Book summary “Cult of the Dead Cow”: summary

Introduction

You rely daily on software that contains hidden flaws and trust digital networks that remain inherently fragile against determined attackers. You live under the constant threat of commercial data breaches and state-sponsored surveillance while tech conglomerates prioritize speed over security.

The Cult of the Dead Cow evolved from a weird Texas zine collective into an elite hacker supergroup that revolutionized commercial software security, invented hacktivism, and shaped modern digital rights.

Joseph Menn traces this journey in Cult of the Dead Cow, showing how a small group of underground pranksters transformed into pioneers of vulnerability disclosure, national security advisors, and human rights advocates. You will discover how teenage bulletin board operators grew into industry titans who forced software giants to fix systemic weaknesses.

• How did a chaotic Texas collective outsmart the most powerful technology corporations in the world?
• Why did elite hackers choose to cooperate with the government rather than destroy it?
• What methods can you use to understand the roots of modern cybersecurity and digital activism?

1. Origins and Text File Distribution

The Cult of the Dead Cow started as a deliberately eccentric collective of teenage system operators in Lubbock, Texas, who pioneered early digital publishing through sequential text file bundles.

You can trace the roots of this counterculture movement to early bulletin board operators who valued creative writing and satirical critique over technical snobbery. Kevin Wheeler, Brandon Brewer, and later Bill Brown formed the group to counter the elitism of the early hacker underground. They adopted a do-it-yourself publishing ethos similar to punk rock, preferring parody and text files to malicious system intrusions.

Bill Brown drafted an epic mock-religious text called the Book of Cow, while Kevin Wheeler published a juvenile satirical file titled Gerbil Feed Bomb. These creations emerged alongside an $715 hard drive purchased by Kevin Wheeler in 1985 and the 1,100 words in Bill Brown's Book of Cow.

Phone phreaking evolved from technical experimentation into a politically radical activity driven by antiwar sentiment and opposition to telecommunication monopolies. Early phreakers used devices like blue boxes and whistles found in cereal boxes to generate specific tones for free long-distance calls. Because AT&T operated as a monopoly and part of the establishment, targeting it became an expression of political defiance among counterculture activists and early hackers. Yippie Abbie Hoffman and Alan Fierstein published the Youth International Party Line and TAP newsletter to distribute instructions for building blue boxes and hacking phone networks, utilizing the 2600 hertz frequency emitted by Cap'n Crunch breakfast cereal whistles alongside the June 1971 publication of the first issue of Youth International Party Line.

A systematic method of numbering and bundling text files enabled the Cult of the Dead Cow to become the most widely read and distributed collective of the pre-web internet era. Kevin Wheeler acted as a hype man by bundling roughly ten new text files together and distributing them across various bulletin boards. By numbering the files sequentially, operators nationwide could easily identify missing pieces and assemble complete sets. Wheeler and other cDc members stayed up all night during HoHoCon to live-write and bundle their landmark two-hundredth text file during the 1985 to 1995 golden decade of text files, establishing File #200 as a milestone text file for the group.

To distribute digital writings effectively across early bulletin board networks, you can adopt their exact publishing mechanics:

• Bundle approximately ten new text files together into a single distribution package.
• Assign sequential numbers to every published text file so operators can track complete sets.

2. The L0pht and Coordinated Disclosure

Boston hackers at the L0pht transformed underground skills into professional security research, establishing the modern standard of coordinated vulnerability disclosure and warning Congress about internet fragility.

John Lester and Brian Hassick founded the L0pht in 1992 as an artist's loft on Waltham Street. It evolved into America's first enduring shared hacker space and a physical bridge between the digital and physical worlds. Members could take apart hardware, share expertise, and mentor younger hackers away from criminal paths inside an anarchic learning lab.

Joe Grand was brought into the L0pht as a teenager to redirect his hacking skills after breaking into an AT&T office in Michigan.

Under the leadership of Peter Zatko, known as Mudge, the L0pht transitioned from a simple clubhouse into a commercial security research lab. Mudge pushed the group to build and sell security tools to fund further research. This led to the creation of L0pht Heavy Industries and the release of software designed to expose flawed Microsoft password handling.

