Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security Entertainment Games Science

Colorado Researchers Crack Internet Chess Club 130

Posted by timothy from the that's-nice-dear-and-how-was-class dept.
edpin writes "University of Colorado at Boulder students hacked the 30,000-plus-member Internet Chess Club as part of research funded by the National Science Foundation. With guidance from University of Colorado at Boulder computer security researcher John Black, two students reverse-engineered the service to up their ranks and steal passwords." Update: 10/10 23:05 GMT by T : Reader Bryan Rapp points out that this story duplicates the one posted last month -- sorry about that.
This discussion has been archived. No new comments can be posted.

Colorado Researchers Crack Internet Chess Club More

Colorado Researchers Crack Internet Chess Club

Comments Filter:

  • Another dupe, timothy? (Score:5, Informative)

    by Anonymous Coward on Sunday October 10, 2004 @06:01PM (#10488178)
    Internet Chess Club Security Defeated [slashdot.org]

  • Meanwhile... (Score:2)

    by alexandre ( 53 ) on Sunday October 10, 2004 @06:04PM (#10488191) Homepage Journal
    we're still using stupid magnetic cards for our daily _BANK_ usage...

    • Re:Meanwhile... (Score:3, Funny)

      by baywulf ( 214371 ) on Sunday October 10, 2004 @06:08PM (#10488227)
      They need to use the high security password mechanism used on bank checks.

    • Re:Meanwhile... (Score:3, Interesting)

      by mbrix ( 534821 ) on Sunday October 10, 2004 @06:11PM (#10488249) Homepage
      Not in Denmark (and I suspect, many other countries). We are moving to chip-based cards instead. Actually, Denmark is almost fully converted away from magnetic cards.

      • Re:Meanwhile... (Score:3, Insightful)

        by Old Wolf ( 56093 ) on Monday October 11, 2004 @01:49AM (#10490517)
        The unfortunate side of this coin is that 'smart' cards don't actually offer a lot of added security. Most of the objections people haev raised to magstripe cards still apply to smartcards. Also, most smartcards get their security hacked within a few months of coming out (meaning that the manufacturers are continually in a cycle of sending new cards out). Their only benefit is that the unwashed masses feel safer.

        This is really a great fraud which makes money for the people developing smart-card processing systems and the general public pay for it (well, the merchants pay for it, and they usually pass the costs onto the customers).

      • Re:Meanwhile... (Score:2)

        by gl4ss ( 559668 ) on Monday October 11, 2004 @05:14AM (#10491269) Homepage Journal
        in most places where they're used for banking they're still used to just hold the one number that would have be readen off from the magnetic strip earlier.

    • Re:Meanwhile... (Score:1)

      by mollymoo ( 202721 ) on Sunday October 10, 2004 @06:57PM (#10488510) Journal
      Perhaps you are, but the UK and I belive much of Europe is moving to chips embedded in the card instead of the magnetic strip. I don't know how many cash machines (ATMs) use them yet, but most shops do.

      • Re:Meanwhile... (Score:2)

        by Tony Hoyle ( 11698 ) <tmh@nodomain.org> on Sunday October 10, 2004 @08:15PM (#10488950) Homepage
        So instead of a hard to reproduce signature (well mine is) there's an easy to remember 4 digit number that the criminal can watch you type in just before stealing your wallet (stores almost universally don't have adequate security on their keypads).

        Thankfully it doesn't seem to be switched on in the UK yet - I've never been asked for a PIN... refusing to type it in while surrounded by shoppers could cause a scene (either give me a secure way to type it in and prove it's secure, or you aint getting it).

        • Re:Meanwhile... (Score:1)

          by mollymoo ( 202721 ) on Sunday October 10, 2004 @09:54PM (#10489479) Journal
          So instead of a hard to reproduce signature (well mine is) there's an easy to remember 4 digit number that the criminal can watch you type in just before stealing your wallet

          Exactly :) I've developed a technique of laying all my figers over the keys so it's harder to tell exactly which ones I pressed. I'd prefer it if the keypad were hidden somehow though.

