Possible super user on GGpoker

[BetCheckBet]

Was very skeptical before reading but looks pretty damn bad

https://forumserver.twoplustwo.com/2.../#post58392326

[Pablo]

Was worth the read to see Mason get roasted again and again.

Pablo

[Dan Druff]

So far it looks pretty bad.

If the info posted is real, the guy’s win rate is insane high, he’s making crazy stupid plays (unless he knows the holecards), and he won a tournament, so this probably isn’t chip dumping or a few opponents infected with a screen scraper.

GG hasn’t said anything, and the OP claims GG has admitted there was cheating.

The big question: Why do this at low stakes?

[Dan Druff]

Not possible.

Verified.

Except it had to do with a vulnerability with their “thumbs up/down” functionality (lol), and apparently the cheater only had access to hand equity % and not hole cards.

[BetCheckBet]

Just more evidence how sites do zero to catch cheaters. That even in the most obvious examples they have to rely on the community. I remember way back in 2004 poeple actually believed these sites had algorithms that quickly caught cheaters.

Likely dozens of people have been using this vulnerability for quite some time and only when someone got greedy was it noticed. Wouldn’t be surprised if this vulnerability has been there for ages. Think about it the guy who exploited it was really stupid about how he went about it. But for someone to go to all this trouble and understand expected EV it’s mostly likely someone else passed this on to them after they had exploited the site and taken their money off.

lol at confiscating 30k. He won nearly 50k in a single tournament. If they were legitimate site they’d be launching criminal case into him with authorities . But this will likely be swept under the rug cause sites prefer to hide cheaters as opposed to acknowledging them. If these sites were properly regulated you’d have gaming boards launching huge investigations here.

Finally the fact the site was able to figure this all out in a few hours tells me how blatantly obvious the cheating was yet they did nothing or that they were aware and were trying to keep it quiet.

Also for those that don’t know ggpoker is one of the hardest sites collect hand histories. They purposely obscure them to make it harder to track players. This is supposed to stop things like bum hunting but reality is it makes it much harder for community to catch cheaters.

[BetCheckBet]

Also funny how many guys on twoplustwo seemed convinced he wasn’t cheating. I mean I’m a huge devils advocate around this stuff and it was pretty damn obvious from both stats and hand histories. Just tells you how many suckers are out there. Funny enough limon is one of them.

Also mason totally fucked up the thread and mods should delete his posts

[hesterandeldridge]

Just more evidence how sites do zero to catch cheaters. That even in the most obvious examples they have to rely on the community. I remember way back in 2004 poeple actually believed these sites had algorithms that quickly caught cheaters.

Likely dozens of people have been using this vulnerability for quite some time and only when someone got greedy was it noticed. Wouldn’t be surprised if this vulnerability has been there for ages.

Also lol at confiscating 30k. He won nearly 50k in a single tournament. If they were legitimate site they’d be launching criminal case into him with authorities . But this will likely be swept under the rug cause sites prefer to hide cheaters as opposed to acknowledging them.

Finally the fact the site was able to figure this all out in a few hours tells me how blatantly obvious the cheating was yet they did nothing or that they were aware and were trying to keep it quiet.

Also for those that don’t know ggpoker is one of the hardest sites collect hand histories. They purposely obscure them to make it harder to tract players. This is supposed to stop things like bum hunting but reality is it makes it much harder for community to catch cheaters.

29k was probably what was left in that account .

they will probably spend more money on PR to get their shills to downplay this.

I wonder in the last 25 years of online poker from planet poker, paradise etc etc til now , if this leak was available to be hacked.

someone who did not want to get caught has probably been making money at an acceptable rate this whole time.

[BetCheckBet]

Just more evidence how sites do zero to catch cheaters. That even in the most obvious examples they have to rely on the community. I remember way back in 2004 poeple actually believed these sites had algorithms that quickly caught cheaters.

Likely dozens of people have been using this vulnerability for quite some time and only when someone got greedy was it noticed. Wouldn’t be surprised if this vulnerability has been there for ages.

Also lol at confiscating 30k. He won nearly 50k in a single tournament. If they were legitimate site they’d be launching criminal case into him with authorities . But this will likely be swept under the rug cause sites prefer to hide cheaters as opposed to acknowledging them.

Finally the fact the site was able to figure this all out in a few hours tells me how blatantly obvious the cheating was yet they did nothing or that they were aware and were trying to keep it quiet.

Also for those that don’t know ggpoker is one of the hardest sites collect hand histories. They purposely obscure them to make it harder to tract players. This is supposed to stop things like bum hunting but reality is it makes it much harder for community to catch cheaters.

29k was probably what was left in that account .

they will probably spend more money on PR to get their shills to downplay this.

I wonder in the last 25 years of online poker from planet poker, paradise etc etc til now , if this leak was available to be hacked.

someone who did not want to get caught has probably been making money at an acceptable rate this whole time.

I edited my post above to reflect but yes I’d say with 90 percent certainty minimum others have been doing this and likely or quite some time. Almost looks like this guy wanted to get caught. It’s almost guaranteed to be in the millions.

