Back Orifice (1998)

Some weird random anecdote about Back Orifice 2000 (BO2k) that nobody asked for:

We were goofing around in high school with this. Putting it on computers in school and messing around. We sent it over to a classmate. Her father was teachter and we figured she might open it on their home PC. (we were 14 at the time, by the way).

Anyway, we made a fake hotmail address in the name of another classmate. These two people didn't share any classes and were not in eachother little social circle. We sent a couple of emails back and forth pretending to be the other guy but lost interest along the way and nothing happend.

Now for the strange part; forward 18 years or so. I'm in the city, I run into the person who we were sending the messages to... with the person who we were pretending to be. Married and 3 children together.

I'd like to think we brought them together in some strange way.

Hi party people, this is Sir Dystic, author of the original 1998 Back Orifice. Great to hear all of you reminiscing about my software!

One thing that I did not predict when I released BO: The distribution ZIP contained three files, a readme.txt, the BO server and the BO client. In retrospect, the BO server should probably not have been distributed with the original .EXE extension as a LARGE portion of people apparently downloaded the ZIP, unzipped it and just double clicked on the BO server, immediately infecting themselves.

Keep disturbing shit please.

..--oo] ooM [oo--..

Oh man, yeah also adding to the list of people that abused their highschool computer labs with this. We had so much fun, but we eventually drew the ire of the school IT admin. After class one day the teacher took us aside with the admin and asked if we had installed BO on the computers, which we of course denied... they "believed" us, heh, but gave us a stern warning that whoever was doing it should stop. We would have all probably ended up with felony charges these days.

The next year, so 1999, we actually got approval to attempt to change our grades as an exercise. We actually managed to do it by sneakily copying a floppy one of the teachers used to store their grades with a program called Integrade. We took it home, reverse engineered the password protection to disable it, changed our grades on the copy, re-enable the password protection with the original password, and turned that in as our proof. Our teacher was impressed and super sketched out/nervous at the same time. I guess they never considered we'd succeed and get access to the whole class's grades...

I ran some training labs full of desktop PCs around the time that BO was released and it was a fantastic tool. It was free and offered a wide range of features for remote administration that win95/98 didn’t have. I could power cycle, re-image, push install .exes, control user accounts, etc all with a free tool. With BO I had complete control of all systems in the lab at a time where that sort of tooling for “legit” uses was prohibitively expensive.

There is also Sub7 from the same period: https://web.archive.org/web/20050401072114/http://www.hackpr...

This brings me many good memories of my script kiddie humble beginnings. It all started with backoriffice and mIrc and slowly it evolved to me wanting to run bitchX and eventually getting into linux. It probably took me an year to go from being a windows user to exclusively run Slackware and poring over Phrack :)

For those not from the NT era the name derives from Microsoft Back Office https://en.m.wikipedia.org/wiki/Microsoft_BackOffice_Server

Back in the good old days we were sending this to random ICQ users saying something like "hey I'm a game developer and made this game, would you like to try it?". I'm not very proud of that tbh.

I’d bet there’s more than a few people here in respectable places now that learnt to code through VB6, Delphi, python, Perl, PHP to write rats and exploit code.

We used Back Orifice on a co-worker’s machine in a call center I worked at. While he was working we would open and close his CD-ROM drive randomly. Restart his machine. All the while we’re four seats down just cackling and he’s turning redder and redder as his machine does all these weird things while he’s trying to work.

This story sort of relates to BO and/or possibly other backdoors. If anyone can help me understand the mystery of what happened to me back around 2001 I would be forever grateful:

I believe I was in 4th or 5th grade and one night, I was playing Diablo 2 online with my cousin. My family was still using dial-up at the time so I was using one line to play and the other line to talk to my cousin on the phone. It was getting late and I was getting tired so I told my cousin I was going to call it a night. I exited Diablo 2 and continued talking to him on the phone. All of a sudden, I noticed a window pop up on my screen and it read:

"MASTER: what are you doing?"

I immediately asked my cousin if it he was messing with me. He proclaimed to not know what I was talking about and for a little bit I didn't believe him. I clicked in the chat box and asked:

"SLAVE: who is this?"

Anytime I messaged back it labeled me as "SLAVE." Anyways, the chat continued and the person told me to "look behind me." Mind you I'm in the basement and there was nothing behind me besides my dad's computer desk. This is where it got spooky:

"MASTER: who are you talking to on the phone?"

At this point, my cousin swore it wasn't him and I believed him. I looked up at my monitor and chills were sent down my spine. My mom had just given me a webcam for Christmas (I guess they had just become popular) and it was at this point I realized this person had been watching me this entire time. I panicked and immediately pulled the phone cable from the back of my Dell. It was hard to sleep soundly that night.

