ABSTRACT:
Poker is card game that many people around the world enjoy. Poker is played at kitchen tables, in casinos and cardrooms, and, recently, on the Web. A few of us here at Reliable Software Technologies play poker. Since many of us spend a good amount of time on-line, it was only a matter of time before some of us put the two interests together. This is the story of how our interests in online poker and software security mixed to create a spectacular security exploit.

The PlanetPoker Internet cardroom offers real-time Texas Hold'em games against other people on the Web for real money. Being software professionals who help companies deliver secure, reliable, and robust software, we were curious about the software behind the online game. How did it work? Was it fair? An examination of the FAQs at PlanetPoker, including the shuffling algorithm (which was ironically published to help demonstrate the game's integrity), was enough to start our analysis wheels rolling. As soon as we saw the shuffling algorithm, we began to suspect there might be a problem. A little investigation proved this intuition correct.