January 21, 2026 • 35 mins
In 2005, Myspace pages were flooded with the saying “Samy is my hero” and then suddenly, the platform went dark. Dexter talks with Jack Rhysider, host of the podcast Darknet Diaries, about Samy Kamkar, how he accidentally took down the biggest social media platform at the time, and how it changed the modern Internet.
Got something you’re curious about? Hit us up killswitch@kaleidoscope.nyc, or @killswitchpod, or @dexdigi on IG or Bluesky.
Listen:
- Jack’s Darknet Diaries episode with Samy: https://darknetdiaries.com/episode/61/
See omnystudio.com/listener for privacy information.
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Speaker 1 (00:10):
So yeah, do logistics. Could I have you introduce yourself.
My name's Jack ree Sider. I'm the host of the
podcast Darknet Diaries.
Speaker 2 (00:20):
If you haven't heard of the Darknet Diaries podcast, let
me explain the background a little bit here. So every
episode they get into some real wild story that's usually
about hackers, and that might be why Jack is so
cautious about revealing his identity, because he knows what's out there.
So maybe we should address the elephant on the screen here.
For those of you watching.
Speaker 1 (00:41):
I'm an anonymous podcaster. I don't like showing myself my
face or anything like that, so I'm using a filter
to keep my privacy when I cover enough of these hacks.
When I hear about breach after breach after breach, I
think to myself, well, I guess all my data is
out there. There's nothing I can do, and I become
black pelt, I suppose, where I just feel completely hopeless
about privacy. But then I realized, no, who's the ding
(01:04):
dong who gave them my data?
Speaker 2 (01:05):
It was me.
Speaker 1 (01:06):
So in order to protect myself from being in breach
after breach, I just stopped giving my data to anyone
who asked for it. And so that's why, after you know,
seven ten years of doing a podcast about hacking, this
is where I've landed on being an extreme privacy advocate.
And that's why I don't like to show my face anywhere.
If you think about, like what your ex lover knew
(01:27):
about you when you were in the height of your relationship,
they do everything. They knew your password, they knew your photo,
but they do everywhere you wet every day. But that
was years ago. You've broken up with them, and now
they don't know anything about what you're up to, right,
and so there's still hope on recovering your privacy and
getting it back. So I'm totally white piled now. I
have a lot of optimism about my privacy.
Speaker 2 (01:47):
I love how we're starting this out like that because
I feel like we're going to go there right because
the time period that we're going to talk about very
much was either a a lot of people didn't really
care too much about their information being out there, or
they didn't really think about it or very much were
thinking in the sense that, uh, you know, everything's out there,
(02:07):
what can I possibly do about this? You know? Yeah, yeah, exactly.
On this week's episode, Jack is going to share one
of the most bizarre, the most frustrating, but also honestly
one of the most hopeful hacking stories that I've ever heard.
It takes us back to a time when even the
phrase hacker freaked everyone out. And if you were around
(02:28):
in the MySpace days and you've been wondering why social
media today looks so boring, maybe this week's story has
some answers for you.
Speaker 3 (02:42):
I'm afraid.
Speaker 2 (02:45):
Kaleidoscope and iHeart podcasts. This is kill Switch. I'm Dexah Thomas.
Speaker 3 (02:54):
I'm all right, goodbye.
Speaker 2 (03:37):
Yeah. So take us back to two thousand and five.
What was the Internet like back then?
Speaker 1 (03:42):
So we're going from Internet one point oh to Internet
two point oho. In those days, and one point oh
was basically read only. Everything was just posted there and
you could read it, but you couldn't really interact with it.
There's no upfolts, there's no likes, there's no shares, there's
no oh let me create an account and comment on this.
It's just read it and that's all you get. And
then as Internet two point zero came around, we started
(04:04):
getting sites like dig and read It and MySpace, where
now you are creating content on this site. Now you
have this little personal space on this website. This is
the music I like, and this is the bands I follow,
and this is the stuff I've been doing every day,
and this is my comments about these things. And so
it became this read write kind of era, where now
I can read it and I can comment on it,
(04:25):
and I can write about it now. I think everyone's
favorite subject then and now is ourselves, and so we
love talking about ourselves on the Internet. And so when
my Space showed up, it's like, we want to know
all about you, and you're like, yeah, let me jump
on here and tell you what my interests are and
show you pictures of what I've been doing and all
the fun activities I've been up to. And so it
was the first big social media to hit our Internet,
(04:48):
and it was really fascinating.
Speaker 2 (04:52):
My Space started in two thousand and three, and the
whole point of the site was to let you connect
with your friends and maybe even make new ones. But
probably the most the famous or infamous feature of MySpace
was the top eight. So this was a feature that
would allow you to publicly rank your top eight friends,
and everyone who used it back then you probably remember
agonizing over who you should put in that top eight
(05:13):
and then accidentally having somebody get mad because they weren't
included or didn't like where they were placed, and then
it causing all sorts of weird beef and drama at school.
Another thing that people probably remember is that when you
first started your account, you were automatically friends with Tom,
the co founder of the site. And then there was
the options that you could use to categorize yourself.
Speaker 1 (05:32):
You could tell us what mood you were in or
what relationship you were in, and you could connect your
boyfriend or girlfriend to you to say, oh, I'm in
a relationship with them, and then they could show that
they're in a relationship with you. And then every now
and then you'd see something where you'd go to your
girlfriend's MySpace and she's no longer set to a relationship
with you, and you're like, what's going on here? Is
there something I don't know about? And you'd learned about things.
(05:55):
It's a hard way.
Speaker 2 (05:57):
One of the big things about MySpace for people who
might not remember is my space was customizable.
Speaker 1 (06:03):
Yeah, you could change the background and I think maybe
the fonts, and when you land on it, you could
even have music playing you could kind of theme it out. Yeah.
Speaker 2 (06:12):
I remember when Facebook came out. One of the reasons
that some people initially did not like Facebook was because
it wasn't customizable. And that was kind of a weird
divibe because I actually felt like, good, I'm sick of
going to somebody's MySpace page and I just want to
message you, and you got like a Britney Spears MIDI
playing like nah man like disable that. I don't want
(06:34):
any of that. But there were some people who really
really missed that personalization, and that personalization was pretty broad.
You could change the background of your page, you could
change the font, you could add music, you could have
a custom flashing cursor if you wanted to. Most people
just did this by copy pasting bits of code into
a form on the site, but if you knew a
little bit of HTML and CSS, you could really start
(06:57):
making that page look like your own. It was a
fun way for people who were even a little bit
interested in computers to get to play around with code.
And for nineteen year old Sammy Kumcar, who was already
very familiar with coding, this was like being a kid
in a candy store. October fourth, two thousand and five
what happens.
Speaker 1 (07:17):
So MySpace has all this customizability, and Sammy was playing
around with some of this because you can set on
my Space that you're in a relationship. There's a drop
down and where there are the options I'm in a
solid relationship, a shaky relationship, whatever. There's like a few options,
and you only get those options. Well, he's like, well,
what if I just tell it that I'm in a
hot relationship? And he was able to modify the code
(07:39):
on his own computer and submit that to the server,
and the server accepted it. So suddenly he's in a
relationship that no one else is in a relationship with
and it's like, well, how did he set that? And
there was some other stuff like how many photos you
could upload. I think there was a photo limit of twelve,
but he had uploaded an extra one or thirteen.
Speaker 2 (07:57):
Growing up, Sammy loved computers and he loved messing around
with him. When he was a kid, he'd figured out
how to hack the computer game counter Strike so that
he was essentially a god in the game. When he
flipped that switch, nobody could beat him. And for some
people that's all they want. They just want to win.
But Sammy got bored after that. He didn't want to
play counter Strike anymore.
Speaker 1 (08:18):
Yeah, because it became so easy for him. He could
just beat anybody. But there was an anti cheat maker
that came out that started detecting things that he was
doing and saying, okay, well that's no longer doable in
the game. And he's like, wow, well that gives me
a whole new challenge here now, how to figure out
how big cheats to not be detected by anti cheat
And so he got back into it just to try
(08:40):
to bypass the anti cheats there, and that became a
whole new thing for him.
