GGPoker tightens security and bans HUDs after superuser scandal

GGPoker tightens security and bans HUDs after superuser scandal

GGPoker is adding client security checks and Win-Rate Anomaly Detection after a superuser case, while planning to end support for older operating systems in 2027. Jurojin Poker has criticized the ban on third-party tools.

GGPoker is expanding its security measures after a recent superuser case, including a ban on third-party tools such as HUDs. The changes add client-side checks, a new method for spotting anomalous play and a plan to end support for several older operating systems in 2027.

New checks in the client

A forthcoming client update will add a Security option under Game Settings. It will contain four optional features, which run only while the GGPoker software is open.

Screen Guard will block remote viewing of all tables, selected tables or the full client. Players can allow access to particular tables, such as when a backer wants to monitor a player they have staked. Connection Monitor will alert users to suspicious connections, including remote-control tools. Process Check lets users exempt selected applications from those alerts, while DNS Check scans for signs that a network’s Domain Name System has been compromised.

GGPoker has also added Win-Rate Anomaly Detection, or WAD, to its game-integrity monitoring. The method uses hole-card knowledge to look for decisions that are correct at a rate considered implausible for an honest human player. GGPoker says tests against previously confirmed cases identified them. The operator says it already has ways to detect real-time assistance, but the distinction between those methods and WAD is not clear.

Older systems and investigation

GGPoker plans to stop supporting operating systems that no longer receive manufacturer security patches from 2027. The affected systems include macOS 11 (Big Sur) and earlier, Windows 7.8 and Windows 8.1. Players will need at least Windows 10 or macOS 12 (Monterrey) before support is withdrawn.

The operator also says it traced funds linked to the superuser case and identified a crypto wallet address. It shared the information with Coinbase, where the funds were believed to have been deposited, and asked the company to restrict the account. GGPoker says it will continue working with authorities and the community, though it is unclear whether that commitment is new.

Jurojin Poker objects to blanket ban

IntuitiveTables and Jurojin Poker, the third-party tools believed to have been compromised in the attacks, both issued guidance on checking devices and said relevant security flaws had been patched.

Jurojin Poker called GGPoker’s broader restrictions heavy-handed, arguing that security measures should target threats without treating all third-party software as a risk. Its statement said: “…there's a difference between addressing security threats and treating an entire ecosystem of third-party software as the threat itself. For years, independent developers have built tools that improve the online poker experience, while players have incorporated those tools into their daily routines. Disrupting all of that through blanket restrictions, regardless of what each tool actually does, is not a security strategy we believe the industry should embrace.”

The company called for clearer standards and cooperation, adding: “A safer poker ecosystem is built by working together, not by turning its participants against each other.” It said it supports GGPoker’s player-protection efforts but urged the operator to open dialogue with affected developers and players.