Hacker Who Stole Half-Life 2's Source Code Interviewed For New Book (arstechnica.com) 192
"Can you love a game so much you must take its sequel?" asks Ars Technica, posting an excerpt from the new book "Death By Video Game: Danger, Pleasure, and Obsession on the Virtual Frontline."
At 6am on May 7, 2004, Axel Gembe awoke in the small German town of Schonau im Schwarzwald to find his bed surrounded by police officers bearing automatic weapons... "You are being charged with hacking into Valve Corporation's network, stealing the video game Half-Life 2, leaking it onto the Internet, and causing damages in excess of $250 million... Get dressed..." The corridors were lined by police, squeezed into his father's house...
Gembe had tried creating homegrown keystroke-recorders specifically targeted at Valve, according to the book, but then poking around their servers he'd discovered one which wasn't firewalled from the internal network. Gembe spent several weeks discovering notes and design documents, until eventually he stumbled onto the latest version of the unreleased game's source code. He'd never meant for the code to be leaked onto the internet -- but he did share it with another person who did. ("I didn't think it through. The person I shared the source with assured me he would keep it to himself. He didn't...")
Eventually Gembe contacted Valve, apologized, and asked them for a job -- which led to a fake 40-minute job interview designed to gather enough evidence to arrest him. But ultimately a judge sentenced him to two years probation -- and Half-Life 2 went on to sell 8.6 million copies.
Gembe had tried creating homegrown keystroke-recorders specifically targeted at Valve, according to the book, but then poking around their servers he'd discovered one which wasn't firewalled from the internal network. Gembe spent several weeks discovering notes and design documents, until eventually he stumbled onto the latest version of the unreleased game's source code. He'd never meant for the code to be leaked onto the internet -- but he did share it with another person who did. ("I didn't think it through. The person I shared the source with assured me he would keep it to himself. He didn't...")
Eventually Gembe contacted Valve, apologized, and asked them for a job -- which led to a fake 40-minute job interview designed to gather enough evidence to arrest him. But ultimately a judge sentenced him to two years probation -- and Half-Life 2 went on to sell 8.6 million copies.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Germany. Not USA.
Still, doesn't "Axel Gembe awoke in the small German town of Schonau im Schwarzwald to find his bed surrounded by police officers bearing automatic weapons... The corridors were lined by police, squeezed into his father's house..." seem excessive to arrest a guy who hacked a game company?
Re: (Score:2)
Re: (Score:2)
Why should they have to waste their time (and thus my money (--if it were in the US)) waiting for him to leave his home?
Re: (Score:2)
lack of international cooperatiom (Score:1, Interesting)
The hacker's actions were a crime both in Germany and the United States. The crime is partly in the jurisdiction of the United States because it was against an American company. Normally it's pretty straightforward to extradite someone given the evidence. It was a courtesy for the FBI to notify German authorities of the plan and provide them with the evidence. I don't see any way the actions of the German authorities were justified to prevent the hacker from being charged and standing trial in the United St
Re:lack of international cooperatiom (Score:5, Insightful)
Because he caused a corporation to hypothetically lose some money, the worst possible crime in the US, and the Germans didn't want to see someone get some wildly disproportionate 50 year sentence for that.
A hypothetical sentence for a hypothetical loss (Score:2)
Re: (Score:3, Insightful)
Re: (Score:3)
The USA held the record for the longest prison sentence for computer hacking [guinnessworldrecords.com] for quite a while. Turkey recently stepped up, however, and showed us all what over-the-top [ibtimes.co.uk] really means.
Re: (Score:2)
Both examples are of hacking bank cards or bank accounts. So these sentences are not just for the hacking, but also for money theft.
Details don't matter in slashdot when it comes to sacred cows. Some folks here would turn a blind eye to even pedophilia if that means changing the goalposts for their sacred arguments.
Re: (Score:2)
Re:lack of international cooperatiom (Score:5, Interesting)
I don't see any way the actions of the German authorities were justified to prevent the hacker from being charged and standing trial in the United States.
