L0pht Heavy Industries (pronounced "loft") was a

hacker A hacker is a person skilled in information technology who achieves goals and solves problems by non-standard means. The term has become associated in popular culture with a security hackersomeone with knowledge of bug (computing), bugs or exp ...

collective A collective is a group of entities that share or are motivated by at least one common issue or interest or work together to achieve a common objective. Collectives can differ from cooperatives in that they are not necessarily focused upon an e ...

active between 1992 and 2000 and located in the

Boston Boston is the capital and most populous city in the Commonwealth (U.S. state), Commonwealth of Massachusetts in the United States. The city serves as the cultural and Financial centre, financial center of New England, a region of the Northeas ...

Massachusetts Massachusetts ( ; ), officially the Commonwealth of Massachusetts, is a U.S. state, state in the New England region of the Northeastern United States. It borders the Atlantic Ocean and the Gulf of Maine to its east, Connecticut and Rhode ...

area. The L0pht was one of the first viable

hackerspace A hackerspace (also referred to as a hacklab, hackspace, or makerspace) is a community-operated, often "not for profit" (501(c)(3) in the United States), workspace where people with common interests, such as computers, machining, technology, sci ...

s in the US, and a pioneer of

responsible disclosure In computer security, coordinated vulnerability disclosure (CVD, sometimes known as responsible disclosure) is a vulnerability disclosure model in which a vulnerability or an issue is disclosed to the public only after the responsible parties hav ...

. The group famously testified in front of Congress in 1998 on the topic of ‘Weak Computer Security in Government’.

Name

The second character in its name was originally a

slashed zero The slashed zero, , is a representation of the Arabic digit zero ("0") with a slash (punctuation), slash through it. This variant zero glyph is often used to distinguish the digit zero from the Latin script letter O anywhere that the distinctio ...

, a symbol used by old

teletypewriter A teleprinter (teletypewriter, teletype or TTY) is an electromechanical device that can be used to send and receive typed messages through various communications channels, in both point-to-point and point-to-multipoint configurations. Init ...

s and some character mode operating systems to mean zero. Its modern online name, including its

domain name In the Internet, a domain name is a string that identifies a realm of administrative autonomy, authority, or control. Domain names are often used to identify services provided through the Internet, such as websites, email services, and more. ...

, is therefore "l0pht" (with a zero, not a letter O or Ø).

History

The origin of the L0pht can be traced to Brian Oblivion and Count Zero, two of the founding members, sharing a common

loft A loft is a building's upper storey or elevated area in a room directly under the roof (American usage), or just an attic: a storage space under the roof usually accessed by a ladder (primarily British usage). A loft apartment refers to large ...

space in South Boston with their wives (Mary and Alicia) who ran a hat business in one half of the space and helped to establish an IRL communal work space. There they experimented with their own personal computers, equipment purchased from the Flea at

MIT The Massachusetts Institute of Technology (MIT) is a private research university in Cambridge, Massachusetts, United States. Established in 1861, MIT has played a significant role in the development of many areas of modern technology and sc ...

, and items obtained from

dumpster diving Dumpster diving (also totting, skipping, skip diving or skip salvage) is wikt:salvage, salvaging from large commercial, residential, industrial and construction containers for unwanted items discarded by their owners but deemed useful to the ...

local places of interest. Founded in 1992 the L0pht quickly became a location for its members to store their computer hardware and work on various projects. In time, the members of L0pht quit their day jobs to start a business venture named L0pht Heavy Industries, a hacker

think tank A think tank, or public policy institute, is a research institute that performs research and advocacy concerning topics such as social policy, political strategy, economics, military, technology, and culture. Most think tanks are non-governme ...

. The business released numerous security advisories. They also produced widely used software tools such as L0phtCrack, a

password cracker In cryptanalysis and computer security, password cracking is the process of guessing passwords protecting a computer system. A common approach (brute-force attack) is to repeatedly try guesses for the password and to check them against an availab ...

for

Windows NT Windows NT is a Proprietary software, proprietary Graphical user interface, graphical operating system produced by Microsoft as part of its Windows product line, the first version of which, Windows NT 3.1, was released on July 27, 1993. Original ...

