I need the assistance of the community

Status
Not open for further replies.
Originally posted by pblse
If the game is finished, release it as quickly as possible to a void too many hacks being created.

What else can they do ? rewrite the whole engine again ? The source isn't going away anytime soon no matter if they catch the person that hacked their network.

The game needs to be released today ! Patch it instead of delaying it further.

Look up the phrase "Pipe Dream". Apply.
 
SabreWhore
Level 1 - [registered]

Registered: Feb 2003
Location:
Posts: 1096
I have completed my musing on this subject and I have the truth of what happened. Many of you wont believe me, but I am convinced I am right none the less

I was trying to put things together in my head and hadnt got the final piece, now I have. the last piece was WHY he announced it as he did, what was he aiming for. I had to really study the posts over and over to understand its impetus but I am 100% convinced its targeted AT the people who stole it.

The post by gabe Newell was designed to support the ruse he implemented.

Heres the scenario.

Gabe discovers someone has hacked his machine. They have logged keystrokes and are clearly loooking for HL2.

So what does he do? Naturally he is comprimised so he formats the machine. Obviously if you suspect virus or trojan you isolate the machine from the Intranet and if your security has failed you isioplate the Intranet from the Internet. So he does this.

Then he comes on a great idea. What if he lets the people THINK they have got him. they get decoy code, Gabe gets lots of Hype and Free advertising, sympathy AND an excuse for the delay and the late annoucnement. Killer manouver.

So they slap together some clever ruse code and they stick Gabes machine complete with bait onto the network connected to the web and they wait.

Now we have the aprt that was eluding me. The announcement. What is he trying to achieve. Firstly theres the step by step guide. Why?
Thats not normal, so why is he dojng it. he wants someone to know EXACTLY what happened in the setaling of the code. This to me says its trageting someone who already knows. he wants the thief to know it is them.

Second he thorws in Microsoft Outlook. Huge exploits and commonly know for being insecure and everyone likes to balme Microsoft. Easy, people arent going to question a weakness in security caused by Microsoft Oulook.

Thirdly the annoucement of the stolen code. IF it was real you would want to convince people it WASNT real wouldnt you? That way people are less likely to go after it.

If it wasnt real however you wouldnt mind them thinking it was. If you SET IT UP to be stolen yourself, you would want the people that stole it and everyone else to believe that what was out there was the real thing.

Bingo. There we have the Reality of Gabes annmouncement. its not an announcement at all its a very cleverly worder confirmation of soemthing he wants to be believed because he staged it this way.

He saw an opportunity and he took it. Clever boy Mr Newell.

On top of everything esle the little 'someone accessed my mail' throw away line also covers him for any emails he might have sent saying 30th september was still a go.

Its actually quite a clever ruse, but its a ruse for sure.

You have to admit my thinking on this makes very good sense. More than what gabe is asking you to believe ;)
 
Steam

I know this is a dated subject, but I never had my say in it. Steam sucks and Valve is being attacked because of it, and rightly so. Steam was perhaps the biggest botch in recent software history. It was almost as bad as a Microsoft product (who a certain some1 worked for *cough*Gabe*cough). Gabe is playing god here folks, can't you see!
 
I am in r&d just not software.
If I saw 5 years of my work going out like this I would be outside someone's door with a set of jumper cables and a pogo stick talking "prepare to be violated"
 
Sorry for sounding kinda outa place on this, but isnt it a major crime to infect someones computer and steal a code like that? Sorry for sounding new, but i am and i just wanted to konw.
 
Originally posted by seinfeldrules
Sorry for sounding kinda outa place on this, but isnt it a major crime to infect someones computer and steal a code like that? Sorry for sounding new, but i am and i just wanted to konw.

Actually no its not. It breaks the Automic Energy Act and a few others that state things about "...unlawful entry into a secure system." It actually becomes a Federal Crime.
 
****, time to go private dick style boys. *gets naked, puts on nothing but a trench coat, dark glasses, and a dick tracy style hat* Alright, lets bust some perps.

Ima pull a Columbo on some wegro asses n get to the bottom of this faster than a box of twinkies.
 
