Remember a few years back when the pre-release source code for Valve's long-awaited Half-Life 2 ended up on BitTorrent? It turns out the developer cooked up an elaborate sting in conjunction with the FBI that came this close to nailing the culprit.
Back in 2003, Valve's internal network was breached by a German hacker, ultimately resulting in the theft and dissemination of the source code for Half-Life 2, which at that point was still more than a year from release. It was a full-on debacle for Valve, not only because the source for one of the most anticipated shooters in history was suddenly loose in the wild long before the game was ready, but because the monumental lapse in security made the developer, to put it bluntly, look a bit stupid.
Valve honcho Gabe Newell appealed to the online community for help in tracking down those responsible. "If you have information about... the infiltration of our network, please send the details," Newell wrote in a message on the company forums. "There are some pretty obvious places to start with the posts and records in IRC, so if you can point us in the right direction, that would be great." Anonymous sources began feeding the FBI transcripts of IRC discussions of the hack (available via Wired, PDF format) but it wasn't until February 2004 that the big break came, courtesy of the hacker himself.
That month, Valve was contacted by "DaGuy@hushmail.com," claiming credit for the break-in and providing details to back his claim but denying that he was responsible for putting the source code online. Valve stayed in contact with the user, who expressed interest in getting a job with the developer; at the same time, the FBI, who was in on the act, used clues in the emails to determine that their man was Axel Gembe of Schonau, Germany. The following month, several managers at Valve spent 40 minutes on the phone with Gembe in a fake job interview, learning how he'd cracked into their network and gained root access via remote exploits and scanning software. "I'm no bad guy, just a little misguided," he claimed.
After the interview, Newell invited Gembe to the U.S. for a face-to-face interview, saying that expenses for the trip would be covered, as would the costs for relocation if he was hired, which he claimed was "pretty standard for the game business." But at that point, for one reason or another, Gembe wised up and declined to leave Germany. In the end, he was charged with the crime in that country, and sentenced to probation.
It's a fantastic story with a not-quite-satisfying conclusion that leads to a painfully obvious question: Why couldn't a company as successful as Valve afford to hire some top German talent to take care of this guy in a more decisive and permanent fashion? What sounds better to you: Spending months chasing leads, sifting through mountains of tips and chat logs, dealing with bored FBI liaison officers and disinterested German prosecutors all while hoping that if you do actually manage to catch the guy he'll get something more than a year or two of probation? Or writing a six-figure check to Zane and Cannell and getting a copy of the missing persons report in the mail a month later?
In any event, U.S. authorities may yet get another crack at Gembe: Last month, federal prosecutors in Los Angeles added his name to a case involving a satellite TV retailer who launched "crippling" DDOS attacks against his competitors in 2003. Gembe is named in the indictment for allegedly providing the Agobot software, which he wrote, for use in the attacks.
Sweet games and slick stings. Valve, you're super.
Too bad they can't get his ass extradited on this charge alone. Oh well, if they can piggy-back it on that other charge (Provided he gets extradited for it) then that'd be fine.
It's a fantastic story with a not-quite-satisfying conclusion that leads to a painfully obvious question: Why couldn't a company as successful as Valve afford to hire some top German talent to take care of this guy in a more decisive and permanent fashion?
It's usually called Assault with a Deadly Weapon, and is frowned on. I mean, who'd want policemen kicking in the doors to arrest people in Germany, of all places?
Baby Tea: Too bad they can't get his ass extradited on this charge alone. Oh well, if they can piggy-back it on that other charge (Provided he gets extradited for it) then that'd be fine.
The German constitution does not allow extraditing citizens, except within the EU, under certain circumstances (or an international court).
Also, I'm not quite sure why this is news (apart from him being added to the Los Angeles case). It's well documented on Wikipedia, and his part in writing Agobot was apparently already part of the previous prosecution against him.
May I also carefully suggest that two years probation sounds fair enough to me.
Baby Tea: Too bad they can't get his ass extradited on this charge alone. Oh well, if they can piggy-back it on that other charge (Provided he gets extradited for it) then that'd be fine.
The German constitution does not allow extraditing citizens, except within the EU, under certain circumstances (or an international court).
Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive. Oh well, that's kinda neat! I'll tuck that away in my 'little known info' side of my head...which is probably more full then it should be.
Baby Tea: Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive.
They do, with respect to foreigners, see for example:
It's a fantastic story with a not-quite-satisfying conclusion that leads to a painfully obvious question: Why couldn't a company as successful as Valve afford to hire some top German talent to take care of this guy in a more decisive and permanent fashion?
The same reason Peter, Ajay, and Michael wound up trying to teach themselves how to launder money by looking it up in a dictionary.
What valve were doing was pretty dubious too imom trying to lure somebody to another country with the intent of using quite a tough legal system against them. Dont get me wrong, what he did was wrong, and I`m sure quite a large setback for valve, but I think something like prohibition or a short / suspended jail sentence would be far more suitable, rather than the serious jail time he would get because he offended a large company in the good ole u-s of a.
oshin: What valve were doing was pretty dubious too imom trying to lure somebody to another country with the intent of using quite a tough legal system against them. Dont get me wrong, what he did was wrong, and I`m sure quite a large setback for valve, but I think something like prohibition or a short / suspended jail sentence would be far more suitable, rather than the serious jail time he would get because he offended a large company in the good ole u-s of a.
I agree. I think 2 years on probation is better than whatever ridiculously high punishment he would get in the US. I doubt Valve lost that much money because of the stolen scource code, because the people that downloaded it were probably the same people who would have pirated Half-Life 2 when it came out anyway.
Baby Tea: Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive.