US courts have a tendency to hand down draconian sentences for even trivial infractions thanks to the 'come down on him like a ton of bricks' attitude to justice among politically ambitious US judges and prosecutors. This has resulted in an extreme reluctance in other countries to extradite people to the US in cases where there is any chance that the prisoner might receive 25 years to life just to further some US offiial's political ambitions for something he'd get a 5 year sentence for in Europe .
Re: (Score:3)
US courts have a tendency to hand down draconian sentences for even trivial infractions thanks to the 'come down on him like a ton of bricks' attitude to justice among politically ambitious US judges and prosecutors.
My understanding is that many judges in the USA are elected, so I wouldn't put the blame on the judges but on the electors. You just get what you (collectively) asked for, for better or worse.
This has resulted in an extreme reluctance in other countries to extradite people to the US
I'm not sure about that. However, some countries, and this includes Germany, forbid extradition of their own nationals [wikipedia.org].
Comment removed (Score:5, Insightful)
Re: (Score:2)
Due to the fact that judges are elected, you get people that are in for revenge, not for justice.
Mod him up! ...that's the problem in a nutshell. Judges and prosecutors should not deal out revenge in response to popular opinion and rage
Re: (Score:2)
Sadly being elected they usually have to take the 'tough on crime' stance... Which for their position means 'hammer anyone they can'. What the public actually tends to want is certain crimes punished harshly (which ones can vary a bit) and the rest they care little about. However the elected judges and others in that chain can't skimp on even one or their opponents will try to claim they aren't 'tough on crime'. So nothing goes over lightly if they can avoid it. So it's not entirely what the voters want, it
Re: (Score:2)
US courts have a tendency to hand down draconian sentences for even trivial infractions thanks to the 'come down on him like a ton of bricks' attitude to justice among politically ambitious US judges and prosecutors.
My understanding is that many judges in the USA are elected, so I wouldn't put the blame on the judges but on the electors. You just get what you (collectively) asked for, for better or worse.
I have never understood how you can have an independent courts in a system where the judges and prosecutors are elected. Not that the old world practice of appointing judges and prosecutors is flawless with it's political appointee problem but at least those judges and prosecutors don't have to whore for campaign funding and votes every few years and they don't get tempted to send people to jail for ridiculously long periods of time to pander to public opinion and make themselves popular in an election year.
Re: (Score:1)
US courts have a tendency to hand down draconian sentences for even trivial infractions thanks to the 'come down on him like a ton of bricks' attitude to justice among politically ambitious US judges and prosecutors.
My understanding is that many judges in the USA are elected, so I wouldn't put the blame on the judges but on the electors. You just get what you (collectively) asked for, for better or worse.
This has resulted in an extreme reluctance in other countries to extradite people to the US
I'm not sure about that. However, some countries, and this includes Germany, forbid extradition of their own nationals [wikipedia.org].
Is there a more extreme manifestation of reluctance to extradite than passing a law forbidding the extradition of your own nationals? Having said that, the USA is not the prime motivator for that law, it's more likely to be countries like Russia, Saudi Arabia, Turkey and the likes where the judiciary is either religiously extreme, completely corrupt or both and jails qualify as a form of hell on earth. Finally, refusal to extradite does not mean the accused gets off scot-free. Any German national the German
Re: (Score:2)
we don't get honest people up for election, but instead a selection of party members that "it's their time" so they are put up in front. Anyone thinking the United States has free elections is completely delusional.
Re: (Score:2)
Re: (Score:2)
I suppose some people will say such weird shit in a place where Charlie Chaplin, one of the richest capitalists of his time, was called a communist.
Re: (Score:2)
Yeah, that justifies a life in jail. Even if it were true.
Re:lack of international cooperatiom (Score:5, Funny)
Re: (Score:2)
Why? When did he work for the KGB [wikipedia.org]?
Re:lack of international cooperatiom (Score:5, Informative)
.... I don't see any way the actions of the German authorities were justified to prevent the hacker from being charged and standing trial in the United States. This is a pretty straightforward application of how international cooperation between law enforcement agencies is supposed to work, yet Germany didn't let that happen.
Germany generally won't extradite their own citizens to stand trial in a foreign country. This has some cultural significance because the DDR (East Germany) used to extradite citizens to the USSR for alleged political crimes.