        • Re:Meanwhile... (Score:1)

          by welsh git ( 705097 ) on Sunday October 10, 2004 @10:15PM (#10489611) Homepage
          And... there are various form of keypad entry systems.. What's stopping Mr Shopkeeper from altering the device to record a copy of the PIN you enter ? Or pointing a tiny covert video camera at the device ? As he already has the magnetic strip info, he just trundles down to the cash machine with his made up card and enters the PIN.

          Whilst in the past some criminals would hide/wire up devices to cash machines, they can now do so from the comfort of their own shops..

          The PIN should NOT be the same as the one used in places where the card isn't visually inspected (i.e. cash machines)

          • Re:Meanwhile... (Score:2)

            by Old Wolf ( 56093 ) on Monday October 11, 2004 @01:46AM (#10490500)
            What's stopping Mr Shopkeeper from altering the device to record a copy of the PIN you enter ?

            The banks won't certify any particular device for use in shops (and thus, they won't be able to process transactions successfully) if it allows this.

            Also, if a shopkeeper perpetrated the fraud by the other means you suggest, it would be simple to trace it to that shop, by examining the transaction records.

            Finally, later versions of the terminal software do not actually record the card number, to avoid this very problem. You should see on the receipt something like "49997........0452" , enough digits to identify the card well enough for audit purposes but not to allow someone to commit fraud with it. And as before, a terminal modification which steals card numbers, would not pass certification.

            NB. This is how it works in New Zealand, if other countries don't implement security measures then they are stupid.

            • Re:Meanwhile... (Score:2)

              by CountBrass ( 590228 ) on Monday October 11, 2004 @02:44AM (#10490757)

              I think you've misunderstood the scenario.

              Dishonest shopkeeper installs tampered with reader (why would he care about certification)? Shoopers come in and buy the low value items (say We've seen something like that here in the UK with crooks setting up their own ATMs, which do dispense money (at their cost) which they re-coup many times over using the stolen card details.

            • Re:Meanwhile... (Score:2)

              by CountBrass ( 590228 ) on Monday October 11, 2004 @02:47AM (#10490770)

              Stupid Slashdot misinterpreting less than signs, you'd think they'd get a competent developer to fix their code as well (and make the pound symbol work without requiring arcane knowledge).

              I think you've misunderstood the scenario.

              Dishonest shopkeeper installs tampered with reader (why would he care about certification)? Shoopers come in and buy the low value items (say less than 100GBP ) and swallows that loss. Shopkeeper takes their card data and stolen PINS and goes on a spending spree.

              We've seen something like that here in the UK with crooks setting up their own ATMs, which do dispense money (at their cost) which they re-coup many times over using the stolen card details.

        • Re:Meanwhile... (Score:1)

          by shrykk ( 747039 ) on Monday October 11, 2004 @04:40AM (#10491149)
          I really think you'd be making a mistake by insisting on a signature rather than PIN.

          A thief's attempt at your signature need only be an approximation to be accepted - and at some shops they don't seem to check at all. You don't really think that the millions of fraudulent transactions that are carried out on stolen cards are all from people with simple signatures, do you? If someone steals your card, they will walk into a shop and try to buy a high-value item, for example a laptop or jewellery. If the shop insists on PIN entry, they will be stopped UNLESS they've seen your number, whereas your signature is right there on the back of the card.

          By the way, chip-and-PIN cards are on their way to the UK - I've already used them a few times.

    • Sounds pretty smug to me... (Score:2)

      by sgant ( 178166 ) on Sunday October 10, 2004 @07:42PM (#10488776) Homepage Journal
      University of Colorado at Boulder researcher John Black said:"Unless you have a lot of experience, don't try to invent your own security system, it will just be broken," said Black, an assistant professor of computer science in CU-Boulder's College of Engineering and Applied Science. "Believe me, it's better to leave that job up to the experts."

      Is it me or does he sound kinda smug about all this? What, did he join ICC some while ago and get his ass handed to him...so all this time he planned his revenge on the whole ICC and those that brought him down! ATTACK THEIR SITE!! And get the NSF to fund him to do it! ATTACK! ATTACK!

