00:00:10
Speaker 1: So yeah, do logistics. Could I have you introduce yourself. My name's Jack ree Sider. I'm the host of the podcast Darknet Diaries.
00:00:20
Speaker 2: If you haven't heard of the Darknet Diaries podcast, let me explain the background a little bit here. So every episode they get into some real wild story that's usually about hackers, and that might be why Jack is so cautious about revealing his identity, because he knows what's out there. So maybe we should address the elephant on the screen here. For those of you watching.
00:00:41
Speaker 1: I'm an anonymous podcaster. I don't like showing myself my face or anything like that, so I'm using a filter to keep my privacy when I cover enough of these hacks. When I hear about breach after breach after breach, I think to myself, well, I guess all my data is out there. There's nothing I can do, and I become black pelt, I suppose, where I just feel completely hopeless about privacy. But then I realized, no, who's the ding dong who gave them my data?
00:01:05
Speaker 2: It was me.
00:01:06
Speaker 1: So in order to protect myself from being in breach after breach, I just stopped giving my data to anyone who asked for it. And so that's why, after you know, seven ten years of doing a podcast about hacking, this is where I've landed on being an extreme privacy advocate. And that's why I don't like to show my face anywhere. If you think about, like what your ex lover knew about you when you were in the height of your relationship, they do everything. They knew your password, they knew your photo, but they do everywhere you wet every day. But that was years ago. You've broken up with them, and now they don't know anything about what you're up to, right, and so there's still hope on recovering your privacy and getting it back. So I'm totally white piled now. I have a lot of optimism about my privacy.
00:01:47
Speaker 2: I love how we're starting this out like that because I feel like we're going to go there right because the time period that we're going to talk about very much was either a a lot of people didn't really care too much about their information being out there, or they didn't really think about it or very much were thinking in the sense that, uh, you know, everything's out there, what can I possibly do about this? You know? Yeah, yeah, exactly. On this week's episode, Jack is going to share one of the most bizarre, the most frustrating, but also honestly one of the most hopeful hacking stories that I've ever heard. It takes us back to a time when even the phrase hacker freaked everyone out. And if you were around in the MySpace days and you've been wondering why social media today looks so boring, maybe this week's story has some answers for you.
00:02:42
Speaker 3: I'm afraid.
00:02:45
Speaker 2: Kaleidoscope and iHeart podcasts. This is kill Switch. I'm Dexah Thomas.
00:02:54
Speaker 3: I'm all right, goodbye.
00:03:37
Speaker 2: Yeah. So take us back to two thousand and five. What was the Internet like back then?
00:03:42
Speaker 1: So we're going from Internet one point oh to Internet two point oho. In those days, and one point oh was basically read only. Everything was just posted there and you could read it, but you couldn't really interact with it. There's no upfolts, there's no likes, there's no shares, there's no oh let me create an account and comment on this. It's just read it and that's all you get. And then as Internet two point zero came around, we started getting sites like dig and read It and MySpace, where now you are creating content on this site. Now you have this little personal space on this website. This is the music I like, and this is the bands I follow, and this is the stuff I've been doing every day, and this is my comments about these things. And so it became this read write kind of era, where now I can read it and I can comment on it, and I can write about it now. I think everyone's favorite subject then and now is ourselves, and so we love talking about ourselves on the Internet. And so when my Space showed up, it's like, we want to know all about you, and you're like, yeah, let me jump on here and tell you what my interests are and show you pictures of what I've been doing and all the fun activities I've been up to. And so it was the first big social media to hit our Internet, and it was really fascinating.
00:04:52
Speaker 2: My Space started in two thousand and three, and the whole point of the site was to let you connect with your friends and maybe even make new ones. But probably the most the famous or infamous feature of MySpace was the top eight. So this was a feature that would allow you to publicly rank your top eight friends, and everyone who used it back then you probably remember agonizing over who you should put in that top eight and then accidentally having somebody get mad because they weren't included or didn't like where they were placed, and then it causing all sorts of weird beef and drama at school. Another thing that people probably remember is that when you first started your account, you were automatically friends with Tom, the co founder of the site. And then there was the options that you could use to categorize yourself.
00:05:32
Speaker 1: You could tell us what mood you were in or what relationship you were in, and you could connect your boyfriend or girlfriend to you to say, oh, I'm in a relationship with them, and then they could show that they're in a relationship with you. And then every now and then you'd see something where you'd go to your girlfriend's MySpace and she's no longer set to a relationship with you, and you're like, what's going on here? Is there something I don't know about? And you'd learned about things. It's a hard way.
00:05:57
Speaker 2: One of the big things about MySpace for people who might not remember is my space was customizable.
00:06:03
Speaker 1: Yeah, you could change the background and I think maybe the fonts, and when you land on it, you could even have music playing you could kind of theme it out. Yeah.
00:06:12
Speaker 2: I remember when Facebook came out. One of the reasons that some people initially did not like Facebook was because it wasn't customizable. And that was kind of a weird divibe because I actually felt like, good, I'm sick of going to somebody's MySpace page and I just want to message you, and you got like a Britney Spears MIDI playing like nah man like disable that. I don't want any of that. But there were some people who really really missed that personalization, and that personalization was pretty broad. You could change the background of your page, you could change the font, you could add music, you could have a custom flashing cursor if you wanted to. Most people just did this by copy pasting bits of code into a form on the site, but if you knew a little bit of HTML and CSS, you could really start making that page look like your own. It was a fun way for people who were even a little bit interested in computers to get to play around with code. And for nineteen year old Sammy Kumcar, who was already very familiar with coding, this was like being a kid in a candy store. October fourth, two thousand and five what happens.
00:07:17
Speaker 1: So MySpace has all this customizability, and Sammy was playing around with some of this because you can set on my Space that you're in a relationship. There's a drop down and where there are the options I'm in a solid relationship, a shaky relationship, whatever. There's like a few options, and you only get those options. Well, he's like, well, what if I just tell it that I'm in a hot relationship? And he was able to modify the code on his own computer and submit that to the server, and the server accepted it. So suddenly he's in a relationship that no one else is in a relationship with and it's like, well, how did he set that? And there was some other stuff like how many photos you could upload. I think there was a photo limit of twelve, but he had uploaded an extra one or thirteen.