Speaker 2 (08:44):
Right, so it's not even playing counter Strike anymore, it's
like playing the game off top of Counterstrike. It's like
playing cat and mouse with the company. So you can
kind of see that Sammy just likes taking stuff apart
and putting it back together again. He likes challenges. And
on MySpace, Sammy realized that he could just write some
JavaScript code on the client side and get MySpace to
display stuff that the creators had not intended, like he
(09:06):
wrote a funny comment in the relationship status section. For him,
this stuff was all pretty rudimentary, so he kept poking around.
Speaker 1 (09:14):
So he was playing around with all these different things
that you could do on MySpace, and he found a
way to make it so that if somebody visited his page,
it would make them follow him. I think it was
JavaScript code that he was able to embed into his
page that would force the person the visitor to follow him.
But you'd still have to have someone come to your
(09:35):
page in order to get someone to follow you.
Speaker 2 (09:37):
But then he.
Speaker 1 (09:37):
Figured out how to replicate this, how to make it
so that anybody who visited his page would then get
this code on their MySpace page, which would mean that
everyone who visited someone else who had this code wouldn't
follow Sammy, and not only would they follow him, but
they would comment on their MySpace page Sabby is my Hero.
Speaker 2 (09:59):
Basically, Sammy embedded code on his page that spread to
any page that looked at his and any page that
looked at that page would also get infected with the
code as well. Maybe you're starting to see where this
is going, But the important part here is that on
each page that had been infected, it would go after
the person's bio and insert the text at the bottom.
But most of all, Sammy is my hero.
Speaker 1 (10:22):
And so people would visit someone else's page, suddenly follow Sammy,
and then have it say Sammy's my hero on their page,
and they're like, wait, who's this guy Sammy? And why
does it say he's my hero.
Speaker 2 (10:33):
At first, it's not really a big deal. It's spreading
to his friends and maybe friends of friends. So Sammy
goes to bed that night thinking that he's just played
a silly prank on his friends on the internet.
Speaker 1 (10:43):
But then the next morning, when he woke up, he
had ten thousand followers on MySpace, and that really blew
his mind. He knew something had gone terribly wrong to
get ten thousand followers.
Speaker 2 (10:56):
So remember this is two thousand and five, and back then,
ten thousand friends was a really monumental number. I'm not
even sure he knew that there were ten thousand people
on MySpace.
Speaker 4 (11:07):
At that point, I just freak out. I have no
idea what to do. I'm sitting in my apartment and
I'm kind of baffled. So I realized, like, oops, I
just wrote a virus and what should I do.
Speaker 2 (11:18):
That's the voice of Sammy on Jack's podcast, The Darknet Diaries.
And because the spread was exponential, the numbers just kept
going up. Another hour later, it was at fifty thousand.
Speaker 4 (11:29):
When fifty one hundred thousand, I couldn't think about anything.
It was just refreshing. Went home, five hundred thousand, six
hundred thousand. It hits a million. I just take a
screenshot because I'm just like that. That's a lot of people.
I had the idea that many people were even on
my spence.
Speaker 2 (11:46):
Sammy now realizes that he's created a virus. Actually, it's worse.
He's created a worm, a piece of code that is
self replicating, and this worm is spreading through all of
my space. But what happens next even Sammy couldn't predict.
That's after break. Sammy's a little bit of code has started
(12:21):
as a joke. He figured that maybe in a couple
of weeks or so it reached a couple hundred people max.
But in less than twenty hours, Sammy knkard had a
million friends. This had gotten completely out of his control.
Speaker 1 (12:35):
He knows something has gone terribly awry. He thought maybe
he'd get a few hundred followers or something out of
this and then be able to turn it off. But
at this point, it feels like the momentum is going
so fast that he's having a hard time controlling it.
And even if you go to Sammy's page and you
unfollow him, what happens is it says, okay, you're no
longer following them, and then it goes back to your page,
(12:55):
and your page has the code to follow him, so
people can't even unfollow him, and if they wanted to,
they're like, why why am I permanently following you? This
is ridiculous.
Speaker 2 (13:05):
So are people messaging Sammy at this point?
Speaker 1 (13:08):
Yeah, they're confused, like who are you? How do I
unfollow you? And he's not sure because he can't pull
this back. He can't go to everyone else's MySpace page
and remove their code, so he's like, oh man, I
don't know how to turn this off. It almost seems
like everyone on my space is going to eventually follow
him because there's no other logical end to this.
Speaker 2 (13:29):
This was all an accident. Sammy had no idea that
what he'd created would spread this far, so he removes
the code from his page, but that doesn't help because
it's already spreading too fast. So he wants to help
stop it, and he gets an idea he could go
straight to my space like irol.
Speaker 1 (13:46):
He actually lived in the same town as them, both
in Los Angeles, and he's like, should I just go
over there and tell him I did this and to
give him some suggestions on what to do.
Speaker 2 (13:55):
So at first, and I wish I was making this up.
He thinks, Okay, maybe I could just like buy some
coffee and donuts and show up at MySpace office and
help them fix it, like give them the donuts, give
the coffee, sit down, crack on knuckles, write some code,
patch things up, all good. But then he thinks about
it and he realizes, Okay, maybe that's not the best idea.
Maybe I should just send them an anonymous message. So
(14:17):
he emails them and says, here's some tips on how
to handle this. It was vague but specific at the
same time, like you didn't want to say who he was.
But he was like, you might want to go in
here and disable this or do this. Here's some SQL
queries to look for these strings and you'll find the
code and you can delete it off everyone's page. He
wanted to be.
Speaker 1 (14:37):
Helpful, he did not because he realized, oh no, I've
caused a big problem here. Fox had actually bought my
Space just before this. He's thinking about this, like, Fox
might be really mad. What do I do if they're
coming after me? This is a big problem. He's trying
to help what he can, but he also doesn't want
to get himself in trouble. But it's really hard because
everything is pointing to his page and it's got his
(14:58):
name on it and everything.
Speaker 2 (15:00):
He's got his literal name on it.
Speaker 1 (15:01):
Yeah, so he's just refreshing it and looking at the
numbers going up and up, and he's like, oh my gosh,
what do I do? And then eventually one of the
refreshes his page just says this page doesn't exist.
Speaker 2 (15:12):
It's gone.
Speaker 1 (15:12):
His page was deleted or at least disabled for a while,
and he's like, okay, that's fine. So then he looks at,
you know, some of his friend's pages and they're all deleted,
they're all disabled. And he's looking at everybody who's trying
to follow him and they're all disabled, and they're all deleted.
And then he refreshes the page again and it says, sorry,
my space is down. We are taking it all offline.
(15:36):
We're doing some maintenance. We'll be back shortly.
Speaker 2 (15:40):
Sammy's a little bit of code ended up bringing MySpace
to its knees. It shut the whole site down. So
I kind of remember this happening. This was back when
I was in college and there was this Bobo shop
next to campus, and I think they had these three
Windows computers installed on the wall so that you could
use your computer while you waited for your order, and
people who were a MySpace would go there and log
(16:01):
in and check their messages. And yes, logging into your
social media on an unsecured public machine is absolutely terrible
security practice, but I don't know, people just didn't know
any better, I guess. So Yeah, Anyway, one day, I
think people were probably at home and their MySpace wasn't
working on their home computer, so they came to the
cafe to log in, and it didn't work there either,
(16:22):
but they'd already bought their boba, so people just had
to wait there awkwardly like normal human beings for the
drink order. Kind of inconvenient, but for Sammy that day
wasn't just inconvenient. Dude was sweating bullets. So after a while,
MySpace fixes the problem and it comes back all nine.
It's slow for a few days, but eventually it's back
(16:43):
to normal and that's it. It's back, And for a while,
Sammy thought that, Okay, maybe this is just a blip
and everyone would just move on and forget it all happened.
Speaker 1 (16:54):
The days after that, nothing happened, and the weeks after that,
nothing happened. She's like, Okay, I think I'll stay away
from his space for a while. I'll just lay low
because whatever happened there, I don't want to make it worse.
So let's just hope this is in the past. So
he went back to doing his work, and at that
point he had started a business.
Speaker 2 (17:13):
During that time period, Sammy had co founded a company
called Finality that used the Internet to make phone calls
instead of relying on traditional phone lines, and at the time,
this was pretty cool technology. So we just focused on that.
