Cereus Security Alert!

[liladypokerpro]

***First let me say that this is copied and pasted from another site (which I cannot name due to conflict of interests).***

CEREUS SECURITY ALERT READ THIS NOW

This is quoted from a news/">poker news source:

AP/UB is again discovered to have another serious flaw:

Poker players investigating Cereus? This time around it's a confirmed security hole on the network uncovered by PokerTableRatings.

The Cereus Network took one on the chin this week, with news of a potentially serious security flaw that would allow intruders access to user's accounts and the contents of their hole cards.

There have been, at this point, no confirmed cases of the exploit being used to hack a user's account for any purposes. That said, the general sense is that playing on the network until a solution has been found, especially on a public connection, is ill-advised.
News of the leak first appeared yesterday on PokerTableRatings.

Here's the summary provided by PTR:

In summary, there is a critical vulnerability in the Cereus Network software which makes it possible for an attacker to hijack poker accounts and view hole cards. The only 100% protection is to stop playing on Cereus Network until they upgrade to using SSL. To our knowledge there are no cases of this vulnerability being used to exploit actual players. http://PokerTableRatings.com created test accounts for all proof of concept testing done during the discovery of this vulnerability. We do not have passwords to any unauthorized user accounts. The Cereus Network has been notified of this vulnerability. We will continue to report on this as it develops.

If you're wondering exactly how vulnerable you might be, the basic relationship is that the more public and unsecured your connection is, the more vulnerable you are. If you're playing on a public connection (think shared wireless in a dorm), you're at the riskier end of the scale; if you're connected directly to your network via ye ole ethernet cable, then you're about as safe as you can be.

Cereus has acknowledged the issue, with a response sent to PTR from Paul Leggett
(COO of Cereus parent company Tokwiro Enterprises):

We really truly appreciate the email you have sent us regarding the vulnerability in our encryption. I just became aware of your article 30 minutes ago and I have read your article and watched the video. I think you have done a great thing for the poker community by emailing us and letting the community know about it. Thank you for that.
I would also like to express how seriously we take this issue. I'm expecting to have a solution in place in a matter of hours and I would really like to discuss engaging your company to help us test the solution, if your company provides such services.
I would greatly appreciate it, if you could paste the contents of this email on your website, so your followers are assured that we are aware of the issue and we are working diligently to address it.

I would also like to emphasize to your readers that this issue would require someone to have access to their local network and also have the technical capabilities to crack our encryption in order to gain access to the player data and see the clear text like you did in your demonstration.

Again, I greatly appreciate you notifying us and the poker community and we will investigate this fully and completely and fix the problem immediately.

Regards,
Paul Leggett
COO, Tokwiro Enterprises

A day after the response, there's no update from PTR or Cereus regarding a solution; we'll keep you posted as the story develops.

There is a video posted on YouTube explaining how the leak works.

[liladypokerpro]

Another news break for the AP/UB players, but things are looking better:

The chief operating officer of the CEREUS network announced today that a security patch fixed the security hole found at AP and http://UB.com, only to be informed later in the day that the patch didn't fully work.

If you haven't been following the news of late, here's what happened so far:

Last week, online poker data site PokerTableRatings announced that they had uncovered a flaw in Cereus' security that could allow third parties to compromise player accounts, giving hackers access to funds, information and hole card data. Other than PTR's announcement of the discovery, there's been no known hacks that have exploited this flaw, yet.

Fast forward today, when Paul Leggett, COO for Cereus, made this post at http://UB.com's blog:

"We have released a new version of the CEREUS Poker Network software this morning. This software update includes the implementation of Open SSL encryption for all Client-Server communication.

We have done thorough testing on the release and everything is working as it was designed. We are now engaging several third parties to test the new Client-Server encryption. I will update you soon regarding which third parties we will be engaging for the testing and with more details about security."

-Paul Leggett

However, PokerTableRatings announced that the security hole still existed, or at least that it didn't fix all the problems that existed. PTR posted the following:

"The update seems to use OpenSSL ONLY for player actions such as hole cards, bets, etc - we have already been able to hijack a test poker account using the exact same methods."

The patch apparently worked for everything except for hijacking poker accounts' login information. The newest patch made it impossible to see other players' hole cards, using the security hole.

That prompted Leggett to make this addition to the blog post:

"UPDATE: PokerTableRatings identified an issue with our Open SSL implementation that we are working on now. They have confirmed that all card data is now using Open SSL encryption. However, we still need to convert one more peice of data to use the new Open SSL encryption. We expect to have it fixed before the end of the day."

We'll have more updates as news breaks, but it appears that it will be safe to play at Cereus rooms again, soon.

[rachelle]

Never have we seen/heard of a poker room with such security flaws - Makes you wonder why people stay play at AB and UB - unless they give me free money I stopped playing there a looooooong time ago =) - gl to all the players that likes playing on those sites....

[grimReaper]

I barely trust having money on FTP and PokerStars, why would anyone bother to put money elsewhere.