CULT OF THE DEAD COW▊
Six teenagers started a hacker zine in a Lubbock slaughterhouse in 1984 and, over the next fifteen years, coined the word "hacktivism," ran one of the first real hacker cons, and twice walked onstage at DEF CON to hand out free software whose only job was to embarrass Microsoft. Their alumni roster reads like a joke someone made up: the man who briefed a sitting president on internet security, and a future Democratic presidential candidate who used to write dystopian fiction under the handle Psychedelic Warlord. The FBI wanted them to be a menace. They turned out to be a supergroup.
To demonstrate the lack of security in Microsoft's Windows 9x series of operating systems.
Cult of the Dead Cow, on why it built and released Back Orifice — the remote-administration tool the antivirus industry immediately filed under "trojan horse"
- WHO
- Cult of the Dead Cow (cDc) — hacker and DIY-media group, founded June 1984, Lubbock, Texas, at the Farm Pac slaughterhouse FACT
- FOUNDERS
- Grandmaster Ratte' (Kevin Wheeler, aka Swamp Ratte'), Franken Gibe, Sid Vicious, and three BBS sysops FACT
- THE DRAMA
- Prolific "t-file" ezine; ran HoHoCon; coined "hacktivism"; released Back Orifice (1998) and BO2k (1999) at DEF CON to humiliate Microsoft; spun off Hacktivismo
- STATUS
- ENSHRINED — the underground zine that became "the original hacking supergroup," per its own 2019 biographer
This file is not an accusation; cDc's most famous act — releasing Back Orifice — was a piece of theater with a stated security point, and the fight over what it "really" was is the drama. The through-line is a group that spent fifteen years being treated as a threat and turned out to be a media stunt with a conscience: text files, in-jokes, a made-up word that stuck, and two tools built specifically to make the largest software company on earth look careless in front of a conference hall.
the drama timeline
ACT I — GENESIS IN A SLAUGHTERHOUSE (1984–1994)
A handful of Texas teenagers turn a BBS ezine into the sassiest underground computer group in America — a title an actual teen magazine gave them.
-
JUN 1984
The cow is founded
Cult of the Dead Cow is founded in Lubbock, Texas, at the Farm Pac slaughterhouse, by Grandmaster Ratte' (Kevin Wheeler), Franken Gibe, Sid Vicious, and three BBS sysops. It becomes best known throughout the BBS scene for its underground ezine — the "t-files."
-
1991
"Sassiest Underground Computer Group"
Sassy magazine names cDc the "Sassiest Underground Computer Group" — the rare hacker crew whose first mainstream press was a teen fashion glossy. The group is also credited with popularizing "31337" as an alternate spelling of "elite."
-
OCT 1994
Their own newsgroup
cDc creates the alt.fan.cult-dead-cow Usenet newsgroup — by its account the first hacking group with a newsgroup of its own. The zine has an audience now, not just a modem.
ACT II — THE CON AND THE COINAGE (1990–1997)
Before DEF CON was DEF CON, cDc was throwing a hacker party in Houston every Christmas. Then one of its members invents a word that outlives the whole scene.
-
1990–95
HoHoCon
cDc co-sponsors HoHoCon (a.k.a. XmasCon) with Drunkfux — five conferences held around Christmas in Houston and later Austin, widely called the first "modern" hacker con and a direct inspiration for DEF CON and HOPE. The scene's institutions start here.
-
1996
"Hacktivism" enters the language
cDc member Omega coins the term "hacktivism" in an email to the group — the fusion of hacking and activism that will name a whole genre of political computing for the next thirty years. Whatever else cDc did, it wrote a word into the dictionary.
ACT III — THE MICROSOFT HUMILIATIONS (1998–1999)
Two summers, two DEF CONs, two pieces of free software built for one purpose: to make Windows security a punchline in front of a live audience.
-
AUG 1, 1998
Back Orifice at DEF CON 6
At DEF CON 6, cDc's Sir Dystic releases Back Orifice — a Windows 9x remote-administration tool (default port 31337) whose name mocks Microsoft's "BackOffice." cDc's stated purpose: to demonstrate the lack of security in Windows 9x. The antivirus industry immediately categorized it as malware, noting it could be silently installed and distributed as the payload of a trojan horse. Both readings are true at once, which is the point.
-
JUL 10, 1999
BO2k — the sequel
At DEF CON 7, cDc releases Back Orifice 2000 (BO2k) — a rebuilt version targeting the Windows NT line, released as open source. Same argument, bigger surface: if this is trivial to build, the security wasn't there to begin with.
-
1999
Hacktivismo spins off
cDc member Oxblood Ruffin founds Hacktivismo as an offshoot devoted to anti-censorship tools and "access to information as a basic human right" — and pointedly rejecting defacements and denial-of-service as hacktivism. The prank group grows a human-rights wing.