That message he'd sent to MySpace never got answered, and
my Space itself didn't really seem to be looking for him.
Maybe they had just let it go. So Sammy got
(17:34):
back to work.
Speaker 1 (17:36):
At some point, You're just like, Okay, everybody's just gone
their way. They fixed it, and that's just it. You know,
you fix incidents all the time at work, and I
think he thought that everything was going to be fine.
So it was a big surprise to him to find
the Secret Service we're after him. The business was doing
really well, so he actually bought himself a Porsche and
was driving that thing around town and so he was
(17:57):
having a good time. And one day he went out
out to the parking lot to kit in his car
and there was some guys standing around his car and
he's like, oh, man, are these guys gonna rob me?
Or what's going on? And one of them shouted, hey,
are you Sammy. He's like, oh gosh, usually people who
robbed me and they don't know your name. So let's
see what's going on here, and it was the Secret Service.
(18:18):
They took him to his house and they confiscated all
his computers and I said, you're being investigated for taking
down my Space.
Speaker 2 (18:25):
It had been six months since that worom took down MySpace,
and now out of the blue, here's the Electronic Crimes
Task Force of the LAPD and the Secret Service coming
around asking questions. They had him under surveillance for months,
and they had a search warrant for his house and
his office. They took his laptop, they took his hard drives,
even took his iPod. The DA ended up hitting Sammy
(18:47):
with a felony hacking charge, and prosecutors wanted him to
spend some time in prison and not be able to
touch computers for the rest of his life. Sammy freaked
out and he ended up taking a plea deal exchange
for not having to go to prison. He paid a
twenty thousand dollars fine, he had to complete seven hundred
and twenty hours of community service and three years of probation. Oh,
(19:10):
and he couldn't use computers. Well, he could use one computer,
but that computer had to be registered with authorities and
it couldn't access the Internet. Now keep in mind here,
Sammy's whole life and work had revolved around technology to
this point, so not being able to use an Internet
enabled computer was kind of like telling them, Okay, yeah,
(19:31):
here kid, have a typewriter, go do your job. At
this point in his life, the Internet was his livelihood
and it's how he was able to support his mom.
Speaker 1 (19:41):
He was paying her rent and helping her out and
all that. And so his startup that he had started,
he had a very difficult time doing any work there
because that was all computer based work that he was doing.
So I don't know if he was making a salary
during that time to help her anymore anything, And it was.
Speaker 2 (19:57):
Tough for Sammy. It meant that he could do a
lot of the stuff that he used to, but he
tried to look at the bright side. Sammy told Vice
his motherboard how it forced him to go outside and
touch grass.
Speaker 4 (20:08):
I kind of started a new chapter of life because
I spent my entire life just in front of the computer,
and finally this like got me out. I just spent
a lot of time doing other things that I think
normal people did.
Speaker 2 (20:18):
But barring access to computers was like barring Sammy from
accessing a part of himself. This was someone who really
loved computers and who says that he didn't mean to
write a worm in the first place.
Speaker 1 (20:30):
Some of these hackers who have been in trouble have
had that sentence brought to them where they're banned from
computers for life. It's always frustrating to me because there's
obviously these people are very talented and skilled and trying
to take their way of making money away their livelihood.
I mean even a cash register as a computer at
this point. It's so sad to see them take that
(20:53):
away when that's the thing that their best at in
life and the most passionate thing. I think what's better
is to try to figure out how to use their
skills for good and to determine is this person, you know, rehabbable.
Are they just trying to burn the world down and
no matter how well we try to turn them in
the right way, they're just going to destroy everything. Or
is this somebody who we can use their skills for
(21:15):
some net benefit on society or you know, it wasn't
like he was trying to do anything malicious. I think
at Samy's core, he's not a malicious person. He's just
someone who's curious and interested in technology, and he's not
trying to harm anybody or hurt anything. I've since met
him and hung out with him quite a few times,
and he is just such a sweetheart. He loves learning stuff,
and he's just so deep down in the technology of
(21:37):
it that he's extremely brilliant, like one of the more
brilliant folks I know when it comes to not so
much seeing what the technology does, but seeing what it
could potentially do. He's just really fascinated with the way
technology works and likes exploring it.
Speaker 2 (21:51):
Let's say it's two thousand and five. You're at MySpace.
You're tom right. Yeah, you find out that somebody has
done something to your website, taken it down for a day,
You figure out who this kid is, what's the appropriate
punishment here? What do you do? Press chargers?
Speaker 1 (22:11):
I wouldn't. I would feel like our code wasn't up
to snuff. We had not you know, fortified it enough,
and somebody found a vulnerability. So this was a surprise
vulnerability assessment. That's that their ownership's on us, right, and
we can't just assume everyone is just like a criminal
if they've done something wrong on our website and try
to take them down. But yeah, I think if I was, yeah,
(22:33):
my Space exec, I'd try to take ownership of this
and say, you know what, this was something we should
have done better, and it's okay, we've solved it. We
were only down for a day. That's not too bad.
It's not like there was a lot of damage done.
Somebody posted this little bit of JavaScript on their page
and that accidentally spread everywhere. I don't think that's criminal behavior.
I think that's just a problem that we we should
(22:56):
have addressed.
Speaker 2 (22:58):
Sammy eventually managed to get back online, and we'll talk
about that in just a minute, but first we need
to talk about how the sami worm changed how the
modern Internet looks. We'll get into that after the break.
(23:19):
What do you think the industry learned after the sami worm?
Have they learned anything?
Speaker 1 (23:24):
Yeah, definitely. So, as I was talking about, at that time,
we were moving into the web two point zero stage, which
is now users can add data to a website. They
can put their pictures up there, they could put texts,
they could put other things, and in this case, they
can put JavaScript up there. And the internet has learned.
The Internet providers or the web page runners, people, edmins,
(23:45):
devs and stuff have learned don't trust anything that a
user does, sanitizer inputs, check it for what's valid and
not valid, and don't allow for anything to be uploaded
that isn't on this strict allow list, because when you
start letting people put up whatever they want, now you've
run into huge problems like this Sammy werm And So
I think this was a lesson that probably a lot
(24:07):
of social media companies learn that. Don't allow people to
put JavaScript up.
Speaker 2 (24:11):
That's a no no.
Speaker 1 (24:12):
And I don't think you could find a single social
media site that allows the user to add JavaScript into
the page, because that would you could add a cryptomindor
to anybody who visited your website. Right, Like, there's lots
of things that could go wrong by letting the user
put JavaScript on their profile. You've got to really limit
what users can do when they're adding content to your website.
Speaker 2 (24:35):
For example, Facebook, which eventually overtook MySpace as the biggest
social media platform, it didn't allow you to customize anything.
And that's pretty much how all our social media is now,
and casual users don't know hdmil anymore like we used to,
like back in the MySpace era, even somebody who wasn't
really into computers could kind of navigate their way around
(24:56):
little snippets of code because we were motivated to because look,
if you want to put that sparkly Snoop Dogg animated
gift on your profile, that is some pretty powerful motivation
to start looking at some code. Is that the correct
decision is to make things more sanitized, more flat?
Speaker 1 (25:14):
Maybe yeah, maybe that's the situation is that Facebook was like,
look what you guys did over there, We're not going
to let our users get crazy like that. And maybe
that was the appropriate response just from a security level,
because yeah, when users start adding their own stuff, they
can take over the whole website and you've got to
be very careful about what they can do there.
Speaker 2 (25:33):
Okay, Now, granted Facebook did start out pretty uncustomizable to
begin with, but maybe the Sammy worn't for them was
kind of an I told you so moment and they
weren't wrong. I mean, if you look at the Internet today,
you can see the impact. Everything kind of looks the same.
There's this clean aesthetic, and customization is minimal to nonexistent.
(25:55):
I mean, Twitter no customization, substack, basically none. I mean
even website builders like Squarespace, they're basically just modular blocks
that you can move bit to the page around. You
almost never really get to mess with the code. And
I'm not saying that this is because of the Sami worm,
but the do it yourself customization that was part of
(26:16):
what made MySpace fun is mostly gone or at least
hidden from the Internet today. And you can understand why.