Nope, not straightforward. (Score:3)
Germany does not extradite its citizens (with very limited exceptions). It's in the constitution. Germany extraditing a German citizen to the US is about as straightforward as introducing a blanket ban on guns in the US - not gonna happen.
Re: (Score:1)
1. He did everything in Germany, so everything falls under German jurisdiction.
2. He seems to be a German citizen, so the German authorities cannot extradite him to a non-EU country. The Constitution prohibits it.
Re: (Score:3)
I don't see any way the actions of the German authorities were justified to prevent the hacker from being charged and standing trial in the United States.
Really? Because it says right there in the article that they arrested Gembe because he'd written malware that used the same exploit as another hacker that they arrested on the same day and thought the two might be connected. Seems like a pretty obvious justification. Maybe you just didn't want to see it.
Re: (Score:3)
From the article:
Re: (Score:2)
Automatic weapons for an illegal download. (Score:5, Insightful)
Can we talk about that? Someone guessed Gabe Newell's password, downloaded some files, leaked them to the internet, and the response to this was to send a small army of heavily armed stormtroopers with automatic weapons to take him into custody with an absurd display of force.
That should be the real story here. We've gone past "corporate personhood" and into "corporate godhood", we're treating people whose only crime was potentially costing a fantastically wealthy corporation some pitiful percently of their quarterly profits the same way we treat active shooters and terrorists in the middle of an attack.
Re: (Score:1)
What makes you think that Corporation could not possibly be divine?
It is nameless and immortal.
It is not constrained by morals. Instead it is the source of morality.
It is everywhere and all-powerful.
It works in mysterious ways.
In fact, whole papers [bepress.com] have been written for this topic, and I'd say they're pretty convincing. Much more convincing than the New Fairytale.
Re: (Score:3)
In other words, it's a religion.
Maybe it's time for another separation of church and state?
Re: (Score:2)
In other words, it's a psychopath.
Re: (Score:2)
In other words, it's a psychopath.
Good, but sociopath is a bit more encompassing of the characteristics of a for-profit Corporation.
They're the new gods, replacing Hollywood stars – the original replacements.
They're more powerful than most governments.
They write the first drafts of many, many of the bills that become law.
Taxpaying citizens pay to maintain the infrastructure upon which they rely, but do not pay for.
Obey.
All of this is thanks to that stupid US Supreme Court Decision, so long ago, regarding railroad companies, but that
Re: (Score:2)
Every time a foreign country refuses to enforce draconian IP laws shoved down their throats via omnibus treaties, the MAFIAA gets another digit of the nuclear launch codes. You don't want to let their bean-counters decide that a smoking ruin where $0 of piracy takes place, is more profitable than allowing the victim the grace of their price-fixed goods.
Re: (Score:3)
the MAFIAA gets another digit of the nuclear launch codes
You mean 0?
http://www.dailymail.co.uk/new... [dailymail.co.uk]
Re: (Score:2)
Not to take away from that article, but calling 15 years "nearly 20 years" was unnecessarily confusing.
Re: (Score:2)
the MAFIAA gets another digit of the nuclear launch codes
You mean 0?
http://www.dailymail.co.uk/new... [dailymail.co.uk]
True about 00000000, although I would recommend against ever citing The Daily Mail (Daily FAIL) as a source – which in its article cites a blog. Far better is Eric Schlosser's somewhat recent book "Command and Control." It's a scary read, detailing how close we were to accidental nuclear Armageddon, and many more times than you think. All in the book is thoroughly backed up by citations and de-classified documents.
Re: (Score:2)
Given police budgets something had to be given up on elsewhere to fund this farce.
Re: (Score:1)
Actually, if you RTFA, you'll see that the German police were doing their job and did not cooperate with attempts to submit him to a show trial in an overseas shithole he had never set foot in.
FTFY.
Re: (Score:2)
Re: (Score:2)
What blocks extradition isn't being a hacker, it's having German citizenship. If someone doesn't have it, he's fair game for extradition.
Re: (Score:2)
Noob mistake. (Score:2)
He should have just paid the $250M in damages instead of going to a court.
Re: (Score:2)
Here's two of the scripts I used, worth each 125M.
