Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security Encryption Entertainment Games

Internet Chess Club Security Defeated 264

Posted by timothy from the global-thermonuclear-war dept.
Scott_F writes "Researchers at the University of Colorado at Boulder have been able to defeat the security mechanisms of the Internet Chess Club and can effectively play a zero-time match, as well as have complete control over the game. The paper is titled How to Cheat at Chess: A Security Analysis of the Internet Chess Club. If you're not familiar with the ICC, it is where many Grandmasters play regularly, with rumors of Bobby Fischer making an occasional appearance. It appears that the ICC has relied on security through obscurity, but we all know how poorly that works. Chess, anyone?" Update: 09/08 21:08 GMT by J : In totally unrelated chess news, I found today's commentary on Zermelo's Theorem interesting, both for the math of the game and the look at a mistaken echo chamber.
This discussion has been archived. No new comments can be posted.

Internet Chess Club Security Defeated More

Internet Chess Club Security Defeated

Comments Filter:

  • Greetings Dr. Falken (Score:5, Funny)

    by Anonymous Coward on Wednesday September 08, 2004 @04:42PM (#10194221)
    Shall we play a game?

    • Hackers games (Score:2, Interesting)

      by frakir ( 760204 )
      Authors of that analysis took really hard way to crack icc binary timestamp. Takes about 2 hours to get ICC java client, find java timeseal class and disassemble it. Same is true for FICS (freechess.org).
      Been there, done that (also once wrote a client app for both servers).

      While writing timestamp version with public/private key authentication would work against snooping CC numbers, lag info can always be altered with simpler means then cracking timestamp. For apps using local clock system calls can alwa

  • Obviously (Score:5, Funny)

    by rf0 ( 159958 ) <rghf@fsck.me.uk> on Wednesday September 08, 2004 @04:42PM (#10194227) Homepage
    Check Mate in 1 then..

    Rus
  • Checkmate.

    Doh! No Fair!

  • Security through obscurity.. (Score:4, Interesting)

    by Karamchand ( 607798 ) on Wednesday September 08, 2004 @04:45PM (#10194261)
    ..is not as bad as its reputation. Of course it is not enough and you should not rely solely on it. But it can be a helpful part of your whole security-plan. Read more in this interesting paper by Jay Beale [bastille-linux.org], the Lead Developer of the Bastille Linux Project.

    • Re:Security through obscurity.. (Score:5, Funny)

      by Mateito ( 746185 ) on Wednesday September 08, 2004 @04:48PM (#10194318) Homepage
      Security through obscurity is not as bad as its reputation.

      That's why I post to /. as AC.

    • yes obscurity will help.. but only if your other bits are sound.

      if you just trust that nobody will ever capture your packets and peek in you're totally screwed if the application relies on any security at all.

      (i'm taking that there was actual game logic on the end clients.. which I seriously must ask what the fuck for? the server could very well just ask which piece to move and where to and then check the validity of that move before doing it - what secutiry through obscurity would that need?)

      after all y

    • Re:Security through obscurity.. (Score:4, Interesting)

      by arvindn ( 542080 ) on Wednesday September 08, 2004 @05:46PM (#10195038) Homepage Journal
      Wrong. I've read Jay Beale's paper, and he argues that while "security implemented solely through obscurity is bad", obscurity can be a useful extra layer to improve security. But "security implemented solely through obscurity" is precisely what is happening in the ICC case, and a little reverse engineering renders the system completely defenseless. The theoretical reason why the reverse engg. was inevitable is the impossibility of obfuscating programs [weizmann.ac.il].

  • Summary of story (Score:5, Funny)

    by ricotest ( 807136 ) on Wednesday September 08, 2004 @04:45PM (#10194265)
    Chess club relies on security through obscurity; got cracked. Therefore security through obscurity sucks and its polar opposite, open source security, rules. Therefore open source rules. Therefore Linux rules. Therefore Microsoft sucks. Apple, we don't yet have an established opinion on.
    • Security through obscurity sucks just because it provides no security at all once everything is cracked. On the other side, security with cryptography/cyphers is mathematically proven to be safe. If Microsoft were to write its own or implement famous algorithms, I would be really happy, and wouldn't spit on them.