If you open up your platform to let people tweak
the code, you also open it up to vulnerabilities. But
on top of that, the Sami worm also revealed that
even reputable websites that we trust. I mean, remember again,
(26:36):
MySpace was the social media platform back then. They might
not be as secure as we would expect them to be.
Speaker 1 (26:43):
I think just us as a society assumes that people
have taken care of the security of their app and
site and all that stuff. And it's like, well, obviously
one hundred thousand people wouldn't have downloaded this if it's
not secure, so I'll trust it as well. And so
you have this kind of social proof. But also you
just have this expectation that the website you're dealing with
(27:04):
it uses the highest security and the best privacy and
all that sort of stuff, and you don't question it.
You just assume it. And I think that's our problem.
I've kind of switched it in my mind after covering
stories like this myself. I assume that they're not using
the best security of privacy, and therefore I'm definitely not
going to share my data with them. I don't give
(27:25):
my real name, or I use a burner email and
a burner phone and the fake address and even a
burner credit card when interacting with most sites today.
Speaker 2 (27:36):
So Jack takes his digital security to another level. And
again it makes sense from all those hackers he's talked
to on Dark Knight diaries because he knows how vulnerable
your information can be if you just put it out there.
But not all hackers are out there to steal your information.
Sammy's an example of someone who's curiosity led him to
look for those vulnerabilities and then to warn people about them.
(27:58):
In two thousand and eight, after three years of being
banned from the Internet, Samy was finally allowed to be
back online. So he left the courthouse that day, drove
straight to the Apple store, bought a PowerBook, and started
messing around. And one of the first things he did
was he started looking into credit cards.
Speaker 1 (28:15):
There's a NFC readers in some of these cards, you
know how you tap to pay, Those are using NFC technology.
And he was saying to himself, well, wait a minute,
what's the communication that happens between these sort of things,
And is there a way that I can steal someone's
credit card if I tap up against them? And so
that was one of his research projects that he did,
was to figure out how to clone NFC cards. And again,
(28:39):
he wasn't trying to steal credit cards in order to
sell them on the dark web or any of that
sort of thing. He was simply trying to understand this
technology so that he could share it with the world
make it a better security system, because I don't want
somebody bumping up to me in the line at the
store and stealing my card and then being able to
use it. So if he could tell the credit card makers, hey,
(29:00):
here's some problems with your card, maybe you should make
your card more secure, then I think that does help
make our cards more secure.
Speaker 2 (29:07):
You've spoken to a pretty wide range of people, some
of whom have done some pretty you know, nefarious stuff.
Where does Sammy rank on that for you?
Speaker 1 (29:15):
Sammy's a good guy. He's not out there to try
to make a bunch of money or steal things or
destroy the world. He's really just curious at his core,
and he loves finding things that the computer can do
that he might think to himself, well, if I can
do this, then it's probably the case that a lot
of other people can do this. So it's not like
I'm inventing something new or breaking something. I'm just showing
(29:38):
you how this technology works that somebody could use it
in this way. It's not like he's trying to give
the world a weapon and say here go mess up
the world. He's trying to show the world, Hey, the
other people might be able to do this, and now
you can too, so let's even the playing field or
the people who make this technology should fix this.
Speaker 2 (29:56):
This was a pretty wild outcome for someone who again
only a few years before that. It started out just
screwing around with Counterstrike. And there's probably some kids out
there who are also exploring video games just like Sammy,
but nowadays there are some more established roots to do
some pretty nefarious stuff.
Speaker 1 (30:14):
I've seen this character arc and a lot of hackers though,
is that they play video games and they get bored
with it, then they try to hack it, and then
they do, and then they're like, well, but that was
just for fun. And then they learn more about hacking
and other circles and stuff, and they learn, oh wow,
that people are actually making money with this interesting and
so then that transfers into okay, here's how to earn
(30:36):
roebucks website and just try to get little kids to
come to our website to earn roebucks free roebucks, but
then we never give it to them. You now scamming
the kids that are before you, which you're now familiar
with the roebucks because you just played the game for
the last ten years or something, and you're like, I
know everything about this game, so obviously I know how
to exploit it or exploit the user base or something
like that. And then you start finding users that want
(30:57):
to join you and they're like, hey, how do I
make money like you? And then starts scamming them even more,
and so you end up in that circle, and then
that just keeps going to something bigger, like cryptocurrency or
something else where you're just like, oh, well, why am
I looking at small potatoes. I could be stealing millions
instead of just a few robots here and there, and
that just turns you into the super criminal at that
(31:19):
point or something. And there is this path that I
see again and again where it starts with video games
and you get into these circles of people hacking and
scamming the game, and then it just keeps going from there.
Speaker 2 (31:30):
And Sammy just got some extra friends. Yeah, that's what
he did. Given the punishment that Sammy had to go through,
it's kind of amazing that he still bounced back and
he's now continuing to work to help people by publicly
disclosing company security and privacy flaws and kind of holding
their feet to the fire to actually fix them.
Speaker 1 (31:50):
History has kind of proven that the hackers are on
the right side. Before we even had hackers, we had
people who were testing the safety of cars and saying, hey,
we should be wearing seat belts, and the car makers
are like, nah, and it's fine, you don't need that.
And they're like, look, here's what's happening when people crash
without seat belts. You should have them wear seat belts.
They were thinking, these people were wrong to make such
(32:11):
a stink out of this right, stop making it look
like our cars aren't safe.
Speaker 2 (32:15):
Our cars are safe.
Speaker 1 (32:16):
And eventually those people want they said, yeah, seat belts
are incredibly safe. So that became the new thing of like, okay,
let's embrace these people who are crash testing our cars
and making sure that they are more of the solution
instead of more of the problem. And I think that's
the side we should look at here, which is do
we have a vulnerability in this technology or this website,
And if so, that's on us to fix that and
(32:38):
thank you for showing me that vulnerability. That will make
our whole system safer. But it's kind of frustrating because
if somebody comes to you and says, hey, your zippers down,
you have this instant feeling of shame and embarrassment and
the sort of thing. And so I think a lot
of people do feel that. When they get told their
website has a vulnerability, you get this emotional reaction. We
don't need that emotional reaction. Your slippers down, but thank
(32:58):
you for telling me. I appreciate him. Gonna get it
back up. It's hard to handle criticism sometimes.
Speaker 2 (33:07):
And Okay, maybe he did technically force over a million
people to say it, But twenty years later, it turns
out Sammy's little bit of code held some truth for hackers.
Sammy really is a hero.
Speaker 1 (33:19):
Sammy is my hero. Is what you would hear people
shouting when you go to death Count. I mean, he's legendary.
You hear about him everywhere you go.
Speaker 2 (33:28):
Your big shout out to Jack Resider for talking with us,
and I'd definitely encourage you to check out his full
interview with Sammy Camcarr on the podcast The Dark Knight Diaries,
where they get into some other details that we couldn't
touch on here, like Sammy's work on drones, his podcast
in general, is a really good look at the hacking
culture that we were talking about today. So if any
of this interested you, definitely check it out and we'll
(33:51):
leave a link in the show notes to check that out.
But that being said, back to our show. Thank you
so much for listening to another episode of kill Switch.
If you want to talk to us, you can email
us at kill Switch at Kalaidoscope dot NYC, or on
(34:14):
Instagram or at kill switch pod. And while you're still
listening to this, you could think about leaving us a review.
It helps other people find the show, which helps us
keep doing our thing, and it lets us know what
people want to hear more of. And once you've done that,
did you know it? Kill Switch is also on YouTube
and the link for that and everything else is in
the show notes. Kill Switch is hosted by Me Dexter Thomas.
(34:39):
It's produced by sen Ozaki, Dar Luck Potts, and Julian Nutter.
Our theme song is by me and Kyle Murdoch, and
Kyle also mixed the show from Kalidoscope. Our executive producers
are Oswa lashin On, Geshat Togador and Kate Osborne from iHeart.
Our executive producers are Katrina norbl And nikki E Tour.
That's it from us. We'll catch ya next week. M
So yeah, do logistics. Could I have you introduce yourself.
My name's Jack ree Sider. I'm the host of the
podcast Darknet Diaries.
Speaker 2 (00:20):
If you haven't heard of the Darknet Diaries podcast, let
me explain the background a little bit here. So every
episode they get into some real wild story that's usually
about hackers, and that might be why Jack is so
cautious about revealing his identity, because he knows what's out there.
