At 6am on May 7, 2004, Axel Gembe awoke in the small German town of Schönau im Schwarzwald to find his bed surrounded by police officers bearing automatic weapons.

One officer barked: “Get out of bed. Do not touch the keyboard.” Gembe knew why they were there. But, bleary-eyed, he asked anyway.

“You are being charged with hacking into Valve Corporation’s network, stealing the video game Half-Life 2 , leaking it onto the Internet, and causing damages in excess of $250 million,” came the reply. “Get dressed.”

Seven months earlier, on October 2, 2003, Valve Corporation director Gabe Newell awoke in Seattle to find that the source code for the game his company had been working on for almost five years had leaked onto the Internet. The game had been due for release a couple of weeks earlier, but the development team was almost a year behind schedule. Half-Life 2 , one of the most anticipated games of the year, was going to be late, and Newell had yet to admit to the public how late it would be. Such a leak was not only financially threatening, but also embarrassing.

After he had spent a few moments pondering these immediate concerns, an avalanche of questions tumbled through Newell’s mind. How had this happened? Had the leak come from within Valve? Which member of his team, having given years of their life to building the game, would jeopardise the project in the final hour?

If it wasn’t an inside job, how did it happen? Did someone have access to Valve’s internal server?

Simon Parkin’s book, Death by Video Game: Danger, Pleasure and Obsession on the Virtual Frontline, comes out on hardcover June 21.

Credit: Melville House

The question that rang loudest of all will be familiar to anyone who has ever had something stolen from them: who did this?

“I got into hacking by being infected myself,” Gembe tells me. “It was a program that pretended to be a Warcraft 3 key generator and I was stupid enough to run it. It was an sdbot, a popular general-purpose malware at the time.”

The young German soon realised what he had installed on his PC. But instead of scrubbing the malware and forgetting about it, he reverse-engineered the program to see how it worked and what it did.

By following the trail back, Gembe was able to track down its operator. Rather than confronting the man, Gembe began asking him questions about the malware.

“At the time I couldn’t a afford to buy games,” he explains. “So I coded my own malware to steal CD keys in order to unlock the titles I wanted to play. It grew quickly to one of the most prominent malwares at the time, mostly because I started writing exploits for some unpatched vulnerabilities in Windows.”

AXFR

In Seattle, Newell’s first thought was to go to the police. His second was to go to the players. At 11pm on October 2, 2003, Newell posted a thread on the official Half-Life 2 forum entitled, “I need the assistance of the community.”

“Yes, the source code that has been posted is the HL-2 source code,” he wrote in the post. Newell went on to outline the facts that Valve had been able to piece together so far. He explained that someone had gained access to his e-mail account about three weeks earlier. Not only that, but keystroke recorders had been installed on various machines at the company. According to Newell, these had been created specifically to target Valve, as they were not recognised by any virus-scanning applications.

Gembe’s malware crimes, while undeniably exploitative and damaging, were crimes driven by a passion for games rather than profits. His favourite game of all was Half-Life. In 2002, like so many fans of the series, Gembe was eager for new details about the forthcoming sequel. That’s when he had the idea: if he was able to hack into Valve’s network, he might be able to find something out about the game nobody else knew yet. He would have his moment of glory but more than that, he would have the reassurance that the game’s creators had everything under control.

“I wasn’t really expecting to get anywhere,” Gembe says. “But the first entry was easy. In fact, it happened by accident.”

Gembe scanned Valve’s network to check for accessible Web servers where he believed information about the game might be held. “Valve’s network was reasonably secure from the outside, but their name server allowed anonymous AXFRs, which gave me quite a bit of information.”

AXFR stands for Asynchronous Full Zone Transfer, a tool used to synchronise servers. It’s also a protocol used by hackers to peek at a website’s data. By transferring this data, Gembe was able to discover the names of all the sub-domains of the company’s Web directory.

“In the port scan logs, I found an interesting server which was in Valve’s network range from another corporation named Tangis that specialised in wearable computing devices,” he says. ” Valve didn’t firewall this server from its internal network.”

