Merge disconnects then proceeds to sign players into other players accounts

[Mantis Toboggan]

On Sunday 11/23 Merge Poker experienced a massive discconect during the main event final table of their Online Poker Series. Endless amounts of players reported being unable to log-in. While this is definitely frustrating, as online poker players, we accept that this can happen on any site at any time. As players slowly began to be able to log back in however, things took an unprecdented turn. Players began to report that while attempting to log into their own account, Merge actually signed them into random players accounts. Not only were these affected parties able to view cashier balance and sit at tables in the wrong account, but they were also able to view these players deposit histories, possibly compromising their banking information.

Here are some quotes from the 2+2 thread:

"i just got back on and it had me on another account. like i could see the dude's balance and everything"

"Got on and won 2 hands on somebody else's account"

"something weird just really happened to me. I was grinding, started to have connection problems, closed the client, re-opened, etc, then without asking me for my password it signed me in automatically, except it WASN'T my account. I was signed in as someone called "terminallychill3". I got on an empty micro table to make sure it wasn't just the name displayed at the top, and sure enough, it was someone else's account, i bought into the table and everything. I obviously didn't play any hands, just felt like I should report it here in case someone else had their account logged into (or if somehow MY account got logged into)."

Merge has made no official statement on why this happened or how they plan to prevent this from happening again. Merge has reimbursed some players who were victims of the disconnect but remains silent on players logging into random accounts. Since this incident Merge has continued to experience several more major discconects but with no word on why this is happening. Fortunately there have been no reports of players logging into the wrong accounts since the 11/23 incident

Personally I have played on Merge since a week after BF and have always trusted them with my money (although strongly disagreeing with their changes to the VIP program and their bannings of players for seemingly winning too much) but after a security breach like this I'm not sure if I can continue. I just want to advise anyone still playing on merge to exercise caution.

Here is a link to a poker news article regarding the issue: http://www.professionalrakeback.com/...Series-Debacle

[Daniel72]

Merge = Carbon .... or are there other notable skins nowadays?

[Dan Druff]

Thanks for posting this. I talked about it on the 11/25 radio show, but I forgot to post about it as well.

Merge did not handle this well. They were largely absent in the 2+2 thread about the matter, and response from support was predictably clueless/bad.

Someone who got cheated out of like $2200+ in equity (I think he was down to the final 14, and was 3rd place in a big tournament) laughably got a $60 tournament coupon as "compensation" for this.

Merge actually did make it right for this particular guy (calculating his equity and giving it to him), but the compensation did not appear to be automatic. He complained, got the lame $60, and then got the $2200 only after making a big stink about it (and posting repeatedly in the 2+2 thread).

I see you linked the professionalrakeback.com article. You should be aware that professionalrakeback is one of Merge's biggest affiliates, so there is plenty of (positive) bias in that article.

You should never trust any "news" from affiliate sites. It is better to get your poker news from neutral sources, such as forums like this or respected news sites such as pokerfuse.com, pokernews.com, and flushdraw.net.

My overall take here is that Merge had a pretty bad and disturbing bug occur, and this obviously casts some doubt upon their ability from a technical standpoint. Even ignoring that, they didn't handle this well, though it also could have been worse (at least they gave one person proper compensation after he complained enough).

Truthfully the best US-facing room to play right now is Bovada.

[The PINO]

Truthfully the best US-facing room to play right now is Bovada.

Just sucks they're no longer accepting new signups from the US as of a few months ago and requested a bunch of USA affiliates to pull down their reviews from their main pages as to not draw any more attention to the brand. I'm sure it's just something to bring the heat down a bit and they'll openly accept signups again sometime in 2015, but we'll see. They simply got "too big, too fast" within the last 12 months...something a few Bovada affiliate managers have been telling me lately.

[Mantis Toboggan]

Merge = Carbon .... or are there other notable skins nowadays?

The Sportsbook skin is still around, i'm not sure if there are any others. I read a couple months ago that the owners of Carbon are also the owners of Merge but I'm not sure that was 100% confirmed.

I see you linked the professionalrakeback.com article. You should be aware that professionalrakeback is one of Merge's biggest affiliates, so there is plenty of (positive) bias in that article.

You should never trust any "news" from affiliate sites. It is better to get your poker news from neutral sources, such as forums like this or respected news sites such as pokerfuse.com, pokernews.com, and flushdraw.net.

Thanks for the heads up, I was not aware that site had ties with merge. I mostly just posted the link so you guys wouldn't think I was making this up

[Dan Druff]

Truthfully the best US-facing room to play right now is Bovada.

Just sucks they're no longer accepting new signups from the US as of a few months ago and requested a bunch of USA affiliates to pull down their reviews from their main pages as to not draw any more attention to the brand. I'm sure it's just something to bring the heat down a bit and they'll openly accept signups again sometime in 2015, but we'll see. They simply got "too big, too fast" within the last 12 months...something a few Bovada affiliate managers have been telling me lately.

