Gambling Federation Malware

[Petunia]

Part of the statement from Ms. Paschini read: “We are voluntarily stepping out of GPWA forums so that GPWA can go back to normal. We think you have had enough stress and emails so far by the so called "malware" situation. Everything has been explained and told about this issue, there is nothing more left to say. We made an error, we are remorseful, and we repaired it. You recognized this in us and we are grateful.”

** So called... what else are we meant to call it? Well, I'd have to say, I for one was happy to see this Press Release... however, the 'error' has been repaird, but I think it will take a while for the damage to recover! just my opinion**

[greedygirl]

We made an error, we are remorseful, and we repaired it.

Bull$hit.

Until G-Fed contacts each and every single player, advising that A) their personal information has been compromised and B) that their computers have been compromised (and further, instructions on removing the malware), they haven't repaired anything.

The players MUST come first, and apparently, G-Fed is either too ignorant, too arrogant or too greedy to understand this. I'm guessing it's a combination of all three.

And I agree, Petunia--the utter notion that this could be deemed a "so-called 'malware' situation" is just adding salt on an already open wound. Were they to be truly "remorseful," why on earth would they use the words, "so-called?"

Um...perhaps because they're NOT truly remorseful???

[fromme4free]

Everyone seems to be forgetting the most important element of this wonderful change in the Gfed software. Picture this example :

Joe Bloggs signs up with Gfed before the alleged database theft occurs
Joe Bloggs details are on this database when it is alledgedly stolen
Gfed make the change to their install file which changes the users hosts file
Joe Bloggs attempts to go to www.royaldutchcasino.com
He gets there, can download and can play

Why? Because he installed Gfed before the change. 90% of players (probably more) on that database, are not affected either, for the same reason.

This "fix" of Gfed's only affects new players, or existing players who re-install their software by downloading it again. If they re-installed
using the same install file they originally used, they wont be affected.

Now taking the stand that the IGC is in some way responsible for helping them with their alleged data theft is even more of a joke. What they should
have done is have the "thief" arrested for theft of confidential company information, which other operators have done in the past.

More importantly, why did they not have the checks and controls in place to ensure that the data could not be stolen in the first place?

The Truth of it is :

Gfed gets their data stolen (supposedly) (1 wrong)
Gfed change their install to "fix" the HOSTS file (2 wrongs)
GFED don’t tell their clients that the clients data has been purloined (3 wrongs)
GFED bitch & moan when the IGC kicks them out for breaking the IGC T&C's (4 wrongs)
GFED ask the IGC to give their membership money to charity (nice, but
trying to detract from the truth) (5 wrongs)
GFED ignore requests for more info about the file change, and concentrate on the data theft that may or may not have happened (6 wrongs)

Ok, maybe I was brought up differently, but i have lived in those offshore locations, and am fairly clued up on how the law works there, and
elsewhere. I was also taught that 2 wrongs don’t make a right. But maybe, for Mr Fogli, there is some algorithm that can prove that 5 or more wrongs
can make a right, if you have been wronged first. (if so, please send it to me)

Meister, as a large portal owner with considerable influence over both users and operators, and a supplier of large quantities of very necessary
information on the industry, can we ask you to maybe set up a "basic" security page, that provides users with easy to use info on securing their
machines.

For Security newbies, I recommend the use of the following software to make your lives easier :

Spybot Search & Destroy (from www.safer-networking.org)
AD AWARE (from www.lavasoft.de)
Antivirus (there are lots out there, I use Norton & MCafee)
CWSHREDDER (for coolwebsearch adware, from www.merijn.org/downloads.html)
Get a firewall, but make sure it secures both incoming & outgoing communication. I use Tiny & Norton.

For more advanced users :
Winpatrol (www.winpatrol.com) (and use the lock hosts file option)
Hijackthis (advanced users only) (from www.merijn.org/downloads.html)
NTFILMON, REGMON etc (from www.sysinternals.com give you a nice view of what is happening on your machine)

For users who don’t want to put all the extra software on their machine, a
simple fix to secure your hosts file is the following :
Find it on your pc (C:\WINNT\system32\drivers\etc OR
C:\Windows\system32\drivers\etc)
You need to make sure you can view Hidden files & folders in windows, and also that the "hide protected operating system files" is disabled (in
Folder Options, view)
Right click on the file, select properties
On The general tab, at the bottom, is an option to set the file to "Read Only". Make sure it is ticked, and click ok.

