61: Samy

Episode Summary

Executive Summary: The episode traces Sammy Kamkar’s journey from mischievous teen hacker to influential security researcher and entrepreneur. It covers his MySpace worm incident, legal consequences, years away from computers, and later ethical research exposing weaknesses in RFID/NFC cards, tracking cookies, drone security, and mobile location surveillance.

Main Topics: Hacker mindset and childhood curiosity: Jack frames hacking as repurposing systems in unintended ways, while Sammy describes early fascination with computers, IRC, and game mechanics as puzzles to understand and exploit. MySpace worm and legal fallout: Sammy explains how a prank on MySpace unintentionally became a self-replicating worm that spread to hundreds of thousands, crashed the site, and led to a search warrant, seizure of equipment, prosecution, probation, and a ban on computers. From mischievous exploits to ethical security research: After punishment and time offline, Sammy shifts to responsible disclosure and proof-of-concept research aimed at revealing real vulnerabilities in public systems rather than abusing them. Privacy and tracking technologies: The episode details Sammy’s work on Evercookie and location-tracking research showing how browsers, phones, and ad/analytics ecosystems can persistently identify and locate users. Physical-world and wireless attack surfaces: Sammy discusses attacks on NFC/RFID credit cards and drones, demonstrating that insecure protocols in the physical world can be hijacked as easily as websites. Public disclosure, pressure, and defense: Sammy argues that releasing compelling demos creates pressure for vendors to fix systemic flaws, and notes the role of the EFF in defending researchers against cease-and-desist threats. Entrepreneurship and applying hacker skills positively: The story closes with Sammy co-founding OpenPath, using modern cryptography and phones as secure, convenient building access tools.

Key Arguments: Sammy’s hacking was driven by curiosity and puzzle-solving, not malice; he repeatedly says he wanted to see how systems worked and what could be done with them. The MySpace prank escalated because of a self-replicating design flaw in browser-executed code, showing how small changes can create major unintended consequences. Security bugs are often systemic, not isolated; many of Sammy’s projects target protocols, assumptions, and implementation patterns rather than one product bug. Ethical disclosure can improve security more effectively than silent reporting alone because public proof-of-concepts create pressure for fixes. Modern devices and services often trade privacy for convenience, sometimes collecting location or tracking data without users understanding the full scope. Hardware and wireless systems are just as vulnerable as software, including credit cards, drones, and access badges. The EFF is portrayed as essential protection for researchers whose work tests the boundary between security research and unauthorized access.

Data Points: Age when first got computer: 9 - Sammy received his first computer and immediately began exploring online communities and programming. Age during MySpace worm period: 15-16 - He was a teenager when he developed and iterated on Counter-Strike cheats and later the MySpace exploit. Age when he dropped out of high school: 16 - He left school and began working in tech while living with his mother. MySpace friends gained: 10,000 overnight; eventually 1,000,000+ - The worm rapidly spread from his profile through copied code on victims’ pages. Spread rate: About 3,000 people per second - Sammy describes the speed at which the worm propagated before takedown. Site downtime: A few hours - MySpace was taken offline while the team responded to the worm. Search warrant timing: About 6 months after launch - Authorities served a warrant months after the MySpace incident. Community service: 720 hours - Part of Sammy’s plea agreement and probation terms. Financial penalty: $20,000 - He also had to pay a fine in addition to legal costs and restitution. Probation length: About 2 years - He completed probation and later had restrictions lifted. First major salary-supporting job: Remote coding contract at age 15 - A company hired him after seeing his cheat software. OpenPath access method: Bluetooth proximity - The company uses phone-based access control without requiring users to pull out a card. Talks given: ~50 - Sammy estimates the number of conference talks he has delivered.

Pivotal Quotes: "I was never a malicious person at all. So all this hacking, all of this exploitation, it's really about a puzzle." — Sammy Kamkar: He explains his motivation for hacking and framing it as curiosity rather than harm. "I wake up to 10,000 new friends." — Sammy Kamkar: He realizes his MySpace prank has turned into a rapidly spreading worm. "I thought, wait, I can mail ants to anyone I want? ... that is basically the hacker mindset" — Jack Resider: Jack uses the ant farm story to define hacker thinking as repurposing tools in unintended ways.

Implications: The episode shows how curiosity can become both dangerous and valuable: careless exploits can create real harm, but the same skills, when redirected, can expose systemic flaws, improve privacy, and build better products.