Pick an answer to see whether you are right and read the story behind it. Press Another for a new question.
The questions cover the history of hacking from the 1970s to today: early viruses and worms, phone phreaking, famous breaches, ransomware, cryptocurrency thefts and the internet's unsolved mysteries.
Below is every question with its answer, so you can use them for a quiz night or to study.
All the hacking trivia questions
42 questions with answers. Open a question to see the answer.
Which 1971 experimental program displayed “I'm the creeper, catch me if you can”?
Answer: Creeper. Creeper moved between computers on ARPANET. A later program called Reaper was written to delete it.
In what year did the Morris worm spread across the early internet?
Answer: 1988. The Morris worm of November 1988 slowed many computers to a crawl.
What audio frequency did the famous Cap'n Crunch whistle produce?
Answer: 2600 Hz. 2600 Hz was a control tone in old AT&T phone switches. The hacker magazine 2600 takes its name from it.
What small accounting error led Clifford Stoll to a hacking ring in 1986?
Answer: A 75-cent discrepancy. Stoll chased a 75-cent error in a lab's computer-time billing, which exposed hackers selling information to the KGB.
Who was the first person convicted under the US Computer Fraud and Abuse Act?
Answer: Robert Tappan Morris. Morris was convicted in 1990 over his 1988 worm. He later became a professor at MIT.
How did the first known ransomware, the 1989 AIDS Trojan, spread?
Answer: Floppy disks sent in the mail. It was mailed on floppy disks and demanded $189 sent to a post office box in Panama.
What did Kevin Mitnick mostly rely on to get into systems?
Answer: Social engineering. Mitnick often tricked employees into handing over access, a method called social engineering.
What was the name of the 15-year-old who knocked Yahoo, CNN and eBay offline in 2000?
Answer: Mafiaboy. A teenage Canadian using the name Mafiaboy flooded major sites with traffic in February 2000.
Which malware damaged centrifuges in Iran's nuclear program?
Answer: Stuxnet. Stuxnet, discovered in 2010, made centrifuges spin at wrong speeds while reporting normal values.
Which security flaw in the OpenSSL library was announced in 2014 with its own logo?
Answer: Heartbleed. Heartbleed let attackers read chunks of memory from vulnerable servers.
Which botnet took over cameras and routers using default passwords and helped knock out Dyn in 2016?
Answer: Mirai. Mirai tried factory-default logins on internet-connected devices.
What kind of fix did researcher Marcus Hutchins find for WannaCry?
Answer: A kill-switch web address. By registering a web address the malware checked for, Hutchins slowed its spread in May 2017.
Which shipping giant said NotPetya cost it around $300 million?
Answer: Maersk. NotPetya spread through a poisoned Ukrainian software update in 2017 and hit companies worldwide.
Around how many people were affected by the 2017 Equifax breach in the US?
Answer: About 147 million. Attackers exploited a known flaw that had not been patched.
How many Yahoo accounts were eventually reported as affected by the 2013 breach?
Answer: All 3 billion. Yahoo first reported one billion accounts in 2016 and updated the figure to all three billion in 2017.
Which software company's update was used to hide malicious code in the 2020 attack on US agencies?
Answer: SolarWinds. The US government attributed the operation to Russia's foreign intelligence service.
About how much ransom did Colonial Pipeline pay in 2021?
Answer: About $4.4 million. The FBI later recovered roughly half of the payment.
What Java library flaw, disclosed in December 2021, was nicknamed Log4Shell?
Answer: Log4j. Log4Shell was rated the maximum severity of 10 out of 10.
In the 2016 Bangladesh Bank heist, what spelling mistake helped stop part of the theft?
Answer: “fundation” instead of “foundation”. A misspelling in a payment instruction raised suspicion, though about $81 million was still taken.
Roughly how much cryptocurrency was stolen from the exchange Bybit in 2025?
Answer: About $1.5 billion. The FBI attributed the theft to North Korean hackers.
Which blockchain game network lost about $620 million in a 2022 hack?
Answer: Ronin (Axie Infinity). The FBI linked the theft to the Lazarus Group.
What happened to most of the roughly $611 million taken from Poly Network in 2021?
Answer: The hacker returned it. The attacker returned nearly all of the funds within days.
Which exchange lost around 850,000 bitcoin and collapsed in 2014?
Answer: Mt. Gox. Mt. Gox filed for bankruptcy in February 2014.
What newspaper headline is embedded in Bitcoin's first block?
Answer: The Times. The text refers to a bank bailout headline dated 3 January 2009.
In what year did Bitcoin's creator last communicate publicly?
Answer: Around 2011. Satoshi Nakamoto's last known messages date from 2011.
What did a UK High Court rule in March 2024 about Craig Wright?
Answer: That he is not Satoshi Nakamoto. The judge found the evidence overwhelming that Wright was not the creator of Bitcoin.
Who noticed the xz backdoor in 2024?
Answer: Andres Freund. Freund, a Microsoft engineer, noticed SSH logins were slower than expected.
What name is linked to the account that earned maintainer trust before the xz backdoor?
Answer: Jia Tan. “Jia Tan” is a pseudonym. No one has publicly identified who was behind it.
Where did the Cicada 3301 puzzles first appear in 2012?
Answer: An anonymous image board post. The first message was posted to an image board in January 2012. All later genuine messages were signed with the same PGP key.
What was the target of Anonymous's 2008 Project Chanology?
Answer: The Church of Scientology. It mixed online attacks with street protests.
What kind of mask became a symbol of Anonymous?
Answer: A Guy Fawkes mask. The mask was popularised by the graphic novel and film V for Vendetta.
How long did LulzSec's famous run last before it announced it was disbanding?
Answer: 50 days. LulzSec called it “50 days of lulz” in 2011.
In what US city is the DEF CON hacker conference held?
Answer: Las Vegas. DEF CON began in 1993 and has grown to tens of thousands of attendees.
What did the Boston group L0pht tell the US Senate in 1998?
Answer: They could take down the internet in 30 minutes. The testimony was one of the first times hackers advised Congress on security.
What does “zero-day” mean in security?
Answer: A flaw the maker doesn't know about yet. Defenders have had zero days to fix it.
Which company ran one of the first bug bounty programs in 1995?
Answer: Netscape. Netscape offered rewards for flaws in its Navigator 2.0 beta.
Which 1987 mystery involved a TV signal hijacking in Chicago?
Answer: The Max Headroom incident. Two stations were briefly hijacked and the person responsible has never been identified.
Which US agency's headquarters hosts the Kryptos sculpture?
Answer: CIA. Three of Kryptos's four coded messages have been solved. The fourth has not.
Which group leaked the NSA-linked EternalBlue exploit in 2017?
Answer: The Shadow Brokers. The tool was later used in WannaCry and NotPetya.
Which free service lets you check whether your email appeared in a data breach?
Answer: Have I Been Pwned. The service was launched by Troy Hunt in 2013.
Which German club performed a 1984 stunt making a bank's system charge it about 135,000 deutschmarks?
Answer: Chaos Computer Club. They gave the money back the next day to prove a point.
Which malware wiped data from about 30,000 computers at Saudi Aramco in 2012?
Answer: Shamoon. The attack erased data and disrupted the company's operations.
Frequently asked questions
How many questions are there?
More than forty, each with a short explanation.
Do I need technical knowledge?
No. The questions are about history and stories, not technical skills.
Do I earn points?
Correct answers earn fun points, saved only in your browser.