      Um...cough...sorry, got a little carried away there...

    • Re:Meanwhile... (Score:2)

      by Old Wolf ( 56093 ) on Monday October 11, 2004 @01:40AM (#10490469)
      What's wrong with that? It isn't a security risk to read what's written on the card or to create a new card, and it's a very minor risk to duplicate a card (the risk being that the attacker could gradually guess the PIN over time).

    • Re:Meanwhile... (Score:2)

      by leonmergen ( 807379 ) * <lmergenNO@SPAMgmail.com> on Monday October 11, 2004 @08:27AM (#10491943) Homepage
      I assume you didn't give the security of credit cards a thought ?

      That's even more extreme... by just knowing one number that they print out on receipts you can access someone's bank account.

  • This isn't really useful... (Score:5, Funny)

    by LegoEvan ( 772742 ) on Sunday October 10, 2004 @06:05PM (#10488193) Homepage
    As I'm Bobby Fischer.

  • Will they never learn? (Score:5, Funny)

    by Anonymous Coward on Sunday October 10, 2004 @06:05PM (#10488200)
    It seems like only yesterday [slashdot.org] that the site was hacked, and now it has happened again?

    Those admins need a good kick up the backside.

  • Forget white hat and black hat... (Score:2, Interesting)

    by rasafras ( 637995 ) <tamas@@@pha...jhu...edu> on Sunday October 10, 2004 @06:06PM (#10488206) Homepage
    ...what the hell are the ethics of edu-hacking? That's pretty weird, if you ask me. It could be considered like white hat except that it's done for the hacker's benefit as well, but still... it seems a little fishy. I mean, would you go through an Anarchist's Cookbook with your teacher?
    Maybe that's just me. *shrug*

    • Re:Forget white hat and black hat... (Score:0)

      by Anonymous Coward on Sunday October 10, 2004 @06:07PM (#10488215)
      I guess you've never had one of those chemistry teachers that shows you a thing or two he probably shouldn't.

    • Re:Forget white hat and black hat... (Score:0)

      by Anonymous Coward on Sunday October 10, 2004 @06:09PM (#10488229)
      > ...would you go through an Anarchist's Cookbook with your teacher?

      Yes I would have. My school had some great teachers. It's just you.

    • Re:Forget white hat and black hat... (Score:2, Funny)

      by ElDuderino44137 ( 660751 ) on Sunday October 10, 2004 @06:19PM (#10488303)
      Don't you have to know how to commit a crime in order to stop folks from commiting crimes?

      What you've said is paramount to saying that no sex education will keep us all virgins!!

      Cheers,
      -- The Dude

      • Re:Forget white hat and black hat... (Score:5, Insightful)

        by general_re ( 8883 ) on Sunday October 10, 2004 @06:25PM (#10488333) Homepage
        Don't you have to know how to commit a crime in order to stop folks from commiting crimes?

        Exactly why killing a man is part and parcel of becoming a homicide detective. Errr, wait, it's not.

        Yes, you have to know how crimes are committed to solve/prevent them, but committing those crimes is not the only way to gain that knowledge.

        • Commiting homicide won't make you a better homicide detective. A homcide detective observes the mistakes of others, a security expert observes their own mistakes.

          Kill somebody, and what are the chances you'll notice the eyelash that conveniently fell out? You'd have to look for your own mistakes, while not utilising the information of how it was done at all for you to gain any skill, and it would be easier to wait until somebody gets killed for a reason other than to solve. The killing itself would get you nothing, all the benefit comes from solving it.

          On the other hand, when you hack, you find out what mistakes other people make, so that you can then not make them. The benefit comes from knowing how people will attempt to hack you.