So maybe we should address the elephant on the screen here.
For those of you watching.
Speaker 1 (00:41):
I'm an anonymous podcaster. I don't like showing myself my
face or anything like that, so I'm using a filter
to keep my privacy when I cover enough of these hacks.
When I hear about breach after breach after breach, I
think to myself, well, I guess all my data is
out there. There's nothing I can do, and I become
black pelt, I suppose, where I just feel completely hopeless
about privacy. But then I realized, no, who's the ding
(01:04):
dong who gave them my data?
Speaker 2 (01:05):
It was me.
Speaker 1 (01:06):
So in order to protect myself from being in breach
after breach, I just stopped giving my data to anyone
who asked for it. And so that's why, after you know,
seven ten years of doing a podcast about hacking, this
is where I've landed on being an extreme privacy advocate.
And that's why I don't like to show my face anywhere.
If you think about, like what your ex lover knew
(01:27):
about you when you were in the height of your relationship,
they do everything. They knew your password, they knew your photo,
but they do everywhere you wet every day. But that
was years ago. You've broken up with them, and now
they don't know anything about what you're up to, right,
and so there's still hope on recovering your privacy and
getting it back. So I'm totally white piled now. I
have a lot of optimism about my privacy.
Speaker 2 (01:47):
I love how we're starting this out like that because
I feel like we're going to go there right because
the time period that we're going to talk about very
much was either a a lot of people didn't really
care too much about their information being out there, or
they didn't really think about it or very much were
thinking in the sense that, uh, you know, everything's out there,
(02:07):
what can I possibly do about this? You know? Yeah, yeah, exactly.
On this week's episode, Jack is going to share one
of the most bizarre, the most frustrating, but also honestly
one of the most hopeful hacking stories that I've ever heard.
It takes us back to a time when even the
phrase hacker freaked everyone out. And if you were around
(02:28):
in the MySpace days and you've been wondering why social
media today looks so boring, maybe this week's story has
some answers for you.
Speaker 3 (02:42):
I'm afraid.
Speaker 2 (02:45):
Kaleidoscope and iHeart podcasts. This is kill Switch. I'm Dexah Thomas.
Speaker 3 (02:54):
I'm all right, goodbye.
Speaker 2 (03:37):
Yeah. So take us back to two thousand and five.
What was the Internet like back then?
Speaker 1 (03:42):
So we're going from Internet one point oh to Internet
two point oho. In those days, and one point oh
was basically read only. Everything was just posted there and
you could read it, but you couldn't really interact with it.
There's no upfolts, there's no likes, there's no shares, there's
no oh let me create an account and comment on this.
It's just read it and that's all you get. And
then as Internet two point zero came around, we started
(04:04):
getting sites like dig and read It and MySpace, where
now you are creating content on this site. Now you
have this little personal space on this website. This is
the music I like, and this is the bands I follow,
and this is the stuff I've been doing every day,
and this is my comments about these things. And so
it became this read write kind of era, where now
I can read it and I can comment on it,
(04:25):
and I can write about it now. I think everyone's
favorite subject then and now is ourselves, and so we
love talking about ourselves on the Internet. And so when
my Space showed up, it's like, we want to know
all about you, and you're like, yeah, let me jump
on here and tell you what my interests are and
show you pictures of what I've been doing and all
the fun activities I've been up to. And so it
was the first big social media to hit our Internet,
(04:48):
and it was really fascinating.
Speaker 2 (04:52):
My Space started in two thousand and three, and the
whole point of the site was to let you connect
with your friends and maybe even make new ones. But
probably the most the famous or infamous feature of MySpace
was the top eight. So this was a feature that
would allow you to publicly rank your top eight friends,
and everyone who used it back then you probably remember
agonizing over who you should put in that top eight
(05:13):
and then accidentally having somebody get mad because they weren't
included or didn't like where they were placed, and then
it causing all sorts of weird beef and drama at school.
Another thing that people probably remember is that when you
first started your account, you were automatically friends with Tom,
the co founder of the site. And then there was
the options that you could use to categorize yourself.
Speaker 1 (05:32):
You could tell us what mood you were in or
what relationship you were in, and you could connect your
boyfriend or girlfriend to you to say, oh, I'm in
a relationship with them, and then they could show that
they're in a relationship with you. And then every now
and then you'd see something where you'd go to your
girlfriend's MySpace and she's no longer set to a relationship
with you, and you're like, what's going on here? Is
there something I don't know about? And you'd learned about things.
(05:55):
It's a hard way.
Speaker 2 (05:57):
One of the big things about MySpace for people who
might not remember is my space was customizable.
Speaker 1 (06:03):
Yeah, you could change the background and I think maybe
the fonts, and when you land on it, you could
even have music playing you could kind of theme it out. Yeah.
Speaker 2 (06:12):
I remember when Facebook came out. One of the reasons
that some people initially did not like Facebook was because
it wasn't customizable. And that was kind of a weird
divibe because I actually felt like, good, I'm sick of
going to somebody's MySpace page and I just want to
message you, and you got like a Britney Spears MIDI
playing like nah man like disable that. I don't want
(06:34):
any of that. But there were some people who really
really missed that personalization, and that personalization was pretty broad.
You could change the background of your page, you could
change the font, you could add music, you could have
a custom flashing cursor if you wanted to. Most people
just did this by copy pasting bits of code into
a form on the site, but if you knew a
little bit of HTML and CSS, you could really start
(06:57):
making that page look like your own. It was a
fun way for people who were even a little bit
interested in computers to get to play around with code.
And for nineteen year old Sammy Kumcar, who was already
very familiar with coding, this was like being a kid
in a candy store. October fourth, two thousand and five
what happens.
Speaker 1 (07:17):
So MySpace has all this customizability, and Sammy was playing
around with some of this because you can set on
my Space that you're in a relationship. There's a drop
down and where there are the options I'm in a
solid relationship, a shaky relationship, whatever. There's like a few options,
and you only get those options. Well, he's like, well,
what if I just tell it that I'm in a
hot relationship? And he was able to modify the code
(07:39):
on his own computer and submit that to the server,
and the server accepted it. So suddenly he's in a
relationship that no one else is in a relationship with
and it's like, well, how did he set that? And
there was some other stuff like how many photos you
could upload. I think there was a photo limit of twelve,
but he had uploaded an extra one or thirteen.
Speaker 2 (07:57):
Growing up, Sammy loved computers and he loved messing around
with him. When he was a kid, he'd figured out
how to hack the computer game counter Strike so that
he was essentially a god in the game. When he
flipped that switch, nobody could beat him. And for some
people that's all they want. They just want to win.
But Sammy got bored after that. He didn't want to
play counter Strike anymore.
Speaker 1 (08:18):
Yeah, because it became so easy for him. He could
just beat anybody. But there was an anti cheat maker
that came out that started detecting things that he was
doing and saying, okay, well that's no longer doable in
the game. And he's like, wow, well that gives me
a whole new challenge here now, how to figure out
how big cheats to not be detected by anti cheat
And so he got back into it just to try
(08:40):
to bypass the anti cheats there, and that became a
whole new thing for him.
Speaker 2 (08:44):
Right, so it's not even playing counter Strike anymore, it's
like playing the game off top of Counterstrike. It's like
playing cat and mouse with the company. So you can
kind of see that Sammy just likes taking stuff apart
and putting it back together again. He likes challenges. And
on MySpace, Sammy realized that he could just write some
JavaScript code on the client side and get MySpace to
display stuff that the creators had not intended, like he
(09:06):
wrote a funny comment in the relationship status section. For him,
this stuff was all pretty rudimentary, so he kept poking around.
Speaker 1 (09:14):
So he was playing around with all these different things
that you could do on MySpace, and he found a
way to make it so that if somebody visited his page,
it would make them follow him. I think it was
JavaScript code that he was able to embed into his
page that would force the person the visitor to follow him.
But you'd still have to have someone come to your
(09:35):
page in order to get someone to follow you.
Speaker 2 (09:37):
But then he.
Speaker 1 (09:37):
Figured out how to replicate this, how to make it
so that anybody who visited his page would then get
this code on their MySpace page, which would mean that
everyone who visited someone else who had this code wouldn't
follow Sammy, and not only would they follow him, but
they would comment on their MySpace page Sabby is my Hero.