They do, with respect to foreigners, see for example:
A shame he wised up. They tipped their hand too soon, I guess. But still, that's pretty damn funny. But I have trouble imagining what kind of response this would have gotten if it had worked fully. Would people applaud or scold VALVe? And what of Germany?
Of course, when the Combine come and conquer Earth, none of it will matter.
Anyhow, I doubt the death penalty was on the table for this case. From what I have seen, extradition goes fine as long as the crime does not run the chance of a death penalty or if the prosecutor takes the penalty off the table.
The one question I have is why did Valve have their source code on a network if they were still working on it? Not only did they run the risk of having it hijacked, which it was, but it leaves their computer, no doubt a top of the line machine(s), open to hacks and bug exploits. It's not like it would be that hard to transfer the data to flash memory, then to the network when it was finished.
The least they could have done is used a Linux or Unix based system, which is almost impossible to hack if configured the right way. And for a company full of techie game devs, that should be common knowledge. I'm only in my 3rd semester of college for network administration and even I know that.
Baby Tea: Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive.
They do, with respect to foreigners, see for example:
Baby Tea: Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive.
They do, with respect to foreigners, see for example:
Baby Tea: Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive.
They do, with respect to foreigners, see for example:
Baby Tea: Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive.
They do, with respect to foreigners, see for example:
Baby Tea: Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive.
They do, with respect to foreigners, see for example:
Baby Tea: Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive.
They do, with respect to foreigners, see for example:
Baby Tea: Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive.
They do, with respect to foreigners, see for example:
AFAIK extradition of citizens is a no-go most everywhere, though.
They can also link up like Voltron and fight interstellar bad guys... but Mexico gets the shins.
pointless bump, why would you do that?
I did it for the lulz. I'm... I'm just so goddamn sorry.
you don't bump or create a new thread, both are frowned upon, you just missed an opportunity to voice your opinion, thats it. done.
Why do I keep hearing "use the search" then? The person who posts obviously has something pertinent to say, and rather than making a whole new thread, they are doing what people tell them. I haven't heard anything about a specific timeframe in which a post can be made.
I didn't realize this was a bumped thread when I replied, but the easiest thing to do if bumped threads bother you is not to read them.
megapenguinx: Oh Valve you crafty kids, you proved hackers are catchable (somewhat)
Actually they pulled a Mission Impossible. Remember that white blond antagonist who's after the NOC list? And when he got freed from capture that the "enemy was re-assured he's uncatchable"?
Hey, I wasn't talking to you, you didn't bump the damn thread. All you need is a good dose of the welcome speech.
The mandatory welcome speech-click to view
Well, I'm the one who replied. Forums are a place for conversations, right? And I was lurking for long enough before I joined to know the spiel, but thanks anyways.
Look man, you can either reply to my original post to you or not. It makes no difference to me, I don't go looking for threads to bump from years ago, but I have seen enough of "use the search feature" from people to make a comment about it. Knowing where you are getting these rules of etiquette from would be helpful.
The Valve Sting: Tricking Hackers With Fake Job Interviews
Remember a few years back when the pre-release source code for Valve's long-awaited Half-Life 2 ended up on BitTorrent? It turns out the developer cooked up an elaborate sting in conjunction with the FBI that came this close to nailing the culprit.
Back in 2003, Valve's internal network was breached by a German hacker, ultimately resulting in the theft and dissemination of the source code for Half-Life 2, which at that point was still more than a year from release. It was a full-on debacle for Valve, not only because the source for one of the most anticipated shooters in history was suddenly loose in the wild long before the game was ready, but because the monumental lapse in security made the developer, to put it bluntly, look a bit stupid.
Valve honcho Gabe Newell appealed to the online community for help in tracking down those responsible. "If you have information about... the infiltration of our network, please send the details," Newell wrote in a message on the company forums. "There are some pretty obvious places to start with the posts and records in IRC, so if you can point us in the right direction, that would be great." Anonymous sources began feeding the FBI transcripts of IRC discussions of the hack (available via Wired, PDF format) but it wasn't until February 2004 that the big break came, courtesy of the hacker himself.
That month, Valve was contacted by "DaGuy@hushmail.com," claiming credit for the break-in and providing details to back his claim but denying that he was responsible for putting the source code online. Valve stayed in contact with the user, who expressed interest in getting a job with the developer; at the same time, the FBI, who was in on the act, used clues in the emails to determine that their man was Axel Gembe of Schonau, Germany. The following month, several managers at Valve spent 40 minutes on the phone with Gembe in a fake job interview, learning how he'd cracked into their network and gained root access via remote exploits and scanning software. "I'm no bad guy, just a little misguided," he claimed.
After the interview, Newell invited Gembe to the U.S. for a face-to-face interview, saying that expenses for the trip would be covered, as would the costs for relocation if he was hired, which he claimed was "pretty standard for the game business." But at that point, for one reason or another, Gembe wised up and declined to leave Germany. In the end, he was charged with the crime in that country, and sentenced to probation.
It's a fantastic story with a not-quite-satisfying conclusion that leads to a painfully obvious question: Why couldn't a company as successful as Valve afford to hire some top German talent to take care of this guy in a more decisive and permanent fashion? What sounds better to you: Spending months chasing leads, sifting through mountains of tips and chat logs, dealing with bored FBI liaison officers and disinterested German prosecutors all while hoping that if you do actually manage to catch the guy he'll get something more than a year or two of probation? Or writing a six-figure check to Zane and Cannell and getting a copy of the missing persons report in the mail a month later?
In any event, U.S. authorities may yet get another crack at Gembe: Last month, federal prosecutors in Los Angeles added his name to a case involving a satellite TV retailer who launched "crippling" DDOS attacks against his competitors in 2003. Gembe is named in the indictment for allegedly providing the Agobot software, which he wrote, for use in the attacks.
via: Boing Boing
Permalink