          To put it another way, a detective must know how to attack. Unless they commit homicide, in which case they'll be on the defense, knowing how to defend is useless if you don't learn how to bypass those defenses, which it won't (note: I am neither a homicide detective nor a cold-blooded murderer). The skill of bypassing defenses comes from attacking, not from defending. A security expert is on the defense though, making him more akin to the killer - and being a homicide detective will certainly help you evade other homicide detectives. Since he must defend, he must know how he will be attacked, and to have the best knowledge of that, he must attack.

          This is probably redundant by now, but I don't wanna waste the typing.

          • Re:Forget white hat and black hat... (Score:5, Insightful)

            by general_re ( 8883 ) on Sunday October 10, 2004 @07:36PM (#10488734) Homepage
            As I said, though, there are plenty of ways to gain that kind of knowledge without actually breaking the law. Forensic accountants learn how to spot money-laundering schemes without having to get out there and launder money. Serial-murder specialists don't have to kill scores of people to learn how serial killers operate. Viral pathologists don't infect people with HIV so they can learn how to prevent AIDS.

            In all those cases, they study past cases, study current events, and don't generally have to become like the things they're acting against in order to defeat them, and I have no idea why computer security should be different - as someone who used to work in banking, allow me to testify that we didn't go out and rob banks or kite checks in order to learn how to prevent others from doing the same. And in those few cases where hands-on experience is absolutely necessary, you don't need to go out into the world and involve innocent third-parties - you set up a controlled environment where they can play on the playground without actually attacking real people. The ethics of this sort of "white-hat" hacking are non-existent - this is absolutely unethical behavior on the part of these clowns, and in no way do the ends justify the means.

            • But if you did go out and rob banks and kite checks, would you not learn something from what worked and what did not?

              There's a question of whether learning to practice is faster/cheaper than learning through study, and I doubt that either is better for all situations.

              Obviously, robbing a bank for practice is a bad idea, as someone is liable to get shot. But hacking a chess site is probably not so bad, since potential harm is low.

              • Re:Forget white hat and black hat... (Score:3, Insightful)

                by general_re ( 8883 ) on Monday October 11, 2004 @04:43AM (#10491163) Homepage
                But if you did go out and rob banks and kite checks, would you not learn something from what worked and what did not?

                Maybe. But the problem is that in so doing, the "good guys" become morally, ethically, and legally indistinguishable from the bad guys - you've erased the difference between you and them, your altruistic motives notwithstanding. The ends do not justify the means.

                But hacking a chess site is probably not so bad, since potential harm is low.

                The rightness or wrongness does not depend on the level of risk to the perpetrators. Investigating the efficacy of home security systems is a worthy goal. Breaking into strangers' houses is not an appropriate method of pursuing that goal, even if you minimize the risk by making sure that nobody's home at the time. And, I suppose I should add, even if you don't plan to take anything.

            • And in those few cases where hands-on experience is absolutely necessary, you don't need to go out into the world and involve innocent third-parties - you set up a controlled environment where they can play on the playground without actually attacking real people.
              How would you do that? If you set up the security, when you try to break it, you'll have knowledge that the attackers won't. This means that you won't try as hard in areas where you think you did a good job, so those areas might not stand up to a real cracker.

              I agree that you shouldn't hack a site to learn how to defend yourself, but as long as nothing gets hurt or damaged I don't have much problem with it, and sometimes it is the best way.

              • Re:Forget white hat and black hat... (Score:2)

                by general_re ( 8883 ) on Monday October 11, 2004 @09:25AM (#10492371) Homepage
                You could set up honeypots, to observe how real bad guys might try to get into a system. You could have someone else set up a test server for you, so that you don't have the advantage of knowing in advance what you're up against.

                Or, you know, you can do the whole thing with no more than a phone call - "Hello, Mr. ICC Webmaster? We're computer security researchers at the University of Colorado, and we'd like your permission to try to break into your systems as part of your research. Plus, in exchange, we can help you harden your systems afterward." Would that really have been so difficult? Is that really so unreasonable, that they should ask permission beforehand? Bad guys trespass without permission - that's how we know they're bad guys. Good guys aren't supposed to do that too.