ACT IV — THE SUPERGROUP GOES LEGIT (2000–)
The kids from the slaughterhouse end up in the White House briefing room, the export-control office, and a presidential campaign.
-
FEB 2000
Mudge briefs the President
cDc and L0pht member Peiter "Mudge" Zatko briefs President Bill Clinton on internet security — the same year cDc is releasing hacking tools at DEF CON. Mudge goes on to DARPA, Google, and a stint as Twitter's head of security. The scene's court jesters are now advising the state.
-
2003
Strong crypto, government-approved
Hacktivismo's Six/Four System, a censorship-resistant encrypted proxy, becomes the first hacker-group tool to receive U.S. Department of Commerce export approval for strong encryption — the government signing off on cDc's crypto.
-
2018–19
Psychedelic Warlord, unmasked
Reporting by Joseph Menn (Reuters, 2018) reveals that Democratic Senate candidate — later 2020 presidential candidate — Beto O'Rourke was a teenage member of cDc under the handle "Psychedelic Warlord," running a BBS and writing fiction and essays for the group. O'Rourke confirmed the membership. Menn's book Cult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World follows in 2019.
both sides, on the record
Back Orifice was an attack tool: whatever cDc called it, Back Orifice could be installed without user interaction, hide from a casual look, and ship as the payload of a trojan horse — and it was, widely, by people with no interest in "security research." The antivirus industry filed it under malware on day one, and script kiddies made that classification look correct [2].
The stunt had a body count of trust: releasing a point-and-click remote-control tool for the most common consumer OS on earth, at a hacker convention, is not a neutral act. cDc supplied the capability and let the internet decide what to do with it.
The point was real, and it landed: Windows 9x genuinely lacked the security model to stop a tool like this, and cDc's stated purpose was to prove it in public rather than quietly. Embarrassment is a legitimate patch-forcing mechanism, and Microsoft's platform did get more defensible in the years that followed [2].
The group graduated: the same crew produced Hacktivismo's anti-censorship, human-rights tooling — explicitly rejecting defacements and denial-of-service — and members who briefed a president and earned government crypto-export approval. A pure "attack group" does not end up here [3].
Mostly it was media: cDc was, in its own description, a hacker and DIY-media organization — t-files, in-jokes, a coined word. The menace was always partly a performance, and the archive treats the performance as such [1].
YOU DECIDE
Back Orifice really could be weaponized, and really was — and it really did expose that Windows 9x had almost nothing underneath it. Both facts are load-bearing; picking one and dropping the other is how you get either the FBI's version or the fan's. Strip the myth away and cDc is a media group that spent fifteen years making a serious point with a joke name, coined the word for it, and then walked half its roster into the establishment it started out mocking.
The archive does not deify. The archive keeps the t-files — and the antivirus signature.
evidence locker
PRIMARY / REFERENCE
Wikipedia — Cult of the Dead Cow ATTRIBUTED — dated timeline: the June 1984 Lubbock founding and founders, the t-file ezine, the 1991
Sassy title, the 1994 newsgroup, the 1996 coinage of "hacktivism," and the alumni (Mudge, Oxblood Ruffin, Beto O'Rourke).
en.wikipedia.org/wiki/Cult_of_the_Dead_Cow Wikipedia — Back Orifice ATTRIBUTED — the Aug 1, 1998 DEF CON 6 release by Sir Dystic, cDc's stated purpose ("demonstrate the lack of security in Microsoft's Windows 9x"), and the antivirus industry's immediate malware/trojan classification. Both sides of the dispute.
en.wikipedia.org/wiki/Back_Orifice Wikipedia — Hacktivismo ATTRIBUTED — the 1999 Oxblood Ruffin spinoff, its anti-censorship mission and rejection of defacements/DoS, and the 2003 Six/Four export-approval milestone.
en.wikipedia.org/wiki/Hacktivismo
CONTEXT & CROSS-LINKS
Wikipedia — HoHoCon ATTRIBUTED — the 1990–95 cDc/Drunkfux conference series, called the first "modern" hacker con and an inspiration for DEF CON.
en.wikipedia.org/wiki/HoHoCon DEF CON media archive — DEF CON 6 & 7 PRIMARY — the conference archives for the two events where Back Orifice (1998) and BO2k (1999) debuted.
media.defcon.org/DEF CON 6/
The standard. Cult of the Dead Cow is a public group of forty years' standing; its founding, tools, conferences, coinages, and membership are matters of record, documented on the reference pages above and in Joseph Menn's 2019 book. Back Orifice is presented as disputed — cDc's stated intent and the antivirus/Microsoft view are both given at full strength. Beto O'Rourke's membership is stated as fact because it is documented and he confirmed it. If a line here couldn't survive scrutiny, it wouldn't be on the page.