Speaker 2 (09:59):
Basically, Sammy embedded code on his page that spread to
any page that looked at his and any page that
looked at that page would also get infected with the
code as well. Maybe you're starting to see where this
is going, But the important part here is that on
each page that had been infected, it would go after
the person's bio and insert the text at the bottom.
But most of all, Sammy is my hero.
Speaker 1 (10:22):
And so people would visit someone else's page, suddenly follow Sammy,
and then have it say Sammy's my hero on their page,
and they're like, wait, who's this guy Sammy? And why
does it say he's my hero.
Speaker 2 (10:33):
At first, it's not really a big deal. It's spreading
to his friends and maybe friends of friends. So Sammy
goes to bed that night thinking that he's just played
a silly prank on his friends on the internet.
Speaker 1 (10:43):
But then the next morning, when he woke up, he
had ten thousand followers on MySpace, and that really blew
his mind. He knew something had gone terribly wrong to
get ten thousand followers.
Speaker 2 (10:56):
So remember this is two thousand and five, and back then,
ten thousand friends was a really monumental number. I'm not
even sure he knew that there were ten thousand people
on MySpace.
Speaker 4 (11:07):
At that point, I just freak out. I have no
idea what to do. I'm sitting in my apartment and
I'm kind of baffled. So I realized, like, oops, I
just wrote a virus and what should I do.
Speaker 2 (11:18):
That's the voice of Sammy on Jack's podcast, The Darknet Diaries.
And because the spread was exponential, the numbers just kept
going up. Another hour later, it was at fifty thousand.
Speaker 4 (11:29):
When fifty one hundred thousand, I couldn't think about anything.
It was just refreshing. Went home, five hundred thousand, six
hundred thousand. It hits a million. I just take a
screenshot because I'm just like that. That's a lot of people.
I had the idea that many people were even on
my spence.
Speaker 2 (11:46):
Sammy now realizes that he's created a virus. Actually, it's worse.
He's created a worm, a piece of code that is
self replicating, and this worm is spreading through all of
my space. But what happens next even Sammy couldn't predict.
That's after break. Sammy's a little bit of code has started
(12:21):
as a joke. He figured that maybe in a couple
of weeks or so it reached a couple hundred people max.
But in less than twenty hours, Sammy knkard had a
million friends. This had gotten completely out of his control.
Speaker 1 (12:35):
He knows something has gone terribly awry. He thought maybe
he'd get a few hundred followers or something out of
this and then be able to turn it off. But
at this point, it feels like the momentum is going
so fast that he's having a hard time controlling it.
And even if you go to Sammy's page and you
unfollow him, what happens is it says, okay, you're no
longer following them, and then it goes back to your page,
(12:55):
and your page has the code to follow him, so
people can't even unfollow him, and if they wanted to,
they're like, why why am I permanently following you? This
is ridiculous.
Speaker 2 (13:05):
So are people messaging Sammy at this point?
Speaker 1 (13:08):
Yeah, they're confused, like who are you? How do I
unfollow you? And he's not sure because he can't pull
this back. He can't go to everyone else's MySpace page
and remove their code, so he's like, oh man, I
don't know how to turn this off. It almost seems
like everyone on my space is going to eventually follow
him because there's no other logical end to this.
Speaker 2 (13:29):
This was all an accident. Sammy had no idea that
what he'd created would spread this far, so he removes
the code from his page, but that doesn't help because
it's already spreading too fast. So he wants to help
stop it, and he gets an idea he could go
straight to my space like irol.
Speaker 1 (13:46):
He actually lived in the same town as them, both
in Los Angeles, and he's like, should I just go
over there and tell him I did this and to
give him some suggestions on what to do.
Speaker 2 (13:55):
So at first, and I wish I was making this up.
He thinks, Okay, maybe I could just like buy some
coffee and donuts and show up at MySpace office and
help them fix it, like give them the donuts, give
the coffee, sit down, crack on knuckles, write some code,
patch things up, all good. But then he thinks about
it and he realizes, Okay, maybe that's not the best idea.
Maybe I should just send them an anonymous message. So
(14:17):
he emails them and says, here's some tips on how
to handle this. It was vague but specific at the
same time, like you didn't want to say who he was.
But he was like, you might want to go in
here and disable this or do this. Here's some SQL
queries to look for these strings and you'll find the
code and you can delete it off everyone's page. He
wanted to be.
Speaker 1 (14:37):
Helpful, he did not because he realized, oh no, I've
caused a big problem here. Fox had actually bought my
Space just before this. He's thinking about this, like, Fox
might be really mad. What do I do if they're
coming after me? This is a big problem. He's trying
to help what he can, but he also doesn't want
to get himself in trouble. But it's really hard because
everything is pointing to his page and it's got his
(14:58):
name on it and everything.
Speaker 2 (15:00):
He's got his literal name on it.
Speaker 1 (15:01):
Yeah, so he's just refreshing it and looking at the
numbers going up and up, and he's like, oh my gosh,
what do I do? And then eventually one of the
refreshes his page just says this page doesn't exist.
Speaker 2 (15:12):
It's gone.
Speaker 1 (15:12):
His page was deleted or at least disabled for a while,
and he's like, okay, that's fine. So then he looks at,
you know, some of his friend's pages and they're all deleted,
they're all disabled. And he's looking at everybody who's trying
to follow him and they're all disabled, and they're all deleted.
And then he refreshes the page again and it says, sorry,
my space is down. We are taking it all offline.
(15:36):
We're doing some maintenance. We'll be back shortly.
Speaker 2 (15:40):
Sammy's a little bit of code ended up bringing MySpace
to its knees. It shut the whole site down. So
I kind of remember this happening. This was back when
I was in college and there was this Bobo shop
next to campus, and I think they had these three
Windows computers installed on the wall so that you could
use your computer while you waited for your order, and
people who were a MySpace would go there and log
(16:01):
in and check their messages. And yes, logging into your
social media on an unsecured public machine is absolutely terrible
security practice, but I don't know, people just didn't know
any better, I guess. So Yeah, Anyway, one day, I
think people were probably at home and their MySpace wasn't
working on their home computer, so they came to the
cafe to log in, and it didn't work there either,
(16:22):
but they'd already bought their boba, so people just had
to wait there awkwardly like normal human beings for the
drink order. Kind of inconvenient, but for Sammy that day
wasn't just inconvenient. Dude was sweating bullets. So after a while,
MySpace fixes the problem and it comes back all nine.
It's slow for a few days, but eventually it's back
(16:43):
to normal and that's it. It's back, And for a while,
Sammy thought that, Okay, maybe this is just a blip
and everyone would just move on and forget it all happened.
Speaker 1 (16:54):
The days after that, nothing happened, and the weeks after that,
nothing happened. She's like, Okay, I think I'll stay away
from his space for a while. I'll just lay low
because whatever happened there, I don't want to make it worse.
So let's just hope this is in the past. So
he went back to doing his work, and at that
point he had started a business.
Speaker 2 (17:13):
During that time period, Sammy had co founded a company
called Finality that used the Internet to make phone calls
instead of relying on traditional phone lines, and at the time,
this was pretty cool technology. So we just focused on that.
That message he'd sent to MySpace never got answered, and
my Space itself didn't really seem to be looking for him.
Maybe they had just let it go. So Sammy got
(17:34):
back to work.
Speaker 1 (17:36):
At some point, You're just like, Okay, everybody's just gone
their way. They fixed it, and that's just it. You know,
you fix incidents all the time at work, and I
think he thought that everything was going to be fine.
So it was a big surprise to him to find
the Secret Service we're after him. The business was doing
really well, so he actually bought himself a Porsche and
was driving that thing around town and so he was
(17:57):
having a good time. And one day he went out
out to the parking lot to kit in his car
and there was some guys standing around his car and
he's like, oh, man, are these guys gonna rob me?
Or what's going on? And one of them shouted, hey,
are you Sammy. He's like, oh gosh, usually people who
robbed me and they don't know your name. So let's
see what's going on here, and it was the Secret Service.
(18:18):
They took him to his house and they confiscated all
his computers and I said, you're being investigated for taking
down my Space.