[BetCheckBet]

Good time to post this as a reminder who got away with this before.



Shout out to druff

[Dan Druff]

This statement from GG was very lacking.

I have a feeling that several others did this and stole a lot, and MoneyTaker was the moron friend someone told about it.

Only alternate explanation was that MoneyTaker was some broke kid who couldn’t afford to deposit much, so he had to run it up this way. But why didn’t he move up after winning the $47k on the tournament?

Here is the thumbs up/down thing which was exploited, by the way:

[LBarry678]

Adobe air? They use ADOBE AIR?

[Dan Druff]

So now that we know it really was an exploit, and was nearly the same as a superuser (GG claims he could see hand equity percentages, but not acutal cards), there's a lot of unanswered questions remaining.

GGPoker's statement was not good enough. It raised more questions than it answered.

According to their confusing and convoluted statement, they "spotted" unusual game patterns and abnormal packets from a user named MoneyTaker69. They traced this activity to an exploit of their "thumbs up/thumbs down" feature. That feature is a graphical one, which allows users to put a thumbs up or thums down next to their avatar, to indicate happiness or unhappiness.

MoneyTaker69 apparently modified the software to where pressing the thumbs up/down would instead receive (and display to him) the hand equity percentages (change to win the hand) at the moment. This allowed him to always know his current chances to win the hand, and then he would make a call/raise/fold decision based upon that. This isn't quite as good as seeing the hole cards, but it's close to as good, as it allows you to see in percentage format how much you're ahead or behind, which is really what you're looking to figure out in poker at all times.

But here's where it gets really weird. They claim that they "detected the issue on December 16th and issued an emergency update", but MoneyTaker69 was playing as recently as December 23!




They will not explain why MoneyTaker69 wasn't banned on December 16, and why he was allowed to play another week and keep cheating.

There are basically two possibilities here:

1) There are/were several cheaters using this exploit, and they caught someone else on December 16. After the patch was released, they erroneously believed they had fixed the problem, not realizing that the cheaters simply could block a client update and keep doing it. So this allowed other cheaters in the ring to continue doing it, and this whole thing only fell apart because MoneyTaker69 was too dumb to be subtle about it.
-or-
2) They let MoneyTaker stay unbanned, in an effort to observe his account and figure out anything else he might be doing, until his crazy play was made public.


Either way, GG isn't being completely honest about this.

[Dan Druff]

From a technical standpoint, there are also some disturbing elements to this.

First off, as already pointed out by LBarry678 above, using Adobe Air as part of their Windows client was a huge mistake. Adobe Air was discontinued in 2019, as did their security updates, so this was a bad framework to be using. Indeed, some vulnerability in Adobe Air was what allowed the cheaters to write this expoit.

Second, and perhaps more importantly, it is bizarre that their server would be willing to send hand equities prior to the conclusion of action of the hand. Hand equities are displayed for all-in run outs -- so the players have an idea what chance they have to win the hand. However, it is a HUGE security flaw for GGPoker's server to send out those equity numbers at any other time than everyone being either folded or all-in! Apparently all that had to be done is have modified GGPoker Windows software ask the server for those equity percentages, and they were sent. Apparently the cheaters modified the thumbs up/down feature to ask for those equities whenever the thumps up/down button was pressed, and then it would be displayed to the cheater. It is not clear exactly what it was about thumbs up/down functionality specifically allowed the cheater to get the equities there and only there, but presumably using that functionality would contain a data request which would allow equities to be part of that request. The fact that these equities were available at all was a huge design flaw, and it also raises questions whether this can be done on other sites which display such equities!

Third, it is insane that GGPoker did not have some kind of check for a modified client. There are many ways this can be done, and the fact that such a check didn't exist was, again, a gigantic security flaw.

Fourth, it is very bad that GGPoker does not have internal checks for absurd/unexpected winrates, where accounts are automatically flagged when winning at crazy rates like 90 BB/100. In fact, there could also be a check for things such as percentage of correct decisions (or at least percentage of correct decisions for pots more than X number of big blinds), and again, any outliers auto-reported to the security team. Apparently they had none of this.

Very bad all around.

[Dan Druff]

Remaining questions for GGPoker which must be answered:

1) Why was MoneyTaker69 allowed to play for at least a week after being caught cheating?

2) Is there anyone else who cheated in this fashion, besides MoneyTaker69? If not, how can you be sure?

3) How much money did MoneyTaker69 profit total in his time on GGPoker?

4) Since MoneyTaker69 occasionally lost due to bad beats, his total winnings will be less than the amount he cheated people (since those who lost shouldn't have lost against him, in many cases). How will these people be compensated, and in what fashion will you do it?

5) How will people be compensated whom he knocked out of the tournament(s) he played, either before or after the money?

6) How long was this exploit being used? Do you have any indication of this?

7) What is MoneyTaker69's name?

8) Has this criminal action been reported to any law enforcement?