            • Apples and oranges (Score:2)

              by phorm ( 591458 ) on Monday October 11, 2004 @03:14PM (#10496047) Journal
              Serial-murder specialists don't have to kill scores of people to learn how serial killers operate

              People would be hurt

              Viral pathologists don't infect people with HIV so they can learn how to prevent AIDS

              People would be hurt

              this is absolutely unethical behavior on the part of these clowns, and in no way do the ends justify the means

              Tell me, how is anyone hurt if I were to find a security hole in a bank site, chess club, whatever, and post an email to said bank/club. The only one hurt would be me, mainly because I would probably have my ass sued off. Deaths by murder or HIV are quite often very obvious, a hacker sneaking into a computer and filing off $0.001/account/day isn't necessarily so. Yes, you can study existing hacks, but the fact is that it's the new and unusal ones that one should beware of... not quite as straightforward as many other cases.

              Oh, and for the record - scientists might not infect the general public with a virus to test it - but they will infect test animals/etc and try some "cures" on human volunteers. I don't suppose you'd like to try getting a bank to volunteer their codebase for you to test our in your closed environment?

              • Re:Apples and oranges (Score:2)

                by general_re ( 8883 ) on Monday October 11, 2004 @04:11PM (#10496684) Homepage
                Who is harmed if I break into your house while you're away, especially if I don't take anything or break anything? No one, obviously, so it must be okay, right?

                I don't think so. You are not permitted to treat someone else's property as your own without their permission, no matter how "harmless" you think it might be. It's not your call to make. Period.

                I don't suppose you'd like to try getting a bank to volunteer their codebase for you to test our in your closed environment?

                We didn't "volunteer" our code to people. We hired professionals, both as employees and as consultants to vet our stuff. Nor did we accept volunteer "consultants" - I assure you, the ICC webmaster was far more generous than my former employers would have been. If it were their systems and their call, the FBI would have been kicking down doors on the CU campus before the ink even dried on their "research paper"

          • Re:Forget white hat and black hat... (Score:2)

            by CountBrass ( 590228 ) on Monday October 11, 2004 @02:51AM (#10490786)
            Kill somebody, and what are the chances you'll notice the eyelash that conveniently fell out? You'd have to look for your own mistakes, while not utilising the information of how it was done at all for you to gain any skill, a...

            Yeah that must be the reason homicide detectives don't get their training by killing people. Moron.

        • Homicide detectives don't stop people from killing. They find out who did it after it's already happened.

        • Re:Forget white hat and black hat... (Score:1)

          by ryanmfw ( 774163 ) on Wednesday October 13, 2004 @06:13PM (#10518189)
          Maybe that's the reason for high crime! We don't have experienced detectives!

    • Re:Forget white hat and black hat... (Score:3, Insightful)

      by Tony-A ( 29931 ) on Sunday October 10, 2004 @11:25PM (#10489952)
      Assuming that they are fair to mediocre players and that their scores do not and will never matter, and they are comfortable with having their scores purged, and they do nothing to "help their buddies" or "hurt their enemies", I don't see anything that unethical about it.
      A lot depends on the target and any perceptions of conflict of interest. Even getting nosy about academic records is most likely taboo.

  • Stealing Passwords? (Score:5, Insightful)

    by still_sick ( 585332 ) on Sunday October 10, 2004 @06:06PM (#10488211)
    Kind of dick move, no?

    They proved their point by putting themselves high up in the ranks.

    A legitimate Research project should NOT have involved messing with other people's accounts.

    If you want to do that, have some person known to the researchers make up an account with the express purpose of their team trying to steal the password.

  • we should be able to mod stories (Score:3, Interesting)

    by Anonymous Coward on Sunday October 10, 2004 @06:07PM (#10488216)
    if we can mod stories as dupe, we can set the threshold high enough so we can never have to deal with idiot editors posting dupes again!!!