Speaker 2 (18:25):
It had been six months since that worom took down MySpace,
and now out of the blue, here's the Electronic Crimes
Task Force of the LAPD and the Secret Service coming
around asking questions. They had him under surveillance for months,
and they had a search warrant for his house and
his office. They took his laptop, they took his hard drives,
even took his iPod. The DA ended up hitting Sammy
(18:47):
with a felony hacking charge, and prosecutors wanted him to
spend some time in prison and not be able to
touch computers for the rest of his life. Sammy freaked
out and he ended up taking a plea deal exchange
for not having to go to prison. He paid a
twenty thousand dollars fine, he had to complete seven hundred
and twenty hours of community service and three years of probation. Oh,
(19:10):
and he couldn't use computers. Well, he could use one computer,
but that computer had to be registered with authorities and
it couldn't access the Internet. Now keep in mind here,
Sammy's whole life and work had revolved around technology to
this point, so not being able to use an Internet
enabled computer was kind of like telling them, Okay, yeah,
(19:31):
here kid, have a typewriter, go do your job. At
this point in his life, the Internet was his livelihood
and it's how he was able to support his mom.
Speaker 1 (19:41):
He was paying her rent and helping her out and
all that. And so his startup that he had started,
he had a very difficult time doing any work there
because that was all computer based work that he was doing.
So I don't know if he was making a salary
during that time to help her anymore anything, And it was.
Speaker 2 (19:57):
Tough for Sammy. It meant that he could do a
lot of the stuff that he used to, but he
tried to look at the bright side. Sammy told Vice
his motherboard how it forced him to go outside and
touch grass.
Speaker 4 (20:08):
I kind of started a new chapter of life because
I spent my entire life just in front of the computer,
and finally this like got me out. I just spent
a lot of time doing other things that I think
normal people did.
Speaker 2 (20:18):
But barring access to computers was like barring Sammy from
accessing a part of himself. This was someone who really
loved computers and who says that he didn't mean to
write a worm in the first place.
Speaker 1 (20:30):
Some of these hackers who have been in trouble have
had that sentence brought to them where they're banned from
computers for life. It's always frustrating to me because there's
obviously these people are very talented and skilled and trying
to take their way of making money away their livelihood.
I mean even a cash register as a computer at
this point. It's so sad to see them take that
(20:53):
away when that's the thing that their best at in
life and the most passionate thing. I think what's better
is to try to figure out how to use their
skills for good and to determine is this person, you know, rehabbable.
Are they just trying to burn the world down and
no matter how well we try to turn them in
the right way, they're just going to destroy everything. Or
is this somebody who we can use their skills for
(21:15):
some net benefit on society or you know, it wasn't
like he was trying to do anything malicious. I think
at Samy's core, he's not a malicious person. He's just
someone who's curious and interested in technology, and he's not
trying to harm anybody or hurt anything. I've since met
him and hung out with him quite a few times,
and he is just such a sweetheart. He loves learning stuff,
and he's just so deep down in the technology of
(21:37):
it that he's extremely brilliant, like one of the more
brilliant folks I know when it comes to not so
much seeing what the technology does, but seeing what it
could potentially do. He's just really fascinated with the way
technology works and likes exploring it.
Speaker 2 (21:51):
Let's say it's two thousand and five. You're at MySpace.
You're tom right. Yeah, you find out that somebody has
done something to your website, taken it down for a day,
You figure out who this kid is, what's the appropriate
punishment here? What do you do? Press chargers?
Speaker 1 (22:11):
I wouldn't. I would feel like our code wasn't up
to snuff. We had not you know, fortified it enough,
and somebody found a vulnerability. So this was a surprise
vulnerability assessment. That's that their ownership's on us, right, and
we can't just assume everyone is just like a criminal
if they've done something wrong on our website and try
to take them down. But yeah, I think if I was, yeah,
(22:33):
my Space exec, I'd try to take ownership of this
and say, you know what, this was something we should
have done better, and it's okay, we've solved it. We
were only down for a day. That's not too bad.
It's not like there was a lot of damage done.
Somebody posted this little bit of JavaScript on their page
and that accidentally spread everywhere. I don't think that's criminal behavior.
I think that's just a problem that we we should
(22:56):
have addressed.
Speaker 2 (22:58):
Sammy eventually managed to get back online, and we'll talk
about that in just a minute, but first we need
to talk about how the sami worm changed how the
modern Internet looks. We'll get into that after the break.
(23:19):
What do you think the industry learned after the sami worm?
Have they learned anything?
Speaker 1 (23:24):
Yeah, definitely. So, as I was talking about, at that time,
we were moving into the web two point zero stage, which
is now users can add data to a website. They
can put their pictures up there, they could put texts,
they could put other things, and in this case, they
can put JavaScript up there. And the internet has learned.
The Internet providers or the web page runners, people, edmins,
(23:45):
devs and stuff have learned don't trust anything that a
user does, sanitizer inputs, check it for what's valid and
not valid, and don't allow for anything to be uploaded
that isn't on this strict allow list, because when you
start letting people put up whatever they want, now you've
run into huge problems like this Sammy werm And So
I think this was a lesson that probably a lot
(24:07):
of social media companies learn that. Don't allow people to
put JavaScript up.
Speaker 2 (24:11):
That's a no no.
Speaker 1 (24:12):
And I don't think you could find a single social
media site that allows the user to add JavaScript into
the page, because that would you could add a cryptomindor
to anybody who visited your website. Right, Like, there's lots
of things that could go wrong by letting the user
put JavaScript on their profile. You've got to really limit
what users can do when they're adding content to your website.
Speaker 2 (24:35):
For example, Facebook, which eventually overtook MySpace as the biggest
social media platform, it didn't allow you to customize anything.
And that's pretty much how all our social media is now,
and casual users don't know hdmil anymore like we used to,
like back in the MySpace era, even somebody who wasn't
really into computers could kind of navigate their way around
(24:56):
little snippets of code because we were motivated to because look,
if you want to put that sparkly Snoop Dogg animated
gift on your profile, that is some pretty powerful motivation
to start looking at some code. Is that the correct
decision is to make things more sanitized, more flat?
Speaker 1 (25:14):
Maybe yeah, maybe that's the situation is that Facebook was like,
look what you guys did over there, We're not going
to let our users get crazy like that. And maybe
that was the appropriate response just from a security level,
because yeah, when users start adding their own stuff, they
can take over the whole website and you've got to
be very careful about what they can do there.
Speaker 2 (25:33):
Okay, Now, granted Facebook did start out pretty uncustomizable to
begin with, but maybe the Sammy worn't for them was
kind of an I told you so moment and they
weren't wrong. I mean, if you look at the Internet today,
you can see the impact. Everything kind of looks the same.
There's this clean aesthetic, and customization is minimal to nonexistent.
(25:55):
I mean, Twitter no customization, substack, basically none. I mean
even website builders like Squarespace, they're basically just modular blocks
that you can move bit to the page around. You
almost never really get to mess with the code. And
I'm not saying that this is because of the Sami worm,
but the do it yourself customization that was part of
(26:16):
what made MySpace fun is mostly gone or at least
hidden from the Internet today. And you can understand why.
If you open up your platform to let people tweak
the code, you also open it up to vulnerabilities. But
on top of that, the Sami worm also revealed that
even reputable websites that we trust. I mean, remember again,
(26:36):
MySpace was the social media platform back then. They might
not be as secure as we would expect them to be.
Speaker 1 (26:43):
I think just us as a society assumes that people
have taken care of the security of their app and
site and all that stuff. And it's like, well, obviously
one hundred thousand people wouldn't have downloaded this if it's
not secure, so I'll trust it as well. And so
you have this kind of social proof. But also you
just have this expectation that the website you're dealing with
(27:04):
it uses the highest security and the best privacy and
all that sort of stuff, and you don't question it.
You just assume it. And I think that's our problem.
I've kind of switched it in my mind after covering
stories like this myself. I assume that they're not using
the best security of privacy, and therefore I'm definitely not
going to share my data with them. I don't give
(27:25):
my real name, or I use a burner email and
a burner phone and the fake address and even a
burner credit card when interacting with most sites today.
