The Valve Sting: Tricking Hackers With Fake Job Interviews

The Valve Sting: Tricking Hackers With Fake Job Interviews

image

Remember a few years back when the pre-release source code for Valve's long-awaited Half-Life 2 ended up on BitTorrent? It turns out the developer cooked up an elaborate sting in conjunction with the FBI that came this close to nailing the culprit.

Back in 2003, Valve's internal network was breached by a German hacker, ultimately resulting in the theft and dissemination of the source code for Half-Life 2, which at that point was still more than a year from release. It was a full-on debacle for Valve, not only because the source for one of the most anticipated shooters in history was suddenly loose in the wild long before the game was ready, but because the monumental lapse in security made the developer, to put it bluntly, look a bit stupid.

Valve honcho Gabe Newell appealed to the online community for help in tracking down those responsible. "If you have information about... the infiltration of our network, please send the details," Newell wrote in a message on the company forums. "There are some pretty obvious places to start with the posts and records in IRC, so if you can point us in the right direction, that would be great." Anonymous sources began feeding the FBI transcripts of IRC discussions of the hack (available via Wired, PDF format) but it wasn't until February 2004 that the big break came, courtesy of the hacker himself.

That month, Valve was contacted by "[email protected]," claiming credit for the break-in and providing details to back his claim but denying that he was responsible for putting the source code online. Valve stayed in contact with the user, who expressed interest in getting a job with the developer; at the same time, the FBI, who was in on the act, used clues in the emails to determine that their man was Axel Gembe of Schonau, Germany. The following month, several managers at Valve spent 40 minutes on the phone with Gembe in a fake job interview, learning how he'd cracked into their network and gained root access via remote exploits and scanning software. "I'm no bad guy, just a little misguided," he claimed.

After the interview, Newell invited Gembe to the U.S. for a face-to-face interview, saying that expenses for the trip would be covered, as would the costs for relocation if he was hired, which he claimed was "pretty standard for the game business." But at that point, for one reason or another, Gembe wised up and declined to leave Germany. In the end, he was charged with the crime in that country, and sentenced to probation.

It's a fantastic story with a not-quite-satisfying conclusion that leads to a painfully obvious question: Why couldn't a company as successful as Valve afford to hire some top German talent to take care of this guy in a more decisive and permanent fashion? What sounds better to you: Spending months chasing leads, sifting through mountains of tips and chat logs, dealing with bored FBI liaison officers and disinterested German prosecutors all while hoping that if you do actually manage to catch the guy he'll get something more than a year or two of probation? Or writing a six-figure check to Zane and Cannell and getting a copy of the missing persons report in the mail a month later?

In any event, U.S. authorities may yet get another crack at Gembe: Last month, federal prosecutors in Los Angeles added his name to a case involving a satellite TV retailer who launched "crippling" DDOS attacks against his competitors in 2003. Gembe is named in the indictment for allegedly providing the Agobot software, which he wrote, for use in the attacks.

via: Boing Boing

Permalink

Sweet games and slick stings. Valve, you're super.

Too bad they can't get his ass extradited on this charge alone. Oh well, if they can piggy-back it on that other charge (Provided he gets extradited for it) then that'd be fine.

Why couldn't a company as successful as Valve afford to hire some top German talent to take care of this guy in a more decisive and permanent fashion?

Word on the street is that there's some sort of new-fangled laws against such a thing.

It's a fantastic story with a not-quite-satisfying conclusion that leads to a painfully obvious question: Why couldn't a company as successful as Valve afford to hire some top German talent to take care of this guy in a more decisive and permanent fashion?

It's usually called Assault with a Deadly Weapon, and is frowned on. I mean, who'd want policemen kicking in the doors to arrest people in Germany, of all places?

Baby Tea:
Too bad they can't get his ass extradited on this charge alone. Oh well, if they can piggy-back it on that other charge (Provided he gets extradited for it) then that'd be fine.

The German constitution does not allow extraditing citizens, except within the EU, under certain circumstances (or an international court).

Also, I'm not quite sure why this is news (apart from him being added to the Los Angeles case). It's well documented on Wikipedia, and his part in writing Agobot was apparently already part of the previous prosecution against him.

May I also carefully suggest that two years probation sounds fair enough to me.

miracle2k:

Baby Tea:
Too bad they can't get his ass extradited on this charge alone. Oh well, if they can piggy-back it on that other charge (Provided he gets extradited for it) then that'd be fine.