Mudge developed a guessing tool for Windows password strengths at BBN Technologies, which was later refined into L0phtCrack by the L0pht crew.

Social engineering and the cultivation of multiple fictional personas served as both psychological defense mechanisms and tactical networking tools within the underground community. Because trust was scarce and cyberfriends could easily become cyberenemies, prominent networkers maintained strict separation between personal realities and online handles. You can extract critical information without relying solely on technical exploits by spinning narratives, charming targets, and manipulating perceptions.

Jesse Dryden utilized exceptional social engineering skills to network with rock stars and build hacking conferences while concealing personal vulnerabilities behind fabricated stories.

The L0pht pioneered the modern standard of coordinated disclosure by giving software vendors advance notice before publishing security flaws. Christien Rioux found a buffer overflow in Internet Explorer 4 and brought printouts to a 2600 meeting, leading the group to publish an advisory under his handle, Dildog.

You can protect users effectively by following these steps:

• offer a month's notice before going public with a security flaw;
• allow software companies time to prepare a patch;
• publish advisories once patches are ready to protect users who update immediately.

Seven members of the L0pht testified in May 1998, with Mudge claiming they could take down the internet in thirty minutes via a flaw in Border Gateway Protocol. Under hacker pseudonyms, members of the L0pht testified before Senator Fred Thompson's committee, warning that the internet was insecure and could be brought down rapidly.

3. Back Orifice and Corporate Security

Releasing powerful remote administration tools forced Microsoft and major tech giants to confront systemic architectural flaws and abandon product liability avoidance.

Josh Buchbinder, known as Sir Dystic, spent over a year developing Back Orifice to prove that standard Windows installations lacked basic security. The program allowed invisible remote control over the target machine via email or executed files.

At Def Con 1998, cDc launched Back Orifice with theatrical staging, distributing CDs to the crowd and triggering widespread media coverage and an FBI inquiry.

Matt Richtel reported in the New York Times in August 1998 on the hacker group releasing a program to exploit Microsoft security holes. The public distribution of tools like Back Orifice challenged Microsoft's security claims and triggered intense public debate, media coverage, and official responses from corporate and governmental bodies.

Christien Rioux developed Back Orifice 2000 as open-source software to prove it contained no back doors and to pressure Microsoft into fixing fundamental security design flaws.

At Def Con in July 1999, cDc released BO2k with a rock-and-roll presentation featuring Kevin in a rap performance and Bill Brown revealing pasties under a tear-away suit.

When you release powerful hacking tools, you should follow these rules:

• pick a cause instead of hacking at random;
• do not get caught.

Commercial security companies capitalized on public fear of hacker tools while simultaneously attempting to covertly acquire them ahead of competitors. Internet Security Systems railed against BO2k to drum up business while an intermediary offered cash to cDc, leading the group to demand one million dollars and a monster truck in reply. ISS sold stock to the public in 1998.

Strict government export regulations on strong cryptography forced developers of hacking tools to implement geographical restrictions. A hired lawyer advised the group to check whether downloaders' IP addresses were in the US and to provide a version with less encryption to foreign users.

You must follow export compliance steps carefully:

• check whether downloaders' Internet Protocol addresses are located in the US;
• have local users promise not to transfer the program beyond the border;
• distribute a version with weaker encryption to users outside the US.

High-profile disclosures and shocking demonstrations ultimately compelled software vendors and corporate customers to take cybersecurity seriously. After BO2k, banks and other mainstream customers pressured Microsoft to make serious changes, leading to the broader adoption of file integrity verification and higher security budgets.

You can improve software defenses by adopting these practices:

• make security concerns and security audits an integral part of the development process;
• encrypt everything by eliminating HTTP and moving to HTTPS everywhere.

4. Hacktivism and Human Rights Advocacy

The cDc expanded into international human rights advocacy by coining the term hacktivism, establishing legal frameworks, and developing anti-censorship tools to combat state oppression.

Misha Kubecka coined the term hacktivism to describe the fusion of hacking techniques with political activism and human rights advocacy. The term emerged to categorize the intersection of traditional hacking skills with political opposition against repressive regimes, bridging technical exploration and social protest. Misha Kubecka invented the portmanteau when describing the collaborative efforts between cDc and the Hong Kong Blondes.