  • dupe duke nuker? (Score:5, Insightful)

    by gl4ss ( 559668 ) on Sunday October 10, 2004 @06:07PM (#10488217) Homepage Journal


    technically the story it links to is though new, but it's about an old thing.

    now.. about these dupes.. just one thing makes me wonder, do the editors have extremely bad memory or don't they follow slashdot at all themselfs? since in most cases a regular reader remembers if he has seen the same story(or one with a lot of resemblance) before. and hell, theoretically they should have more time than 20 secs per a story they pass, so they could have put "chess" into the old stories search.

    now, on things that need refreshing or something a 'follow-up' stories could be worth while doing, but not reporting them as totally new.

  • Slashdot fights evil (Score:5, Funny)

    by Timesprout ( 579035 ) on Sunday October 10, 2004 @06:07PM (#10488224)
    by influencing crackers to dupe [slashdot.org] their cracks, thus saving other organisations from their unwanted attention.

  • Heh (Score:5, Interesting)

    by FiReaNGeL ( 312636 ) <[fireang3l] [at] [hotmail.com]> on Sunday October 10, 2004 @06:10PM (#10488239) Homepage
    You don't have to give yourself all the trouble of defeating security to be a chess star on Internet. Just run a copy of fritz on another computer while you 'play'... instant skill!

    This is why is stopped playing online. Nothing beats a real game of chess, in front of a real person anyway. Reactions from your opponent are almost as important as in poker!

  • Ethical ramifications of this. (Score:4, Insightful)

    by mind21_98 ( 18647 ) on Sunday October 10, 2004 @06:10PM (#10488242) Homepage Journal
    A public institution funding cheating attempts is cause for concern. I assume they got the Internet Chess Club's permission beforehand, but if they didn't they could be in a world of trouble. Just my two cents.

  • Web Programmers (Score:4, Informative)

    by Jesus IS the Devil ( 317662 ) on Sunday October 10, 2004 @06:16PM (#10488283)
    I've seen way too many programmers who think they're the world's greatest gift to mankind, but don't know the FIRST RULE of developing web applications:

    NEVER TRUST USER INPUT

    This leads to stupid hacks like sql injection, html injection (leads to XSS), etc etc.

    Not saying this is how it happened, but I wouldn't be the least bit surprised if this is how it happened.

  • I wonder... (Score:5, Insightful)

    by Oligonicella ( 659917 ) on Sunday October 10, 2004 @06:16PM (#10488284)
    what the U of C's attitude would be toward someone who hacked into their computers to, you know, just experiment and gain knowledge? Maybe up their grades or look at other peoples information?

    Just wondering if the shoe fits the other foot.

    • Re:I wonder... (Score:2, Informative)

      by Vole_of_Wrath ( 789989 ) on Sunday October 10, 2004 @06:49PM (#10488466)
      As a student of University of Colorado, living in the dorms no less, CU is VERY uptight about their internet security. They have almost every port closed from the outside, and they dont let you access the internet without several dozen procedures to make sure your computer is safe. I'm not saying it isn't foolproof, but it's like Fort Knox :X

  • Ask Slashdot? (Score:2, Insightful)

    by comwiz56 ( 447651 ) <comwiz@@@gmail...com> on Sunday October 10, 2004 @06:19PM (#10488300) Homepage
    I think this belongs more as an ask slashdot, "What are the ethics of edu-hacking?"

  • Isn't this Illegal? (Score:3, Interesting)

    by Anonymous Coward on Sunday October 10, 2004 @06:21PM (#10488310)
    I don't see how this being done under the auspices of the school absolves the students from prosecution.

    Can anyone explain this to me?

  • Such an august list of members (Score:5, Funny)

    by cliffiecee ( 136220 ) on Sunday October 10, 2004 @06:32PM (#10488378) Homepage Journal
    Internet Chess Club has more than 30,000 members worldwide and claims Madonna, Nicolas Cage, Will Smith and Gary Kasparov as players.

    One of these things is not like the others,
    One of these things just doesn't belong,
    Can you tell which thing is not like the others
    By the time I finish my song?

