Long before DEF CON grew a code of conduct and a ban list, the scene policed itself — with zines and root shells. When one crew decided another was all talk, it did not file a complaint. It dumped the database, published the passwords, and mailed the whole thing out as an issue. The cruelty was the format. This is the underground doing to its own what it is famous for doing to everyone else.
We exp0se your secrets. We expose your girlfriend. Relationships end.
ZF0 ("Zero for 0wned"), stating the mission plainly — ZF0 issue 5 (Exploit-DB)
The best part about writing this issue was targeting those who preach about security and swear by their own "perfectly" secure servers.
ZF0, on why it hunted the people who lectured about security — ZF0 issue 2
Two things run through every entry here. The first is hypocrisy-hunting: the target is almost never a random box. It is someone who sold security, preached it, or wore the scene's respect — and then reused a five-character root password. The second is the receipt as the weapon. These crews did not argue that a rival was incompetent; they proved it by walking through his shadow file in front of everyone.
Everything quoted below is from a published zine — mirrored for years on Exploit-DB and archived locally. This section documents what was published; it does not reproduce the raw dox (SSNs, private third-party material) that serves cruelty and not the record.
The full case files. The sections below are the showcase; each rivalry and figure also has its own deep-dive dossier, sourced to the mirrored zines:
Or read the whole arc as one story on The Chronicle.
Before the zines, before the cons, the scene fought over 300-baud modems and stolen long-distance codes. The founding rivalry — Legion of Doom versus Masters of Deception — got mythologized by prosecutors into a "gang war in cyberspace." The people who were in it say that war never happened. Both of those things are true, and that is the point.
The crews form
Two founding collectives appear the same year. Legion of Doom (LOD), started by the handle Lex Luthor, becomes the elite phreak/hacker crew of the American BBS underground. In Lubbock, Texas, Cult of the Dead Cow (cDc) is founded in a slaughterhouse by Grandmaster Ratte' and friends — the group that will later count Mudge (Peiter Zatko) and a future presidential candidate among its alumni.
The schism
After a falling-out with LOD's Erik Bloodaxe (Chris Goggans), New York's Phiber Optik (Mark Abene) is pushed out and starts a rival crew: Masters of Deception. The name is the insult — "M" is one letter up from "L." With Acid Phreak, Scorpion, Corrupt and Outlaw, MOD becomes LOD's downtown rival.
The "Great Hacker War"
The feud, as told, escalates: LOD and MOD trade BBS insults, and MOD members are said to have hijacked Bloodaxe's phone service and listened to his calls. Then the state arrives. Amid the Operation Sundevil crackdown, and days after an AT&T outage they did not cause, the Secret Service and FBI serve warrants on MOD. Phiber Optik and others are charged with computer tampering and trespass and plead guilty; Abene serves roughly a year — the scene's first celebrity prison term.
"A complete fabrication"
The twist the legend leaves out: Phiber Optik himself said the war never happened. He called the "gang war in cyberspace" a fabrication of the U.S. attorney's office and a press hungry for a story; two senior LOD members agreed it was one-upmanship, not combat. The scene's most famous war may be the one the scene insists was invented for a press release.
cDc turns the con into a stage
The rivalry energy migrates from BBSes to conference stages. At DEF CON 6, Cult of the Dead Cow releases Back Orifice — Sir Dystic's Windows remote-admin tool built to humiliate Microsoft's security — as theater, with a full stage show. The scene's fights are now public performances: the model ZF0 and, eventually, the con's own ban list will inherit.
The crews become institutions
The endpoint of every scene war: the crews that survive turn into cons and companies. The Dis.org Crew — self-described as "a loosely (dis)organized group," amateurs to professionals — hosts a generation of luminaries; the Shmoo Group spins up ShmooCon; LOD alumni found security firms; Mudge lands at DARPA, Google, and Twitter. The underground that once feuded over codes now runs the industry that hunts them.
Not a crew war — a personal one, between two people who never met until one had cuffed the other by proxy. On Christmas Day 1994 an IP-spoof attack copies the files of security researcher Tsutomu Shimomura. He takes it as a challenge, teams up with a New York Times reporter, and two months later the intruder — Kevin Mitnick — is under arrest in Raleigh. What lingers is not the chase but the fight over the telling: a bestselling book with Shimomura's byline, a movie, and Mitnick's decade-long insistence that the reporting was invention. Full file: the Mitnick vs Shimomura dossier.
The Christmas Day intrusion
Someone uses an IP-spoofing and TCP-sequence-prediction attack to get into Shimomura's home machines in San Diego and copy his files — a technique he had himself helped document. He treats it as personal. The government would later attribute the intrusion to Kevin Mitnick, who pleaded guilty in 1999; no motive beyond the challenge is asserted here.
The two-month hunt ends in Raleigh
Shimomura works with New York Times reporter John Markoff to trace the intruder by his cellular signal to a Raleigh apartment, where the FBI arrests Mitnick. The taunting voicemails later attached to the legend are reported to have been left by an unrelated third party — some after the arrest — not by Mitnick.
The rebuttal
Shimomura and Markoff publish Takedown — subtitle "…By the Man Who Did It" — and sell the film. Mitnick's camp calls the account inflated; in sworn Senate testimony he calls the reporting "largely fictitious… without reason, justification, or proof." Markoff defended his work. Two tellings; the reader weighs them.
