Unbelievable. 999dice "fixes" their system and sneaks in a new scam tactic.

EbbiDos

newbie

Activity: 20

Merit: 0

Quote from: Superhitech on February 28, 2015, 09:25:45 PM

Good thing you caught this. Is it possible for you to code a new bot that manually sets the server seed before every bet?

My bot does that and verifies every bet: https://bitcointalksearch.org/topic/m.10715929
It does:

Code:

GetServerSeedHashResponse serverSeed = await DiceWebAPI.GetServerSeedHashAsync(Session);
int clientSeed = rnd.Next();
var settings = new AutomatedBetsSettings
                {
                    BasePayIn = baseBet,
                    GuessLow = guessLow,
                    GuessHigh = guessHigh,
                    MaxBets = (betCount > Session.MaxBetBatchSize) ? Session.MaxBetBatchSize : betCount,
                    ResetOnWin = resetOnWin,
                    ResetOnLose = resetOnLoss,
                    IncreaseOnWinPercent = increaseOnWin,
                    IncreaseOnLosePercent = increaseOnLoss,
                    MaxAllowedPayIn = maxBet,
                    ResetOnLoseMaxBet = resetOnMaxLoss,
                    StopOnLoseMaxBet = stopOnMaxLoss,
                    StopMaxBalance = stopMaxBalance,
                    ClientSeed = clientSeed,
                    Currency = Currency
                };
PlaceAutomatedBetsResponse result = await DiceWebAPI.PlaceAutomatedBetsAsync(Session, settings);
for (int i = 0; i < result.BetCount; i++)
{
    if (!VerifyBetResult(result.ServerSeed, clientSeed, i, result.Secrets[i], serverSeed.ServerSeedHash))
        bRiggedBetFound = await LogRiggedBet(result.ServerSeed, clientSeed, result.BetIds[i], result.Secrets[i], serverSeed.ServerSeedHash);
}

And the verification routine:

Code:

private bool VerifyBetResult(string serverSeed, int clientSeed, int betNumber,
                            long betResult, string serverSeedHash = null)
        {
            Func strtobytes = s => Enumerable
                .Range(0, s.Length / 2)
                .Select(x => byte.Parse(s.Substring(x * 2, 2), NumberStyles.HexNumber))
                .ToArray();
            byte[] server = strtobytes(serverSeed);
            byte[] client = BitConverter.GetBytes(clientSeed).Reverse().ToArray();
            byte[] num = BitConverter.GetBytes(betNumber).Reverse().ToArray();
            byte[] serverhash = serverSeedHash == null ? null : strtobytes(serverSeedHash);
            byte[] data = server.Concat(client).Concat(num).ToArray();
            using (SHA512 sha512 = new SHA512Managed())
            {
                if (serverhash != null)
                    using (SHA256 sha256 = new SHA256Managed())
                        if (!sha256.ComputeHash(server).SequenceEqual(serverhash))
                            return false;//throw new Exception("Server seed hash does not match server seed");
                byte[] hash = sha512.ComputeHash(sha512.ComputeHash(data));
                while (true)
                {
                    for (int x = 0; x <= 61; x += 3)
                    {
                        long result = (hash[x] << 16) | (hash[x + 1] << 8) | hash[x + 2];
                        if (result < 16000000)
                            return result % 1000000 == betResult;
                    }
                    hash = sha512.ComputeHash(hash);
                }
            }
        }

In short for non-programmers:
1. I get the server seed's hash
2. I generate a random number in clientSeed and put that into the class AutomatedBetsSettings
3. I place that automated bet and get back a class PlaceAutomatedBetsResponse. Inside this class is the server seed.
4. I verify every bet with VerifyBetResult(). If a rigged bet will be detected it will log all data to a file so we could proof they have manipulated.

For single bets the bot does the same procedure.