The German constitution does not allow extraditing citizens, except within the EU, under certain circumstances (or an international court).

Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive. Oh well, that's kinda neat! I'll tuck that away in my 'little known info' side of my head...which is probably more full then it should be.

Baby Tea:
Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive.

They do, with respect to foreigners, see for example:

http://en.wikipedia.org/wiki/List_of_United_States_extradition_treaties

AFAIK extradition of citizens is a no-go most everywhere, though.

Malygris:

It's a fantastic story with a not-quite-satisfying conclusion that leads to a painfully obvious question: Why couldn't a company as successful as Valve afford to hire some top German talent to take care of this guy in a more decisive and permanent fashion?

The same reason Peter, Ajay, and Michael wound up trying to teach themselves how to launder money by looking it up in a dictionary.

What valve were doing was pretty dubious too imom trying to lure somebody to another country with the intent of using quite a tough legal system against them. Dont get me wrong, what he did was wrong, and I`m sure quite a large setback for valve, but I think something like prohibition or a short / suspended jail sentence would be far more suitable, rather than the serious jail time he would get because he offended a large company in the good ole u-s of a.

Most european countries will not extradite their citisens to the USA because USA has the death penalty which is against the human rights.

oshin:
What valve were doing was pretty dubious too imom trying to lure somebody to another country with the intent of using quite a tough legal system against them. Dont get me wrong, what he did was wrong, and I`m sure quite a large setback for valve, but I think something like prohibition or a short / suspended jail sentence would be far more suitable, rather than the serious jail time he would get because he offended a large company in the good ole u-s of a.

I agree. I think 2 years on probation is better than whatever ridiculously high punishment he would get in the US. I doubt Valve lost that much money because of the stolen scource code, because the people that downloaded it were probably the same people who would have pirated Half-Life 2 when it came out anyway.

Does this mean that Valve is the new Internet Superheroes?

miracle2k:

Baby Tea:
Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive.

They do, with respect to foreigners, see for example:

http://en.wikipedia.org/wiki/List_of_United_States_extradition_treaties

AFAIK extradition of citizens is a no-go most everywhere, though.

They can also link up like Voltron and fight interstellar bad guys... but Mexico gets the shins.

VALVe, you awesome, awesome, company.

A shame he wised up. They tipped their hand too soon, I guess. But still, that's pretty damn funny. But I have trouble imagining what kind of response this would have gotten if it had worked fully. Would people applaud or scold VALVe? And what of Germany?

Of course, when the Combine come and conquer Earth, none of it will matter.

Xaryn Mar:
Most european countries will not extradite their citisens to the USA because USA has the death penalty which is against the human rights.

the human rights? I was unaware there was an absolute list of this sort of thing.

http://xkcd.com/468/

Anyhow, I doubt the death penalty was on the table for this case. From what I have seen, extradition goes fine as long as the crime does not run the chance of a death penalty or if the prosecutor takes the penalty off the table.

The one question I have is why did Valve have their source code on a network if they were still working on it? Not only did they run the risk of having it hijacked, which it was, but it leaves their computer, no doubt a top of the line machine(s), open to hacks and bug exploits. It's not like it would be that hard to transfer the data to flash memory, then to the network when it was finished.

The least they could have done is used a Linux or Unix based system, which is almost impossible to hack if configured the right way. And for a company full of techie game devs, that should be common knowledge. I'm only in my 3rd semester of college for network administration and even I know that.

Oh Valve you crafty kids, you proved hackers are catchable (somewhat)

Propagandasaurus:

They can also link up like Voltron and fight interstellar bad guys... but Mexico gets the shins.

LOL, you sir are a welcome addition to the 'saurus club :)

Propagandasaurus:

miracle2k:

Baby Tea:
Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive.

They do, with respect to foreigners, see for example:

http://en.wikipedia.org/wiki/List_of_United_States_extradition_treaties

AFAIK extradition of citizens is a no-go most everywhere, though.

They can also link up like Voltron and fight interstellar bad guys... but Mexico gets the shins.

pointless bump, why would you do that?

Zeeky_Santos:

Propagandasaurus:

miracle2k:

Baby Tea:
Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive.

They do, with respect to foreigners, see for example:

http://en.wikipedia.org/wiki/List_of_United_States_extradition_treaties

AFAIK extradition of citizens is a no-go most everywhere, though.

They can also link up like Voltron and fight interstellar bad guys... but Mexico gets the shins.

pointless bump, why would you do that?

