Back Orifice: a remote control tool released at a hacker conference

The story

On August 1, 1998, at the DEF CON hacker conference in Las Vegas, a group called the Cult of the Dead Cow released a free program named Back Orifice. The name mocked a Microsoft server product.

The program let one computer control another running Windows 95 or 98 over the internet: viewing files, recording keystrokes, taking screenshots and running programs. The group said it was released to show how weak the security of those versions of Windows was.

Remote control software has legitimate uses. What made Back Orifice different was that it could install without asking and hide itself from the computer’s owner. It was easy to bundle inside another program as a Trojan horse, and it became popular with people who wanted to spy on others. Antivirus companies quickly began treating it as malware.

Why it mattered

It made remote control of someone else’s computer easy enough for almost anyone, and showed how thin the line is between a useful remote support tool and spyware. The difference is whether the owner knows it is there and agreed to it, which is why legitimate support tools ask permission and show when someone is connected.

The lesson today

Remote control tools are still one of the most common ways into a business computer. Some are malware. Others are legitimate tools that scammers ask people to install. The defense is the same: only approved remote access tools should run on business computers, and anything else should be noticed and stopped.