      • Re:Summary of story (Score:2, Insightful)

        by Anonymous Coward
        As they have done... LONG ago! The application of said algs are generally the users responsibility, as it is in UNIX.

        Most people find managing private keys to bee "way hard". Even if that management is nothing more that making sure you store a backup of the key offline in case your computer goes poof.

        Oh well for the world when lazy people are 99% of the people out there...

      • Re:Summary of story (Score:4, Insightful)

        by bunratty ( 545641 ) on Wednesday September 08, 2004 @06:04PM (#10195208)
        On the other side, security with cryptography/cyphers is mathematically proven to be safe.
        Can you point me to such a proof? A mathematical cryptographic system that can be decrypted in a reasonable amount of time, but is proven unable be cracked in a reasonable amount of time, would amount to a proof that P != NP. Then I can collect my $1000000!

    • Re:Summary of story (Score:2, Funny)

      by Anonymous Coward
      Chess club relies on security through obscurity

      First rule of chess club: Do NOT talk about chess club!
    • Apple, we don't yet have an established opinion on.

      Ooooooooooooooo, Shiny!

      KFG
  • as there are no referees to make wrong calls, and judges to give wrong scores.
    But, cheating is still possible with the help of latest technology. In an on board match, you could have some person watching your game and suggest moves after checking in a computer. This is more true of non Grandmaster games. Its almost impossible to do this in GrandMaster games as necessary precautions are taken.
    Now, in internet chess, cheating is even more likely to occur. It is very difficult to hold a fair tournament com

    • Re:Chess is the fairest games of all (Score:5, Insightful)

      by VendingMenace ( 613279 ) on Wednesday September 08, 2004 @04:58PM (#10194430)
      wouldn't this be the case for more than just chess? Such as checkers, chinese checkers, chineese chess, strategeo, risk, ect.

      (Dare i mention the infamous GO in a chess story?)

      While i am attempting to drop my karma like a rock, i would also add that chess is NOT the fairest of all games, becuase there is a definate difference/advantage depending on what color you are, and thus who goes first. A game in wich this is not the case (or it is compensated for would be even more fair. (here is where my karma takes nose dive :) ) GO is just such a game. The komi (points awarded to the player that goes second) helps eliminate this advantage. As such, i belive that GO is a fairer game.

      I should say that i am not trying to trash talk chess. I enjoy chess just as much as the next guy, and it is terrific game to play -- both for enjoyment and as mental excersise. Above, i was just trying to point out what i thought was wrong with the parent.

      • Re:Chess is the fairest games of all (Score:5, Insightful)

        by HeghmoH ( 13204 ) on Wednesday September 08, 2004 @05:08PM (#10194572) Homepage Journal
        There's an easy way to fix the unfairness in Chess. Play an even number of games, alternating sides, and see who comes out on top in the end. I think it's no coincidence that this is what's actually done in tournaments.
        • This is a good point, and i had thougth of that. But then to desribe chess as a fair game, a game of chess would actually have to consist of 2 games of chess. Thus, the base unit of play that one would have to partake in (in order to claim that one had played chess) would have to be 2 games.

          I am not sure that many people would agree with this boundry. That is, if you played a single game of chess, you would feel safe claiming that you had played a game of chess. If soemone came up to you and said, "No
      • Actually, this would be much more difficult with Go, as the best Go-playing AIs are not really better than the average player.
      • wouldn't this be the case for more than just chess? Such as checkers, chinese checkers, chineese chess, strategeo, risk, ect.

        (Dare i mention the infamous GO in a chess story?)

        I don't see how you could cheat in an online GO game at championship levels. I don't play, but as I understand it playbooks aren't helpful and the computer is no help (no known algorithm plays a good game).
      • The dice are too fickle. Fairness would involve reducing it to a pure strategy game. The dice and teh cards in Risk make it much less than pure strategy.
      • Actually it's an open question if chess is a fair game or not. You are actually making the implicity assumption that moving first is an advantage. There are games where going second is an advantage.