Heres the deal with the hacking issue, its considered hacking and illegal if:

The Computer Fraud and Abuse Act (as amended Oct. 3, 1996)
Section 1030. Fraud and related activity in connection with computers

(a) Whoever--

(1) having knowingly accessed a computer without authorization or exceeding authorized access, and by means of such conduct having obtained information that has been determined by the United States Government pursuant to an Executive order or statute to require protection against unauthorized disclosure for reasons of national defense or foreign relations, or any restricted data, as defined in paragraph y of section 11 of the Atomic Energy Act of 1954, with reason to believe that such information so obtained could be used to the injury of the United States, or to the advantage of any foreign nation, willfully communicates, delivers, transmits, or causes to be communicated, delivered, or transmitted, or attempts to communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not entitled to receive it, or willfully retains the same and fails to deliver it to the officer or employee of the United States entitled to receive it;

(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains--

(A) information contained in a financial record of a financial institution, or of a card issuer as defined in section 1602(n) of title 15, or contained in a file of a consumer reporting agency on a consumer, as such terms are defined in the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.);
(C) information from any protected computer if the conduct involved an interstate or foreign communication;

(3) intentionally, without authorization to access any nonpublic computer of a department or agency of the United States, accesses such a computer of that department or agency that is exclusively for the use of the Government of the United States or, in the case of a computer not exclusively for such use, is used by or for the Government of the United States and such conduct affects that use by or for the Government of the United States;

(4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period;

(A) knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;

(B) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or

(C) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage;

(6) knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed without authorization

(B) such computer is used by or for the Government of the United States;

(7) with intent to extort from any person, firm, association, educational institution, financial institution, government entity, or other legal entity, any money or other thing of value, transmits in interstate or foreign commerce any communication containing any threat to cause damage to a protected computer;

shall be punished as provided in subsection (c) of this section.

(b) Whoever attempts to commit an offense under subsection (a) of this section shall be punished as provided in subsection (c) of this section.

(c) The punishment for an offense under subsection (a) or (b) of this section is--

(1)

(A) a fine under this title or imprisonment for not more than ten years, or both, in the case of an offense under subsection (a)(1) of this section which does not occur after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; and

(B) a fine under this title or imprisonment for not more than twenty years, or both, in the case of an offense under subsection (a)(1) of this section which occurs after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; and

(2)

(A) a fine under this title or imprisonment for not more than one year, or both, in the case of an offense under subsection (a)(2), (a)(3), (a)(5)(C), or (a)(6) of this section which does not occur after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; and

(B) a fine under this title or imprisonment for not more than 5 years, or both, in the case of an offense under subsection (a)(2), if--

(i) the offense was committed for purposes of commercial advantage or private financial gain;

(ii) the offense was committed in furtherance of any criminal or tortious act in violation of the Constitution or laws of the United States or of any State; or

(iii) the value of the information obtained exceeds $5,000;

(C) a fine under this title or imprisonment for not more than ten years, or both, in the case of an offense under subsection (a)(2), (a)(3) or (a)(6) of this section which occurs after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; and

(3)

(A) a fine under this title or imprisonment for not more than five years, or both, in the case of an offense under subsection (a)(4), (a)(5)(A), (a)(5)(B), or (a)(7) of this section which does not occur after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; and

(B) a fine under this title or imprisonment for not more than ten years, or both, in the case of an offense under subsection (a)(4), (a)(5)(A), (a)(5)(B), (a)(5)(C), or (a)(7)of this section which occurs after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; and

[former paragraph (4) stricken effective Oct. 11, 1996].

(d) The United States Secret Service shall, in addition to any other agency having such authority, have the authority to investigate offenses under subsections (a)(2)(A), (a)(2)(B), (a)(3), (a)(4), (a)(5), and (a)(6) of this section. Such authority of the United States Secret Service shall be exercised in accordance with an agreement which shall be entered into by the Secretary of the Treasury and the Attorney General.

(e) As used in this section--

(1) the term "computer" means an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but such term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device;

(2) the term "protected computer" means a computer--

(A) exclusively for the use of a financial institution or the United States Government, or, in the case of a computer not exclusively for such use, used by or for a financial institution or the United States Government and the conduct constituting the offense affects that use by or for the financial institution or the Government; or

(B) which is used in interstate or foreign commerce or communication;

(3) the term "State" includes the District of Columbia, the Commonwealth of Puerto Rico, and any other commonwealth, possession or territory of the United States;

(4) the term "financial institution" means--

(A) an institution with deposits insured by the Federal Deposit Insurance Corporation;

(B) the Federal Reserve or a member of the Federal Reserve including any Federal Reserve Bank;

(C) a credit union with accounts insured by the National Credit Union Administration;

