Lessons Learned: A Security Analysis of the Internet Chess Club John Black Martin Cochran Ryan Gardner University of Colorado Department of Computer Science UCB 430 Boulder, CO 80309 USA
[email protected],
[email protected],
[email protected] Abstract between players. Each move a player made was transmit- ted (in the clear) to an ICS server, which would then relay The Internet Chess Club (ICC) is a popular online chess that move to the opponent. The server enforced the rules of server with more than 30,000 members worldwide including chess, recorded the position of the game after each move, various celebrities and the best chess players in the world. adjusted the ratings of the players according to the outcome Although the ICC website assures its users that the security of the game, and so forth. protocol used between client and server provides sufficient Serious chess players use a pair of clocks to enforce security for sensitive information to be transmitted (such as the requirement that players move in a reasonable amount credit card numbers), we show this is not true. In partic- of time: suppose Alice is playing Bob; at the beginning ular we show how a passive adversary can easily read all of a game, each player is allocated some number of min- communications with a trivial amount of computation, and utes. When Alice is thinking, her time ticks down; after how an active adversary can gain virtually unlimited pow- she moves, Bob begins thinking as his time ticks down. If ers over an ICC user.