        Risk isn't a fair game, in the sense that it involves random elements, rather then purely skill. Checkers is probably a fair game, however, there are some varitions to it's standard rules.

        http://en.wikipedia.org/wiki/Solved_board_games [wikipedia.org]

        According to that page, reversi is just such a game.

        It's entirely

    • as there are no referees to make wrong calls, and judges to give wrong scores.

      Actually, tournaments have people called arbiters who assist the players and rule on any unclear cases or when the players disagree on something. And it's not uncommon that an arbiter makes a wrong call.

      But, cheating is still possible with the help of latest technology. In an on board match, you could have some person watching your game and suggest moves after checking in a computer. This is more true of non Grandmaster game

  • Would you like to play a game?

    Some of the top analytical and intuitive problem solvers in the world, and they can still get their credit cards hacked. Bravo.

    But why oh why couldn't the researchers have researched a hack on, say, Everquest? Thirty thousand startled and whiny chess players wouldn't be nearly as entertaining as three hundred thousand startled and whiny mob grinders.
  • Could somebody explain the meaning and significance of the term "zero-time match"?

    • Re:Zero-Time match? (Score:2, Informative)

      by Anonymous Coward
      Matches are timed, you have x minutes or seconds to complete your game, sometimes with an increment where after each move y seconds are added to your time remaining.

      A Zero-Time match would mean you've hacked the clock and your moves never take any time.

      • Re:Zero-Time match? (Score:3, Insightful)

        by phearlez ( 769961 )
        The article mentions, in fact, that the minimum 'charge' is 0.1 seconds even if the client returns '0' so an exactly 0 time match is impossible.

        Another poster's implied dismissal of low time games as 'smack-the-clock' speed chess seems to disregard what is implied in the article - that many people play low-time games because it's commonly believed that you cannot cheat on them. It's not what I think of as chess but if it's widely used for that reason this find is significant.

  • Just a thought (Score:3, Interesting)

    by phaetonic ( 621542 ) * on Wednesday September 08, 2004 @04:46PM (#10194288)
    Would Yahoo! Games be more secure than ICC? If so, why?
    • Yes. Because of the whole "you can't make it perfectly secure" thing. Thus, from the defender's point of view (ICC or Yahoo!), [cost of broken security] > [cost of implementing security], all is well. If, from the attacker's point of view, [reward of breaking security]
      A special case of this is the "don't run faster than the bear - run faster than the slowest guy you're with" - if the bear doesn't get anything to reward him (her?) for running past the slowest guy in order to get you, then he (she?)
    • I play Yahoo Towers, and once in a while you would come across some guy that played super fast, making perfect Yahoos, etc. Obviously a bot. Yah, there's cheating at Yahoo.

      Do I really care? No, I go play someone else.

  • Are the alternatives safer? (Score:3, Funny)

    by GMFTatsujin ( 239569 ) on Wednesday September 08, 2004 @04:46PM (#10194289) Homepage
    I'm always up for a nice game of global thermonuclear war...
  • There would be so many possible Sai jokes....

  • cheat at chess?? (Score:5, Funny)

    by spoonyfork ( 23307 ) <[moc.liamg] [ta] [krofynoops]> on Wednesday September 08, 2004 @04:47PM (#10194301) Journal
    Cheating at chess online?? Like how, an aimbot or something? It isn't like the other player isn't going to notice when your Queen bunnyhops across the board and headshots 4 pawns in a row without missing. Feh.
    • Cheating at chess online?? Like how, an aimbot or something? It isn't like the other player isn't going to notice when your Queen bunnyhops across the board and headshots 4 pawns in a row without missing

      Nah, it's nothing that obvious. The cheat takes away the fog of war, just like every 13-year-old bastard I play on battle.net : (

    • Re:cheat at chess?? (Score:3, Informative)

      by Daniel ( 1678 )
      Most serious chess games are played with a clock; this analysis shows how to rig the clock on ICC.

      Daniel

    • Re:cheat at chess?? (Score:5, Funny)

      by Mr. Bad Example ( 31092 ) on Wednesday September 08, 2004 @05:32PM (#10194837) Homepage
      That'd sure make chess more...interesting.