00:07:57
Speaker 2: Growing up, Sammy loved computers and he loved messing around with him. When he was a kid, he'd figured out how to hack the computer game counter Strike so that he was essentially a god in the game. When he flipped that switch, nobody could beat him. And for some people that's all they want. They just want to win. But Sammy got bored after that. He didn't want to play counter Strike anymore.
00:08:18
Speaker 1: Yeah, because it became so easy for him. He could just beat anybody. But there was an anti cheat maker that came out that started detecting things that he was doing and saying, okay, well that's no longer doable in the game. And he's like, wow, well that gives me a whole new challenge here now, how to figure out how big cheats to not be detected by anti cheat And so he got back into it just to try to bypass the anti cheats there, and that became a whole new thing for him.
00:08:44
Speaker 2: Right, so it's not even playing counter Strike anymore, it's like playing the game off top of Counterstrike. It's like playing cat and mouse with the company. So you can kind of see that Sammy just likes taking stuff apart and putting it back together again. He likes challenges. And on MySpace, Sammy realized that he could just write some JavaScript code on the client side and get MySpace to display stuff that the creators had not intended, like he wrote a funny comment in the relationship status section. For him, this stuff was all pretty rudimentary, so he kept poking around.
00:09:14
Speaker 1: So he was playing around with all these different things that you could do on MySpace, and he found a way to make it so that if somebody visited his page, it would make them follow him. I think it was JavaScript code that he was able to embed into his page that would force the person the visitor to follow him. But you'd still have to have someone come to your page in order to get someone to follow you.
00:09:37
Speaker 2: But then he.
00:09:37
Speaker 1: Figured out how to replicate this, how to make it so that anybody who visited his page would then get this code on their MySpace page, which would mean that everyone who visited someone else who had this code wouldn't follow Sammy, and not only would they follow him, but they would comment on their MySpace page Sabby is my Hero.
00:09:59
Speaker 2: Basically, Sammy embedded code on his page that spread to any page that looked at his and any page that looked at that page would also get infected with the code as well. Maybe you're starting to see where this is going, But the important part here is that on each page that had been infected, it would go after the person's bio and insert the text at the bottom. But most of all, Sammy is my hero.
00:10:22
Speaker 1: And so people would visit someone else's page, suddenly follow Sammy, and then have it say Sammy's my hero on their page, and they're like, wait, who's this guy Sammy? And why does it say he's my hero.
00:10:33
Speaker 2: At first, it's not really a big deal. It's spreading to his friends and maybe friends of friends. So Sammy goes to bed that night thinking that he's just played a silly prank on his friends on the internet.
00:10:43
Speaker 1: But then the next morning, when he woke up, he had ten thousand followers on MySpace, and that really blew his mind. He knew something had gone terribly wrong to get ten thousand followers.
00:10:56
Speaker 2: So remember this is two thousand and five, and back then, ten thousand friends was a really monumental number. I'm not even sure he knew that there were ten thousand people on MySpace.
00:11:07
Speaker 4: At that point, I just freak out. I have no idea what to do. I'm sitting in my apartment and I'm kind of baffled. So I realized, like, oops, I just wrote a virus and what should I do.
00:11:18
Speaker 2: That's the voice of Sammy on Jack's podcast, The Darknet Diaries. And because the spread was exponential, the numbers just kept going up. Another hour later, it was at fifty thousand.
00:11:29
Speaker 4: When fifty one hundred thousand, I couldn't think about anything. It was just refreshing. Went home, five hundred thousand, six hundred thousand. It hits a million. I just take a screenshot because I'm just like that. That's a lot of people. I had the idea that many people were even on my spence.
00:11:46
Speaker 2: Sammy now realizes that he's created a virus. Actually, it's worse. He's created a worm, a piece of code that is self replicating, and this worm is spreading through all of my space. But what happens next even Sammy couldn't predict. That's after break. Sammy's a little bit of code has started as a joke. He figured that maybe in a couple of weeks or so it reached a couple hundred people max. But in less than twenty hours, Sammy knkard had a million friends. This had gotten completely out of his control.
00:12:35
Speaker 1: He knows something has gone terribly awry. He thought maybe he'd get a few hundred followers or something out of this and then be able to turn it off. But at this point, it feels like the momentum is going so fast that he's having a hard time controlling it. And even if you go to Sammy's page and you unfollow him, what happens is it says, okay, you're no longer following them, and then it goes back to your page, and your page has the code to follow him, so people can't even unfollow him, and if they wanted to, they're like, why why am I permanently following you? This is ridiculous.
00:13:05
Speaker 2: So are people messaging Sammy at this point?
00:13:08
Speaker 1: Yeah, they're confused, like who are you? How do I unfollow you? And he's not sure because he can't pull this back. He can't go to everyone else's MySpace page and remove their code, so he's like, oh man, I don't know how to turn this off. It almost seems like everyone on my space is going to eventually follow him because there's no other logical end to this.
00:13:29
Speaker 2: This was all an accident. Sammy had no idea that what he'd created would spread this far, so he removes the code from his page, but that doesn't help because it's already spreading too fast. So he wants to help stop it, and he gets an idea he could go straight to my space like irol.
00:13:46
Speaker 1: He actually lived in the same town as them, both in Los Angeles, and he's like, should I just go over there and tell him I did this and to give him some suggestions on what to do.
00:13:55
Speaker 2: So at first, and I wish I was making this up. He thinks, Okay, maybe I could just like buy some coffee and donuts and show up at MySpace office and help them fix it, like give them the donuts, give the coffee, sit down, crack on knuckles, write some code, patch things up, all good. But then he thinks about it and he realizes, Okay, maybe that's not the best idea. Maybe I should just send them an anonymous message. So he emails them and says, here's some tips on how to handle this. It was vague but specific at the same time, like you didn't want to say who he was. But he was like, you might want to go in here and disable this or do this. Here's some SQL queries to look for these strings and you'll find the code and you can delete it off everyone's page. He wanted to be.
