Incident: Online Poker Scam: Spyware Cheats Players, Affects PokerStars and Full Tilt Poker

Published Date: 2015-09-17

Postmortem Analysis
Timeline 1. The software failure incident of the online poker scam using the Win32/Spy.Odlanor spyware happened in March 2015 as mentioned in the article [51600].
System 1. Win32/Spy.Odlanor spyware 2. PokerStars and Full Tilt Poker online poker sites 3. Various poker-related programs such as Tournament Shark, Poker Calculator Pro, Smart Buddy, Poker Office, etc. [51600]
Responsible Organization 1. Hackers using malicious spyware were responsible for causing the software failure incident reported in the article [51600].
Impacted Organization 1. Gamblers using online poker sites such as PokerStars and Full Tilt Poker were impacted by the software failure incident [51600].
Software Causes 1. The software cause of the failure incident was the presence of malicious spyware named Win32/Spy.Odlanor, which was used by hackers to cheat in online poker games by capturing screenshots of the victim's virtual poker hand on popular gambling sites [51600].
Non-software Causes 1. Criminal activity by hackers who exploited the vulnerability to cheat in online poker games [51600].
Impacts 1. The software failure incident led to criminals being able to cheat their way to winning games on popular gambling sites by using spyware to view players' virtual poker hands and bet against them, ultimately stealing their money [51600].
Preventions 1. Implementing multi-factor authentication for online poker accounts could have prevented unauthorized access even if the spyware was installed on a user's computer [51600]. 2. Regularly updating and patching the online poker software to fix vulnerabilities that could be exploited by malware like Win32/Spy.Odlanor [51600]. 3. Educating users about the risks of downloading and installing software from untrusted sources to prevent unwitting installation of malware [51600].
Fixes 1. Updating anti-virus software and regularly scanning for malicious files could help prevent the installation of the spyware [51600].
References 1. Security experts at Eset [51600]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident related to the online poker scam involving the Win32/Spy.Odlanor spyware has affected multiple users on popular gambling sites like PokerStars and Full Tilt Poker [51600]. The incident has been observed to have impacted several hundred users, with the malware being detected in Eastern European countries such as the Czech Republic, Poland, and Hungary [51600]. (b) The incident involving the Win32/Spy.Odlanor spyware targeting online poker players has not been specifically mentioned to have occurred at other organizations or with their products and services in the provided article [51600].
Phase (Design/Operation) design, operation (a) The software failure incident in the article is related to the design phase. The incident occurred due to the development and deployment of malicious spyware named Win32/Spy.Odlanor, which was used to cheat in online poker games by capturing screenshots of players' hands and player IDs on popular gambling sites like PokerStars and Full Tilt Poker. The spyware was installed on victims' computers through infected apps or software online, including poker-related programs like Tournament Shark, Poker Calculator Pro, Smart Buddy, and others. This design flaw in the spyware allowed hackers to gain an unfair advantage in the games by viewing opponents' hands and IDs [51600]. (b) The software failure incident is also related to the operation phase. The spyware, once installed on a victim's computer, operated by capturing screenshots of the windows of the targeted poker clients (PokerStars or Full Tilt Poker) and sending them to the attacker's remote computer. This operation allowed the hackers to not only see the hands of the infected opponents but also their player IDs, making it easy for them to connect to the tables where the victims were playing. The operation of the spyware facilitated the cheating scheme by providing real-time information to the hackers during the online poker games [51600].
Boundary (Internal/External) within_system (a) within_system: The software failure incident described in the articles is primarily within the system. The failure occurred due to the installation of malicious spyware (Win32/Spy.Odlanor) on users' computers, which then allowed hackers to capture screenshots of the victim's poker hand and player ID while playing on popular gambling sites like PokerStars and Full Tilt Poker [51600]. The spyware was loaded onto victims' systems through various poker-related programs or disguised as installers for other software, indicating that the failure originated from within the system itself.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in this case is primarily due to non-human actions, specifically the use of malicious spyware named Win32/Spy.Odlanor. The spyware is designed to create screenshots of the windows of popular poker sites being used by the victim, revealing their hands and player ID. These screenshots are then sent to the attacker's remote computer, allowing them to cheat in online poker games without direct human involvement [51600]. (b) However, human actions also play a role in this software failure incident. The spyware can be unwittingly installed on a computer if the user downloads infected apps or software online. In some cases, the spyware was loaded onto the victim's system through poker-related programs like Tournament Shark, Poker Calculator Pro, Smart Buddy, and Poker Office. Therefore, human actions such as downloading infected software contribute to the spread of the malware [51600].