Code:

serverSeed = await DiceWebAPI.GetServerSeedHashAsync(Session);
clientSeed = rnd.Next();
single = await DiceWebAPI.PlaceBetAsync(Session, betSize, guessLow, guessHigh, clientSeed, Currency);
if (!VerifyBetResult(single.ServerSeed, clientSeed, 0, single.Secret, serverSeed.ServerSeedHash))
    bRiggedBetFound = await LogRiggedBet(single.ServerSeed, clientSeed, single.BetId, single.Secret, serverSeed.ServerSeedHash);

To be sure there is no information exchance between generating my clientSeed and DiceWebAPI.PlaceAutomatedBetsAsync() I've checked the source code of the DiceWebAPI library which is public on github: https://github.com/triple9dice/
Everything is as it should be.

Superhitech

legendary

Activity: 1064

Merit: 1000

Good thing you caught this. Is it possible for you to code a new bot that manually sets the server seed before every bet?

XinXan

hero member

Activity: 1064

Merit: 505

Someone already commented about this but if what you are saying its true you could indeed win predicting the site prediction

keepinquiet

full member

Activity: 420

Merit: 151

So I heard from a friend that 999dice removed the click to see the hash button, so I went over to see exactly what they did.

Yep, they removed the button, the hash is always visible (assuming you want to stay on the Fair Bets tab and never see your bet history or the chat room as you play). Whats amazing is that the hash is always in the HTML - my 'scambuster' script in the other thread can read the hash without ever having that tab open. So if it's always there, why hide it?

Anyway, the reason I got riled up and went to post this is I tried a few bets with my script to be sure it still worked (since there's no button to push anymore) and I flipped out because the client hash I was setting is NOT what was showing in the Client Hash box.

Until I watched it.

999dice is now overwriting your own client seed on EVERY bet! The asshole thief admin, having been forced to change remove the button, made A WHOLLY UNNECESSARY CHANGE and now the site will re-write the Client Seed ON EVERY BET.

For all anyone knows, the seed it's set to, when run with the server seed, will produce the result the site wants. Sure, they don't know which way you'll bet, but you can be damn sure that people bet in patterns. It's the simplest software in the world to determine a likely pattern of 0/1/0/1 and then set a client seed that will work with the server seed to force a loss.

Hey "Jay" - when the hell are you going to stop the scamming? I click the button that says "Set the Client Seed manually" - and you forcibly change it on every bet!

Once again, forcing me to change the seed. Something, that, when you do it, notifies the server BEFORE you place the bet.

Here's the code:
$("#FairTabClientSeed").focusout(view.controls.updateClientSeed);

What that says is when the element with the id fairtabclientseed loses focus (you click out of the box), it runs updateClientSeed.

Know what updateClientSeed does?
updateClientSeed:function() {
var n=$("#FairTabClientSeed").val().trim();
if(n.length===0) {
view.updateUserInfo();
return }
pipe.server.setClientSeed(n)
}

That runs a call to TELL THE SERVER YOU CHANGED THE CLIENT SEED. No, not when you bet, but as soon as you update the seed.

Why the hell does the server need to know that BEFORE you bet?

So let's review:
Old 999dice: You must inform the server you are checking the hash by clicking a button before you bet, and you're forced to do it for every bet.

New 999dice: You must inform the server you are checking the hash by manually inputting a client seed, arguably more work than clicking the 'get server seed hash' button, and the server changes it after you bet, so that you're forced to do it for every bet.

He removed one scammy thing and replaced it with another, that does the SAME THING.

If you don't set your own client seed and you use the one they provide, they know the outcome of the roll before you ever push a button, and they can provide a client seed that will err in their favor if you follow the same pattern you have been for betting. And humans are terrible sources of entropy. The site can absolutely figure out your next likely high/low bet, and provide a client seed that lets them win (assuming you follow your pattern. Its not foolproof, but it's something that bends the favor in their direction).

If you DO change the seed, they know what you sent in advance, and know you're looking.

All this I found from checking the site out for 5 minutes. I'm almost positive something worse is going on. I just havent even begun to look yet.

Oh, and the chat room is auto-censored for anything anyone could possibly say to accuse them, or warn others of the scam. Try sending a bitcointalk link to the chatroom. YOU will see it. No one else will.

Topic: Unbelievable. 999dice "fixes" their system and sneaks in a new scam tactic. (Read 3639 times)