00:14:37
Speaker 1: Helpful, he did not because he realized, oh no, I've caused a big problem here. Fox had actually bought my Space just before this. He's thinking about this, like, Fox might be really mad. What do I do if they're coming after me? This is a big problem. He's trying to help what he can, but he also doesn't want to get himself in trouble. But it's really hard because everything is pointing to his page and it's got his name on it and everything.
00:15:00
Speaker 2: He's got his literal name on it.
00:15:01
Speaker 1: Yeah, so he's just refreshing it and looking at the numbers going up and up, and he's like, oh my gosh, what do I do? And then eventually one of the refreshes his page just says this page doesn't exist.
00:15:12
Speaker 2: It's gone.
00:15:12
Speaker 1: His page was deleted or at least disabled for a while, and he's like, okay, that's fine. So then he looks at, you know, some of his friend's pages and they're all deleted, they're all disabled. And he's looking at everybody who's trying to follow him and they're all disabled, and they're all deleted. And then he refreshes the page again and it says, sorry, my space is down. We are taking it all offline. We're doing some maintenance. We'll be back shortly.
00:15:40
Speaker 2: Sammy's a little bit of code ended up bringing MySpace to its knees. It shut the whole site down. So I kind of remember this happening. This was back when I was in college and there was this Bobo shop next to campus, and I think they had these three Windows computers installed on the wall so that you could use your computer while you waited for your order, and people who were a MySpace would go there and log in and check their messages. And yes, logging into your social media on an unsecured public machine is absolutely terrible security practice, but I don't know, people just didn't know any better, I guess. So Yeah, Anyway, one day, I think people were probably at home and their MySpace wasn't working on their home computer, so they came to the cafe to log in, and it didn't work there either, but they'd already bought their boba, so people just had to wait there awkwardly like normal human beings for the drink order. Kind of inconvenient, but for Sammy that day wasn't just inconvenient. Dude was sweating bullets. So after a while, MySpace fixes the problem and it comes back all nine. It's slow for a few days, but eventually it's back to normal and that's it. It's back, And for a while, Sammy thought that, Okay, maybe this is just a blip and everyone would just move on and forget it all happened.
00:16:54
Speaker 1: The days after that, nothing happened, and the weeks after that, nothing happened. She's like, Okay, I think I'll stay away from his space for a while. I'll just lay low because whatever happened there, I don't want to make it worse. So let's just hope this is in the past. So he went back to doing his work, and at that point he had started a business.
00:17:13
Speaker 2: During that time period, Sammy had co founded a company called Finality that used the Internet to make phone calls instead of relying on traditional phone lines, and at the time, this was pretty cool technology. So we just focused on that. That message he'd sent to MySpace never got answered, and my Space itself didn't really seem to be looking for him. Maybe they had just let it go. So Sammy got back to work.
00:17:36
Speaker 1: At some point, You're just like, Okay, everybody's just gone their way. They fixed it, and that's just it. You know, you fix incidents all the time at work, and I think he thought that everything was going to be fine. So it was a big surprise to him to find the Secret Service we're after him. The business was doing really well, so he actually bought himself a Porsche and was driving that thing around town and so he was having a good time. And one day he went out out to the parking lot to kit in his car and there was some guys standing around his car and he's like, oh, man, are these guys gonna rob me? Or what's going on? And one of them shouted, hey, are you Sammy. He's like, oh gosh, usually people who robbed me and they don't know your name. So let's see what's going on here, and it was the Secret Service. They took him to his house and they confiscated all his computers and I said, you're being investigated for taking down my Space.
00:18:25
Speaker 2: It had been six months since that worom took down MySpace, and now out of the blue, here's the Electronic Crimes Task Force of the LAPD and the Secret Service coming around asking questions. They had him under surveillance for months, and they had a search warrant for his house and his office. They took his laptop, they took his hard drives, even took his iPod. The DA ended up hitting Sammy with a felony hacking charge, and prosecutors wanted him to spend some time in prison and not be able to touch computers for the rest of his life. Sammy freaked out and he ended up taking a plea deal exchange for not having to go to prison. He paid a twenty thousand dollars fine, he had to complete seven hundred and twenty hours of community service and three years of probation. Oh, and he couldn't use computers. Well, he could use one computer, but that computer had to be registered with authorities and it couldn't access the Internet. Now keep in mind here, Sammy's whole life and work had revolved around technology to this point, so not being able to use an Internet enabled computer was kind of like telling them, Okay, yeah, here kid, have a typewriter, go do your job. At this point in his life, the Internet was his livelihood and it's how he was able to support his mom.
00:19:41
Speaker 1: He was paying her rent and helping her out and all that. And so his startup that he had started, he had a very difficult time doing any work there because that was all computer based work that he was doing. So I don't know if he was making a salary during that time to help her anymore anything, And it was.
00:19:57
Speaker 2: Tough for Sammy. It meant that he could do a lot of the stuff that he used to, but he tried to look at the bright side. Sammy told Vice his motherboard how it forced him to go outside and touch grass.
00:20:08
Speaker 4: I kind of started a new chapter of life because I spent my entire life just in front of the computer, and finally this like got me out. I just spent a lot of time doing other things that I think normal people did.
00:20:18
Speaker 2: But barring access to computers was like barring Sammy from accessing a part of himself. This was someone who really loved computers and who says that he didn't mean to write a worm in the first place.