  • YRO: Internet Chess Club Sues Colorado Researchers (Score:1)

    by psoriac ( 81188 ) on Sunday October 10, 2004 @06:54PM (#10488493)
    Posted by timothy on Monday October 12, @03:00PM
    from the came-back-and-bit-us-in-the-ass dept.
    someguy     writes "The 30,000-plus-member Internet Chess Club filed suit today against the University of Colorado at Boulder for encouraging students to hack their service as part of research funded by the National Science Foundation. With guidance from University of Colorado at Boulder computer security researcher John Black, two students were able to reverse-engineer the service to up their ranks and steal passwords."

    ( Read More... | 1 of 3 comments | yro.slashdot.org )

  • Bah (Score:1, Flamebait)

    by Trailwalker ( 648636 ) on Sunday October 10, 2004 @06:55PM (#10488497)
    A Chess Club?

    Tell them to come back after they have cracked one of the systems at Langley, Va.

    • Re:Bah (Score:1)

      by AlienRancher ( 734517 ) on Sunday October 10, 2004 @07:54PM (#10488835)
      They were looking for the blueprints for the weapons of mass distraction? TWF? Really. How secure you expect to be a chess club? I suggest they up the difficulty level. Next target: the Girl Scout cookies web server

      • Re:Bah (Score:3, Informative)

        by jnguy ( 683993 ) on Sunday October 10, 2004 @09:22PM (#10489286) Homepage
        A chess club where grandmasters play, and the general population has confidence in, I would imagine its fairly secure.

        • I don't really... (Score:2)

          by Kjella ( 173770 ) on Monday October 11, 2004 @05:48AM (#10491363) Homepage
          ...because their ratings on the website are well - if not irrelevant, but at best a confirmation. I have a belief in their skills because of their grandmaster ranking (as in, through tournament play), not because of their online rating. If that was the sole claim to their skill, I would be very doubtful. Tournaments of some importance, even over the internet is often done with a public audience and all that makes it very credible.

          Grandmasters could play on the most unsecure, untrusted of networks and it would do very little to them. As long as they get to play interesting games against worthy opponents, why should they care about some online ranking? They have their real ranking to show.

          Kjella

  • This is research? (Score:2, Insightful)

    by Anonymous Coward on Sunday October 10, 2004 @06:57PM (#10488509)
    The difference between this "research" and a felony is exactly what? Maybe the anthrax scare was really an NSF funded biological experiment?

    This is a complete waste of taxpayer money, and Dr. Black should have his grants revoked. In fact, I've been in the supposed "computer security" academic community, and it's mostly bogus crap masqueraded as "research" because people don't know better. Computer security research is the AI of our time.

    • Re:This is research? (Score:2)

      by Artifakt ( 700173 ) on Sunday October 10, 2004 @07:48PM (#10488810)
      Computer security research is the AI of our time.

      Yes, but AI is also still the AI of our time. So's 90% of Macroeconomics, 80% of Chaos Theory, and a whopping 103.8% of Nanaotech.

    • Re:This is research? (Score:1)

      by tq_at_sju ( 218880 ) on Sunday October 10, 2004 @09:26PM (#10489312) Homepage
      well the difference is obvious so what you're asking is a loaded question. Other people too have compared this to killing as a crime, which is also absurd.... It is what it is, maybe it's foolish to do, but it's not the same thing as an actual crime, because actual crimes and even actual crime's punishments are based on intent. They intended to use the information in an educational manner and they also intended to tell the chess club that they did it, they didn't intend to change madonna's account around so that every time she went pawn to rook 4 a wav of material girl played...wait a minute that's a good idea...

  • security (Score:3, Funny)

    by virtualone ( 768392 ) on Sunday October 10, 2004 @07:00PM (#10488525)
    From TFA - "Unless you have a lot of experience, don't try to invent your own security system, it will just be broken"

    instead, just bindly trust that handy cryphography API that came with your operating system
    - (c) by the NSA
  • You'd think they'd unlock the keys to the playboy/Penthouse site and gain gold membership or something, folks, but nooooo....it hadda be the Chess Club.

    To quote Homer's brain, That's it; I'm leaving.

  • Academic research reporting should be left... (Score:1, Informative)

    by Anonymous Coward on Sunday October 10, 2004 @08:10PM (#10488927)
    to academics and not institutions.