Hope it helps.

[greedygirl]

Good post, Fromme.

This "fix" of Gfed's only affects new players, or existing players who re-install their software by downloading it again. If they re-installed

The trouble is that unless G-Fed becomes significantly pro-active (and honest) by advising those who've downloaded the software, the majority of these players will continue to have the malware loaded on their computers.

And of course, ALL G-Fed players should be made aware that their personal information has been compromised. The only GOOD reason I can see for not doing so, is if G-Fed has been lying all along, using the "stolen database" bit as an excuse for their actions.

[Petunia]

**Hey 4Free - you have a few valid points - it made my head hurt all over, but valid none the less.

Greedy Girl - I agree with you too. How many of the players still has the 'faulted' downloads running, and are not quite aware of the whole situation and it's effects? I am very curious about what the 'correction' was that GFed was referring to. I agree, everyone on the current database needs to be made aware of this, and encourage to download the 'clean' version. I guess the statement says "I don't have to explain myself any further" - that is the bottem line of what I got out of it! **

[dominique]

I want to look at some of the positives that have transpired in relation to this mess.

I am very pleased to hear about GFED's departure from GPWA, I just knew the folks at GPWA were concerned about this and I recently defended them elsewhere in relation to this situation. John and Marlene have been very good for the GPWA I think.

The $5000 donation is a good thing under any circumstances, as is the voluntary withdrawal of GFED.

eCOGRA, the IGC, CAP and the GPWA have come through and acted honorably and done the right thing.

What's missing?

I think GFED needs to contact all their players and affiliates directly (as Bryan stated, not all of them read message boards) and explain what happened and, in the case of players, help fix the malware situation on the individually affected computers.

Sometimes one needs to stand back and look at the positive things that can come from a bad situation - and in this case the industry in general has acted responsibly and unified. I am very pleased to see this, and I sincerely hope GFED will bring this situation to it's logical conclusion by contacting all affected parties directly.

[Dirk Diggler]

Why? Because he installed Gfed before the change. 90% of players (probably more) on that database, are not affected either, for the same reason.

This "fix" of Gfed's only affects new players, or existing players who re-install their software by downloading it again. If they re-installed
using the same install file they originally used, they wont be affected.

My understanding of it is that each time you login to G-fed it automatically updates, and these changes are being made in that. So as long as you logged in after they changed this host file you will have been affected.

BTW Excellent point Greedy Girl about them not even informing the players of the breach of data etc. This is a key issue if they really do want to put things right.

[spearmaster]

Everyone seems to think the "time frame" is recent - that G-Fed only did this recently.

The whole trouble with this premise is that I have already proven beyond a doubt, on MY computer, with a screenshot provided to GPWA, that G-Fed was modifying the hosts file as far back as November 2003. And at the time, Royal Dutch was NOT one of those being blocked.

To put it bluntly, you are only hearing what G-Fed wants you to hear.

[dominique]

Who WAS blocked then?

I must have had it on my old computer back then too.

[jetset]

** So called... what else are we meant to call it? Well, I'd have to say, I for one was happy to see this Press Release... however, the 'error' has been repaird, but I think it will take a while for the damage to recover! just my opinion**

The "so-called" bit really got up my nose as well - what sort of "remorse" is this, as GG says it is rubbing salt into an open wound. These guys certainly have a strange way of doing their PR, but I guess it is a good distraction from the main event here.

My understanding is that this nasty little trojan of GFED's has been around for at least several months - in fact I saw a reference somewhere recently to it being found on downloads going back over six months.

That means that those here who are demanding more direct and remedial action from GFED are right to do so i.m.o.

GFED's "we've done everything so let's just let this go away now" doesn't cut it under these circumstances.