      White: (castles)

      Black: OMG WTF CAMPING L5M3R N00B

    • Re:cheat at chess?? (Score:4, Informative)

      by csritchie ( 631120 ) on Wednesday September 08, 2004 @05:33PM (#10194863) Homepage
      Cheating online at chess is much less sophisticated.

      1. Open chess program
      2. Input Opponent's move
      3. Chess program offers best possible countermove

      You never need to know why the move works, how it will help you win or even when mate is near. The program does it all...

      Of course online veterans can spot someone using a program fairly quickly. Some sites even try to discourage it by not letting you move your mouse off the app. If you do your opponent is notified and they can adjourn the game.

      Even then, all you would need is a laptop and some creative timing skills. But if you need to cheat at chess that badly, when it doesn't effect any legitimate rank you may have for the "traditional" clubs, you need are in desperate need of getting laid and should put away the computer...

  • Sufficient.. (Score:2, Insightful)

    by some2 ( 563218 ) *
    security protocol used between client and server provides sufficient security

    If two guys are playing and the game randomly changes, a review of the play list can confirm someone cheated. Therefore, they do have sufficient security. There is a big distinction between having sufficient security and being ultra-secure. You don't secure a pool with armed guards to prevent kids from falling in, you simply build a taller fence.

  • Ah ha! (Score:2, Funny)

    by jszep ( 220212 )
    That's how Deep Blue won...

  • Ha! (Score:5, Funny)

    by CGP314 ( 672613 ) <CGP@ColinGregor y P a lmer.net> on Wednesday September 08, 2004 @04:48PM (#10194319) Homepage
    At long last we have proof that Go [wikipedia.org] is better than Chess. Nobody compromised their server [pandanet.co.jp] : )

  • Can't believe it (Score:5, Funny)

    by Nick of NSTime ( 597712 ) on Wednesday September 08, 2004 @04:49PM (#10194343)
    Wait, an online chess club doesn't have a good defence? Their server has an opening? The whole web site is one big gambit?
  • The password was "JOSHUA".

  • The Real Challenge (Score:4, Interesting)

    by randall_burns ( 108052 ) <randall_burns@@@hotmail...com> on Wednesday September 08, 2004 @04:50PM (#10194348)
    Is creating a _really_ secure equivalent of the internet chess club. I see this as a serious opportunity for an open source team to demonstrate how they can do security _right_.

    I can imagine that it _would_ be possible to do some really intersting things that would make remote matches _much_ harder to cheat at(i.e. do things like authenticate who is observing each of the remote players).

    • Re:The Real Challenge (Score:5, Informative)

      by Scarblac ( 122480 ) <slashdot@gerlich.nl> on Wednesday September 08, 2004 @05:36PM (#10194902) Homepage

      Is creating a _really_ secure equivalent of the internet chess club. I see this as a serious opportunity for an open source team to demonstrate how they can do security _right_.

      Short history, from memory: Way way back, there was only ICS, the Internet chess server. In 1995, it was turned into the commercial server ICC, the Internet Chess Club, which is still around and going strong. It's closed source and costs money unless you're a grandmaster.

      As a protest to this, FICS, the Free ICS was started. It is, to this day, free "as in beer" (if for a moment we assume that beer is free of charge). It used to be Free as in GPL and avilable from the FTP site.

      However, after others downloaded the Free code and started their own commercial servers with it (and they don't have to distribute their own changes under the GPL, since the software isn't distributed at all, it only runs the server), the code was closed as the developers didn't like working for free for a commercial server. I believe that server was Chess.net.

      Later, FICS new main developer recoded all of FICS, so that none of the GPL code remained - or so he claimed when he sold a copy to a company named GamesParlour during the Internet boom, under some license other than the GPL. He also worked for them for a while. Endless FICS flamewars ensued. There is actually a reasonable chance that his claim is true, since he's been the sole developer for many years now.

      Anyway, some people thought this was reason enough to start a new, open source chess server. The one I know of is chessd [sf.net]. I have no idea about its status.

      To this day, FICS is still the best place to play chess for free for non-GMs, while talking about AI in the religion channel and politics in the politics channel, and everything else in ch 50.