Believe it or not, I'd like to think this person gets partial credit for sparking my interest in computer security. From that point on, a chain reaction started and I began to immerse myself in security and became fascinated with learning about its history. Today, I happily have a career in the field :), but I still think back to this story from time to time and wonder what exactly happened.

Could it have been a Diablo 2 exploit? Maybe I joined someone's hosted game, they were somehow able to get my IP address, and then possibly exploited Windows XP? The chat window mechanism seemed pretty unique to me (maybe I'm wrong) like this person created it themselves. I'd be curious to read other people's theories. Maybe the person that executed the attack reads this post and can explain it all... :)

People may not remember but the name was a pun on "BackOffice" which was a Microsoft product at the time.

https://en.wikipedia.org/wiki/Microsoft_BackOffice_Server

Back Orifice was basically a rootkit avant la lettre.

I can't believe there's only one mention to Beto O'Rourke here...

https://www.reuters.com/investigates/special-report/usa-poli...

When I was in highschool in the late 90’s, I was really into exploring networks and systems I wasn’t supposed to be in, but it was always about learning technology for me. I found this tool to be extremely creepy.

I discovered that my local ISP had the finger port open on their dialup gateway. Since usernames were first letter + last name I could look up any ip addresses I found in my local firewall logs basically by name.

I saw someone trying to connect to this port and knew exactly who was scanning for this and eventually found a honeypot listener that would allow attackers to connect, but let you control the data sent back. I can’t remember exactly what I sent, but I called out the attacker by name when he connected to my machine and he never scanned me again

Like so many others here this really helped me gain an interest in computers at a young age. It's sad to think that the shit most of us did as kids for fun and learning would land today's children in hot water. I lucked out in Jr High, after getting suspended for 'hacking the school computers' as the computer lab admin caught wind and really encouraged me to learn and provided me with a lot of hands on experience that I may not have gotten otherwise. Novell, thick net, etc. Good memories for sure.

Woah, totally! I feel the need to write this one down. I was in high school when BO arrived. We had such a blast scanning the local dial-up ISP since we know the subnet block they always used, it was fast because it was all within their hardware. Anyway, we noticed a webcam on a computer we discovered, which was very rare at the time, but it was turned off. So we sent a pop-up window that said something like. "system configuration required, please power on all peripherals". And it worked! We were able to capture a short clip and download it. Well, it was uncompressed AVI and a 6 second clip was like 1.6 MB, so it took tens of minutes to get it. When we played it, it was just some dumpy guy with his dumpy wife sitting in the background mumbling stuff; but to us, it was totally 31337...

I used to use this tool to mess with my college computer class professor. Me and a buddy installed it on the teachers computer that she used to instruct the class. We did mostly innocent stuff like closing windows or messing with the browser a bit. Occasionally we would reboot her computer when it was close to the end of class and we didn’t want to start something new. We’re both still coders to this day.

Netbus and BO got me in so much trouble as a kid (though honestly I probably should have gotten in a lot more trouble).

At school, all the windows machines were locked down with a "security" application called Fortress. I started selling boot floppies that would disable Fortress to teachers, and might have loaded a few of those up with the aforementioned toys.

At home, I don't think I paid for internet access at all until well after college. A port scan of local ISP networks usually yielded someone infected with netbus or bo, and I could snarf their dialup credentials.

While those exploits probably should have landed me in jail, the worst that happened to me was an expulsion as a result of somebody else bulk changing logo.sys across school.

OK I have to say this: reading some of the comments here makes me think I was actually friends with you back in 1998/1999 because that's about when I was doing this same shit in my high school computer lab. Small world.

A few friends and I managed to install this on target machines by starting a chain email and claiming the attached .exe was a “virus patch”.

We would then port scan known IP ranges for our ISP to find a machine we could connect to and play with. It was always fun trying to determine who actually owned the machine we found. I grew up in a small, rural community so it was actually possible to figure this out.

This lasted maybe a year or two around 98,99. A very nice memory on a lazy Saturday morning, thanks for sharing!

Bots to scan all users for BO on IRC were common. I even was a bit mischievous with it myself. Karma was served when I self-owned - was playing with running the server to experiment but forgot I left mIRC running, and in a minute my computer was hosed.

Mannnnn the nostalgia. I loved programs like this and Sub7c my favorite was DivineIntervention 3 I just liked the interface and thought the name was cool lol. I’d love to see what all the devs of these things are up to today. Pri$m, if you’re out there let it be known that your work on DI3 is what got me into programming!

I can't recall if it was Back Orifice, or another "root kit tool" of the time, but these tools are absolutely where I first saw the allure and call of a custom telnet shell. I remember telnet-ing into the control port and aggressively open/closing the CD-ROM drive on my brother in the other room (among other pranks).