Gembe had found an unguarded tunnel into the network on his first attempt. “The Valve PDC had a username ‘build’ with a blank password,” he explains. “I was able to crack the passwords in no time. Once I had done that… well, basically I had the keys to the kingdom.”

“You cannot stop the Internet”

There’s something about the secrets and codes that video-game developers leave in their games that allows players a kind of glimpse behind the curtain. For a moment, the game’s fiction is broken and a player is able to see the cogs and workings behind the virtual world.

Arguably the earliest example of an “Easter egg” in a game was in the 1979 Atari 2600 game Adventure. The game was programmed by one of Atari’s young employees, Warren Robinett. Like many of his colleagues, Robinett was disillusioned with his employer’s policy of not crediting the game’s designers and creators. He added a secret room to the game that, if discovered, revealed the text: “Created by Warren Robinett.” It was a way to leave his own mark on the virtual world he created and, for players who first discovered the room (long after the designer left Atari), it was a link to an unseen creator.

Gembe had broken into another secret room, filled with illicit treasure. It was, as he put it, a kingdom, one that he believed would solve the Half-Life 2 mystery.

At this point, Gembe wasn’t bothered about covering his tracks. So far he had nothing to hide. But he wanted to ensure that he would remain undetected as he explored further.

“All I cared about at that point was not being thrown out,” he says. “My first job was to find a host where I could set up some sort of hideout.”

Gembe began to search for information about the game. He found various design documents and notes about its creation, the kind of material he hoped he might find. As the weeks passed, Gembe realised that nobody at Valve had noticed he was inside the company’s network. He began to push a little harder. That’s when he found the ultimate prize: the source code for the game he had been waiting to play for so many years.

The temptation was too great. On September 19, 2003, Gembe downloaded the unfinished game’s code and made off with Valve’s crown jewels.

“Getting the source code was easy, but the game didn’t run on my computer,” he says. “I made some code changes to get it to run in a basic form, but it wasn’t fun. Also, I only had the main development ‘trunk’ of the game. They had so many development branches that I couldn’t even begin to check them all out.”

The secret was too potent for Gembe to keep to himself. While he maintains that he was not the person who uploaded the source code to the Internet, he undoubtedly passed the code to the person who did.

“I didn’t think it through,” he says. “There was, of course, an element of bragging going on. But the person I shared the source with assured me he would keep it to himself. He didn’t.”

Once the game was on the Internet, there was no containing it.

“The cat was out of the bag,” says Gembe. “You cannot stop the Internet.”

Welcome to Valve Software.

Credit: Sam Machkovech

Hello Gabe

The community’s response to Newell’s plea for help was mixed. While many expressed their sympathy about the theft, others felt betrayed by Valve for being led to believe that the game would be ready for its scheduled launch in late 2003.

Despite a few leads, nobody was able to provide information about who might have perpetrated the crime. The FBI became involved in the investigation but also drew blanks.

Meanwhile, the team at Valve, who had been working hard to complete the game for months, was left feeling dispirited by the leak. The game was costing the company $1 million a month to build and the end was some way off. The leak had not only caused financial damage but had demotivated a weary team. One young designer asked Newell at the time, “Is this going to destroy the company?”

At 6:18am on February 15, 2004, Valve’s MD received an e-mail with a blank subject line from sender “Da Guy.”

“Hello Gabe,” the author began, before going on to claim responsibility for infiltrating Valve’s network months earlier.

Newell was unsure whether to believe the story at first. But two attached documents, both of which could only have been obtained by someone with access to private areas of Valve’s server, proved that the sender’s claims were valid.

Five months after Half-Life 2 was released onto the Internet, long after all leads had gone cold, the thief had turned himself in. “I was sorry for what happened,” says Gembe today. “I wanted them to know who did this thing, and that my intention was never for things to work out the way they did.”

But that wasn’t all that Gembe was after. The young man perceived a way he could create a positive outcome from his crime, both for Valve and himself. In a separate e-mail, he asked whether Newell would consider giving him a job.

“I was very naive back then,” he says. “It was and still is my dream to work for a game-development company, so I just asked. I hoped that they could forgive what I had done, mostly because it wasn’t intentional.”