Hacktivist initiatives expanded into international human rights advocacy, developing tools to bypass state censorship and firewalls. Projects such as Hacktivismo sought to apply technical expertise to promote free expression, counter internet surveillance, and support dissidents operating under oppressive regimes. Oxblood Ruffin engaged with international reporting regarding alleged dissident activities and censorship circumvention in China.

The Hacktivismo Declaration established a legal and moral foundation by aligning internet access with internationally recognized human rights treaties. Drafted with legal input from the Electronic Frontier Foundation and cDc members, the declaration cited binding international covenants rather than nonbinding declarations to frame state-sponsored censorship as a severe form of systemic violence. Laird drafted the initial declaration in Kevin's Harlem apartment, consulting lawyers like Cindy Cohn and Glenn Kurtzrock before launching it on July 4, 2001.

You can apply these legal and ethical principles in your advocacy:

• cite internationally recognized documents equating information access with human and political rights;
• state unequivocally that reasonable access to lawfully published internet material is a basic human right;
• study ways and means of circumventing state-sponsored internet censorship.

Hacktivismo's public attempts to build anti-censorship proxy tools like Peekabooty and Six/Four served as crucial proofs of concept that directly influenced the development of Tor. Although cDc proxy projects struggled to achieve critical mass, they proved there was a massive global demand for anonymity and censorship evasion, prompting Tor developers to adopt clear specifications. Steve Topletz and Hacktivismo released Xerobank in 2006, a modified Firefox browser running from a USB stick, which prodded Tor to bundle its own browser package.

Patrick Ball pioneered the application of rigorous data analysis and cryptography to document state-sponsored atrocities and prosecute human rights abusers. By compiling extensive witness accounts, managing databases, and cross-referencing military records with reported crimes, Ball provided irrefutable proof of genocide and abuse across multiple nations, directly leading to the removal of high-ranking offenders. At the 2001 Def Con panel, Ball presented findings from El Salvador where he matched crime databases with military records to identify and dismiss one hundred officers responsible for over one hundred abuses each, utilizing 9000 witness accounts recorded in El Salvador describing torture and killings.

You can support these global efforts through concrete actions:

• write a letter a month for Amnesty International on behalf of political prisoners;
• join US interest groups fighting restrictions on internet and security research;
• donate programming time to efforts like privacy-protecting browsers.

Former @stake alumni at Apple instituted major structural changes and chokepoints to make fraud economically unviable for cybercriminals. Window Snyder pushed for security measures such as requiring a paid developer certificate to install software on iPhones and minimizing retained user data. Apple implemented techniques rendering iPhones impenetrable to police and to Apple itself, becoming the first major technology company to treat itself as a potential adversary to its customers by charging $100 as the cost of a developer certificate for the iPhone.

Mudge revolutionized federal cybersecurity funding by creating a fast-track grant program for small hacker teams rather than large defense contractors.

Recognizing that standard government bureaucracy favored major corporations with slick paperwork, Mudge created the Cyber Fast Track program at DARPA. This distributed small amounts of money to individual hands-on researchers while allowing them to keep their own intellectual property. Mudge backed Charlie Miller, who used a DARPA grant to study near-field communication flaws, ultimately leading to the remote hacking of a moving jeep and forcing a major vehicle safety recall across nearly two hundred proposals funded by Mudge under a three-year fixed term for leadership positions inside DARPA.

You can evaluate security projects using these specific criteria:

• ask defensive grant applicants if their approaches are tactical or strategic;
• determine how a project would increase or decrease the overall attack surface being defended;
• require applicants to explain how they would beat their own proposed security method.

Mudge and his wife Sarah established the Cyber Independent Testing Lab to score software binaries for safety features without needing source code. Modeled after Consumer Reports, the lab scanned binaries for automatic safety features, similar to seat belts or brakes, while aiming to create nutritional labels for software so consumers could make informed, safety-based choices. Using funding from DARPA and the Ford Foundation, the lab demonstrated that on Mac operating systems, attackers had a harder time compromising Google's Chrome browser than Safari or Firefox, overlapping with a $20 billion valuation achieved by Stripe in September 2018 where Mudge worked.