9) Given your platform's usage of the discontinued Adobe Air, plus various internatl security check lapses which led to this occurring, there are some major security issues at GGPoker. Do you plan to allow any independent audit of GGPoker security, in order to make players comfortable continuing to play there?

[Dan Druff]

Some are now giving a hard time to GGPoker ambassadors such as Daniel Negreanu, Jason Koon, Fedor Holz, etc.

I don't feel it's the right time to do that yet. This is different than the Lock Poker ambassadors who kept promoting depositing there when it was clear Lock wasn't paying anyone out, or the UB ambassadors promoting the site after the owners there had cheated the players.

GGPoker is guilty of incompetence here -- and is currently not being transparent enough -- but this was not a case of GGPoker itself stealing or cheating. There's a huge difference between this and UB or Lock. So while GGPoker has a lot to do in order to make all of this right (both monetarily and informationally), this does not rise to the level where current ambassadors need to quit in a huff.

I have not seen the GGPoker ambassador contracts, but I am almost sure they have some kind of non-disparagement agreement in them (at least while working for GG), and probably also have a code of conduct involving making non-approvevd statements regarding the company.

So it's not as simple as Negreanu coming out and saying, "My feelings about this GGPoker cheating scandal are..."

If GGPoker was non-paying winners, or if they were directly cheating their customers, I would be the first one to call out Negreanu and company to immediately quit and speak out against them. But that's not what is happening here.

In short, the ambassadors need to be cut a break -- at least for the moment.

[Dan Druff]

There are some other suspicious accounts from earlier this year, though none as blatant as MoneyTaker. But all of these (scroll down on the link to see the ones the guy is talking about) were crushing it at around 30+ bb/100, and then quit at around 15k hands played:

https://forumserver.twoplustwo.com/s...postcount=5239

GG supposedly claimed in August it was "money laundering" and not cheating, but definitely worth another look.

[sah_24]

Just more evidence how sites do zero to catch cheaters. That even in the most obvious examples they have to rely on the community. I remember way back in 2004 poeple actually believed these sites had algorithms that quickly caught cheaters.

Likely dozens of people have been using this vulnerability for quite some time and only when someone got greedy was it noticed. Wouldn’t be surprised if this vulnerability has been there for ages. Think about it the guy who exploited it was really stupid about how he went about it. But for someone to go to all this trouble and understand expected EV it’s mostly likely someone else passed this on to them after they had exploited the site and taken their money off.

lol at confiscating 30k. He won nearly 50k in a single tournament. If they were legitimate site they’d be launching criminal case into him with authorities . But this will likely be swept under the rug cause sites prefer to hide cheaters as opposed to acknowledging them. If these sites were properly regulated you’d have gaming boards launching huge investigations here.

Finally the fact the site was able to figure this all out in a few hours tells me how blatantly obvious the cheating was yet they did nothing or that they were aware and were trying to keep it quiet.

Also for those that don’t know ggpoker is one of the hardest sites collect hand histories. They purposely obscure them to make it harder to track players. This is supposed to stop things like bum hunting but reality is it makes it much harder for community to catch cheaters.

Ya just like when the California gaming board sided with Mike Postle ... you are hilariously fucking stupid

[mickeycrimm]

n

[Dan Druff]

Here we go again, this time at microstakes ($10 buyin):

Hello,

I am a regular microstakes cash player, and I believe I may have found a superuser:

gemini2 @NL10
lamborghini2 @NL10

I suspect that these two accounts belong to the same person. Both accounts quickly accumulate 500-600 big blinds in a short time with a VPIP of >75%, and then immediately leave the table. They just play at one table. They consistently attempt to play the full board. Upon observing their played hands, it became evident that there is something unusual. I am uncertain about how to fully utilize online resources, but with further research, you'll likely see the abnormalities.

gemini2 leaves, and lamborghini2 appears soon after. These nicknames don't play very often, but when they do, they become chip leaders rapidly and then leave. There might be numerous accounts we are unaware of.

I strongly urge GG officials to monitor their hands closely to detect any abnormalities. The playing style of both accounts is exactly the same.

Typically, I label players based on their chip counts and the number of tables. This approach helps me identify those with abnormal stats who quickly become chip leaders. These two players have been catching my attention for a while. I have a few more players I suspect, but won't mention their usernames for now because I am not entirely sure about them.

I am sharing the screenshots of the data I obtained from smarthand.pro. Although statistics for some of the hands played on this site are provided, it would be beneficial if you could further investigate using additional tools, if available.

That's enough information from me; the rest is up to you guys who want to investigate.

Have a nice day and good luck.

Source: https://forumserver.twoplustwo.com/2...where-1830945/

[Dan Druff]

Jason Koon claims this was simply bonus abuse, which is possible. However, I tried to get an answer about the Moneytaker69 stuff they won't clarify, and didn't get anywhere...

Embedded Tweet

https://twitter.com/JasonKoon/status/1749970689384468492

Embedded Tweet

https://twitter.com/ToddWitteles/status/1749971950632599638

Embedded Tweet

https://twitter.com/ToddWitteles/status/1749981971974164941