View source for Back Orifice 2000

{{short description|Computer program for remote administration}}
{{Infobox software
|name = Back Orifice 2000
|logo = <!-- Deleted image removed: [[Image:bo2k_2005.png|100px|Current (as of 2005) BO2k logo]] -->
|screenshot = bo2kscreenshot.jpg
|screenshot size = 250px
|caption = Screenshot of BO2k client
|developer = [[Dildog]] ([[Cult of the Dead Cow|cDc]]) (original code)<br />BO2k Development Team (current maintenance)
|operating_system = [[Microsoft Windows]],<br /> [[Linux]] (client only)
|latest_release_version = 1.1.6 (Windows), 0.1.5 pre1 (Linux)
|latest_release_date = March 21, 2007
|genre = [[Remote administration]]
|license = [[GNU General Public License|GPL]]
|website = 
}}
[[Image:Bo2kad.png|thumb|right|380px|Back Orifice 2000 advertisement (featuring the original logo)]]
'''Back Orifice 2000''' (often shortened to '''BO2k''') is a [[computer program]] designed for [[remote administration|remote system administration]]. It enables a user to control a computer running the [[Microsoft Windows]] operating system from a remote location. The name is a pun on [[Microsoft BackOffice Server]] software.

BO2k debuted on July 10, 1999, at [[DEF CON]] 7, a computer security convention in Las Vegas, Nevada. It was originally written by [[Dildog]], a member of US hacker group [[Cult of the Dead Cow]]. It was a successor to the cDc's [[Back Orifice]] remote administration tool, released the previous year. {{As of|2007}}, BO2k was being actively developed.

Whereas the original Back Orifice was limited to the [[Windows 95]] and [[Windows 98]] operating systems, BO2k also supports [[Windows NT]], [[Windows 2000]] and [[Windows XP]]. Some BO2k client functionality has also been implemented for [[Linux kernel|Linux]] systems. In addition, BO2k was released as [[free software]], which allows one to [[porting|port]] it to other operating systems.

== Plugins ==
BO2k has a [[Plug-in (computing)|plugin]] architecture. The optional plugins include:
* communication encryption with [[Advanced Encryption Standard|AES]], [[Serpent (cipher)|Serpent]], [[CAST-256]], [[International Data Encryption Algorithm|IDEA]] or [[Blowfish (cipher)|Blowfish]] encryption algorithms
* network address altering notification by [[email]] and [[Common Gateway Interface|CGI]]
* total remote file control
* remote [[Windows registry]] editing
* watching at the desktop remotely by streaming video
* remote control of both the keyboard and the mouse
* a chat, allowing administrator to discuss with users
* option to hide things from system ([[rootkit]] behavior, based on [[FU Rootkit]])
* accessing systems hidden by a firewall (the administrated system can form a connection outward to the administrator's computer. Optionally, to escape even more connection problems, the communication can be done by a web browser the user uses to surf the web.)
* forming connection chains through a number of administrated systems
* client-less remote administration over [[Internet Relay Chat|IRC]]
* on-line keypress recording

== Controversy ==
Back Orifice and Back Orifice 2000 are widely regarded as [[malware]], tools intended to be used as a combined [[rootkit]] and [[Backdoor (computing)|backdoor]]. For example, at present many [[antivirus software]] packages identify them as [[trojan horse (computing)|Trojan horses]].<ref>[https://web.archive.org/web/19991021223522/http://symantec.com/press/1999/n990712.html Symantec press release], dated 12 July 1999, accessed 8 August 2006</ref><ref>[http://www.iss.net./prReleases/pr_14513.html ISS press release]{{Dead link|date=June 2019 |bot=InternetArchiveBot |fix-attempted=yes }}, dated 13 July 1999, accessed 8 August 2006</ref><ref>[http://www.trendmicro.com/en/about/news/pr/archive/1999/pr071299.htm Trend Micro press release] {{Webarchive|url=https://web.archive.org/web/20070311035454/http://www.trendmicro.com/en/about/news/pr/archive/1999/pr071299.htm |date=2007-03-11 }}, dated 12 July 1999, accessed 8 August 2006</ref><ref>[http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=1770 CA threat description] {{Webarchive|url=https://web.archive.org/web/20070312000845/http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=1770 |date=2007-03-12 }}, dated 30 November 2005, accessed 8 August 2006</ref><ref>[http://www.f-secure.com/v-descs/bo2k.shtml F-secure threat description], accessed 8 August 2006</ref> This classification is justified by the fact that BO2k can be installed by a Trojan horse, in cases where it is used by an unauthorized user, unbeknownst to the system administrator.

