My son is in a dispute with a well known bookmaker who introduced a flash
based game on the 16th December 2004 froma new partner to it's web site it
involved betting on a game of darts.
The problem lies in the fact that my son on one day (27th Dec) won £5000 and
the next day some £13000 with a friend, the bookmaker cried "hacked and says
logs of the active accounts show wrong doing. My son nor I for that matter
know anything regarding flash, fromthe convesations with the security people
they suggest my son has hacked into the game and then changed variables? to
enable him to win. My son states catagorically he has not and to be fair he
does not have the ability as far as I can see, the situation is getting out
of hand and is in the hands so they say of the police.

The point of this post though is without going into detail how easy would it
be to gain access to the programme of the game and secondly without the
knowledge of what you are looking at how simple or not would it be to change
aspects of the game to your benefit????

From memory they spoke of compile or decompile somewhere in the conversation
???

any assistance would be gratefully recieved as I have stated I do not want
specifics just an outline understanding and an estimate of how much
experience would be required.

--

[quoted text, click to view]

Unfortunately, such software does exist. A hacker can access a flash
variable in a mem slot and change it. I don't want to give too much detail
(and give people ideas) but it's not hard to do, and this company probably
has some safeguards against it (like checking the variable against a secret
variable to make sure they match).

This is not to say your son is guilty of anything, just to verify that this
is possible.

HTH

*********
GamesAboutMovies.com
The coolest online games made for movies!

the possibility depends entirely on the extent to which the developers of
the game have attempted to prevent it, or not as the case may be

there now exist tools for decompiling flash files of which the above
developers should be well aware

furthermore given that macromedia, who make flash, have never laid any
claims to it providing anything like a secure environment in which to build
applications, anybody foolish enough to rely on flash alone as a means of
securing the £1000s that might change hand in large scale online gambling,
are frankly professionaly negligent, i hope the agency has business
insurance as if i were 'a well known bookmaker' i'd sue their arses off

as to whether your son peaked under the hood or not i have no idea. It is
unlikely that the darts game did rely solely on flash so the 'supposed
hacker' would need a good understanding of not only flash but also any
number of other online technologies and the skills to hack them. Yes it's
trivial to use a decompiler but it certainly isn't to follow the program and
data flow particularly if external technologies are used and preventative
measures such as encryption

there claim that "logs of the active accounts show wrong doing" implies some
fairly sophisticated methods. Peaking in a swf or flash with a decompiler
would not involve any of their server side logs in any way whatsoever

there are a few scenarios

the well known bookmakers level of security and methods were so basic that
anybody, your son included, could have figured out how to blag it, but we
are talking laughably negligent, like barclays leaving the safes open and
sending everyone home (although it's still theft)

your son is far more skilled than you realise and did indeed circumvent the
bookmakers security measures. 'Hacking' secure online systems is very very
difficult, it has been popularised in the press over the years but in
reality it demands a very high level of expertise

your son won the money fair and square, bookmakers are pissed, look into it,
spot some major flaws in the system and want to pull the plug pronto and
limit their damages so they play bluff with you and call your son a hacker
so they don't have to cough the money

whatever way it is, there are some very serious accusations of criminal
activity here with potential custodial sentences, i would seek legal advice
immediately. Furthermore it may be helpful to seek consultation with a
computer security expert to interpret any techno-babble 'bookmakers' chuck
at you (you'd be unlikley to find many round here simply because the
emphasis is on flash, look in your yellow pages, data security experts are
well established these days). On a lighter note if your son just won £18000
fair and square they should damn well cough up!

jim

[quoted text, click to view]