Samy Kamkar

Samy Kamkar (born December 10, 1985) is an American privacy and security researcher, hacker, and entrepreneur who dropped out of high school at 16 and, according to his own biography, co-founded the unified-communications company Fonality as a teenager before becoming known internationally for a piece of self-propagating JavaScript code.

The Samy Worm

On October 4, 2005, Kamkar, then 19, released a cross-site scripting (XSS) worm on MySpace that came to be known simply as "Samy." Exploiting gaps in MySpace's JavaScript filtering, the worm silently added itself to the profile of anyone who viewed an infected page, forced that visitor to send Kamkar a friend request, and displayed the phrase "but most of all, samy is my hero." What began as roughly 200 friend requests the morning it launched grew to over a million infected profiles in under 24 hours before MySpace was forced to take the site offline, making it one of the fastest-spreading worms recorded up to that time.

Investigation and Legal Consequences

Roughly six months after the worm's release, the U.S. Secret Service and the Los Angeles Electronic Crimes Task Force executed a search and seized Kamkar's computers and devices; he was subsequently charged by the Los Angeles County District Attorney's office. On January 31, 2007, Kamkar pleaded guilty to a felony computer-crime charge. He was sentenced to three years of probation and community service, along with restitution to MySpace; the terms of his probation limited him to a single, non-networked computer with no personal internet access. His probation was lifted in 2008, after which he resumed public security research and speaking.

Later Career: Open Hardware and RF Security Research

After his probation ended, Kamkar built a career as an independent security researcher, publishing open-source proof-of-concept tools that exposed weaknesses in consumer and industrial systems. In 2010 he released Evercookie, a JavaScript library demonstrating how "zombie cookies" could respawn after deletion by exploiting multiple browser storage mechanisms; Evercookie later drew attention after being referenced in an internal NSA slide on tracking Tor users, part of the material leaked by Edward Snowden in 2013. In December 2013 he released SkyJack, a Raspberry Pi-based system that used a deauthentication attack to seize control of nearby Parrot AR.Drone quadcopters over their unsecured Wi-Fi links. In 2015 he presented OpenSesame, which used a repurposed children's toy and a De Bruijn-sequence algorithm to brute-force fixed-code garage door openers in seconds, and RollJam, a device demonstrated at DEF CON 23 that could defeat rolling-code systems used by many garage doors and vehicle keyless-entry systems. Around the same period he released KeySweeper, a stealth Arduino-based sniffer disguised as a USB wall charger that could intercept and log keystrokes from Microsoft wireless keyboards, along with later projects such as MagSpoof (magnetic-stripe card emulation) and PoisonTap (USB-based network traffic hijacking).

Legacy

Kamkar is frequently cited as an early, concrete example of the real-world legal consequences web-application vulnerabilities could carry for their discoverers, at a time when the legal treatment of self-propagating exploit code was still unsettled. His later trajectory — from a felony XSS conviction to a long-running, respected career publishing open-source security research and speaking regularly at DEF CON and Black Hat — is often referenced as a case study in the path from unauthorized hacking to mainstream security research.

Timeline

• 1985-12-10Samy Kamkar is born.
• 2005-10-04Kamkar releases the 'Samy' cross-site-scripting worm on MySpace; it infects over one million profiles within about 24 hours.
• 2007-01-31Kamkar pleads guilty to a felony computer-crime charge over the Samy worm.
• 2008Kamkar's probation is lifted.
• 2010-09-13Kamkar releases Evercookie, a JavaScript tool demonstrating persistent 'zombie cookie' browser tracking.
• 2013-12-02Kamkar releases SkyJack, open-source hardware/software for hijacking Parrot drones over Wi-Fi.
• 2015-01Kamkar releases KeySweeper, a USB-charger-disguised sniffer for Microsoft wireless keyboards.
• 2015-08Kamkar presents RollJam, an attack on rolling-code garage door and vehicle keyless-entry systems, at DEF CON 23.