, a

POCSAG Radio-paging code No. 1 (usually and hereafter called POCSAG) is an asynchronous protocol used to transmit data to pagers. Its usual designation is an acronym of the Post Office Code Standardisation Advisory Group, the name of the group that devel ...

decoder, and CD software collections. In 1997, on August 8–10, Mudge, Brian Oblivion, Kingpin, Space Rogue, Stefan, Weld Pond, and John Tan of L0pht discussed recent projects and accomplishments, Windows NT, new projects, emerging trends and shortcomings in technologies, with Q&A session at Beyond HOPE at the Puck Building in New York City. In October 1999 L0pht was featured in a lengthy article in the ''

New York Times ''The New York Times'' (''NYT'') is an American daily newspaper based in New York City. ''The New York Times'' covers domestic, national, and international news, and publishes opinion pieces, investigative reports, and reviews. As one of ...

'' ''Sunday Magazine''. In the article

Jeffrey Hunker Jeffrey Hunker (January 20, 1957 – May 31, 2013) was an American cyber security consultant and writer. Biography Hunker received his bachelor's degree from Harvard College and Ph.D. from Harvard Business School. He joined the Boston Consulting ...

, NSC's then Director of Information Protection, said about L0pht, "Their objective is basically to help improve the state of the art in security and to be a gadfly, so to speak." In January 2000, L0pht Heavy Industries merged with the startup

@stake ATstake, Inc. (stylized as @stake) was a computer security professional services company in Cambridge, Massachusetts, United States. It was founded in 1999 by Battery Ventures (Tom Crotty, Sunil Dhaliwal, and Scott Tobin) and Ted Julian. Its initi ...

, completing the L0pht's slow transition from an underground organization into a "

whitehat A white hat (or a white-hat hacker, a whitehat) is an ethical security hacker. Ethical hacking is a term meant to imply a broader category than just penetration testing. Under the owner's consent, white-hat hackers aim to identify any vulnerabilit ...

" computer security company.

Symantec Symantec may refer to: * Gen Digital, an American consumer software company formerly known as Symantec * Symantec Security, a brand of enterprise security software purchased by Broadcom Broadcom Inc. is an American multinational corporation, ...

announced its acquisition of @stake on September 16, 2004, and completed the transaction on October 8 of that year. In March 2006, Weld Pond and Dildog founded application security company

Veracode Veracode is an application security company based in Burlington, Massachusetts. Founded in 2006, it provides SaaS application security that integrates application analysis into development pipelines. The company provides multiple security analysi ...

as a spin out from Symantec. The Veracode static binary analysis technology was built at @stake, based on prototypes and ideas incubated at the L0pht. On March 14, 2008, several members of L0pht sat at a panel at a standing-room-only group of infosec professionals at SOURCE:Boston. Present were Weld Pond, John Tan, Mudge, Space Rogue, Silicosis and Dildog.

Senate testimony

On May 19, 1998, all seven members of L0pht (Brian Oblivion, Kingpin, Mudge, Space Rogue, Stefan Von Neumann, John Tan, Weld Pond) famously testified before the

Congress of the United States The United States Congress is the legislative branch of the federal government of the United States. It is a bicameral legislature, including a lower body, the U.S. House of Representatives, and an upper body, the U.S. Senate. They both ...

that they could shut down the entire Internet in 30 minutes. The Washington Post referred to the response as "a tragedy of missed opportunity". Four members of the original group Space Rogue, Weld Pond, Kingpin and Mudge held a briefing entitled "“A Disaster Foretold — And Ignored” Revisiting the First-Ever Congressional Cybersecurity Hearing" hosted by the Congressional Internet Caucus Academy. The briefing, held on May 22, 2018, was almost exactly 20 years after the original testimony and was streamed live via Facebook. At the

Defcon The defense readiness condition (DEFCON) is an alert state used by the United States Armed Forces. For security reasons, the U.S. military does not announce a DEFCON level to the public. The DEFCON system was developed by the Joint Chiefs of Sta ...