Wow, I didn't know that. I had heard they were asking affiliates to "tone down" the promotion of the brand, but not that they shut off US signups.

Interesting.

[HowQuaint]

Merge = Carbon .... or are there other notable skins nowadays?

All the Jazette skins are still in operation, as well as YouWin

I see you linked the professionalrakeback.com article. You should be aware that professionalrakeback is one of Merge's biggest affiliates, so there is plenty of (positive) bias in that article.

You should never trust any "news" from affiliate sites. It is better to get your poker news from neutral sources, such as forums like this or respected news sites such as pokerfuse.com, pokernews.com, and flushdraw.net.

All of those sites are affiliates and / or accept advertising money on banners and whatnot. Professional Rakeback does not accept advertising fees directly and only is paid for affiliate work. I wouldn't call any of those sites "unbiased" Dan.

Our follow up article on the original can be found here: http://professionalrakeback.com/Merg...nds-for-Outage

In addition, of the few players affected, a couple who did not post publicly informed us they were adequately compensated.

For the record, this was an egregious fuckup, but on a small scale. I personally played a 9 hour session right after this happened because everyone was freaked out and I had all the fish to myself

Truthfully the best US-facing room to play right now is Bovada.

Just sucks they're no longer accepting new signups from the US as of a few months ago and requested a bunch of USA affiliates to pull down their reviews from their main pages as to not draw any more attention to the brand.

Wow, I didn't know that. I had heard they were asking affiliates to "tone down" the promotion of the brand, but not that they shut off US signups.

That isn't entirely true. Bovada still accepts US players from hundreds of affiliate sites. They just cut out a lot of the big ones or, as stated, asked them to remove their materials from easy public purview. We were forced to remove them

[Dan Druff]

I see you linked the professionalrakeback.com article. You should be aware that professionalrakeback is one of Merge's biggest affiliates, so there is plenty of (positive) bias in that article.

You should never trust any "news" from affiliate sites. It is better to get your poker news from neutral sources, such as forums like this or respected news sites such as pokerfuse.com, pokernews.com, and flushdraw.net.

All of those sites are affiliates and / or accept advertising money on banners and whatnot. Professional Rakeback does not accept advertising fees directly and only is paid for affiliate work. I wouldn't call any of those sites "unbiased" Dan.

Our follow up article on the original can be found here: http://professionalrakeback.com/Merg...nds-for-Outage

In addition, of the few players affected, a couple who did not post publicly informed us they were adequately compensated.

For the record, this was an egregious fuckup, but on a small scale. I personally played a 9 hour session right after this happened because everyone was freaked out and I had all the fish to myself

Okay, so perhaps all of those sites (with the exception of this one) aren't 100% unbiased, but I will say that sites like pokerfuse and flushdraw have covered nearly every newsworthy online poker story (without prejudice), even if it makes their partner rooms look bad. And I say that from my own opinion as someone who IS completely neutral, who can tell biased reporting when he sees it.

I understand that you and your site have a close relationship with Merge, so it's hard to write an article bashing them and still maintain a good relationship. Much like I wouldn't appreciate my good friends coming out here and bashing me when I do something stupid.

In my opinion, while your Merge article did acknowledge what occurred, it seemed to gloss over some of the most egregious negatives of the situation (namely, Merge's reaction and what a bug like this means for the safety of the network).

I was simply advising people that it's better to get your news from sites with zero incentive to protect the reputation of the subjects being discussed.

[vookenmeister]

In my opinion, while your Merge article did acknowledge what occurred, it seemed to gloss over some of the most egregious negatives of the situation (namely, Merge's reaction and what a bug like this means for the safety of the network).

I think it's impossible for anyone to write without some sort of bias as every waking moment of our lives we are filling up our brains with thoughts and ideas that form long lasting beliefs that are slightly imperfect at best.

It can be argued that you had a bias going into how you were going to interpret the article that was written. I think the original article was pretty fair given the situation. It wasn't misleading at all. The purpose of the article wasn't really meant to be an editorial but more a summary of the known facts.

Granted I must admit that I have a bias as well as I am familiar with the author. Hence I can understand the point of view of the piece.

I was simply advising people that it's better to get your news from sites with zero incentive to protect the reputation of the subjects being discussed.

This is good advice... but remember it's impossible to read anything that doesn't have some sort of bias. I appreciate that you do your best to be as impartial as humanly possible (keep up the fight).


the situation is quite concerning especially since the Merge software should be battletested by now. It's just a frank reminder that shit can always happen and we all should constantly be on the guard. Keep your balances as low as possible to play your stakes.

And I loved the merge software for multitabling. It was even better than Stars or FT. Hands down the easiest to stack... when it mattered.

