A local hacker, known as LowVoltage, this week claimed he had found security holes in the www.702game.co.za Web site that allow players to manipulate the share challenge game to their advantage.
[The hacker] has been trying a lot to rig the game.
Lindsay Williams, money editor, 702
The game site is part of the 702 and Metropolitan share challenge game which will conclude in October with the best "trader" winning R1 million.
The many security holes identified by the hacker include the ability to manipulate or delete the open trades of other players. The bigger flaw, however, was with the share purchase process that allowed users to alter the values of hidden fields before being submitted.
In an e-mail to a local mailing list, LowVoltage illustrated how he had been able to purchase 500 Billiton "shares" for only 5c, with the result that he headed the leader board yesterday morning.
LowVoltage apparently e-mailed details of the holes to the competition organisers late last year.
Lindsay Williams, money editor for 702, says the hacker "had been trying a lot to rig the game" and the station is well aware of his activities. Williams says all trades are manually audited to ensure their validity and trades conducted by LowVoltage had been erased. He adds that "anyone who goes up or down a lot" is closely watched and all trades are verified every week.
According to Williams, all the security flaws were closed by this morning. However, he noted that the station is investigating the possibility that the hacker had found a hole in the payment gateway which had been used to enter the game. All competitors are required to pay R100 to participate in the game.
Nick McGhee, a developer at Cyberhostxteq, developer of the site, confirmed that the company is examining the security of the payment gateway, although the Standard Bank gateway is not the responsibility of Cyberhostxteq.
McGhee says all of the security flaws have been plugged, particularly the purchasing forms which are now rejected if sent from anywhere else other than the game server. He adds that extra security has been put on the database transactions.
Williams says the hacker gained nothing from his actions and would not have been eligible to win any of the weekly prizes. "If he had done it properly he could already have won the competition."
Share