      Oh, and keeping track of time client side, and sending the times to ICC is done there with a utility called "timestamp". On FICS, the equivalent is called "timeseal", and I would be really really surprised if it wasn't at least as vulnerable. I believe there is actually some exploit in the wild. Not many people care though.

      (I'm ElOso on FICS.)

  • No HTML version. :( (Score:3, Funny)

    by caluml ( 551744 ) <slashdot@spamgoe ... minus herbivore> on Wednesday September 08, 2004 @04:50PM (#10194349) Homepage
    Why no HTML version? Grrr.

  • Adds a whole new meaning... (Score:3, Funny)

    by Mateito ( 746185 ) on Wednesday September 08, 2004 @04:51PM (#10194359) Homepage
    This adds a whole new meaning to

    "y3r p4wn i5 0wn3d!!!"

  • Legality? (Score:3, Interesting)

    by maximilln ( 654768 ) on Wednesday September 08, 2004 @04:53PM (#10194380) Homepage Journal
    I'm all for it, but...

    Was this legal?

    Aren't there local, state, federal, and international laws against exposing the vulnerability of a private system? Haven't many people already been harassed by the FBI for doing much the same thing with corporate systems? Or do these people get a free pass because they're from a University?

  • Bobby Fischer in the ICC ? (Score:3, Informative)

    by rainer_d ( 115765 ) on Wednesday September 08, 2004 @04:55PM (#10194401) Homepage
    Well, not currently. He's detained [voanews.com] in Japan and has just fought of (temporarily) his deportation to the US.
    Bobby Fischer certainly has a very interesting and complex personality....

    Rainer

  • What happened exactly? (Score:5, Insightful)

    by Old Wolf ( 56093 ) on Wednesday September 08, 2004 @04:59PM (#10194459)
    ICC's game security relies on a program called 'timestamp' that accurately records how much time you used for the move (so that players with more internet latency than others don't get penalised).
    This timestamp program is not open source but they publish a binary version for various operating systems.
    It sounds as if someone has hacked this (ie. so you can tell it that your move took 0.1 seconds -- the server deliberately does not allow moves to be faster than 0.1 seconds). If you have ever played a timed chess game (especially, one with short times, eg. 1 minute per game), you will know that this represents a huge advantage.

    I don't know what the article means about "complete control over the game", the server does not allow illegal moves etc. -- unless they have somehow hacked into the server, or managed to insert packets into the TCP/IP connections between the server and the opponent (which would be a problem with FreeBSD or the opponent's OS).

    Also the article mentions 'network security protocol', which is odd given that you can play games there by a plain telnet connection (telnet to chessclub.com:23 or chessclub.com:5080) or any 3rd party clients with no security.

    The Windows client software supplied by ICC includes some un-documented security to validate itself (ie. let the server know you are using this piece of software and not a 3rd-party client), this is useful for detecting if people are trying to cheat by getting a chess-playing program to automatically play their moves for them.

    And finally, I fear that a "robustification" of timestamp, to use accepted open security mechanisms, would end up in greater lag for the players -- either due to greater packet sizes, or greater processing power required by the client or the server (which has to do this for 4000+ connections at once), which is a pity (even 20ms is noticeable in a speed game of chess).

    Anyone have more information?

    • Re:What happened exactly? (Score:5, Informative)

      by 14erCleaner ( 745600 ) <FourteenerCleaner@yahoo.com> on Wednesday September 08, 2004 @05:10PM (#10194599) Homepage Journal
      Anyone have more information?

      You could read the actual paper, but this is Slashdot, after all...

      Yes, they hacked the Linux version of the timestamp client to send zero move times. They also reverse-engineered the timestamp protocol.

      Security is an issue because they're exchanging passwords and credit-card numbers with the client. The authors were able to crack the "encryption" being used to transmit this stuff (a 100-byte one-time pad) by sniffing only 10 bytes (it was a very predictable sequence). The client and server also exchange two 64-bit keys in the open when the session is opened, which are used to generate the 100-byte pad.

      • If it's a predictable sequence, then it's not a one time pad.

        An OTP needs to be only used once, and to be completely random. Besides, it can't be generated in place. I wrote a small chat program that used an OTP once.