Dimension (Hardware/Software) software (a) The software failure incident related to hardware: - The software failure incident in the article is not directly attributed to hardware issues. The incident involves hackers using spyware to cheat in online poker games by capturing screenshots of the victim's poker hand and player ID [51600]. (b) The software failure incident related to software: - The software failure incident in the article is primarily due to malicious spyware named Win32/Spy.Odlanor, which is installed on users' computers through infected apps or software online. This spyware captures screenshots of the victim's poker hand and player ID, allowing hackers to cheat in online poker games [51600].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the articles is malicious in nature. Hackers used malicious spyware named Win32/Spy.Odlanor to cheat in online poker games by capturing screenshots of players' hands and player IDs on popular gambling sites like PokerStars and Full Tilt Poker. The spyware allowed the attackers to gain an unfair advantage over their victims and steal their money by betting against them in the same game [51600].
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident described in Article 51600 was primarily driven by poor decisions made by hackers who developed and deployed the malicious spyware Win32/Spy.Odlanor to cheat in online poker games. The hackers used the spyware to capture screenshots of players' hands and player IDs on popular gambling sites like PokerStars and Full Tilt Poker. This allowed them to gain an unfair advantage by betting against their victims and stealing their money. The decision to create and distribute this spyware was a deliberate and unethical choice made by the perpetrators, leading to a significant software failure incident [51600].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident in the article can be attributed to development incompetence. The incident involved hackers using spyware named Win32/Spy.Odlanor to cheat in online poker games by viewing players' hands and player IDs on popular gambling sites like PokerStars and Full Tilt Poker. The spyware was installed on victims' computers through infected apps or software, including poker-related programs like Tournament Shark, Poker Calculator Pro, Smart Buddy, and Poker Office. This incident highlights the lack of professional competence in ensuring the security and integrity of online gaming platforms [51600]. (b) The software failure incident can also be categorized as accidental. Users unwittingly installed the spyware on their computers by downloading infected apps or software online, indicating that the introduction of the malicious software was accidental on the part of the victims. Additionally, the malware was disguised as installers for various legitimate programs, further contributing to the accidental nature of its installation [51600].
Duration permanent (a) The software failure incident described in the articles is more of a permanent nature. The incident involves hackers using malicious spyware named Win32/Spy.Odlanor to cheat in online poker games by viewing players' hands and player IDs on popular gambling sites like PokerStars and Full Tilt Poker. The spyware creates screenshots of the targeted poker clients' windows, allowing the attackers to gain an unfair advantage over their victims. The malware has been observed in the wild since March 2015, with several hundred users infected by it as of September 16, according to Eset security experts [51600]. This type of software failure, where the spyware continues to operate and pose a threat to online poker players, falls under the category of a permanent failure.
Behaviour value, other (a) crash: The software failure incident in the article is not related to a crash where the system loses state and does not perform any of its intended functions. The incident involves spyware being used to cheat in online poker games rather than a system crash [51600]. (b) omission: The software failure incident does not involve the system omitting to perform its intended functions at an instance(s). Instead, the spyware is actively used to capture screenshots of the victim's poker hand and player ID to cheat in the game [51600]. (c) timing: The software failure incident is not related to the system performing its intended functions correctly but too late or too early. The spyware used in the incident captures real-time information from the victim's poker game to cheat, indicating that the timing of the system's actions is aligned with the cheating scheme [51600]. (d) value: The software failure incident is related to the system performing its intended functions incorrectly. The spyware, Win32/Spy.Odlanor, is designed to capture and transmit screenshots of the victim's poker hand and player ID to the attacker, allowing them to cheat in the game by having access to privileged information [51600]. (e) byzantine: The software failure incident does not involve the system behaving erroneously with inconsistent responses and interactions, which would align with a byzantine failure. The spyware in this incident operates consistently to capture and transmit specific information to facilitate cheating in online poker games [51600]. (f) other: The behavior of the software failure incident in the article can be categorized as unauthorized access and exploitation of system vulnerabilities. The spyware, disguised as various legitimate programs, infiltrates the victim's system to capture sensitive information and enable cheating in online poker games. This behavior falls under the category of malicious exploitation rather than a traditional software failure mode [51600].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident described in the articles led to a significant impact on people's property, specifically their money. Hackers used malicious spyware to cheat in online poker games, allowing them to up the stakes and steal money from unsuspecting victims [51600]. The spyware, named Win32/Spy.Odlanor, was used to create screenshots of the victim's poker hand and player ID, enabling the hackers to connect to the tables the victim was playing on and exploit the information for financial gain [51600]. As a result, several hundred users were infected with this malware, leading to potential financial losses for the victims [51600].
Domain entertainment (a) The software failure incident reported in the articles is related to the entertainment industry, specifically online poker gambling sites like PokerStars and Full Tilt Poker [51600]. The incident involved hackers using spyware to cheat players out of their money by gaining access to their virtual poker hands and player IDs on these popular gambling platforms.

Sources

Back to List