There are several reasons for this, including: the association with cDc; the tone of the initial product launch at DEF CON<ref>[http://www.cnn.com/TECH/computing/9907/21/badrap.idg/ CNN.com report "Bad rap for Back Orifice 2000?"], dated 21 Jul 1999, accessed 8 August 2006</ref> (including that the first distribution of BO2k by cDc was infected by the [[CIH (computer virus)|CIH]] virus<ref>[https://web.archive.org/web/20070311051432/http://news.zdnet.com/2100-9595_22-515160.html ZDNet news "Back Orifice CDs infected with CIH virus"], dated 14 July 1999, accessed 8 August 2006</ref>); the existence of tools (such as "Silk Rope"<ref>{{Cite web |url=http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=BKDR%5FORIFICE%2EADD |title=Trend Micro threat description |access-date=2020-06-21 |archive-url=https://web.archive.org/web/20021020021916/http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=BKDR_ORIFICE.ADD |archive-date=2002-10-20 |url-status=live }}</ref>) designed to add BO2k [[Dropper (malware)|dropper]] capability to self-propagating malware; and the fact that it has actually widely been used for malicious purposes.<ref>[http://seclists.org/incidents/2000/Oct/0010.html Insecure.org mailing list archive], Rik van Riel report dated 3 October 2000, accessed 8 August 2006</ref><ref>[http://www.securityfocus.com/news/11324 Security Focus "Airport PCs stuffed with meaty goodness"], dated 21 September 2005, accessed 8 August 2006</ref><ref>[http://www.microsoft.com/technet/security/alerts/info/inforat.mspx Microsoft Security Administrator article "Danger: Remote Access Trojans"], September 2002 edition, accessed 8 August 2006</ref> The most common criticism is that BO2k installs and operates silently, without warning a logged-on user that remote administration or surveillance is taking place.<ref>[http://www.schneier.com/crypto-gram-9908.html#BackOrifice2000 Bruce Schneier's Crypto-Gram Newsletter], dated 15 August 1999, accessed 8 August 2006</ref> According to the official BO2k documentation, the person running the BO2k server is not supposed to know that it is running on their computer.<ref>{{Cite web |url=http://bo2k.sourceforge.net/docs/bo2k_1_1_5/BasicTutorial.html |title=Official BO2k Documentation: Basic Setup |access-date=2007-05-10 |archive-url=https://archive.today/20120710140604/http://bo2k.sourceforge.net/docs/bo2k_1_1_5/BasicTutorial.html |archive-date=2012-07-10 |url-status=dead }}</ref>

BO2k developers counter these concerns in their ''Note on Product Legitimacy and Security'', pointing out—among other things—that some remote administration tools widely recognized as legitimate also have options for silent installation and operation.<ref>{{Cite web |url=http://bo2k.sourceforge.net/docs/bo2k_legitimacy.html |title=Legitimacy |access-date=2006-08-05 |archive-url=https://web.archive.org/web/20050407210233/http://bo2k.sourceforge.net/docs/bo2k_legitimacy.html |archive-date=2005-04-07 |url-status=dead }}</ref>

==See also==
{{Portal|Free and open-source software}}
*[[Sub7]]
*[[MiniPanzer and MegaPanzer]]
*[[File binder]]

==External links==
* {{youtube|_maZ2Kf5KDs|BO2K teaser #1}}
* {{youtube|_Nfuz3oAO_M|BO2K teaser #2|link=no}}
* {{youtube|Uze6SaOHa-0|DEF CON 7 - Reznor - Cult of the Dead Cow - BO2K!|link=no}}
* {{youtube|oHxNEvklKqE|BO2K Presentation Behind-the-Scenes|link=no}}

== References ==
{{Reflist}}

{{Remote administration software}}
{{Cult of the Dead Cow}}

[[Category:Windows remote administration software]]
[[Category:Cult of the Dead Cow software]]
[[de:Back Orifice]]
[[es:Back Orifice]]
[[fr:Back Orifice]]
[[it:Back Orifice]]
[[pt:Back Orifice]]
[[sv:Back Orifice]]