"We pay for all interview related expenses (travel, hotel, food, etc.) as well as relocation expenses (pretty standard for the game business)." Newell passed the resume along to the feds, then invited Gembe to travel to Seattle for a follow-up interview in person. "I'm no bad guy, just a little misguided." "Well, I really hope you hire me," he wrote. Gembe detailed how he'd cracked the company's network, first entering through an account that had no password, then ramping up to root access using remote CGI exploits and scanning software.Īfter the interview, the then-21-year-old Gembe sent the company his résumé. In March, several Valve managers staged a 40-minute "job interview' with DaGuy over the phone, in which the hacker confirmed that he was Gembe. From clues in the e-mail, the FBI identified the aspiring employee as Axel Gembe, of Schonau, Germany. Teminating processes of security and anti-virus programsĪgobot.Coordinating with the FBI in Seattle, Valve began a correspondence with DaGuy, who expressed interest in getting a job with the company. When connecting, Agobot.ax uses the following passwords: When spreading to local network, Agobot.ax probes the following shares:Īgobot.ax tries to connect using the following account names: The attack can not be performed on the following sites: The backdoor can perform the following types of DDoS (Distributed Denial of Service) attacks: The scan is performed on ports 80, 135 and 445 for RPC/DCOM (MS03-026), RPC/Locator (MS03-001) and WebDAV (MS03-007) vulnerabilities. The backdoor can scan subnets for exploitable computers and send a list of their IPs to the bot operator. It has the functionality to read user's Address Book and send the list of email addresses to the bot operator. change IRC server that the bot connects to.download and execute a file from http server.download and execute a file from ftp server.The following oprerations can be performed with via a bot: The backdoor is controlled via an IRC bot, that is created on a certain IRC server in a specific channel when the backdoor's file is active. On Windows NT-based systems the backdoor can start as a service. "Configuration Loader" = "scvhost.exe".The Agobot.ax backdoor copies itself as SCVHOST.EXE file to Windows System folder and creates startup keys for this file in System Registry: There are some differences in this backdoor variant comparing to its previous variants.
0 kommentar(er)