Probably because starting a new thread on a similar topic is frowned upon.

Zeeky_Santos:

Propagandasaurus:

miracle2k:

Baby Tea:
Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive.

They do, with respect to foreigners, see for example:

http://en.wikipedia.org/wiki/List_of_United_States_extradition_treaties

AFAIK extradition of citizens is a no-go most everywhere, though.

They can also link up like Voltron and fight interstellar bad guys... but Mexico gets the shins.

pointless bump, why would you do that?

I did it for the lulz. I'm... I'm just so goddamn sorry.

Chipperz:

Zeeky_Santos:

Propagandasaurus:

miracle2k:

Baby Tea:
Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive.

They do, with respect to foreigners, see for example:

http://en.wikipedia.org/wiki/List_of_United_States_extradition_treaties

AFAIK extradition of citizens is a no-go most everywhere, though.

They can also link up like Voltron and fight interstellar bad guys... but Mexico gets the shins.

pointless bump, why would you do that?

Probably because starting a new thread on a similar topic is frowned upon.

Propagandasaurus:

Zeeky_Santos:

Propagandasaurus:

miracle2k:

Baby Tea:
Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive.

They do, with respect to foreigners, see for example:

http://en.wikipedia.org/wiki/List_of_United_States_extradition_treaties

AFAIK extradition of citizens is a no-go most everywhere, though.

They can also link up like Voltron and fight interstellar bad guys... but Mexico gets the shins.

pointless bump, why would you do that?

I did it for the lulz. I'm... I'm just so goddamn sorry.

you don't bump or create a new thread, both are frowned upon, you just missed an opportunity to voice your opinion, thats it. done.

Zeeky_Santos:

Chipperz:

Zeeky_Santos:

Propagandasaurus:

miracle2k:

Baby Tea:
Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive.

They do, with respect to foreigners, see for example:

http://en.wikipedia.org/wiki/List_of_United_States_extradition_treaties

AFAIK extradition of citizens is a no-go most everywhere, though.

They can also link up like Voltron and fight interstellar bad guys... but Mexico gets the shins.

pointless bump, why would you do that?

Probably because starting a new thread on a similar topic is frowned upon.

Propagandasaurus:

Zeeky_Santos:

Propagandasaurus:

miracle2k:

Baby Tea:
Really? I had no idea! I figured all countries kind of worked together (To some extent, at least) in criminal cases. I guess I was just naive.

They do, with respect to foreigners, see for example:

http://en.wikipedia.org/wiki/List_of_United_States_extradition_treaties

AFAIK extradition of citizens is a no-go most everywhere, though.

They can also link up like Voltron and fight interstellar bad guys... but Mexico gets the shins.

pointless bump, why would you do that?

I did it for the lulz. I'm... I'm just so goddamn sorry.

you don't bump or create a new thread, both are frowned upon, you just missed an opportunity to voice your opinion, thats it. done.

Why do I keep hearing "use the search" then? The person who posts obviously has something pertinent to say, and rather than making a whole new thread, they are doing what people tell them. I haven't heard anything about a specific timeframe in which a post can be made.

I didn't realize this was a bumped thread when I replied, but the easiest thing to do if bumped threads bother you is not to read them.

paypuh:
Snippity snip

Hey, I wasn't talking to you, you didn't bump the damn thread. All you need is a good dose of the welcome speech.

megapenguinx:
Oh Valve you crafty kids, you proved hackers are catchable (somewhat)

Actually they pulled a Mission Impossible. Remember that white blond antagonist who's after the NOC list? And when he got freed from capture that the "enemy was re-assured he's uncatchable"?

That's what happened just now.

Zeeky_Santos:

paypuh:
Snippity snip

Hey, I wasn't talking to you, you didn't bump the damn thread. All you need is a good dose of the welcome speech.

Well, I'm the one who replied. Forums are a place for conversations, right? And I was lurking for long enough before I joined to know the spiel, but thanks anyways.

Look man, you can either reply to my original post to you or not. It makes no difference to me, I don't go looking for threads to bump from years ago, but I have seen enough of "use the search feature" from people to make a comment about it. Knowing where you are getting these rules of etiquette from would be helpful.

 

Reply to Thread

Log in or Register to Comment
Have an account? Login below:
With Facebook:Login With Facebook
or
Username:  
Password:  
  
Not registered? To sign up for an account with The Escapist:
Register With Facebook
Register With Facebook
or
Register for a free account here