as cheating.Playing card games like Poker rely on shuffling a deck of physical cards. By shuffling the 52 cards of a standard deck, players all have an equal chance of getting any card in the deck. When playing online however, algorithms are used to “randomly” distribute the cards. I put that in quotes because nothing a computer ever does is truly random. Randomness in computers is simulated by the generation of an integer with a deterministic pseudo-random algorithm, mediated by a “seed” number. Most computer programs use the hardware system clock to generate a constantly changing seed number. For most applications, this method sufficiently simulates randomness. However, when real money is being placed on the virtual table, this lack of randomness can be exploited by syncing a client computer to the server’s system clock.
Playing card games like Poker rely on shuffling a deck of physical cards. By shuffling the 52 cards of a standard deck, players all have an equal chance of getting any card in the deck. When playing online however, algorithms are used to “randomly” distribute the cards. I put that in quotes because nothing a computer ever does is truly random. Randomness in computers is simulated by the generation of an integer with a deterministic pseudo-random algorithm, mediated by a “seed” number. Most computer programs use the hardware system clock to generate a constantly changing seed number. For most applications, this method sufficiently simulates randomness. However, when real money is being placed on the virtual table, this lack of randomness can be exploited by syncing a client computer to the server’s system clock.
Now that a computer has created the illusion of randomness, there is still the issue of how to figure out how to deal out a set of 52 virtual cards. With a sufficiently convincing random number generator, this can be achieved through software. But its not always implemented properly. In 1999, PlanetPoker publicly released their shuffling algorithms to dissuade critics who openly complained about a skewed game. Security experts Cigital took one look at the algorithms, and were able to prove that the software shuffling implementation produced deals that were not at all similar to how cards are shuffled in reality. Sorting on a computer requires placing static elements into randomized positions, much like the act of shuffling a deck of cards. The problem lies in the probabilities. Cigital showed that the PlanetPoker algorithm incorrectly distributed cards, with a skewed shuffling function. While pseudo-randomness was applied to the discreet decks of digital cards, certain combinations of cards emerged as more likely to occur.
While these applying these concepts may seem impractical, exploits in the game systems tend to lead to client-side applications used to take advantage of vulnerable online poker tables. Pokerbot (now defunct) was just one of dozens of applications for sale that allowed players to gamble online without having to actually sit in front of their computer to do it.
The fact that these systems are vulnerable is not surprising. What is interesting though, is how the vulnerabilities in online poker highlight the differences between online and conventional poker. Playing poker requires that players come to a mutual understanding of the randomness of shuffling cards, and players’ relative inability to calculate which card will be in the hands of other players. Players of Internet poker participate in a similar way, trusting that the server will deal out cards randomly, and that other players connected to the server 1) are human and 2) are using identical software to process the game information to that human. Players of conventional poker can use their eyes to spot shady play, but online, you’re just going to have to trust the system.
Now that a computer has created the illusion of randomness, there is still the issue of how to figure out how to deal out a set of 52 virtual cards. With a sufficiently convincing random number generator, this can be achieved through software. But its not always implemented properly. In 1999, PlanetPoker publicly released their shuffling algorithms to dissuade critics who openly complained about a skewed game. Security experts Cigital took one look at the algorithms, and were able to prove that the software shuffling implementation produced deals that were not at all similar to how cards are shuffled in reality. Sorting on a computer requires placing static elements into randomized positions, much like the act of shuffling a deck of cards. The problem lies in the probabilities. Cigital showed that the PlanetPoker algorithm incorrectly distributed cards, with a skewed shuffling function. While pseudo-randomness was applied to the discreet decks of digital cards, certain combinations of cards emerged as more likely to occur.
While these applying these concepts may seem impractical, exploits in the game systems tend to lead to client-side applications used to take advantage of vulnerable online poker tables. Pokerbot (now defunct) was just one of dozens of applications for sale that allowed players to gamble online without having to actually sit in front of their computer to do it.
The fact that these systems are vulnerable is not surprising. What is interesting though, is how the vulnerabilities in online poker highlight the differences between online and conventional poker. Playing poker requires that players come to a mutual understanding of the randomness of shuffling cards, and players’ relative inability to calculate which card will be in the hands of other players. Players of Internet poker participate in a similar way, trusting that the server will deal out cards randomly, and that other players connected to the server 1) are human and 2) are using identical software to process the game information to that human. Players of conventional poker can use their eyes to spot shady play, but online, you’re just going to have to trust the system.
Leave a comment