00:20:30
Speaker 1: Some of these hackers who have been in trouble have had that sentence brought to them where they're banned from computers for life. It's always frustrating to me because there's obviously these people are very talented and skilled and trying to take their way of making money away their livelihood. I mean even a cash register as a computer at this point. It's so sad to see them take that away when that's the thing that their best at in life and the most passionate thing. I think what's better is to try to figure out how to use their skills for good and to determine is this person, you know, rehabbable. Are they just trying to burn the world down and no matter how well we try to turn them in the right way, they're just going to destroy everything. Or is this somebody who we can use their skills for some net benefit on society or you know, it wasn't like he was trying to do anything malicious. I think at Samy's core, he's not a malicious person. He's just someone who's curious and interested in technology, and he's not trying to harm anybody or hurt anything. I've since met him and hung out with him quite a few times, and he is just such a sweetheart. He loves learning stuff, and he's just so deep down in the technology of it that he's extremely brilliant, like one of the more brilliant folks I know when it comes to not so much seeing what the technology does, but seeing what it could potentially do. He's just really fascinated with the way technology works and likes exploring it.
00:21:51
Speaker 2: Let's say it's two thousand and five. You're at MySpace. You're tom right. Yeah, you find out that somebody has done something to your website, taken it down for a day, You figure out who this kid is, what's the appropriate punishment here? What do you do? Press chargers?
00:22:11
Speaker 1: I wouldn't. I would feel like our code wasn't up to snuff. We had not you know, fortified it enough, and somebody found a vulnerability. So this was a surprise vulnerability assessment. That's that their ownership's on us, right, and we can't just assume everyone is just like a criminal if they've done something wrong on our website and try to take them down. But yeah, I think if I was, yeah, my Space exec, I'd try to take ownership of this and say, you know what, this was something we should have done better, and it's okay, we've solved it. We were only down for a day. That's not too bad. It's not like there was a lot of damage done. Somebody posted this little bit of JavaScript on their page and that accidentally spread everywhere. I don't think that's criminal behavior. I think that's just a problem that we we should have addressed.
00:22:58
Speaker 2: Sammy eventually managed to get back online, and we'll talk about that in just a minute, but first we need to talk about how the sami worm changed how the modern Internet looks. We'll get into that after the break. What do you think the industry learned after the sami worm? Have they learned anything?
00:23:24
Speaker 1: Yeah, definitely. So, as I was talking about, at that time, we were moving into the web two point zero stage, which is now users can add data to a website. They can put their pictures up there, they could put texts, they could put other things, and in this case, they can put JavaScript up there. And the internet has learned. The Internet providers or the web page runners, people, edmins, devs and stuff have learned don't trust anything that a user does, sanitizer inputs, check it for what's valid and not valid, and don't allow for anything to be uploaded that isn't on this strict allow list, because when you start letting people put up whatever they want, now you've run into huge problems like this Sammy werm And So I think this was a lesson that probably a lot of social media companies learn that. Don't allow people to put JavaScript up.
00:24:11
Speaker 2: That's a no no.
00:24:12
Speaker 1: And I don't think you could find a single social media site that allows the user to add JavaScript into the page, because that would you could add a cryptomindor to anybody who visited your website. Right, Like, there's lots of things that could go wrong by letting the user put JavaScript on their profile. You've got to really limit what users can do when they're adding content to your website.
00:24:35
Speaker 2: For example, Facebook, which eventually overtook MySpace as the biggest social media platform, it didn't allow you to customize anything. And that's pretty much how all our social media is now, and casual users don't know hdmil anymore like we used to, like back in the MySpace era, even somebody who wasn't really into computers could kind of navigate their way around little snippets of code because we were motivated to because look, if you want to put that sparkly Snoop Dogg animated gift on your profile, that is some pretty powerful motivation to start looking at some code. Is that the correct decision is to make things more sanitized, more flat?
00:25:14
Speaker 1: Maybe yeah, maybe that's the situation is that Facebook was like, look what you guys did over there, We're not going to let our users get crazy like that. And maybe that was the appropriate response just from a security level, because yeah, when users start adding their own stuff, they can take over the whole website and you've got to be very careful about what they can do there.
00:25:33
Speaker 2: Okay, Now, granted Facebook did start out pretty uncustomizable to begin with, but maybe the Sammy worn't for them was kind of an I told you so moment and they weren't wrong. I mean, if you look at the Internet today, you can see the impact. Everything kind of looks the same. There's this clean aesthetic, and customization is minimal to nonexistent. I mean, Twitter no customization, substack, basically none. I mean even website builders like Squarespace, they're basically just modular blocks that you can move bit to the page around. You almost never really get to mess with the code. And I'm not saying that this is because of the Sami worm, but the do it yourself customization that was part of what made MySpace fun is mostly gone or at least hidden from the Internet today. And you can understand why. If you open up your platform to let people tweak the code, you also open it up to vulnerabilities. But on top of that, the Sami worm also revealed that even reputable websites that we trust. I mean, remember again, MySpace was the social media platform back then. They might not be as secure as we would expect them to be.
00:26:43
Speaker 1: I think just us as a society assumes that people have taken care of the security of their app and site and all that stuff. And it's like, well, obviously one hundred thousand people wouldn't have downloaded this if it's not secure, so I'll trust it as well. And so you have this kind of social proof. But also you just have this expectation that the website you're dealing with it uses the highest security and the best privacy and all that sort of stuff, and you don't question it. You just assume it. And I think that's our problem. I've kind of switched it in my mind after covering stories like this myself. I assume that they're not using the best security of privacy, and therefore I'm definitely not going to share my data with them. I don't give my real name, or I use a burner email and a burner phone and the fake address and even a burner credit card when interacting with most sites today.
00:27:36
Speaker 2: So Jack takes his digital security to another level. And again it makes sense from all those hackers he's talked to on Dark Knight diaries because he knows how vulnerable your information can be if you just put it out there. But not all hackers are out there to steal your information. Sammy's an example of someone who's curiosity led him to look for those vulnerabilities and then to warn people about them. In two thousand and eight, after three years of being banned from the Internet, Samy was finally allowed to be back online. So he left the courthouse that day, drove straight to the Apple store, bought a PowerBook, and started messing around. And one of the first things he did was he started looking into credit cards.