Something about telnet-ing into a service gives that Great Hacker Feel. You're at a command line! But it's not bash, or cmd.exe, it's something specific to that rootkit. There's little easter eggs. Some common escape codes might work, they might not. The prompt changes as you use it.

These days, I don't get many opportunities, but if I can add a very simple line-oriented protocol to a side project I sure will.

This brings back fun memories of teenage mischief. Used sit around IRC channels with mIRC scripts looking for people who had the default BO port open.

Between that and unsecured smtp relays that didn’t limit the from address, we had lots of fun.

My University had public, non-firewalled IP addresses in the dorms... all one had to do was scan the IP ranges for the default port for Back Orifice to have some fun. (The good old days)

I installed this on a bunch of school computers when I was 15 only to open and close the CD-ROM bays to freak out the teachers. This was the golden days of computing!

I had a big zip file of all my HPAVC files in one place from the early nineties. Fast-forward to about 2005 when I was working in corp and I needed a Win32 Disassembler for a particular task and I knew where it was. As soon as the still-compressed zip file hits my computer... well, my boss said my computer had 490 viruses on it and counting. A VERY bad look that only trust got me past.

BO was a must-have tool for crackers and to have fun with friends and colleagues. I had my tiny share of those days. In late 1999, I was part of a 50-60 odd team company in one of my very early jobs. I was in the non-internet department while learning to write ASP, JavaScript, and ActionScript on the side. So, our team had access to the Internet for about an hour each day.

I was friendly with the Admins or those people who have access to the Internet and LAN thing. I helped them out quite a bit. Well, I dropped in BO, and the only thing I did was turn on the Internet for our team.

I also found out that the boss goes around poking other people's computers across the shared network, and his first look was the "temp" directory. I remember masking or creating shortcuts for all standard windows directory names to go to a pre-defined directory with a set of pre-defined contents.

I installed Netbus on the public computers at my local community library. They ran Windows 98 and were connected directly to the internet via a T1 / frame relay connection with a public IP for each machine, no firewall. So I could sit at home and keylog people’s Hotmail passwords. Those were the days ….

Seeing this thread and so many familiar stories makes me feel right at home. Sub7 was my RAT of choice. My brother and friends weren't very technical, but I taught them to use Sub7 so they could spread the exe around to their friends and we could all have some fun. We were all heavy ICQ users at the time. It wasn't long before we discovered the ICQ send file box had a size limit on the file name field. So you could, say, call the exe "pic-of-me-nude.jpg .exe" with so many spaces in the file name before the .exe part disappeared that most of our male friends would accept it from a "random female" and run it without any hesitation. Needless to say, we opened a lot of CD ROMS and listened in on many chats.

I think the audience here would appreciate some stories on the darknetdiaries.com. There are even several interviews with people describing how they got interested in the IT security field in their teens in highschool. Can't really recommend any specific from the top of my head.

My time to shine.

BO and NetBus nearly got me arrested on the Friday before my Prom.

I want to tell the rest of this story, but I worry about the statue of limitations and whether the crimes committed are still prosecutable.

I didn’t, at the time, realize what we were doing outside “near, we’re in the ISP’s computers?” but, uh, I found out when the Detectives knocked on my door and took a 16-year-old me downtown to discuss “what I’ve been up to on your computer.”

That story ends with my friend getting kicked out of High School, The HIPAA law guidelines being drafted around some of his actions, then his passing away of an unknown heart issue at 20.

His naive partner-in-crime going on to having a great career in IT.

Side note: we had almost every teacher’s Netware login before we graduated. =)

The golden era of the internet ;-}

Oh man brings back so many memories of messing with friends. There was even a doom version that modeled monsters after system processes allowing you to shoot and kill the processes and watch them die

Wrote about this as a college senior for my computer security class. Spent a day or two in the TAMU computer lab with that site prominently displayed… that was 22 years ago. I did set up 2 computers to demo how this worked as part of the presentation but never went much further than that. I seem to remember my report including hypothetical ways to use a tool I think was called silkworm or silk wrapper to disguise this as something else for distribution. Time flies.

I installed this on a pc at work when it came out to see what it could do.

I must have forgot to shut it off because there was a gang of security people in my office the next morning.

As a 13 year old this was mind blowing and inspiring, likely equivalent to finding a copy of the anarchist cookbook at a garage sale. The amount of pranks I played on the bullies in school over IRC[0] was one of the most gratifying thing i've ever felt in my entire life.

[0] oddly a small town in Ohio with a population of ~3,000 in 1999 was somehow all connected on IRC, this was well before ICQ or AIM or any social network had peaked.

BO was the only malware I got infected with on Windows. Back in 99, some colleague had sent me an executable to try out (supposed to be the portscan tool he developed), it did nothing so he said "hmm ok". Later, my mouse started becoming erratic, I started to make typos. I finally figured out what's going on when the CD drive ejected itself and I shut off the computer. He later admitted messing around.

