Amigotechs Online Gaming Solutions Warning

On January 5, 2012, Certified Fair Gambling (CFG) was contacted by management at Youwager to investigate a complaint that a player had about 50-play Jacks or Better video poker (JOB50) offered at their casino. Youwager informed me that they use the online casino software package created and licensed by Amigotechs.

The player at Youwager claimed that while playing JOB50, in those situations where he held draw hands (a flush draw, a straight
draw, high cards, low pair, 5 new cards), he did not make a hand of Jacks or Better on any of his 50 completed hands. He also
claimed that in those situations when he held a made hand and drew cards (a high pair, two pair or trips), he did not improve
that hand on any of his 50 hands.

Youwager was cooperative in providing all necessary log files, providing two test accounts, giving information about system
implementation, and answering all other questions. Upon request, I was provided with log files giving play for certain players
on JOB50 for the period August 4, 2011 through December 27, 2011. These log files detailed the date and time the game was
played, the initial cards dealt to the player, the cards the player held, and the replacement cards for each of the hands. In
total, 922 hands of JOB50 were provided in these log files.

Unfortunately, the log files for each hand were cut short and did not contain all 50 completions. Typically, they contained
from 37 to 39 completions. I investigated the reason the log files were truncated, but was unable to arrive at a wholly
satisfactory conclusion.

Based on my examination of the log files, I determined that the complaint had merit and that the software operated in a manner
that was unfair to the player. My conclusions follow.

• During the period December 16, 2011 to December 27, 2011, if the player had a drawing hand then he did not improve to
  Jacks or better in any of the hands given in the log file. Thus the player’s claim that draw hands did not improve was found to
  be true.
• During the period December 16, 2011 to December 27, 2011, the player’s claim that made hands did not improve was found
  to be false.
• Based on a random sampling of hands, the software operated correctly during the period August 4, 2011 to December 15,
  2011.

To be more specific, a total of 25 hands of JOB50 were present in the log files for the period December 16, 2011 to December
27, 2011. Of those 25 hands, 6 were made hands and 19 were draw hands. The 19 draw hands never improved to a pair of Jacks or better. Of the 6 made hands, 3 were a high pair and 3 were two-pair. In the case of the high pair, each improved at least once
when the replacement cards were dealt. In the case of the two-pair hands, one of them improved and two did not.

The drawing hands, the cards the player held, and the number of valid log file entries are given in the following table:

Cards Dealt	Cards Held	Hands available in log file
AS,3D,KD,4C,TD	AS,KD	37
6S,QH,7H,9H,4H	QH,7H,9H,4H	39
8C,3D,AS,6D,QD	AS,QD	37
3H,8D,4H,9H,2D	None	39
KS,6D,2D,9C,JS	KS,JS	39
3C,4C,9H,8C,4S	4C,4S	39
3H,QD,TC,6H,KC	QD,KC	38
8S,9C,QC,2C,6D	QC	39
3S,3C,2D,6C,4H	3S,3C	39
2D,TH,2H,JD,6C	2D,2H	37
7S,2D,5S,QD,8H	QD	37
9C,3H,TH,4D,JD	JD	37
3S,6H,JH,5H,QD	JH,QD	37
6D,AH,JD,KH,4C	AH,KH	39
3S,JD,9H,AH,5D	AH,JD	38
5D,7H,8H,3C,QS	QS	39
2D,4C,8H,JH,3S	JH	38
8C,9C,2S,6C,6H	6C,6H	39
KD,7H,TC,9C,6D	7H,TC,9C,6D	39

To obtain the chance that this happened at random, detailed computations were performed for each hand. These computations
determined the exact probability that the player did not improve each specific hand. Taking into account the truncated log
files, the probability that none of these 19 draw hands improved to a hand that is Jacks or better is:

P = 1.244426E-121 =
0.00000000000000000000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000000000000000000001244426.

There are 120 zeroes to the right of the decimal in this number.

To put this in perspective, it is more likely to win the United States Powerball lottery 14 times in a row, buying a single
ticket, than that the results of this game happened purely by chance. It is more likely, playing blackjack, to be dealt a
blackjack 90 times in a row than that the results of the game happened purely by chance.

If all 50 completions for each hand are taken into consideration, this number becomes

P = 2.303642E-159 =
0.0000000000000000000000000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000000000000000000000000000000000000000000000000000002303642.