What? Hey, you started making up numbers, so why shouldn't I?
So not the sharpest knife in the drawer (Score:2)
"The person I shared the source with assured me he would keep it to himself. He didn't..."
Well duh.
Hacker stills: 7/10
Social skills: 0/10
Re: (Score:1)
Spelling skills: 0/10
Re: (Score:2)
One HUNDRED BILLION dollars! (Score:1)
"You are being charged with hacking into Valve Corporation's network, stealing the video game Half-Life 2, leaking it onto the Internet, and causing damages in excess of $250 million..."
Can't stand how companies attach such arbitrary bullshit numbers to this kind of thing. Two-hundred and fifty million dollars is literally just a number some person with great self-interest in picking a huge exaggerated number pulled out their ass with no way to quantify in any realistic manner.
Re: (Score:2, Interesting)
I guess, that's how much Valve had to pay the makers of the Havoc physics engine, when it was discovered, that they had copied their code verbatim into the HL2 source
Continued Access To Valve's Systems??? (Score:2, Insightful)
TFA says:
"But there were concerns about the ongoing access that Gembe had to Valve's servers and the potential damage he could still cause. So the FBI contacted the German police in order to alert them to the plan."
Not much of an expert here, but they talked to him for 40 minutes, asking him about the details of the breach, which he apparently was willing to explain in detail and they couldn't shut him out?
Re: (Score:2)
you're a fucking idiot.
"oh, so that's how you got in. okay. do you know any other backdoors?"
"nope."
"promise?"
"yup!"
"well, that's good enough for us!"
The cardinal sin: Never contact your victim (Score:2)
Especially not in a way that they can trace you.
The urban legend is as old as the one about the hooker asking the John whether he's a policeman and if he is he has to answer truthfully. He doesn't. Likewise, nobody is going to give you a job for hacking them.
Think about it: One of the key requirements when working for someone in such an environment is trust. He has to trust you that you will not sabotage his project, that you will not steal his project, that you will not allow others to gain access to it. A
Moral of the story... (Score:2)
Dont be stupid...
Giving it to someone random on the internet and trusting them. Contact the company.... All of the above is incredibly stupid of you are a hacker.
Dear kiddies, rule #1 - keep your mouth shut.
Rule #2 - if you want to talk about something, see rule #1.
Re: (Score:2)
Exactly.
#1 Rule about hacking: STFU aka "do NOT brag about it."
I guess he wanted "recognition" for how 3l33t he was.
Wow (Score:2)
"Eventually GEMBLE contacted Valve, apologized, and asked them for a job"
My mouth is still hanging open. Some people really, really have no idea how this world works.
"Damages in excess of $250 million" (Score:2)
I see cop math is not limited to the USA.
Re: (Score:2, Funny)
Retarded. You can't expect autocorrect to handle a name.
Re: (Score:1)
The real retarded is the one who expects a job from who he stole from.
Re: (Score:1)
It's hard to point out a non-retarded person in this story from conception to publication.
Re: (Score:2)
He stole the time and the option of Valve to release their code as they pleased.
Someone needs to fucking steal episode 3 then!
Re: (Score:2)
Exfiltrated would be a better word. Illegally copying would be another few. Dangerously stupid yet more.
But understand this. As far as the majority of people would understand this, he 'stole' data. That is to say, the common definition for the word 'steal' includes copying something on a computer you do not have the right to.
Re: (Score:2)
The common definition requires taking something away so that the original owner no longer has accessed to it.
[citation needed]
The common definition does not specify that at all. It is just 'taking something from the owner'.
Re: (Score:2)
The common definition requires taking something away so that the original owner no longer has accessed to it.
[citation needed]
The common definition does not specify that at all. It is just 'taking something from the owner'.
Yeah, and if I copy your whatever, I haven't taken it.
Re: (Score:2)
Sure you did, you copied it and took the copy for yourself. You now have it in your possession. Tell me how that isn't taking?
Re: (Score:2)
Re: (Score:2)
No, it doesn't. Stealing means taking something that does not belong to you. If you steal my ideas, you've stolen them.