[RegGaymer]

Merge literally living up to their name, oh the irony!

[HowQuaint]

Okay, so perhaps all of those sites (with the exception of this one) aren't 100% unbiased,

I was simply advising people that it's better to get your news from sites with zero incentive to protect the reputation of the subjects being discussed.

It is settled then. You simply need to start writing a lot more articles Todd! :P

EDIT: Can you link me to which radio show you spoke about this in? Any idea at what point of the show it was mentioned?

[Dan Druff]

I was simply advising people that it's better to get your news from sites with zero incentive to protect the reputation of the subjects being discussed.

It is settled then. You simply need to start writing a lot more articles Todd! :P

EDIT: Can you link me to which radio show you spoke about this in? Any idea at what point of the show it was mentioned?

It was on the last show in November, and I don't know at what point I discussed it. I didn't say anything too groundbreaking. I described the situation and stated two opinions:

1) Merge handled it poorly, allowing their third-world money CS team to initially handle it (and offering LOL $60 tickets as compensation to parties out thousands in equity), as well as not immediately contacting affected parties and offering them proper compensation.

2) The fact that such an egregious bug could exist at this point is very scary regarding the security and stability of the Merge Network.

I did give them a small amount of praise for making it right with that one 2+2 poster for $2200 (the correct compensation) once he complained about the LOL $60 he got.

[Mantis Toboggan]

Merge is currently experiencing major disconnects again.

Reports are coming in that player "L4ss3m4jj4n" may be using some sort of DDOS attack against the site. It had been documented that every time he minraises a pot, the site immediately disconnects. Frankly, I was pretty skeptical about this but after opening his table in the $125k (he has a top stack) and watching the dissconects several times in a row as soon as he bets, i'm starting to believe. Support has mentioned they are aware of the situation and looking into his account as I type this.

Someone is streaming his table if anyone is interested in seeing for themself... http://secure.twitch.tv/ryandanielslive

Edit: Kevmath now tweeting about the situation

Embedded Tweet

https://twitter.com/Kevmath/status/541734645055119362

[Sanlmar]

So do you think Merge will help players who suffered here?

Or is this, "Not our fault".

Unless I get some good faith gesture, I am done once again with this site.

[Mantis Toboggan]

Hard to say at this point. Merge doesn't have a great reputation for refunding players for disconnects but they do reimburse players on occasion.

This seems to be getting a lot of attention around the web so if what we are fairly certain is happening, is actually happening, I think they would face a huge hit to their reputation if they didn't pay anyone back.

On a side note it seems "L4ss3m4jj4n" has been sitting out for the last ~15 minutes once players began to call him out in the chat box. Not sure if he's gone into hiding or if Merge has shut him down, but there have been no disconnects since he has sat out.

[Shizzmoney]

And now this; possible disconnect exploit on Merge/Carbon (17 mins in):

There is a lengthy discussion in the Merge network thread on this. But I feel that seeing as more people read NVG it needs to be here as well. Over the last few days a player going by L4ss3m4jj4n has been somehow disconnecting the software in situations advantageous to him. At first it was in SNGs and a PLO game. But now he has taken a turn in the 125k Sunday Major. I myself have personally watched him build pots no less than 10 times and on the turn and river either min raise or donk bet for the software to DC. It never happens when he is not in a hand or when he folds. We even have someone streaming it on twitch just to show that it isnt some fluke. I am not a conspiracy theorist nor do I make this thread lightly. But his is a serious issue and its effecting one of the only viable options for US player at this time.

[Dan Druff]

Yeah this looks pretty bad, and is probably the reason last for the crashes on Merge two weeks ago.

Anyone know this guy's real identity?

BTW it shouldn't be called a "superuser", because that's not what the guy is doing. He just crashes the site with DDoS so he can win pots.

[Dan Druff]

According to this 2+2 thread, which may be the same perpetrator, his name is Lars, and is from Sweden.

http://forumserver.twoplustwo.com/28...funds-1479005/

Here he got banned from Stars in October for doing the same thing, and then had the nerve to bitch about it on 2+2!

Sweden seems to be full of online poker scumbags. Remember those Swedish guys who were associated with the Bandidos, who conspired to look at hole cards through trojans, and involved Matt Marafioti in his scheme?

Also those breakins at the EPT Barcelona were supposedly linked to Sweden, as well.

[Shizzmoney]

One of his old SN: "The_LagMaster"

[Sanlmar]

I can think of another example, so I'll run with this.

JP Morgan thinks they are under attack. Users have been repeatedly disconnected in large numbers.

Traders are in the midst of making large bets.

Do you think IT would broadcast some kind of warning to the corporate users?

Or would they just cover it up and let the traders figure it out for themselves?


Creating loyal customers who will rave about the site....