An anonymous crew, five issues, 2008–2009. It started by humiliating rival underground groups for talking bigger than their opsec. It ended, on the eve of Black Hat 2009, by owning the most famous whitehats in the world and dumping roughly 75,000 passwords to prove a point: the people the industry pays to lecture about security could not defend their own boxes.
ACT I — THE CREW WARS (2008)
h0no, Coder-Underground, Enigma Group
The early issues are pure scene-versus-scene. ZF0 mocks h0no ("1337 Speak doesn't actually make your penis bigger in real life"), dumps the database it says it pulled from Coder-Underground (run by the handles Kurupt and Milamber), and devotes issue 2 to the Enigma Group — a crew that "preached about security" — publishing its forum, IRC config, and the leader's own boast, "anyone on this server, i guarentee you, can hold a candle next to me," directly above the credentials that proved otherwise. A moderator is filed under "a fan of password re-use," his logins shown across fifteen services.
HBH, milw0rm, and Chanology
The circle widens: HackThisSite-adjacent crews, repeated jabs at milw0rm, and in issue 4 the whole Anonymous/Chanology apparatus — its IRC servers, its wiki, partyvan.info, the g00ns channel. ZF0's verdict on the Scientology-raiding activists is its most quotable line about the era's pecking order: "The most talented people in Anonymous hack Scientology people... that places them below the people who hacked ethelsflowershop.com."
ACT II — OWNING THE WHITEHATS (Black Hat eve, July 2009)
Issue 5 dropped on the eve of the Black Hat Briefings, timed to land while the industry's elite gathered in Las Vegas. The targets were no longer teenage crews. They were the keynote speakers.
The massacre — ~75,000 passwords
ZF0 announced it had compromised a roster of "notable whitehats" and their haunts: Kevin Mitnick, Dan Kaminsky, Julien Tinnes, Ralph van der Heyden, and forums including elitehackers, binrev, hak5, darkmindz and blackhat-forums — roughly 75,000 passwords collected. The dump ran with attack logs and the crew's running commentary. Contemporaneous coverage called it, accurately, "Security Gurus 0wned by Black Hats."
Kevin Mitnick, owned on his own box
The prize scalp: the world's most famous security consultant, popped on his own server (dc21.hostedhere.net). ZF0 published his home directory, bash history, and shadow file — the man who wrote the book on social engineering, undone by a hosting box. Mitnick's own response, to the press, was that he was surprised the others had kept email and work data on an internet-facing host. He blamed the hosting provider.
Dan Kaminsky — the whole life, dumped
A year after Kaminsky made global headlines for the DNS cache-poisoning flaw, ZF0 rooted his boxes and published the lot: passwords ("Five character root password? Niiiiiiice."), his résumé, his mailing-list traffic, his network toolkit, and his private chats. Having written "we are mostly sparing the girlfriend," they published his partner's messages anyway — her telling him, across January 2009, "I am WORRIED about you... you refuse to do anything about it," that she was "watching you slowly kill yourself," and, simply, "take care of yourself." Kaminsky waved the whole hack off in public: "Messy, but heh. Walk onto a battlefield, you might get shot." He was a showman and, by many accounts and no shortage of stage footage, a heavy drinker — the scene laughed along with the drunk sets for years. It used to be fun. Then it wasn't funny anymore: he died in 2021, at 42, of diabetic ketoacidosis — the slow collapse the dumped messages had watched coming twelve years early.
rsnake, Tinnes, and the thesis
The issue swings at rsnake (dismissed as chasing "the hype, the drama, and seeing his name in lights") and Julien Tinnes, and states its whole worldview outright: the security scene is a status game, its celebrities are media-whoring "noobs," and the surest way to prove it is to read their mail. Whatever one thinks of the crew, the technical claim landed: the industry's most decorated names were sitting on boxes a motivated attacker walked straight into.
A different flavor of crew rivalry: not zine-versus-zine but a long-running internet radio show versus the people who tried to wreck it. The LRHzine documents the show's retaliation against a persistent harasser — a case study in the scene's "you don't complain, you counter-hack" reflex. Full file: the L0DE Radio Hour dossier.
L0DE Radio Hour vs. "ilken"
The L0DE Radio Hour crew — L0de, ReadError, slimer, vap0r and others — documents its war with a chronic harasser (handle "ilken") who botted and spammed the show and threatened its participants. The response was total: router and email compromise, account takeovers, servers wiped. The zine's mission statement is the whole ethos of this section in one line: "you don't fuck with lrh." (The crew's own dox of the target and his family is left where it lies; the pattern is the point, not the private data.)
Two readings, both true. The ugly one: these are crews republishing private lives — a partner's frightened messages, a family's data — and calling the humiliation journalism. The cruelty is real and it landed on real people, some of whom never chose to be public.
The uncomfortable one: the technical claim was correct every time. The men who sold and lectured the world on security could not keep a five-character root password off their mail servers, and the only people willing to say so out loud were the ones willing to prove it. Years later DEF CON built a transparency report and a ban list to do this politely. The zines did it first, and without the manners.
The archive does not cheer. The archive keeps the issues — and notes who was, in the end, right about the boxes.
research/zines/. Rival-crew figures are kept to their scene handles. The most sensitive third-party material — a private partner's self-harm disclosure, reproduced SSNs and home addresses — is deliberately withheld; it is cruelty, not evidence. Dan Kaminsky is deceased; his cause of death is stated as his family stated it, diabetic ketoacidosis, and the scene's memory of his drinking is given as reputation, not as a cause. The owning happened; the receipts are the zines. If a line here couldn't survive scrutiny, it wouldn't be on the page.