You are basically saying "I don't believe intellectual property is property, and I will redefine the language so that in the way I use it it is not property."
http://www.dictionary.com/browse/steal?s=t
I don't buy this, at all.
When you have an idea, that is as close as you can get intellectual property. That information is in your head and is yours. As soon as you tell anyone, without taking any steps to protect said information, or at least it's use (but that's something different) it's in their head too. You can make no claim or assertion as to what a person does with the information in their heads. You can make all the claims you want but there's no way at all to prove ownership, or that you were th
Re: (Score:2, Insightful)
Wow, you are all over this thread. Okay, here goes. They had their ideas, they stored them on their own computers. Someone hacked into them and stole them. They stole their ideas, that were rigidly defined. They copied them, they took the copy they made and had it in their possession. That is stealing. Taking something that doesn't belong to you IS stealing. The whole 'denying it to the owner' argument is BS. If I steal something physical from someone, then give it back in perfect condition before they need
Re: (Score:2)
Re: (Score:2)
They had their ideas, they stored them on their own computers.
Okay.
Someone hacked into them and stole them.
No.
They stole their ideas,
No.
that were rigidly defined.
So?
They copied them,
Yes.
they took the copy they made
No. You don't "take a copy you make". You just "make a copy". Then there's a copy, and the original. That's why it's not stealing.
and had it in their possession.
They had in their possession a copy of some copyrighted material. That is copyright infringement.
That is stealing.
No. It's theft. If it were stealing, it would have been covered by existing law, and there would have been no need to create copyright law. But theft is fundamentally different because someone is deprived of something. Aha, you say, but when you violate copyright, so
Re: (Score:2, Insightful)
Media industry has nothing to do with it. Stealing is defined as 'taking something without permission', which is what this guy did. He took a copy of the code without permission. That is stealing.
Re: (Score:2)
He took a copy of the code without permission. That is stealing.
He made a copy of the code. Unless you're insinuating there were two folders and he cut/took one leaving them one folder?
Re: (Score:2)
He took a copy of the code without permission. That is stealing.
No. He made a copy of the code (that is, he copied it) without permission. That is copyright infringement. You could make a strong argument that it was theft if he had deleted the original after making a copy, putting aside the potential existence of backups which are not really relevant to the argument since to an attacker, they are imaginary.
Re: (Score:2, Insightful)
How would he have exfiltrated the data? He would have made a copy, then took that copy (out of memory in this case). You are being pedantic as all heck about that, so I feel I have a right to be pedantic back.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Very few people who think just like me would consider copying a form of theft.
Fixed that for you. None of the common dictionary definitions for "steal" mention depriving the original owner of anything. The one that seems most appropriate in this context is, "to appropriate (ideas, credit, words, etc.) without right or acknowledgment."
The fact that someone is familiar with the accepted meaning of words does not mean they've been brainwashed by the media industry. That you subscribe to a non-standard definition suggests that you've been engaging in a practice commonly referred to as "d
Re: (Score:3)
Uh yes, there was a theft of a product. The fact that that product was virtual is irrelevant. The same as if you signed a contract to create some software, wrote the program, and then the company you wrote the program for refused to because you because "information wantz to be free!".
Re: (Score:3)
No product was stolen. The guy may have violated several laws, but he did not remove any objects from their owner's possession - the essential condition for an act to be defined as theft. It wasn't theft anymore than it was arson, loitering or fishing without a permit.
It's fascinating to me that this mischaracterization of the meaning of "steal" has hung around for as long as it has. I suspect that most of the people who believe this have never bothered themselves to consult a dictionary.
Re: (Score:2)
It's fascinating to me that this mischaracterization of the meaning of "steal" has hung around for as long as it has. I suspect that most of the people who believe this have never bothered themselves to consult a dictionary.
No. They know the truth. They are simply willfully denying it in order to support some other belief that can't handle the notion that copyright infringement is not theft. Probably it has to do with justifying the amount of money they've spent on their My Little Pony DVD collection.
Re: (Score:2)
It's fascinating to me that this mischaracterization of the meaning of "steal" has hung around for as long as it has.