[Note. On January 9, 2012, I was supplied with complete log files for JOB50 for the period February 11, 2011 to January 7,
2012. During the period between December 15, 2011 and December 28, 2011, no draw hand improved to Jacks or Better. In total,
there were over 120 draw hands that did not improve during this period. Before December 15, 2011 and after December 28, 2011,
the game of JOB50 performed in a statistically normal fashion and there were no instances of this issue. The mathematical
analysis of the additional hands occurring between December 15, 2011 and December 28, 2011 is not included in the computation
of the probability given above.]

My opinion is that this software was programmed to allow it to make the player lose. In the past, software providers have
argued that such behavior was the fault of a bad random number generator or simply bad luck by the player. In my opinion, the
game was programmed by someone who had access to the source code and acted in a malicious manner devised to make the player lose. The easiest way to write a program in this way is to have it randomly deal cards to complete the hand, and if the hand
becomes a winner, simply repeat the deal until the completed hand is less than a pair of Jacks. Then go on to the next hand.
This type of behavior is easy to spot on a multi-hand game because of the unusual final result. This behavior would become much
more problematic to spot on a game with fewer lines or a single line. I did not examine the log files for other variations of
video poker. However, it would be unreasonable to expect such a limitation on the scope of this particular issue.

Based on my investigation, I determined that Youwager did not have access to the source code and could not have made any
changes to the Amigotechs software operating on their website. Youwager appears to have no culpability in this matter and in
every way cooperated. For this reason I conclude that Youwager had neither fault nor intent in this matter.

I conclude that Amigotechs, the vendor who supplied the casino software to Youwager, is responsible for providing a product
that was programmed to act in a malicious fashion to the detriment of the player and that this software did act in a malicious
fashion on 19 occasions.

Signed,

Eliot Jacobson, Ph.D., President
Certified Fair Gambling
January 11, 2012

[Thank you to Michael Shackleford for his helpful review of this post, for his secondary analysis of the data and for his welcome to make this post on his site.]

Quote: teliot

On January 5, 2012, Certified Fair Gambling (CFG) was contacted by management at Youwager to investigate a complaint that a player had about 50-play Jacks or Better video poker (JOB50) offered at their casino. Youwager informed me that they use the online casino software package created and licensed by Amigotechs.
...
[Note. On January 9, 2012, I was supplied with complete log files for JOB50 for the period February 11, 2011 to January 7,
2012. During the period between December 15, 2011 and December 28, 2011, no draw hand improved to Jacks or Better. In total,
there were over 120 draw hands that did not improve during this period. Before December 15, 2011 and after December 28, 2011,
the game of JOB50 performed in a statistically normal fashion and there were no instances of this issue. The mathematical
analysis of the additional hands occurring between December 15, 2011 and December 28, 2011 is not included in the computation
of the probability given above.]
...
Based on my investigation, I determined that Youwager did not have access to the source code and could not have made any
changes to the Amigotechs software operating on their website. Youwager appears to have no culpability in this matter and in
every way cooperated. For this reason I conclude that Youwager had neither fault nor intent in this matter.

I conclude that Amigotechs, the vendor who supplied the casino software to Youwager, is responsible for providing a product
that was programmed to act in a malicious fashion to the detriment of the player and that this software did act in a malicious
fashion on 19 occasions.

Signed,

Eliot Jacobson, Ph.D., President
Certified Fair Gambling
January 11, 2012

It looks like you're inviting comments, and in this case, I have to disagree with your conclusion. If Youwager "could not have made any changes to the Amigotechs software operating on their website", then it is still an open question as to how the game operated normally until December 15, acted improperly until December 28, and then operated normally thereafter. Do you know the technical architecture of the system? Do you know where the software was running and who had the ability to change configuration parameters? Were any configuration parameters changed? Is there an audit log of such changes? Until and unless you answer these questions, it is improper to arrive at a conclusion. In short, you're not done yet.

Quote: MathExtremist

Do you know the technical architecture of the system? Do you know where the software was running and who had the ability to change configuration parameters? Were any configuration parameters changed? Is there an audit log of such changes?

I considered all of these matters. Youwager made this information available to me as requested.

Was the Amigotech software actually installed on the Youwager servers, or was it running remotely as a hosted solution?

I had a long conversation with their CEO yesterday. They acknowledge that their Jacks or Better 50-line software malfunctioned in the way I described between December 15 and December 28, 2011.

I was told that they have a number of fixes that were put in place for security reasons because people hacked their flash software. Such hacks are constant and are a challenge for all such companies. They are conducting an internal investigation to determine if it was a patch that went wrong, or if there was an employee who purposely did this, or if there was some other cause. I asked that they make a public statement once they have concluded their investigation.