(D) a member of the Federal home loan bank system and any home loan bank;

(E) any institution of the Farm Credit System under the Farm Credit Act of 1971;

(F) a broker-dealer registered with the Securities and Exchange Commission pursuant to section 15 of the Securities Exchange Act of 1934;

(G) the Securities Investor Protection Corporation;

(H) a branch or agency of a foreign bank (as such terms are defined in paragraphs (1) and (3) of section 1(b) of the International Banking Act of 1978); and

(I) an organization operating under section 25 or section 25(a) of the Federal Reserve Act. (5) the term "financial record" means information derived from any record held by a financial institution pertaining to a customer's relationship with the financial institution;

(6) the term "exceeds authorized access" means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter;

(8) the term "damage" means any impairment to the integrity or availability of data, a program, a system, or information, that--

(A) causes loss aggregating at least $5,000 in value during any 1-year period to one or more individuals;

(B) modifies or impairs, or potentially modifies or impairs, the medical examination, diagnosis, treatment, or care of one or more individuals;
(f) This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an intelligence agency of the United States.
 
"SabreWhore
Level 1 - [registered]"


This is the sherlock holmes here, i copied and pasted it from the nforce forums, this is the guy that deserves the credit, and yes his story makes all sense


As a side note for the not so proper speaking english guy
 
Not to be a dick or anything but it sounds like he got rootkitted (the whole right click and explorer crash thing).

As for skill level of the hacker(s) involved i would rate it (from the information in the post) a 6 or even 5. Face it its not hard to use published exploits in IE controls to dl a file and execute it with out the user not knowing it (<object data> anyone?). Well for what it is worth i would offer my services to Valve for free to help them analyze what happened and how it took place, i would even be willing to help them foritfy their systems and policies. And yes i am capable to do this and heck even certified (CISSP). So for everyone thinking that the person(s) who did this is some high caliber hacker who will never be caught think again, if they were so damn good what are they doing messing around modifying remoteanywhere software? When they could easily build keylogging into a root kit and NO ONE WOULD BE ABLE TO TELL. Unless of course your shoddy rootkit crashed everytime you right clicked. ;)

Sorry to hear about the attack, but i am sure this wont happen again to these guys. And dont worry people valve isnt going to go under (unless their legal dept didnt do a good job in securiing the license agreement with the Havok engine people). Even if they didnt im sure that valve wont be found negligent in the courts so they wont have to bear much if any liability for the crime at hand. So good luck to valve and im sorry they had to lose so much face. But keep on ticking guys and keep up the kick ass work on the games i cant wait to see the game in shrinkwrap!

-InfoSecWillie
 
Originally posted by Cleaver
"SabreWhore
Level 1 - [registered]"


This is the sherlock holmes here, i copied and pasted it from the nforce forums, this is the guy that deserves the credit, and yes his story makes all sense

I think the guy might be right, we know for a fact that the stolen code is crippled and uncompilable.
 
No reason to get bitchy at valve for not telling us every idea or possibility that pops into their head.

they won;t tell us something unless its definate, and with development, how many things status is going at fixed rate?

Mis-communication does not validate being hacked and having your product prematurely revealed to the world.

their community service (information from VALVe Only thread) should be enough to be respected, but no.

They keep us out of the loop for a few things and we drag out the cross and nails.

Not all of us, just the people who can't deal with a delay.
Anyone remember how long N64 was delayed?
 
Originally posted by LoneDeranger
I think the guy might be right, we know for a fact that the stolen code is crippled and uncompilable.

ummm, i compiled it (0.o)
 
so happens i read portugese as well :) Just dont type it so well.

Cheers
 
So whoever stole the source code for the game stole the whole engine that ran it? Or the whole game itself?

Sorry im still kinda new with this stuff;(
 
Hi, wazzup....I see both sides of the spectrum here when it comes to priceless intellectual properties being lost to network security lapses. I agree that this is an awful tragedy. But at the same time any property holder as truly wealthy as Valve should have invoked the very highest security level matching that of the deepest levels of a silent government agency. But what if it came from within Valve you say? A malicious disgruntled programmer perhaps? I doubt it, really. No sane person would take a risk from within like that, especially with the stock options given by Valve and the sheer financial prospect of this particular game release. My answer to all this? War Drivers.

They cruise around with thier laptops in thier vehicles unleashing the most sophisticated hack programs one could ever find, inconspicuosly jacking intellectual properties with barly a packet sniff. The problem with networks is that in exchange for seamless quota reaping work value and accessability, it is not a locked door. It is a screen door on a mansion patio.