Speaker 2 (27:36):
So Jack takes his digital security to another level. And
again it makes sense from all those hackers he's talked
to on Dark Knight diaries because he knows how vulnerable
your information can be if you just put it out there.
But not all hackers are out there to steal your information.
Sammy's an example of someone who's curiosity led him to
look for those vulnerabilities and then to warn people about them.
(27:58):
In two thousand and eight, after three years of being
banned from the Internet, Samy was finally allowed to be
back online. So he left the courthouse that day, drove
straight to the Apple store, bought a PowerBook, and started
messing around. And one of the first things he did
was he started looking into credit cards.
Speaker 1 (28:15):
There's a NFC readers in some of these cards, you
know how you tap to pay, Those are using NFC technology.
And he was saying to himself, well, wait a minute,
what's the communication that happens between these sort of things,
And is there a way that I can steal someone's
credit card if I tap up against them? And so
that was one of his research projects that he did,
was to figure out how to clone NFC cards. And again,
(28:39):
he wasn't trying to steal credit cards in order to
sell them on the dark web or any of that
sort of thing. He was simply trying to understand this
technology so that he could share it with the world
make it a better security system, because I don't want
somebody bumping up to me in the line at the
store and stealing my card and then being able to
use it. So if he could tell the credit card makers, hey,
(29:00):
here's some problems with your card, maybe you should make
your card more secure, then I think that does help
make our cards more secure.
Speaker 2 (29:07):
You've spoken to a pretty wide range of people, some
of whom have done some pretty you know, nefarious stuff.
Where does Sammy rank on that for you?
Speaker 1 (29:15):
Sammy's a good guy. He's not out there to try
to make a bunch of money or steal things or
destroy the world. He's really just curious at his core,
and he loves finding things that the computer can do
that he might think to himself, well, if I can
do this, then it's probably the case that a lot
of other people can do this. So it's not like
I'm inventing something new or breaking something. I'm just showing
(29:38):
you how this technology works that somebody could use it
in this way. It's not like he's trying to give
the world a weapon and say here go mess up
the world. He's trying to show the world, Hey, the
other people might be able to do this, and now
you can too, so let's even the playing field or
the people who make this technology should fix this.
Speaker 2 (29:56):
This was a pretty wild outcome for someone who again
only a few years before that. It started out just
screwing around with Counterstrike. And there's probably some kids out
there who are also exploring video games just like Sammy,
but nowadays there are some more established roots to do
some pretty nefarious stuff.
Speaker 1 (30:14):
I've seen this character arc and a lot of hackers though,
is that they play video games and they get bored
with it, then they try to hack it, and then
they do, and then they're like, well, but that was
just for fun. And then they learn more about hacking
and other circles and stuff, and they learn, oh wow,
that people are actually making money with this interesting and
so then that transfers into okay, here's how to earn
(30:36):
roebucks website and just try to get little kids to
come to our website to earn roebucks free roebucks, but
then we never give it to them. You now scamming
the kids that are before you, which you're now familiar
with the roebucks because you just played the game for
the last ten years or something, and you're like, I
know everything about this game, so obviously I know how
to exploit it or exploit the user base or something
like that. And then you start finding users that want
(30:57):
to join you and they're like, hey, how do I
make money like you? And then starts scamming them even more,
and so you end up in that circle, and then
that just keeps going to something bigger, like cryptocurrency or
something else where you're just like, oh, well, why am
I looking at small potatoes. I could be stealing millions
instead of just a few robots here and there, and
that just turns you into the super criminal at that
(31:19):
point or something. And there is this path that I
see again and again where it starts with video games
and you get into these circles of people hacking and
scamming the game, and then it just keeps going from there.
Speaker 2 (31:30):
And Sammy just got some extra friends. Yeah, that's what
he did. Given the punishment that Sammy had to go through,
it's kind of amazing that he still bounced back and
he's now continuing to work to help people by publicly
disclosing company security and privacy flaws and kind of holding
their feet to the fire to actually fix them.
Speaker 1 (31:50):
History has kind of proven that the hackers are on
the right side. Before we even had hackers, we had
people who were testing the safety of cars and saying, hey,
we should be wearing seat belts, and the car makers
are like, nah, and it's fine, you don't need that.
And they're like, look, here's what's happening when people crash
without seat belts. You should have them wear seat belts.
They were thinking, these people were wrong to make such
(32:11):
a stink out of this right, stop making it look
like our cars aren't safe.
Speaker 2 (32:15):
Our cars are safe.
Speaker 1 (32:16):
And eventually those people want they said, yeah, seat belts
are incredibly safe. So that became the new thing of like, okay,
let's embrace these people who are crash testing our cars
and making sure that they are more of the solution
instead of more of the problem. And I think that's
the side we should look at here, which is do
we have a vulnerability in this technology or this website,
And if so, that's on us to fix that and
(32:38):
thank you for showing me that vulnerability. That will make
our whole system safer. But it's kind of frustrating because
if somebody comes to you and says, hey, your zippers down,
you have this instant feeling of shame and embarrassment and
the sort of thing. And so I think a lot
of people do feel that. When they get told their
website has a vulnerability, you get this emotional reaction. We
don't need that emotional reaction. Your slippers down, but thank
(32:58):
you for telling me. I appreciate him. Gonna get it
back up. It's hard to handle criticism sometimes.
Speaker 2 (33:07):
And Okay, maybe he did technically force over a million
people to say it, But twenty years later, it turns
out Sammy's little bit of code held some truth for hackers.
Sammy really is a hero.
Speaker 1 (33:19):
Sammy is my hero. Is what you would hear people
shouting when you go to death Count. I mean, he's legendary.
You hear about him everywhere you go.
Speaker 2 (33:28):
Your big shout out to Jack Resider for talking with us,
and I'd definitely encourage you to check out his full
interview with Sammy Camcarr on the podcast The Dark Knight Diaries,
where they get into some other details that we couldn't
touch on here, like Sammy's work on drones, his podcast
in general, is a really good look at the hacking
culture that we were talking about today. So if any
of this interested you, definitely check it out and we'll
(33:51):
leave a link in the show notes to check that out.
But that being said, back to our show. Thank you
so much for listening to another episode of kill Switch.
If you want to talk to us, you can email
us at kill Switch at Kalaidoscope dot NYC, or on
(34:14):
Instagram or at kill switch pod. And while you're still
listening to this, you could think about leaving us a review.
It helps other people find the show, which helps us
keep doing our thing, and it lets us know what
people want to hear more of. And once you've done that,
did you know it? Kill Switch is also on YouTube
and the link for that and everything else is in
the show notes. Kill Switch is hosted by Me Dexter Thomas.
(34:39):
It's produced by sen Ozaki, Dar Luck Potts, and Julian Nutter.
Our theme song is by me and Kyle Murdoch, and
Kyle also mixed the show from Kalidoscope. Our executive producers
are Oswa lashin On, Geshat Togador and Kate Osborne from iHeart.
Our executive producers are Katrina norbl And nikki E Tour.
That's it from us. We'll catch ya next week. M
kill switch News
Hosts And Creators
Oz Woloshyn
Karah Preiss
Show Links
AboutPopular Podcasts
Two Guys, Five Rings: Matt, Bowen & The Olympics
Two Guys (Bowen Yang and Matt Rogers). Five Rings (you know, from the Olympics logo). One essential podcast for the 2026 Milan-Cortina Winter Olympics. Bowen Yang (SNL, Wicked) and Matt Rogers (Palm Royale, No Good Deed) of Las Culturistas are back for a second season of Two Guys, Five Rings, a collaboration with NBC Sports and iHeartRadio. In this 15-episode event, Bowen and Matt discuss the top storylines, obsess over Italian culture, and find out what really goes on in the Olympic Village.
iHeartOlympics: The Latest
Listen to the latest news from the 2026 Winter Olympics.
Milan Cortina Winter Olympics
The 2026 Winter Olympics in Milan Cortina are here and have everyone talking. iHeartPodcasts is buzzing with content in honor of the XXV Winter Olympics We’re bringing you episodes from a variety of iHeartPodcast shows to help you keep up with the action. Follow Milan Cortina Winter Olympics so you don’t miss any coverage of the 2026 Winter Olympics, and if you like what you hear, be sure to follow each Podcast in the feed for more great content from iHeartPodcasts.