00:28:15
Speaker 1: There's a NFC readers in some of these cards, you know how you tap to pay, Those are using NFC technology. And he was saying to himself, well, wait a minute, what's the communication that happens between these sort of things, And is there a way that I can steal someone's credit card if I tap up against them? And so that was one of his research projects that he did, was to figure out how to clone NFC cards. And again, he wasn't trying to steal credit cards in order to sell them on the dark web or any of that sort of thing. He was simply trying to understand this technology so that he could share it with the world make it a better security system, because I don't want somebody bumping up to me in the line at the store and stealing my card and then being able to use it. So if he could tell the credit card makers, hey, here's some problems with your card, maybe you should make your card more secure, then I think that does help make our cards more secure.
00:29:07
Speaker 2: You've spoken to a pretty wide range of people, some of whom have done some pretty you know, nefarious stuff. Where does Sammy rank on that for you?
00:29:15
Speaker 1: Sammy's a good guy. He's not out there to try to make a bunch of money or steal things or destroy the world. He's really just curious at his core, and he loves finding things that the computer can do that he might think to himself, well, if I can do this, then it's probably the case that a lot of other people can do this. So it's not like I'm inventing something new or breaking something. I'm just showing you how this technology works that somebody could use it in this way. It's not like he's trying to give the world a weapon and say here go mess up the world. He's trying to show the world, Hey, the other people might be able to do this, and now you can too, so let's even the playing field or the people who make this technology should fix this.
00:29:56
Speaker 2: This was a pretty wild outcome for someone who again only a few years before that. It started out just screwing around with Counterstrike. And there's probably some kids out there who are also exploring video games just like Sammy, but nowadays there are some more established roots to do some pretty nefarious stuff.
00:30:14
Speaker 1: I've seen this character arc and a lot of hackers though, is that they play video games and they get bored with it, then they try to hack it, and then they do, and then they're like, well, but that was just for fun. And then they learn more about hacking and other circles and stuff, and they learn, oh wow, that people are actually making money with this interesting and so then that transfers into okay, here's how to earn roebucks website and just try to get little kids to come to our website to earn roebucks free roebucks, but then we never give it to them. You now scamming the kids that are before you, which you're now familiar with the roebucks because you just played the game for the last ten years or something, and you're like, I know everything about this game, so obviously I know how to exploit it or exploit the user base or something like that. And then you start finding users that want to join you and they're like, hey, how do I make money like you? And then starts scamming them even more, and so you end up in that circle, and then that just keeps going to something bigger, like cryptocurrency or something else where you're just like, oh, well, why am I looking at small potatoes. I could be stealing millions instead of just a few robots here and there, and that just turns you into the super criminal at that point or something. And there is this path that I see again and again where it starts with video games and you get into these circles of people hacking and scamming the game, and then it just keeps going from there.
00:31:30
Speaker 2: And Sammy just got some extra friends. Yeah, that's what he did. Given the punishment that Sammy had to go through, it's kind of amazing that he still bounced back and he's now continuing to work to help people by publicly disclosing company security and privacy flaws and kind of holding their feet to the fire to actually fix them.
00:31:50
Speaker 1: History has kind of proven that the hackers are on the right side. Before we even had hackers, we had people who were testing the safety of cars and saying, hey, we should be wearing seat belts, and the car makers are like, nah, and it's fine, you don't need that. And they're like, look, here's what's happening when people crash without seat belts. You should have them wear seat belts. They were thinking, these people were wrong to make such a stink out of this right, stop making it look like our cars aren't safe.
00:32:15
Speaker 2: Our cars are safe.
00:32:16
Speaker 1: And eventually those people want they said, yeah, seat belts are incredibly safe. So that became the new thing of like, okay, let's embrace these people who are crash testing our cars and making sure that they are more of the solution instead of more of the problem. And I think that's the side we should look at here, which is do we have a vulnerability in this technology or this website, And if so, that's on us to fix that and thank you for showing me that vulnerability. That will make our whole system safer. But it's kind of frustrating because if somebody comes to you and says, hey, your zippers down, you have this instant feeling of shame and embarrassment and the sort of thing. And so I think a lot of people do feel that. When they get told their website has a vulnerability, you get this emotional reaction. We don't need that emotional reaction. Your slippers down, but thank you for telling me. I appreciate him. Gonna get it back up. It's hard to handle criticism sometimes.
00:33:07
Speaker 2: And Okay, maybe he did technically force over a million people to say it, But twenty years later, it turns out Sammy's little bit of code held some truth for hackers. Sammy really is a hero.
00:33:19
Speaker 1: Sammy is my hero. Is what you would hear people shouting when you go to death Count. I mean, he's legendary. You hear about him everywhere you go.
00:33:28
Speaker 2: Your big shout out to Jack Resider for talking with us, and I'd definitely encourage you to check out his full interview with Sammy Camcarr on the podcast The Dark Knight Diaries, where they get into some other details that we couldn't touch on here, like Sammy's work on drones, his podcast in general, is a really good look at the hacking culture that we were talking about today. So if any of this interested you, definitely check it out and we'll leave a link in the show notes to check that out. But that being said, back to our show. Thank you so much for listening to another episode of kill Switch. If you want to talk to us, you can email us at kill Switch at Kalaidoscope dot NYC, or on Instagram or at kill switch pod. And while you're still listening to this, you could think about leaving us a review. It helps other people find the show, which helps us keep doing our thing, and it lets us know what people want to hear more of. And once you've done that, did you know it? Kill Switch is also on YouTube and the link for that and everything else is in the show notes. Kill Switch is hosted by Me Dexter Thomas. It's produced by sen Ozaki, Dar Luck Potts, and Julian Nutter. Our theme song is by me and Kyle Murdoch, and Kyle also mixed the show from Kalidoscope. Our executive producers are Oswa lashin On, Geshat Togador and Kate Osborne from iHeart. Our executive producers are Katrina norbl And nikki E Tour. That's it from us. We'll catch ya next week. M
Speaker 1: So yeah, do logistics. Could I have you introduce yourself. My name's Jack ree Sider. I'm the host of the podcast Darknet Diaries.