IS it a mischaractarization, really? I mean, look we're talking about something that in the physical world has a very specific meaning, AND a very specific set of psychological and physical effects that fail to be present when something is digitally copied . I doubt, for example, that you'd have the same sort of horror if someone copied your laptop, and walked away with it, than you would if they actually just outright stole it. I realize I am not the best at articulating my thoughts, so if I am unclear
Re: (Score:2)
It's fascinating to me that this mischaracterization of the meaning of "steal" has hung around for as long as it has.
IS it a mischaractarization, really? I mean, look we're talking about something that in the physical world has a very specific meaning, AND a very specific set of psychological and physical effects that fail to be present when something is digitally copied .
Psychological and physical effects have nothing at all to do with the definition of "steal". Now, if he were being sued for emotional distress, you might be on to something. It's really not that complicated. If you're in possession of something that doesn't belong to you as a result taking that something without the owner's permission, you have stolen it. And please note that the definition of "take" doesn't have anything to do with depriving the original owner of possession.
Re: (Score:2)
You are incorrect: identity theft.
Re: (Score:3, Interesting)
He forgot to repeat "I didn't think it through" when he called Valve, told them he hacked into their server, copying the source code to their product, resulting in the source code for their main product being released publicly, and then asked for a job.
Is there any company where that situation would happen and it ends with "you're hired!"
Re: it wuz haxx0rz! (Score:3, Interesting)
The nsa, on multiple occasions.
Re: (Score:2)
So the NSA is stupid? I doubt this.
One of the key elements when it comes to hiring someone for a job in security is trust. Give me ONE good reason to trust someone who has already shown he has no problem betraying me.
Re: (Score:3)
Read up on the Star Trek set thing. That story alone confirms it several times.
High ranking jobs at the NSA are a sinecure used as a reward for people that have never worked for a similar group before.
The "Brownie, you're doing a heck of a job" thing applies far more at the NSA than it did at FEMA.
Re: (Score:2)
Unless the NSA is any different than other corporations (and why should it be?), the work is not done at the level where friends of friends are flattening their rump. It's quite possible or even likely that the people who are actually working there got their job the good old fashioned way, i.e. by knowing something and being able to do something.
Re: (Score:3)
If you look up the Snowden stuff (which would never have happened if the NSA has their shit together instead of employing dodgy subcontractors) you can see for yourself that
Re: (Score:2)
It's cheaper to have him behind bars than having him on the payroll.
Re: (Score:2)
Re: it wuz haxx0rz! (Score:2)
Considering that rabid fans are part of some emotional cult that is a good idea, sure
Re: it wuz haxx0rz! (Score:1)
i always thought the main interest point was that valve lied about scripted ai.
Re:it wuz haxx0rz! (Score:4, Insightful)
He forgot to repeat "I didn't think it through" when he called Valve, told them he hacked into their server, copying the source code to their product, resulting in the source code for their main product being released publicly, and then asked for a job.
Is there any company where that situation would happen and it ends with "you're hired!"
Never underestimate the naivete and gullibility of a young person with a dream. Even as we speak, there are tens of thousands of kids across the country taking out huge student loans to get degrees that will barely qualify them for barista jobs at Starbucks--all because someone told them to "pursue your dreams" without adding the vital addendum "But have a realistic backup plan."
Re: (Score:2)
He forgot to repeat "I didn't think it through" when he called Valve, told them he hacked into their server, copying the source code to their product, resulting in the source code for their main product being released publicly, and then asked for a job.
Is there any company where that situation would happen and it ends with "you're hired!"
Never underestimate the naivete and gullibility of a young person with a dream. Even as we speak, there are tens of thousands of kids across the country taking out huge student loans to get degrees that will barely qualify them for barista jobs at Starbucks--all because someone told them to "pursue your dreams" without adding the vital addendum "But have a realistic backup plan."
Plus, there are a number of tales of "former hackers" hired for security work. The part of the story that usually gets left out of discussions of this phenomena is the amount of jail time or legal charges the person had to sort out before they got that job. Very few of them jumped from "I totally committed a felony you were the victim of" to "I'd like $150k and a car allowance."
Re: (Score:1)
The Game contacted Valve - it had a built-in 'call home' feature...
Re: (Score:2)