        The way you do it is to use some good random number generator, such as /dev/hwrandom on boards that support it, wait until enough data has accumulated, and send a copy to the person you want to talk to. Then you need some kind of protocol to agree on which part of the file you're using.
        • There is nothing saying an OTP HAS to be random, it just has to be used only once. You can use any series of characters, including 'aaaaaaa'. Of course if you do that then you are a fool, but chess experts are often considered fools, just highly intelligent fools, which are the best kind.

          This has made me want a good game of chess, i was never as good as I'd like, but I did enjoy it. If only the computer would let me win occassionally, it is very hard on my ego.

          • Well, the concept of an OTP always has "truly random" mentioned somewhere in it. It's because the whole thing works on the idea that by adding truly random noise to a message produces something that looks like more noise.
    • (-5 Lame, for replying to my own post)

      Having read the researcher's paper more fully: there are two "network security protocol"s in question:
      1) 'timestamp' encrypts its messages to prevent tampering; this is obviously useless if you have already reverse-engineered the timestamp program
      2) the Windows client uses some weak security to identify itself and allow credit-card processing.

      Obviously the solution to (2) is, as the researchers suggest, only allowing credit card by a secure web-based system (which are

  • Security Rule # 1 (Score:5, Funny)

    by UrgleHoth ( 50415 ) on Wednesday September 08, 2004 @05:00PM (#10194463) Homepage
    The first rule of Chess Club is - you do not talk about Chess Club.

  • Security through obscurity meme... (Score:3, Insightful)

    by Alomex ( 148003 ) on Wednesday September 08, 2004 @05:00PM (#10194473) Homepage
    The RSA company created the "security through obscurity is useless" meme as a way to sell their product (public key cryptosystems).

    However, in reality all security is through obscurity. For one you need to keep the (private) key secret.

    In practice, good security is composed of several layers, one of which should be obscurity. For example, you might RSA/ssh restrict access to a host, but it still pays to (a) not advertise its existence (b) make it insconpicuous (c) close logins to an account after more than three failed attempts (d) keep the communication protocol secret (e) place a good lock on the door to the computer room (f) not write the password on a post it note and place it in your drawer (g) ... you get the idea.

    Notice how many of those listed above derive security from obscurity in practical, effective ways.

    • Re:Security through obscurity meme... (Score:5, Insightful)

      by HeghmoH ( 13204 ) on Wednesday September 08, 2004 @05:35PM (#10194891) Homepage Journal
      However, in reality all security is through obscurity. For one you need to keep the (private) key secret.

      That is not what "security through obscurity" means. The term refers to keep things other than the key secret, such as the algorithm, the magic key combination needed to get the password prompt, etc.
    • Don't let the fact that Auguste Kerckhoffs came up with the principle in the 1880s interfere with your "RSA made it up to make money" FUD.

      • Kerckhoffs might have been the first to say it, but in practice nobody paid attention until PKC became a reality. Don't believe me? Look at the Enigma and DES, both of which used security through obscurity (in the case of the enigma, the entire encrypting device was secret, in DES the content of the S-boxes was classified).

    • But that's not what security by obscurity is.

      Security by obscurity means the security of your system depends on its implementation being secret. Say, some program claiming to be secure that sends "encrypted" data by XOR'ing it with the string "password" which is fixed. Same goes for a chat server I reverse-engineered which tried to make it difficult to write different clients by sending you a number, and requiring you to apply some math on it and send it back. As soon as somebody decompiled it, the math th
  • What is it with chess playing computers using security through obscurity? First a high school kid breaks into the chess playing WOPR by guessing the password, Joshua, deceased son of programmer Dr. Falcon, now this? Next thing you know someone is going to post an article about how some kids figured out how to make free phone calls by shorting a payphone handset with a cola can tab, a cptn. crunch wistle, and a 6.5536Mhz crystal.

  • Cheating through outside programs (Score:3, Insightful)

    by Deliveranc3 ( 629997 ) <deliverance@level4 . o rg> on Wednesday September 08, 2004 @05:05PM (#10194539) Journal
    In chess on Yahoo many of the top players use a chess program it's really simple:
    set it to super hard
    move as your oponent
    lose to computer you win.

