61: Samy

Episode Summary

Executive Summary: This episode of Darknet Diaries features hacker Sammy Kamkar, who recounts his journey from a curious child to a notorious hacker. He shares his early experiences with IRC and Counter-Strike cheats, leading to the creation of the MySpace 'Sammy worm' that took down the site. After legal troubles and a ban from computers, he transitioned to ethical security research, uncovering vulnerabilities in NFC credit cards, drones (Skyjack), browser tracking (Evercookie), and smartphone location tracking. His work highlights the hacker mindset and the cat-and-mouse game between security and exploitation.

Main Topics: Early Hacking and Counter-Strike Cheats (Priority: 4/5): Sammy's first hacking experiences, from crashing his computer via IRC to writing cheats for Counter-Strike, including aimbots and wallhacks, and the cat-and-mouse game with PunkBuster. MySpace Worm and Legal Consequences (Priority: 5/5): Sammy created a self-replicating worm on MySpace that added him as a friend and spread rapidly, taking down the site. This led to a secret service raid, charges, probation, and a ban from computers for two years. Transition to Ethical Hacking (Priority: 5/5): After probation, Sammy engaged in legal security research, demonstrating vulnerabilities in NFC credit cards, creating the Evercookie tracking library, and developing the Skyjack drone hijacking project. Smartphone Location Tracking Discovery (Priority: 5/5): Sammy reverse-engineered how Google and Apple track users via Wi-Fi MAC addresses and Android phones, revealing that location data is collected even when location services are off, leading to congressional hearings. Google Maps Traffic Manipulation (Priority: 3/5): Sammy created a proof-of-concept app that sent fake data to Google Maps, simulating a traffic jam to divert other drivers, demonstrating vulnerabilities in crowd-sourced traffic data. OpenPath and Physical Security (Priority: 3/5): Sammy co-founded OpenPath, a company that uses smartphones and encryption to replace physical access cards, aiming to improve convenience and security for building entry.

Key Arguments: Hacking is fundamentally a puzzle-solving activity, not necessarily malicious. Publicly disclosing vulnerabilities is often more effective than private disclosure to force companies to fix security issues. Even when users opt out of location services, smartphones can still transmit data that reveals their location. Governments and corporations stockpile vulnerabilities, making public disclosure necessary to pressure fixes. The hacker mindset involves repurposing technology beyond its intended use. Legal consequences and community service can be a transformative experience, leading to a more ethical approach to hacking.

Data Points: MySpace friends from worm: 1,000,000+ - Sammy's worm added over a million friends before MySpace was taken down. Worm spread rate: 3,000 per second - The worm added about 3,000 new friends per second at its peak. Community service hours: 720 - Sammy was required to complete 720 hours of community service as part of his plea deal. Years without computer: 2 - Sammy was banned from using computers for two years during his probation. Age at MySpace worm: 19 - Sammy was 19 years old when he created the MySpace worm. Age at first paycheck: 15 - Sammy was 15 when he got his first programming job.

Pivotal Quotes: "I was never a malicious person at all. So all this hacking, all of this exploitation, it's really about a puzzle. To me, this was all a puzzle, a really fun puzzle." — Sammy Kamkar: Sammy describes his motivation for hacking as puzzle-solving, not malice. "I just take a screenshot because now I'm just like, that's a lot of people. I had no idea that many people were even on MySpace." — Sammy Kamkar: Sammy's reaction when the MySpace worm hit one million friends. "I've gotten cease and desists many times, and I've been extremely fortunate that the EFF... has actually been very helpful to me." — Sammy Kamkar: Sammy acknowledges the EFF's role in defending his right to publish security research.

Implications: This episode highlights the fine line between harmless tinkering and criminal hacking, and the importance of ethical disclosure. It shows how curiosity can lead to groundbreaking security research, and the need for stronger privacy protections in consumer technology. The hacker mindset remains a powerful tool for innovation and security improvement.