Are you l33t?

They’re a familiar sight on chat boards, in spam messages and in viruses. Even a co-worker might use one – jokingly, of course. They’re words that look unpronounceable: “l33t,” “w00t” and “h4x0r,” among many others.

They’re all part of “l33tspeak” (pronounced “leet speak”), Internet slang that at one time identified the writer as a proficient hacker and now identifies anyone who uses it seriously as a hopeless wannabe.

L33tspeak started in the 1980s in the hacker community. Some say it was born of a need to avoid the prying eyes of keyword searches, while others say it was really just a form of graffiti-like expression in a drab, text-based world.

“It’s a very quick way of identifying who’s in your gang,” says Graham Cluley, senior technology consultant for security vendor Sophos.

In the late 1990s, use of l33tspeak made its way into online chat boards and online games. Since then, it’s been overused – mainly by teenagers trying to win respect among hackers – to the point where it has become a source of amusement or annoyance.

1 before 3 except after (

L33tspeak leaves a lot open to the writer’s creativity, but there are certain rules of thumb for cracking the code.

The first and most basic rule of l33tspeak is to change certain letters to similar-looking numbers or symbols – for example, “e” becomes “3,” “a” becomes “4” or “@,” and so forth.

The second rule is that certain letters need to be transformed into something cooler, ‘Nettier – and frankly, more l33t. If a word ends in an “s,” it probably ought to end in “z” instead, so “wares” becomes “warez” – or, more correctly, “w4r3z.” The letter “x” is eminently more l33t than “ck”; with another tweak or two, that’s how “hacker” becomes “h4x0r.”

Again, there’s a lot of flexibility available here, and the writer could choose to stick with letters and symbols where the substitutions are fairly easy to recognize – or the writer could go with an “advanced” l33tspeak, where the characters are “drawn” rather than substituted.

For example, “M” could become “|/|” and “U” could become “|_|” (see chart for some examples of character representations).

It seems pretty straightforward – until you see /- |_0+ 0|= +3X+ (“a lot of text”).

“It does require skill to read and write quickly, especially when you get away from close representations of actual letters,” says Elias Levy, architect of DeepSite services at Symantec.

A state of mind

Just as important as the way stuff is written are the words themselves, as l33tspeak includes a vocabulary all its own.

The word “l33t” itself (also “L337”) is really “leet,” a corruption of “elite” and meaning someone who is very good at what they do. The opposite would be a “n00b” (short for “newbie”) or a “lamer” (also “llama”).

If someone says you have been “owned” (written “0wn3d,” or even “pwn3d,” as somewhere along the way the latter became an acceptable misspelling), it’s not a good thing, as it means they have beaten you pretty badly in some fashion. Similarly, to say something “0wnz” means it is pretty cool, and “ownage” – er, “0wn493” – is a general exclamation of coolness. “W00t” is also an exclamation, meaning “hooray.”

There are several places where the average IT person might see l33tspeak. There could be l33t-like wording in the subject line of a spam e-mail message (say, “v|agr@”) as an attempt to sneak past a spam filter.

It also can sometimes show up in the posturing of virus writers. Sophos’ Cluley pointed out a rant that was dropped on users’ desktops by the W32/Yaha-K worm, written by an Indian hacking group called the Indian Snakes:

m@iN mIssIoN iS t0 sPreAd tHe nAmE @YerH$ t0 : mY b3$t fRi3nD

s00 mUch t0 c0me…

eXp3ct th3 uNeXp3ctEd

dEdic@t3d

Still, only the lowest echelon of hackers – the so-called “script-kiddies” – would ever write like this, says Joe Hartmann, director of North American AV research for Trend Micro.

“The hackers who want to be recognized for what they do refrain from using l33tspeak,” he says. Although those in the anti-virus profession might come across such writing often, they don’t exactly incorporate it into their own lingo. “In the security industry, you don’t want to make yourself look even younger than you are,” Hartmann says.

Today, l33tspeak is considered by many to be a joke. There are l33tspeak “translators” available online, to h4x0r-ize any English phrase typed in. One such translator places “hacker” alongside other “dialects” such as “redneck,” “jive” and “cockney.”

There is even a L337.com e-commerce site offering T-shirts emblazoned with the phrase “1 4// L337” – along with boxer shorts, lunchboxes, coffee mugs, wall clocks and other l33tspeak merchandise.

Ironically, to speak l33t – at least, to excess – is to betray the fact that one is not l33t. And to wear a baseball cap proclaiming one’s “sk1llz”? What does that say?