    In FPS' Anyone who's been to a lan cafe has seen screen watching but it's little brother talking on the phone or using a voice comm program to communicate with teamates (while alive and dead).

    The worst part about cheats like these is that the cheater doesn't think they are cheating, if you ask they won't know what you are talking about.

    It's fine in matches where both teams are doing it but in public servers it's definitly cheating, in some games like quake or CS(With death cams it's kind of a problem it's not always obvious but in games that rely heavily on knowledge such as raven shield knowing where your teamate was shot from after he dies can be decisive.

    Please people if you have access to information your opponents cannot possibly have access to consider what you are doing to the game.

    I like things like death cams and teamwork but I'd have to take steps against this kind of thing if I was running a server, though usually the people running servers are the worst offenders, Ventrillo anyone?
  • aka... Him throw punch, you no be there.
  • Next week I'll be publishing a paper about my neighbor's house, entitled "How to Get Free Jewelry: A Security Analysis of the Robinson Estate". I'll be posting this paper on all the telephone poles in the neighborhood.

    It seems as though the Robinsons, who live down the street from me, relied on security through obscurity. I guess they were asking for it! I sure am doing them a favor by exposing this vulnerability.

  • Hmm (Score:3, Funny)

    by Dirtside ( 91468 ) on Wednesday September 08, 2004 @05:15PM (#10194649) Journal
    Looks like the only winning move is not to play.
  • Honestly this paper sounds a bit childish. It seems as if the write is either very proud of himself or very unhappy with ICC. It seems that reasonable efforts were made for security though not wonderful. The server should compare calculated network lag to tracrt network lag, and should remove the symbols, but there is only so much you can do to keep someone from reverse engineering a small binary. The 64 bit seed seems to need an asymetrical encryption, but really what else is needed? And is there a HU

  • FICS (Score:4, Interesting)

    by bcrowell ( 177657 ) on Wednesday September 08, 2004 @05:23PM (#10194732) Homepage
    FICS [freechess.org] is better than ICC anway. FICS is free. ICC makes you pay.

  • Integrated timestamping (Score:5, Informative)

    by SashaM ( 520334 ) <msasha.gmail@com> on Wednesday September 08, 2004 @05:27PM (#10194772) Homepage

    The article says that no unix chess client comes with integrated timestamping, which is a good reason to plug mine - Jin [jinchess.com], which does.

    Also, I'm an ICC admin [chessclub.com] and I can tell you that we're looking into the issue and will probably publish an official response later.

  • It was possible to win a game just by refreshing the board so much that the opponent's timer ran out. Later the ICC had timestamping which should reduce effects of net lag.
  • The pink elephant overlooked in this discussion is that cheating in online chess is trivial anyway - just let Fritz make the moves for you and you win every time (except, perhaps, against Kasparov and, of course, other cheaters).

    So, no point in reverse engineering the client and cracking the protocol just to fake some latency in order to gain some extra seconds. Which only help in blitz games anyway. Which are a lot more fun to play offline anyway.

  • Check and checkmate. :) If they relied on security through obscurity, they got what they asked for.

  • Heard the talk (Score:3)

    by arvindn ( 542080 ) on Wednesday September 08, 2004 @05:38PM (#10194932) Homepage Journal
    John Black (first author) presented this at the Crypto 2004 [iacr.org] rump session. It was a fantastic talk, and I was fortunate to be there.

    In general the timestamping problem is clearly an insoluble one, because the server has no way to tell if the human took only as much time to think as the client software claims. Obfuscation is a stopgap solution that deters the casual attacker, but there is no cryptographic solution apart from "trusted" hardware (yikes).

    The way the music/movie industry has tackled the problem is to go on the offensive and call everyone a criminal. Let's see what the ICC does.

  • There are several new stories today about Bobby Fischer winning a deportation injunction [guardian.co.uk] in Japan.
  • So when is PunkBuster going to come out with a new version that supports all the popular chess clients?

  • "Since rearchitecting the Internet is both infeasible and falls short of a full solution (...)"

    I couldn't agree more.

  • "Queen takes Bishop"

Slashdot Top Deals

If all else fails, lower your standards.

Close