To Gembe’s surprise, Newell wrote back a few days later saying yes, Valve was interested. He asked whether Gembe would agree to a phone interview. The true intention of the call, however, was to obtain an on-the-record admission from Gembe that he had been responsible for the leak, an FBI trick, designed to gain a confession by appealing to a person’s sense of pride.

Gembe quelled his suspicion and dialled the number he had been provided with. As far as he knew, this was an interview with two senior members of Valve’s management team. In reality, the call was being taped by the FBI.

“I hoped for the best,” he says. “I was not the brightest kid back then. At first they wanted to know how I hacked into the network. I told them in full detail. Then they asked me about my experience and skills. I still remember they were surprised that I spoke fluent English without much of an accent.”

The trio talked for 40 minutes. Any sense of guilt dissipated for Gembe in the presence of his heroes. But that was nothing compared to the adrenalin rush he felt when he received an invitation to a second interview, a face-to-face meeting at Valve’s headquarters in Seattle, on American soil.

Having set the trap, Valve and the FBI needed to obtain a visa for Gembe (and his father and brother, who wanted to accompany him to the United States). But there were concerns about the ongoing access that Gembe had to Valve’s servers and the potential damage he could still cause. So the FBI contacted the German police in order to alert them to the plan.

Later that week, an armed German policeman woke Gembe before dawn. He got dressed and headed downstairs. The corridors were lined by police, squeezed into his father’s house.

“Can I get something to eat before we leave?” Gembe asked. “No problem,” said one of the policemen.

Gembe reached for a kitchen knife to cut some bread. “Every policeman in the room raised his rifle at me,” he says.

After drinking a cup of coffee and smoking a cigarette, Gembe climbed into the back of a van and was driven to the local police station. There the chief of police greeted him. He walked up to Gembe, looked him in the eye and said: “Have you any idea how lucky you are that we got to you before you got on that plane?”

The police interrogated Gembe for three hours. “Most of the questions they asked me were about the Sasser-Worm,” he says, referring to a particularly vicious malware that affects computers running vulnerable versions of Windows XP and Windows 2000, created by an eighteen-year-old German computer science student Sven Jaschan from Rotenburg, Lower Saxony.

“For some reason they thought there was a connection between me and Sasser, which I denied. Sasser was big news back then and its author, Sven Jaschan, was raided the same day as me in a coordinated operation, because they thought I could warn him.”

Gembe’s bot exploited the same vulnerability as Jaschan’s. “Of course I denied this and told them that I never write such shoddy code,” he says.

When the police realised there was no link between Gembe and the Sasser-Worm, they began to ask him about Valve.

“I could have refused to answer and demanded an attorney, but I chose to tell them everything I knew honestly and completely, which I guess they appreciated,” he says. “The guy questioning me liked me, because he said, ‘You are not an asshole like most of the other guys.’ That department has to deal mostly with child porn. I guess I was so open with them because I didn’t believe I had done much wrong, at the time.”

Gembe was remanded to custody for two weeks. He was released once the police determined he wasn’t about to flee, with the proviso that he check in with them three times each week, every week, for three years, until his trial.

While waiting for his day in court, Gembe worked hard to change his life. He finished an apprenticeship and secured a job in the security sector, writing Windows applications to manage security systems and performing database and server administration work.

The trial lasted for seven hours. No one from Valve was present, though a reporter from the Wall Street Journal showed up. Aside from the initial theft of the game’s source code, there was no evidence to suggest that Gembe had been responsible for releasing the unfinished game onto the Internet.

Gembe admitted to hacking into Valve’s network, and the judge sentenced him to two years’ probation, citing his difficult childhood and the way he had worked to turn his life around as considerations when it came to deciding on the relatively lenient punishment.

Ah, City 17. (We all <3 Half-Life 2)

The mystery

By the time of the trial, 8.6 million copies of Half-Life 2 had been sold, its success unaffected by the leak of October 2, 2003.

More than a decade on from the raid, Gembe is remorseful.

Listing image: Melville House

98 Comments