Samy Kamkar: A MySpace Worm, an Internet Ban and a Comeback

In October 2005, a 19-year-old in Los Angeles named Samy Kamkar wanted a few more MySpace friends. Within a day he had a million of them, MySpace was offline, and he'd written the fastest-spreading worm the internet had ever seen.

The Secret Service came for his computers. A plea deal kept him off the internet for years. And then he came back with a decade's worth of toys: a drone that hijacks other drones, a wallet-sized card spoofer, a $5 computer that backdoors a locked laptop, and a laser that reads what you type through a window.

Today the hacker who was banned from the internet co-founded a company that controls who gets through the door. The joke is that it isn't a joke.

Samy Kamkar at a Glance

• Kamkar dropped out of high school at 16 and co-founded Fonality, an open-source phone-systems company, at 17.
• On October 4, 2005, he released the Samy worm on MySpace, which added him as a friend to more than a million profiles and stamped "but most of all, samy is my hero" on each one before the site was pulled offline.
• Six months later the Secret Service and the LAPD's electronic crimes task force raided him; his 2007 plea brought three years' probation, community service and a ban on internet access.
• In 2010 he released Evercookie, a browser cookie designed to be nearly impossible to delete, and exposed how smartphones were quietly reporting their owners' locations.
• In December 2013 he unveiled SkyJack, a Parrot drone carrying a Raspberry Pi that seeks out other Parrot drones and takes them over.
• In 2015 and 2016 came a run of hardware gadgets, from radio devices that could unlock cars to MagSpoof and PoisonTap, that made him a DEF CON headliner.
• In 2016 he co-founded Openpath, a touchless access-control company that Motorola Solutions bought in July 2021.
• At DEF CON 32 in August 2024 he showed how to use lasers to hear keystrokes through glass windows.

The Life of Samy Kamkar

Kamkar's Early Years

Kamkar was a Los Angeles teenager who left high school at 16. A year later he co-founded Fonality, a startup selling business phone systems built on open-source software, which meant that by his late teens he already had a company and no diploma.

He was, by his own later account, a curious kid with too much time and a browser. In 2005 that curiosity met MySpace.

Samy Is My Hero

Around midnight on October 4, 2005, Kamkar added a little hidden JavaScript to his MySpace profile. Anyone who viewed it would automatically send him a friend request, add the words "but most of all, samy is my hero" to their own page, and pass the code along to everyone who viewed theirs.

"I figured that maybe in a month I'd get 100 or 200 friends," he told Vice a decade later. "Some of them will complain, I'll delete it and that's it."

By morning he had 200. By early afternoon 2,500, and then the numbers kept doubling until nearly a million MySpace users were his friends and his heroes, and MySpace took the whole site down to purge the code. "This has gotten out of control," he messaged a friend as reports poured in that he'd "hacked" people.

It was a self-propagating cross-site scripting worm, something nobody had seen at that scale, and it did its damage in less than a day. "Samy changed the industry forever," the web security expert Jeremiah Grossman said.

The Raid

MySpace deleted his profile and came back online within a couple of hours. The government took longer.

Six months after the worm, the Secret Service and the LAPD's electronic crimes task force executed a warrant and carried off his computers and devices. "It was kinda scary," he recalled. "I didn't even have a high school diploma, so I was really concerned."

In 2007 he pleaded guilty to a computer-crime charge in Los Angeles and was sentenced to three years of probation, community service, and life with a single registered computer that wasn't allowed to touch the internet. When the ban ended he says he didn't know where to go, visited a couple of websites and logged off after ten minutes.

Evercookie and the Phone That Told on You

Kamkar's comeback was a series of demonstrations that privacy on the web was thinner than anyone admitted. In 2010 he released Evercookie, a tracking cookie that stores copies of itself in a dozen corners of the browser so that deleting it simply causes it to respawn.

He then turned to phones, documenting how Android devices stored and transmitted their owners' location data. By his own account, that research was cited by the NSA, triggered hearings on Capitol Hill and shaped how browsers, phones and later cars handle privacy.

SkyJack

In December 2013, the same week Amazon announced plans for delivery drones, Kamkar released SkyJack: a Parrot AR.Drone quadcopter carrying a Raspberry Pi, a battery and two wireless radios that flies around looking for other Parrot drones, hijacks the wireless link that controls them and takes over their flight and cameras.

"How fun would it be to take over drones, carrying Amazon packages," he wrote, and Ars Technica reported that at least 500,000 Parrot drones had been sold by then. He published the whole thing, hardware and software, so anyone could build one.

Cars, Cards and a $5 Computer

The hardware years followed. In 2015 he took the DEF CON stage with "Drive It Like You Hacked It," showing cheap radio devices that could defeat the keyless entry on cars and garage doors, and followed up with MagSpoof, a tiny device that can stand in for any magnetic stripe card by generating the right magnetic field in front of a reader.

In 2016 came PoisonTap, a $5 Raspberry Pi Zero that, plugged into the USB port of a locked computer, pretends to be a network and quietly installs a backdoor in its browser. Gizmodo's verdict became his favorite review: "Now I want to fill my USB ports up with cement."

Every one of these projects shipped as open source, with write-ups, which is the point. Kamkar's style is to make the terrifying thing cheap, public and playful so that it gets fixed.

Openpath

In 2016 he also became a founder again, co-founding Openpath, a touchless access-control company whose readers let people open office doors with their phones. The former MySpace menace was now selling the locks.

Motorola Solutions acquired Openpath in July 2021 and folded it into its video security and access control business.

Kamkar Today

The demonstrations haven't stopped. More recently he published NAT Slipstreaming, a technique that let a web page reach services behind a visitor's firewall, and in August 2024 he returned to DEF CON with a talk on optical espionage, using lasers to recover keystrokes from the vibrations of a window.

He's based in Los Angeles, still publishes everything on GitHub under the handle samyk, and still describes himself in two words: "explo(r|it)ing boundaries."

Samy Kamkar: Still Everyone's Hero

The worm that got him raided would be a footnote if he'd stopped there. Instead he turned the same instinct, find the thing nobody thought to lock and show everyone, into twenty years of useful mischief.

MySpace is gone. The lessons it learned the hard way from a 19-year-old are built into every browser you use.

But most of all, Samy is still his own hero, and he's earned it.