Quote:

I was told that they have a number of fixes that were put in place for security reasons because people hacked their flash software. Such hacks are constant and are a challenge for all such companies.

I am not very enthusiastic about Flashware in general, but as live gaming platform, I have to conclude it is not fit as a gaming platform.
I have to ask, because of increased internet speeds and processor capacity, and speed, if the Flashware was ported using SSH, or conventional 128or 256 bit security. I ask, because the connection needs to be unhackable, and the internal TX/RX also needs some strong encryption. Essentially, the box should be sealed, and Security needs a complete check-up and report to rule out a Back-Door.

Quote: 98Clubs

I am not very enthusiastic about Flashware in general, but as live gaming platform, I have to conclude it is not fit as a gaming platform.

98Clubs - when you use the phrase "live gaming platform", are your referring to live (real time) multi-player games like Poker?

Chris

Interesting points here. I just hoped that things would really work out pretty well in this one, as well as making things real good when playing online gambling in that kind of situation.
_______________________
Ladbrokes Casino

Greetings. Since this post was first made there has been a lot going on behind the scene. After a review of our findings by Amigotechs, this error was acknowledged as having happened in the manner described above. Amigotechs then conducted an internal investigation to determine the cause of this malfunction of their software.

The quick version is that their software was being abused by certain people playing JOB50. Some players discovered that they could win multiple times on a single hand. They did this by closing a session in pause mode and then re-opening it in multiple browsers at the same point, getting to play out the same hand from the draw. Amigotechs put in a fix for this attack, and it was the fix that went wrong.

Their description was highly technical involving specifics of the logic of their computer code. It did not translate well to a general audience. I requested that they write an explanation that was as easy to understand and as simply expressed as possible.

Here is Amigotech's explanation of the incident, written by their CEO Nancy Hennessy. She requested that I post it here, as Amigotech's official response to my original post in this thread.

Quote: Amigotechs

Amigotechs software is Flash based. As such, there are certain security issues that arise that are unlike other software platforms where the software package is downloaded and installed in the player’s computer. In a Flash based system, the player uses software that is downloaded as needed onto his browser. It is not in our security interest to detail the wide range of security problems we have faced, however we will directly address the issue that created this particular misbehavior in our software.

One feature of our security protection is that we have a “risk flag” that is raised when certain parameters of our software operate outside of their normal bounds. If the risk flag is raised and a further incident occurs, like an abnormally large win, then our software takes action to stop play until the situation is considered manually.

In the case of JOB50, we previously encountered a hacking situation where a player would be dealt a strong drawing hand then close the browser session, leaving the game and their hand in pause mode. The player would then reopen that same hand in multiple browser sessions and play the same hand multiple times, winning large amounts in a way that was clearly cheating. Therefore we created a risk flag that was raised if the player was dealt the exact same starting poker hand in JOB50 for two hands in a row.

In the case of JOB50, if the risk flag was raised and the player won a substantial amount, then rather than stopping the game to have it looked at manually, our decision was to let the player continue playing so we could better investigate how our systems were being compromised by the player. In that case we decided to allow the play, while denying the player further wins on his draw hands as they were played using the same cards in multiple browser windows.

In the case of JOB50, this flag was raised by the game being played in free play mode. Our error was to not have code in place to identify when the flag was raised by virtue of free play mode and turn it off. After a large win by a player, the game stopped operating correctly, dealing only losing hands to all players who had a drawing hand. We fully acknowledge that this was a poor way to deal with the problem. Computer code designed and written to help us with a specific security issue found its way into ordinary play.

This code was meant to track and prevent certain types of fraud -- players opening multiple sessions and other unexplained methods of beating the system. However, this is no longer our standard way of dealing with data inconsistency, as it does not provide transparency to the customer. Because of its unique vulnerability, we previously did not update JOB50 to the new standard. Since this incident, we have updated JOB50. Now all games, when presented with an inconsistent data state, will simply stop and present the user with an “Invalid Action” message.

We sincerely apologize to our customers for this unfortunate incident and insure our customers that we will do everything we can to offer safe, fun and fair games.

In consideration of all of the available facts of this incident, I conclude that the issue raised in the original complaint was caused by malfunctioning and poorly written software. Specifically, software designed to detect and deal with certain forms of player cheating began operating in normal play mode. Amigotechs had neither malice nor intent.

Fascinating cheat but a terrible solution to the issue. The software is faulty and prone to security risks. I would take the game completely down and rehash it in a different form.

Let's hope that the casino figures out the money lost and returns the losses to players who are effected.

Nice work, teliot.