    In all fairness... after reading the original paper, I asked ICC if they are aware of the problem and directed me to their security help file. ICC did fix one problem regarding membership payments:

    http://www.chessclub.com/help/security

    "Question: Is my credit card secure at ICC?

    ICC has upgraded the way we process online payments. You can check out our new secure web payment forms at https://www.chessclub.com/store/members/payment.ph p

    When you access the web form, your browser shows a "locked padlock" icon that indicates your communication with ICC are encrypted and secure. ICC takes great care in protecting financial information. See help privacy for more information. In almost ten years of service, no member has ever lost a penny of their money because of poor security at ICC."

    Now if only someone could divulge Madonna's online name so all the chess geeks could finger her.

  • great news (Score:4, Funny)

    by Pierre ( 6251 ) on Sunday October 10, 2004 @09:01PM (#10489137)
    This is great! I forgot my password 6 months ago and I can't get anybody to reset it for me - I'll bet these guys have recovered it - woo hoo I can play chess again

  • ICC Security Improvements (Score:5, Informative)

    by gmacd997 ( 811854 ) on Sunday October 10, 2004 @10:03PM (#10489534)
    The Internet Chess Club (ICC) has taken steps to improve security since this paper was published.

    For details on the paper and ICC's response see the help file at:
    http://www.chessclub.com/help/blackpaper

    For details on how ICC protects user's security see:
    http://www.chessclub.com/help/security

    For details on how ICC protects user's privacy see:
    http://www.chessclub.com/help/privacy

    An excerpt from the /blackpaper help file:

    Question: What is ICC doing to improve security?

    ICC is doing three main things to improve security:

    1) ICC has changed our payment systems so that all online credit card payments go through secure web forms. You can check out our new secure web payment forms at https://www.chessclub.com/store/members/payment.ph p When you access the web form, your browser shows a 'locked padlock' icon that indicates your communication with ICC are encrypted and secure. ICC takes great care in protecting financial information. See http://www.chessclub.com/help/privacy for more information.

    2) ICC is updating Timestamp to close the cracks identified in the paper. This process will take some time to complete. As Black, Cochran, and Gardner show in their paper, getting Timestamp security right is a complex task. Ultimately, when we deploy a new version of Timestamp, ICC users will need to upgrade their chess client software to take advantage of the increased security.

    3) ICC is doing an internal security review. ICC is committed to keeping confidential data secure through upgrades to our servers and client programs. We are actively engaged in improving our current security mechanisms, while at the same time, devoting substantial resources to catching cheaters.

    ...

    If you have any questions or comments, you can ask a question in Channel 1, the Help Channel, send a message to ICC or send an email to icc@chessclub.com.

    Also, ICC is not suing anyone over the paper by John Black, Martin Cochran, and Ryan Gardner.

    George MacDonald
    General Manager
    Internet Chess Club

  • hacking the honor system... (Score:3, Insightful)

    by Vellmont ( 569020 ) on Sunday October 10, 2004 @11:07PM (#10489877) Homepage
    The article seems to exagerate the importance of this hack by talking about voting, credit card numbers, etc. But my question is how significant is this?

    How secure something needs to be depends on what it is you're protecting. In this case it's the legitimacy of a chess game played over the internet and ratings of individual players. Is their something at stake more than game fairness and an online chess rating? (prize money for example). The article mentions famous people are on the server, is Madonnas chess account being hacked supposed to make me feel scared?

    The problems should be fixed of course (if possible), but it sure seems like we're scraping the bottom of the security alert barrel on this one.

  • Since when does "news for nerds" (Score:2, Funny)

    by mark-t ( 151149 ) <markt AT nerdflat DOT com> on Monday October 11, 2004 @01:14AM (#10490367) Journal
    ... include coverage of people who have nothing better to do with their time than cheat at a board game?

Slashdot Top Deals

Reality must take precedence over public relations, for Mother Nature cannot be fooled. -- R.P. Feynman

Close