00:00:20
Speaker 2: If you haven't heard of the Darknet Diaries podcast, let me explain the background a little bit here. So every episode they get into some real wild story that's usually about hackers, and that might be why Jack is so cautious about revealing his identity, because he knows what's out there. So maybe we should address the elephant on the screen here. For those of you watching.
00:00:41
Speaker 1: I'm an anonymous podcaster. I don't like showing myself my face or anything like that, so I'm using a filter to keep my privacy when I cover enough of these hacks. When I hear about breach after breach after breach, I think to myself, well, I guess all my data is out there. There's nothing I can do, and I become black pelt, I suppose, where I just feel completely hopeless about privacy. But then I realized, no, who's the ding dong who gave them my data?
00:01:05
Speaker 2: It was me.
00:01:06
Speaker 1: So in order to protect myself from being in breach after breach, I just stopped giving my data to anyone who asked for it. And so that's why, after you know, seven ten years of doing a podcast about hacking, this is where I've landed on being an extreme privacy advocate. And that's why I don't like to show my face anywhere. If you think about, like what your ex lover knew about you when you were in the height of your relationship, they do everything. They knew your password, they knew your photo, but they do everywhere you wet every day. But that was years ago. You've broken up with them, and now they don't know anything about what you're up to, right, and so there's still hope on recovering your privacy and getting it back. So I'm totally white piled now. I have a lot of optimism about my privacy.
00:01:47
Speaker 2: I love how we're starting this out like that because I feel like we're going to go there right because the time period that we're going to talk about very much was either a a lot of people didn't really care too much about their information being out there, or they didn't really think about it or very much were thinking in the sense that, uh, you know, everything's out there, what can I possibly do about this? You know? Yeah, yeah, exactly. On this week's episode, Jack is going to share one of the most bizarre, the most frustrating, but also honestly one of the most hopeful hacking stories that I've ever heard. It takes us back to a time when even the phrase hacker freaked everyone out. And if you were around in the MySpace days and you've been wondering why social media today looks so boring, maybe this week's story has some answers for you.
00:02:42
Speaker 3: I'm afraid.
00:02:45
Speaker 2: Kaleidoscope and iHeart podcasts. This is kill Switch. I'm Dexah Thomas.
00:02:54
Speaker 3: I'm all right, goodbye.
00:03:37
Speaker 2: Yeah. So take us back to two thousand and five. What was the Internet like back then?
00:03:42
Speaker 1: So we're going from Internet one point oh to Internet two point oho. In those days, and one point oh was basically read only. Everything was just posted there and you could read it, but you couldn't really interact with it. There's no upfolts, there's no likes, there's no shares, there's no oh let me create an account and comment on this. It's just read it and that's all you get. And then as Internet two point zero came around, we started getting sites like dig and read It and MySpace, where now you are creating content on this site. Now you have this little personal space on this website. This is the music I like, and this is the bands I follow, and this is the stuff I've been doing every day, and this is my comments about these things. And so it became this read write kind of era, where now I can read it and I can comment on it, and I can write about it now. I think everyone's favorite subject then and now is ourselves, and so we love talking about ourselves on the Internet. And so when my Space showed up, it's like, we want to know all about you, and you're like, yeah, let me jump on here and tell you what my interests are and show you pictures of what I've been doing and all the fun activities I've been up to. And so it was the first big social media to hit our Internet, and it was really fascinating.
00:04:52
Speaker 2: My Space started in two thousand and three, and the whole point of the site was to let you connect with your friends and maybe even make new ones. But probably the most the famous or infamous feature of MySpace was the top eight. So this was a feature that would allow you to publicly rank your top eight friends, and everyone who used it back then you probably remember agonizing over who you should put in that top eight and then accidentally having somebody get mad because they weren't included or didn't like where they were placed, and then it causing all sorts of weird beef and drama at school. Another thing that people probably remember is that when you first started your account, you were automatically friends with Tom, the co founder of the site. And then there was the options that you could use to categorize yourself.
00:05:32
Speaker 1: You could tell us what mood you were in or what relationship you were in, and you could connect your boyfriend or girlfriend to you to say, oh, I'm in a relationship with them, and then they could show that they're in a relationship with you. And then every now and then you'd see something where you'd go to your girlfriend's MySpace and she's no longer set to a relationship with you, and you're like, what's going on here? Is there something I don't know about? And you'd learned about things. It's a hard way.
00:05:57
Speaker 2: One of the big things about MySpace for people who might not remember is my space was customizable.
00:06:03
Speaker 1: Yeah, you could change the background and I think maybe the fonts, and when you land on it, you could even have music playing you could kind of theme it out. Yeah.
00:06:12
Speaker 2: I remember when Facebook came out. One of the reasons that some people initially did not like Facebook was because it wasn't customizable. And that was kind of a weird divibe because I actually felt like, good, I'm sick of going to somebody's MySpace page and I just want to message you, and you got like a Britney Spears MIDI playing like nah man like disable that. I don't want any of that. But there were some people who really really missed that personalization, and that personalization was pretty broad. You could change the background of your page, you could change the font, you could add music, you could have a custom flashing cursor if you wanted to. Most people just did this by copy pasting bits of code into a form on the site, but if you knew a little bit of HTML and CSS, you could really start making that page look like your own. It was a fun way for people who were even a little bit interested in computers to get to play around with code. And for nineteen year old Sammy Kumcar, who was already very familiar with coding, this was like being a kid in a candy store. October fourth, two thousand and five what happens.
00:07:17
Speaker 1: So MySpace has all this customizability, and Sammy was playing around with some of this because you can set on my Space that you're in a relationship. There's a drop down and where there are the options I'm in a solid relationship, a shaky relationship, whatever. There's like a few options, and you only get those options. Well, he's like, well, what if I just tell it that I'm in a hot relationship? And he was able to modify the code on his own computer and submit that to the server, and the server accepted it. So suddenly he's in a relationship that no one else is in a relationship with and it's like, well, how did he set that? And there was some other stuff like how many photos you could upload. I think there was a photo limit of twelve, but he had uploaded an extra one or thirteen.