26 hacking conference, held on August 10, 2018 in Las Vegas, seven of the L0pht members sat on a panel entitled "The L0pht Testimony, 20 Years Later (and Other Things You Were Afraid to Ask)". Among other things the panel encouraged attendees to keep on hacking but stay on the side of the law that kept them out of jail. The General Counsel of the National Security Agency, Glenn S. Gerstell quoted testimony from the L0pht’s hearing during his keynote to

American Bar Association The American Bar Association (ABA) is a voluntary association, voluntary bar association of lawyers and law students in the United States; national in scope, it is not specific to any single jurisdiction. Founded in 1878, the ABA's stated acti ...

’s 28th Annual Review of the Field of National Security Law Conference on November 1, 2018.

Products

As L0pht occupied a physical space, it had real expenses such as electricity, phone, Internet access, and rent. Early in the L0pht's history these costs were evenly divided among L0pht members. In fact, L0pht originally shared a space with a hat-making business run by the spouses of Brian Oblivion and Count Zero, and the rental cost was divided amongst them both. This was soon subsidized by profits made from selling old hardware at the monthly MIT electronic flea market during the summer. Occasionally, shell accounts were offered for low cost on the L0pht.com server to selected individuals; while these individuals had access to the L0pht.com server they were not members of L0pht. One of the first physical products sold for profit by L0pht was a

decoder kit, which was sold in both kit and assembled form. Subsequently, the Whacked Mac Archives were transferred to CD-ROM for sale, soon followed by CD copies of the Black Crawling System Archives. The command line version of L0phtCrack, the

for

, was given away free, but the

GUI Gui or GUI may refer to: People Surname * Gui (surname), an ancient Chinese surname, ''xing'' * Bernard Gui (1261 or 1262–1331), inquisitor of the Dominican Order * Luigi Gui (1914–2010), Italian politician * Gui Minhai (born 1964), Ch ...

version was sold as a commercial product. This was followed by the creation of the Hacker News Network website to host advertisements. However, even with these sources of income, L0pht barely broke even, and eventually began doing custom security coding for companies like NFR. In January 2009, L0phtCrack was acquired by the original authors Zatko, Wysopal, and Rioux from Symantec. L0phtCrack 6 was released at the SOURCE Boston Conference on March 11, 2009. L0phtCrack 6 contains support for 64-bit Windows platforms as well as upgraded

rainbow tables A rainbow table is a precomputed Lookup table, table for caching the outputs of a cryptographic hash function, usually for Password cracking, cracking password hashes. Passwords are typically stored not in plain text form, but as hash values. If ...

support. On April 21, 2020 Terahash announced it had acquired L0phtCrack, details of the sale were not released. As of July 1, 2021, the L0phtCrack software is no longer owned by Terahash, LLC. It has been repossessed by the previous owners, formerly known as L0pht Holdings, LLC for Terahash defaulting on the installment sale loan. L0phtCrack has now been released as open source. Space Rogue had also published a book on February 24, 2023.

Members

L0pht membership varied but included at various times: * Brian Oblivion (Brian Hassick) * Count Zero (John Lester) * Dildog (Christien Rioux) * Kingpin (Joe Grand) * Silicosis (Paul Nash) * Space Rogue (Cris Thomas) * Stefan (Stefan Wuensch) * Weld Pond (Chris Wysopal) * Mudge (Peiter Zatko) - later became a program manager at

DARPA The Defense Advanced Research Projects Agency (DARPA) is a research and development agency of the United States Department of Defense responsible for the development of emerging technologies for use by the military. Originally known as the Adva ...

and worked for Google * tan (John Tan)

Name

History

Senate testimony

Products

Members

References

External links