BO2k debuted on July 10, 1999, at DEF CON 7, a computer security convention in Las Vegas, Nevada. It was originally written by Dildog, a member of US hacker group Cult of the Dead Cow. It was a successor to the cDc's Back Orifice remote administration tool, released the previous year. As of 2007[update], BO2k was being actively developed.
Whereas the original Back Orifice was limited to the Windows 95 and Windows 98 operating systems, BO2k also supports Windows NT, Windows 2000 and Windows XP. Some BO2k client functionality has also been implemented for Linux systems. In addition, BO2k was released as free software, which allows one to port it to other operating systems.
Plugins
BO2k has a plugin architecture. The optional plugins include:
watching at the desktop remotely by streaming video
remote control of both the keyboard and the mouse
a chat, allowing administrator to discuss with users
option to hide things from system (rootkit behavior, based on FU Rootkit)
accessing systems hidden by a firewall (the administrated system can form a connection outward to the administrator's computer. Optionally, to escape even more connection problems, the communication can be done by a web browser the user uses to surf the web.)
forming connection chains through a number of administrated systems
Back Orifice and Back Orifice 2000 are widely regarded as malware, tools intended to be used as a combined rootkit and backdoor. For example, at present many antivirus software packages identify them as Trojan horses.[1][2][3][4][5] This classification is justified by the fact that BO2k can be installed by a Trojan horse, in cases where it is used by an unauthorized user, unbeknownst to the system administrator.
There are several reasons for this, including: the association with cDc; the tone of the initial product launch at DEF CON[6] (including that the first distribution of BO2k by cDc was infected by the CIH virus[7]); the existence of tools (such as "Silk Rope"[8]) designed to add BO2k dropper capability to self-propagating malware; and the fact that it has actually widely been used for malicious purposes.[9][10][11] The most common criticism is that BO2k installs and operates silently, without warning a logged-on user that remote administration or surveillance is taking place.[12] According to the official BO2k documentation, the person running the BO2k server is not supposed to know that it is running on their computer.[13]
BO2k developers counter these concerns in their Note on Product Legitimacy and Security, pointing out—among other things—that some remote administration tools widely recognized as legitimate also have options for silent installation and operation.[14]