00:07:57
Speaker 2: Growing up, Sammy loved computers and he loved messing around with him. When he was a kid, he'd figured out how to hack the computer game counter Strike so that he was essentially a god in the game. When he flipped that switch, nobody could beat him. And for some people that's all they want. They just want to win. But Sammy got bored after that. He didn't want to play counter Strike anymore.
00:08:18
Speaker 1: Yeah, because it became so easy for him. He could just beat anybody. But there was an anti cheat maker that came out that started detecting things that he was doing and saying, okay, well that's no longer doable in the game. And he's like, wow, well that gives me a whole new challenge here now, how to figure out how big cheats to not be detected by anti cheat And so he got back into it just to try to bypass the anti cheats there, and that became a whole new thing for him.
00:08:44
Speaker 2: Right, so it's not even playing counter Strike anymore, it's like playing the game off top of Counterstrike. It's like playing cat and mouse with the company. So you can kind of see that Sammy just likes taking stuff apart and putting it back together again. He likes challenges. And on MySpace, Sammy realized that he could just write some JavaScript code on the client side and get MySpace to display stuff that the creators had not intended, like he wrote a funny comment in the relationship status section. For him, this stuff was all pretty rudimentary, so he kept poking around.
00:09:14
Speaker 1: So he was playing around with all these different things that you could do on MySpace, and he found a way to make it so that if somebody visited his page, it would make them follow him. I think it was JavaScript code that he was able to embed into his page that would force the person the visitor to follow him. But you'd still have to have someone come to your page in order to get someone to follow you.
00:09:37
Speaker 2: But then he.
00:09:37
Speaker 1: Figured out how to replicate this, how to make it so that anybody who visited his page would then get this code on their MySpace page, which would mean that everyone who visited someone else who had this code wouldn't follow Sammy, and not only would they follow him, but they would comment on their MySpace page Sabby is my Hero.
00:09:59
Speaker 2: Basically, Sammy embedded code on his page that spread to any page that looked at his and any page that looked at that page would also get infected with the code as well. Maybe you're starting to see where this is going, But the important part here is that on each page that had been infected, it would go after the person's bio and insert the text at the bottom. But most of all, Sammy is my hero.
00:10:22
Speaker 1: And so people would visit someone else's page, suddenly follow Sammy, and then have it say Sammy's my hero on their page, and they're like, wait, who's this guy Sammy? And why does it say he's my hero.
00:10:33
Speaker 2: At first, it's not really a big deal. It's spreading to his friends and maybe friends of friends. So Sammy goes to bed that night thinking that he's just played a silly prank on his friends on the internet.
00:10:43
Speaker 1: But then the next morning, when he woke up, he had ten thousand followers on MySpace, and that really blew his mind. He knew something had gone terribly wrong to get ten thousand followers.
00:10:56
Speaker 2: So remember this is two thousand and five, and back then, ten thousand friends was a really monumental number. I'm not even sure he knew that there were ten thousand people on MySpace.
00:11:07
Speaker 4: At that point, I just freak out. I have no idea what to do. I'm sitting in my apartment and I'm kind of baffled. So I realized, like, oops, I just wrote a virus and what should I do.
00:11:18
Speaker 2: That's the voice of Sammy on Jack's podcast, The Darknet Diaries. And because the spread was exponential, the numbers just kept going up. Another hour later, it was at fifty thousand.
00:11:29
Speaker 4: When fifty one hundred thousand, I couldn't think about anything. It was just refreshing. Went home, five hundred thousand, six hundred thousand. It hits a million. I just take a screenshot because I'm just like that. That's a lot of people. I had the idea that many people were even on my spence.
00:11:46
Speaker 2: Sammy now realizes that he's created a virus. Actually, it's worse. He's created a worm, a piece of code that is self replicating, and this worm is spreading through all of my space. But what happens next even Sammy couldn't predict. That's after break. Sammy's a little bit of code has started as a joke. He figured that maybe in a couple of weeks or so it reached a couple hundred people max. But in less than twenty hours, Sammy knkard had a million friends. This had gotten completely out of his control.
00:12:35
Speaker 1: He knows something has gone terribly awry. He thought maybe he'd get a few hundred followers or something out of this and then be able to turn it off. But at this point, it feels like the momentum is going so fast that he's having a hard time controlling it. And even if you go to Sammy's page and you unfollow him, what happens is it says, okay, you're no longer following them, and then it goes back to your page, and your page has the code to follow him, so people can't even unfollow him, and if they wanted to, they're like, why why am I permanently following you? This is ridiculous.
00:13:05
Speaker 2: So are people messaging Sammy at this point?
00:13:08
Speaker 1: Yeah, they're confused, like who are you? How do I unfollow you? And he's not sure because he can't pull this back. He can't go to everyone else's MySpace page and remove their code, so he's like, oh man, I don't know how to turn this off. It almost seems like everyone on my space is going to eventually follow him because there's no other logical end to this.
00:13:29
Speaker 2: This was all an accident. Sammy had no idea that what he'd created would spread this far, so he removes the code from his page, but that doesn't help because it's already spreading too fast. So he wants to help stop it, and he gets an idea he could go straight to my space like irol.
00:13:46
Speaker 1: He actually lived in the same town as them, both in Los Angeles, and he's like, should I just go over there and tell him I did this and to give him some suggestions on what to do.
00:13:55
Speaker 2: So at first, and I wish I was making this up. He thinks, Okay, maybe I could just like buy some coffee and donuts and show up at MySpace office and help them fix it, like give them the donuts, give the coffee, sit down, crack on knuckles, write some code, patch things up, all good. But then he thinks about it and he realizes, Okay, maybe that's not the best idea. Maybe I should just send them an anonymous message. So he emails them and says, here's some tips on how to handle this. It was vague but specific at the same time, like you didn't want to say who he was. But he was like, you might want to go in here and disable this or do this. Here's some SQL queries to look for these strings and you'll find the code and you can delete it off everyone's page. He wanted to be.
