s_d

The only bug I recall being reported on BO was in the built in HTTP server (which I wrote from scratch in C), if you shared a specific directory with the HTTP server, on Internet Explorer it would not let you click through to sub-directories because of a missing slash at the end I think. I only ever tested it with Firefox which seemed to not care if the slash was present. I found out about this from people who thought it was a feature, and were horrified to find out that anyone COULD access those sub-directories if they manually added the trailing slash or used a different browser.

.ooM.ooF.

An interesting bit about the internals and development of the BO code: The BO server was written in C and consisted mostly of a single while(1){ switch(command): ... } loop, the only functions were where callbacks were required, and it reused the same 5 variables in main() for everything. I got feedback from more than one security professional that this made it very difficult to reverse engineer. I think when I was writing it my concern was minimal overhead, and not using the stack must save SOME important resources?

When Dildog wrote BO2k I gave him the BO source to start with, he claims he rewrote everything from scratch and seemed a bit horrified by my code, which was never intended for distribution.

..ooM? ..ooM!

Hi party people, this is Sir Dystic, author of the original 1998 Back Orifice. Great to hear all of you reminiscing about my software!

One thing that I did not predict when I released BO: The distribution ZIP contained three files, a readme.txt, the BO server and the BO client. In retrospect, the BO server should probably not have been distributed with the original .EXE extension as a LARGE portion of people apparently downloaded the ZIP, unzipped it and just double clicked on the BO server, immediately infecting themselves.

Keep disturbing shit please.

..--oo] ooM [oo--..