Yeah I remember one of these would allow you to somehow make a jpg executable and then would download the full payload for the rest of the tool. Image sharing over AIM and the like would make direct connections when transferring so you had to look up their IP address with netstat or something while the picture was transferring to them. And then keep checking to see if they actually installed/opened it.

Ohh, that brings back memories! I didn't use BO, though I knew it existed, but used sub7 and NetBus a lot. The person who taught us (me and brother) to use it did the classic CD tray prank and then rebooted out computer. I remember him telling us to who run a command like arp -a on the Windows terminal and we were shitting our pants, so he triggered a reboot.

Good times getting into friends' computers etc.

Ah, the memories! I brought this into school and a few of my mates wanted copies. Word got out amongst the teachers that there was some program being used for shenannigans by the pupils. I told everyone do delete it but some didn't realise it'd end up in their recycle bin and the network admin found out. Saturday morning detention material, luckily I didn't got caught :)

It's amazing how vulnerable Windows used to be. And despite that it took over the computing world. Ah to live in the pre-internet days.

The BO payload was so large that it was hard to inject or distribute without pretty obviously being suspicious.

A friend developed Fraggle Lite in ASM with separate versions for the network adapter, which became the world's smallest RAT for a while. I never found the Easter egg, but I do remember the original password for our hardcoded users. I wonder if I still have them somewhere...

Had a lot of fun with bo2k and friends. cDc zines got me in to hacker culture and probably contributed to my career trajectory.

I wrote a similar tool to mess with my friends at the computer lab at school (since back orifice, netbus, etc. would all be detected by antivirus at this point).

Years later, I was shocked when whatever antivirus I was running detected it as a trojan through heuristics. I realize this is pretty normal these days, but back then it felt like magic.

Wow, so much memories! BO, Nervous, BitchSlap, mIRC scripts... I also remember the famous NetBios hack at this time. Easy to do, and you felt like a real hacker! Command lines instead of GUI! That was an incredible feeling and it later brought me to Linux.. and still on Linux (ok on Ubuntu, I'm a casu now :D)

Ah, yes. I used that to prank some friends when Windows/MSN Messenger started to be a thing. Good memories :-)

I was suspended from school for things like this circa 1997. It was all relatively harmless but absolutely against the letter of the law. I wonder what would happen today to a young person exploring computer security and getting caught in shenanigans at school. Would they go to prison?

Same as so many others here, I remember messing around with BO with a buddy in high school days. Scanning IP addresses (I think we just started bulk scanning addresses that matched his ISP maybe?), browsing their files, taking screenshots…

And yea, chatting about all this over AIM and IRC… ahhhh.

Pretty sure someone used this to make my CD-ROM eject once, and that was very disconcerting.

Holy... I had the similar idea and have just implemented it (https://sitemakertools.com/vps-bootstrapper/), but for Linux!

I made a couple of plugins for this back in the day "butt plugs" heh I can't remember what they all did but I think one was sort of a proxy so that you could scan other networks with an already infected machine.

The good old days. I recall hearing the cDc going on the radio to "announce" BO with some trite words about Microsoft. I thought BO was fun but bo2k was really the bees knees of RATs.

Oh boy! We used to have a lot of fun with this back in high school!

Today morning out of nowhere, this came to mind. Back Orifice. I had a smile when I remembered the first time I read about it. What coincidence its on HN today! Or is it?

Oh the shenanigans I had with this at work. IT at the time were pretty clueless.. at least until that time they hired a good consultant who saw what we were up to :laughs:

I want to used BO to prank my mom. Having a background in computers, once she realized what was happening she dove for the network cable. I’d never seen her move so fast.

Following years Sub7 became a monster of its own. Schoolbus master password kind of ruined everything for us young lamers.

I was thinking of it recently. Does it still run on modern Windows? Has anything new arrived as its alternate?

We used something like this in the early 2000s called Blade Runner. Scary times on the Internet.

when the internet was actually fun, mostly anonymous and almost fully detached from real life.

Classmate got expelled from high school for installing this on school computer

I still remember it because was one of first RAT available.

Oh Gosh, many many memories of my script kiddie past.

oh I remember this one. opening CD tray remotely

lol we used to use Back Orifice to mess with friends on ICQ, yeah, I'm old. I know.

Was Girlfriend similar to this?

Wow. This brings back memories!

this thread is relevant to my interests.

Ahhh the CDC.

wow. this takes me back...

Beto's greatest achievement.

BO reminds me of all new and shiny apps that are meant to "keep an eye on kids&spouses" ... or maybe it's the other way around.

Nothing beats Cabronator