I do hope that they resolve this and find the prick who might keep the best game to ever be released from being in our paying hands when it should. However, this really should have been hidden away like iraq's WMD's.{LOL} So both are somewhat to blame.
 
perhaps you should give a little back to the HL2 community for helping you out this this....
get what you give, and all that.
 
Originally posted by chewysplace
hell, its dam good thinking i say. and possible too!


Maybe when he was on "the Rock" in San Fran things got a little to real and he needed "Rock $$" to keep from getting turned-out, since he had no smokes all he could do to save him-self was to offer the "code". I'd come out and say "ooh oh yeah i got cracked uhm i mean hacked"

Im not this mean really but valve told me they can't do chit about my HL key not werking. And i wasn't even hacked. hmmm
 
LMFAO @ cleaver... first time i've agreed with what you've posted on this thread ;)
 
gabe

it's your fault, don't use outlook....

and maybe halflife2.net can desactivate the test/test forum account ?
 
Originally posted by Meatplow>>>
Hi, wazzup....I see both sides of the spectrum here when it comes to priceless intellectual properties being lost to network security lapses. I agree that this is an awful tragedy. But at the same time any property holder as truly wealthy as Valve should have invoked the very highest security level matching that of the deepest levels of a silent government agency. But what if it came from within Valve you say? A malicious disgruntled programmer perhaps? I doubt it, really. No sane person would take a risk from within like that, especially with the stock options given by Valve and the sheer financial prospect of this particular game release. My answer to all this? War Drivers.

They cruise around with thier laptops in thier vehicles unleashing the most sophisticated hack programs one could ever find, inconspicuosly jacking intellectual properties with barly a packet sniff. The problem with networks is that in exchange for seamless quota reaping work value and accessability, it is not a locked door. It is a screen door on a mansion patio.

I do hope that they resolve this and find the prick who might keep the best game to ever be released from being in our paying hands when it should. However, this really should have been hidden away like iraq's WMD's.{LOL} So both are somewhat to blame.

Your joking about the wardriving thing right..
 
Originally posted by alohg
Maybe when he was on "the Rock" in San Fran things got a little to real and he needed "Rock $$" to keep from getting turned-out, since he had no smokes all he could do to save him-self was to offer the "code". I'd come out and say "ooh oh yeah i got cracked uhm i mean hacked"

Im not this mean really but valve told me they can't do chit about my HL key not werking. And i wasn't even hacked. hmmm

the moment you bought the game, they got royalties. i imagine they could care less about your cd-key.
 
Originally posted by bate18
seriously, why would gabe write out the whole process of the hack, its too odd, and why would he include little meaningless details, like him stating in the beginning of the letter: "Ever have one of those weeks? This has just not been the best couple of days for me or for Valve." and "Well, this sucks." those just dont seem to fit into place when talking about something as serious as this is, especially for them, it just seem TOO odd for me

thats what he wants you to think, and he succeded :)

do you see it now?
 
THANK YOU InfoSecWillie, PODEMOS CONVERSAR EM PORTUGUÊS ? :p
tO VENDO QUE UM PEESOAL AQUI FALA PORTUGUÊS E EU ME MATANDO PRA FALAR UM INGLÊS...
 
honestly, i've got valve and newell's back for this one. i'll be goin on and off all the IRC channels i can all night to find this sh*tbag who stole their source, if indeed it was even stolen (i'm about 50/50 right now, because the statements about Gabe possibly making it all up make 100% sense... i'm still contemplating, hehe)
 
You guys make it sounds like this could only end badly. I see it differently. Maybe Valve could release the source under a conservative license (prohibiting commercial exploitation and that sort of thing) and work with the community to improve the game. Sure there's the chance to cheat, but then again there's the possibility of a Linux port :)
 
Yeah, it IS odd, it sounds very much like a hoax or the company is REALLY in some deep shit right now and basically panicing.

And the Outlook thing the message mentions, that was years ago, there is no preview pane vulnerability today unless this was a very old unpatched machine.

And, like I said eariler apparently no firewall anywhere ont heir network ? I mean pcanywhere requires a connection IN which I assume they wouldn't have to their development machines.

Is it is true it has nothing to do with Outlook, it's insanely bad security in their whole network and the network guy they have should be shot.
 
Status
Not open for further replies.
Back
Top