You can apply software testing methods directly:

• scan software binaries for standard safety features without needing access to source code;
• score code based on built-in safety mechanisms to provide nutritional-label-style guidance for buyers.

Christien Rioux cofounded Veracode to decompile complex software binaries back into human-readable instructions for large-scale security analysis. Recognizing that software vendors lacked incentives to secure their products, Christien targeted software buyers instead. Veracode built a decompiler to audit binary files, forcing major vendors to clean up code flaws through third-party pressure after Christien spent a brutal year analyzing Adobe's Flash player binary code, refusing to shave until the decompiler successfully completed the scan. This effort resulted in a $614 million acquisition price when Veracode sold to CA Technologies in 2017, a $950 million final resale price, and a $10,000 standard annual cost for Veracode services.

You can secure software procurement through these steps:

• serve software customers instead of makers to pressure vendors into allowing security audits;
• decompile binaries back into human-readable instructions to perform static analysis.

The political crises surrounding the 2016 election sparked widespread ethical awakening, walkouts, and resistance among tech workers in Silicon Valley. Disillusioned by domestic information warfare, immigration bans, data surveillance, and corporate contracts with military and border enforcement agencies, tech workers organized resistance movements. Slack engineer Leigh Honeywell led an offshoot creating the public Never Again pledge signed by over 2,800 employees vowing to oppose immoral conduct and data targeting, alongside figures like Maciej Ceglowski and Leigh Honeywell forming initiatives to pledge ethical conduct, fund progressive candidates, and oppose harmful data retention.

You can protect user privacy in your organization:

• oppose retaining data that could be used for ethnic or religious targeting;
• advocate for deploying end-to-end encryption across platforms.

Security practitioners hold critical roles requiring moral obligations and personal codes of ethics that transcend corporate loyalty. In his 2013 Def Con speech, Alex Stamos argued that corporate white-hat security professionals getting sucked into cyberwarfare must live an examined life and act as ethical safeguards, outlining hypothetical scenarios regarding vulnerability disclosure, government backdoors, and corporate whistleblowing to encourage professionals to share tough decisions. Stamos pulled out of the 2014 RSA Conference after it was revealed RSA took $10 million for an NSA backdoor in a toolkit, organizing a counterconference called TrustyCon instead.

You can maintain your professional integrity through these guidelines:

• share tough ethical decisions and scenarios with newer entrants to the profession;
• involve legal counsel when approached by national-security authorities;
• be willing to publicly quit and break nondisclosure agreements if corporate practices violate public trust.

10 Key Ideas

1. The Cult of the Dead Cow evolved from a weird Texas zine collective into an elite hacker supergroup that revolutionized commercial software security, invented hacktivism, and shaped modern digital rights.
2. A systematic method of numbering and bundling text files enabled the Cult of the Dead Cow to become the most widely read and distributed collective of the pre-web internet era.
3. Boston hackers at the L0pht transformed underground skills into professional security research, establishing the modern standard of coordinated vulnerability disclosure and warning Congress about internet fragility.
4. Releasing powerful remote administration tools forced Microsoft and major tech giants to confront systemic architectural flaws and abandon product liability avoidance.
5. Commercial security companies capitalized on public fear of hacker tools while simultaneously attempting to covertly acquire them ahead of competitors.
6. The cDc expanded into international human rights advocacy by coining the term hacktivism, establishing legal frameworks, and developing anti-censorship tools to combat state oppression.
7. Hacktivismo's public attempts to build anti-censorship proxy tools like Peekabooty and Six/Four served as crucial proofs of concept that directly influenced the development of Tor.
8. Mudge revolutionized federal cybersecurity funding by creating a fast-track grant program for small hacker teams rather than large defense contractors.
9. Christien Rioux cofounded Veracode to decompile complex software binaries back into human-readable instructions for large-scale security analysis.
10. Security practitioners hold critical roles requiring moral obligations and personal codes of ethics that transcend corporate loyalty.