00:14:37
Speaker 1: Helpful, he did not because he realized, oh no, I've caused a big problem here. Fox had actually bought my Space just before this. He's thinking about this, like, Fox might be really mad. What do I do if they're coming after me? This is a big problem. He's trying to help what he can, but he also doesn't want to get himself in trouble. But it's really hard because everything is pointing to his page and it's got his name on it and everything.
00:15:00
Speaker 2: He's got his literal name on it.
00:15:01
Speaker 1: Yeah, so he's just refreshing it and looking at the numbers going up and up, and he's like, oh my gosh, what do I do? And then eventually one of the refreshes his page just says this page doesn't exist.
00:15:12
Speaker 2: It's gone.
00:15:12
Speaker 1: His page was deleted or at least disabled for a while, and he's like, okay, that's fine. So then he looks at, you know, some of his friend's pages and they're all deleted, they're all disabled. And he's looking at everybody who's trying to follow him and they're all disabled, and they're all deleted. And then he refreshes the page again and it says, sorry, my space is down. We are taking it all offline. We're doing some maintenance. We'll be back shortly.
00:15:40
Speaker 2: Sammy's a little bit of code ended up bringing MySpace to its knees. It shut the whole site down. So I kind of remember this happening. This was back when I was in college and there was this Bobo shop next to campus, and I think they had these three Windows computers installed on the wall so that you could use your computer while you waited for your order, and people who were a MySpace would go there and log in and check their messages. And yes, logging into your social media on an unsecured public machine is absolutely terrible security practice, but I don't know, people just didn't know any better, I guess. So Yeah, Anyway, one day, I think people were probably at home and their MySpace wasn't working on their home computer, so they came to the cafe to log in, and it didn't work there either, but they'd already bought their boba, so people just had to wait there awkwardly like normal human beings for the drink order. Kind of inconvenient, but for Sammy that day wasn't just inconvenient. Dude was sweating bullets. So after a while, MySpace fixes the problem and it comes back all nine. It's slow for a few days, but eventually it's back to normal and that's it. It's back, And for a while, Sammy thought that, Okay, maybe this is just a blip and everyone would just move on and forget it all happened.
00:16:54
Speaker 1: The days after that, nothing happened, and the weeks after that, nothing happened. She's like, Okay, I think I'll stay away from his space for a while. I'll just lay low because whatever happened there, I don't want to make it worse. So let's just hope this is in the past. So he went back to doing his work, and at that point he had started a business.
00:17:13
Speaker 2: During that time period, Sammy had co founded a company called Finality that used the Internet to make phone calls instead of relying on traditional phone lines, and at the time, this was pretty cool technology. So we just focused on that. That message he'd sent to MySpace never got answered, and my Space itself didn't really seem to be looking for him. Maybe they had just let it go. So Sammy got back to work.
00:17:36
Speaker 1: At some point, You're just like, Okay, everybody's just gone their way. They fixed it, and that's just it. You know, you fix incidents all the time at work, and I think he thought that everything was going to be fine. So it was a big surprise to him to find the Secret Service we're after him. The business was doing really well, so he actually bought himself a Porsche and was driving that thing around town and so he was having a good time. And one day he went out out to the parking lot to kit in his car and there was some guys standing around his car and he's like, oh, man, are these guys gonna rob me? Or what's going on? And one of them shouted, hey, are you Sammy. He's like, oh gosh, usually people who robbed me and they don't know your name. So let's see what's going on here, and it was the Secret Service. They took him to his house and they confiscated all his computers and I said, you're being investigated for taking down my Space.
00:18:25
Speaker 2: It had been six months since that worom took down MySpace, and now out of the blue, here's the Electronic Crimes Task Force of the LAPD and the Secret Service coming around asking questions. They had him under surveillance for months, and they had a search warrant for his house and his office. They took his laptop, they took his hard drives, even took his iPod. The DA ended up hitting Sammy with a felony hacking charge, and prosecutors wanted him to spend some time in prison and not be able to touch computers for the rest of his life. Sammy freaked out and he ended up taking a plea deal exchange for not having to go to prison. He paid a twenty thousand dollars fine, he had to complete seven hundred and twenty hours of community service and three years of probation. Oh, and he couldn't use computers. Well, he could use one computer, but that computer had to be registered with authorities and it couldn't access the Internet. Now keep in mind here, Sammy's whole life and work had revolved around technology to this point, so not being able to use an Internet enabled computer was kind of like telling them, Okay, yeah, here kid, have a typewriter, go do your job. At this point in his life, the Internet was his livelihood and it's how he was able to support his mom.
00:19:41
Speaker 1: He was paying her rent and helping her out and all that. And so his startup that he had started, he had a very difficult time doing any work there because that was all computer based work that he was doing. So I don't know if he was making a salary during that time to help her anymore anything, And it was.
00:19:57
Speaker 2: Tough for Sammy. It meant that he could do a lot of the stuff that he used to, but he tried to look at the bright side. Sammy told Vice his motherboard how it forced him to go outside and touch grass.
00:20:08
Speaker 4: I kind of started a new chapter of life because I spent my entire life just in front of the computer, and finally this like got me out. I just spent a lot of time doing other things that I think normal people did.
00:20:18
Speaker 2: But barring access to computers was like barring Sammy from accessing a part of himself. This was someone who really loved computers and who says that he didn't mean to write a worm in the first place.
00:20:30
Speaker 1: Some of these hackers who have been in trouble have had that sentence brought to them where they're banned from computers for life. It's always frustrating to me because there's obviously these people are very talented and skilled and trying to take their way of making money away their livelihood. I mean even a cash register as a computer at this point. It's so sad to see them take that away when that's the thing that their best at in life and the most passionate thing. I think what's better is to try to figure out how to use their skills for good and to determine is this person, you know, rehabbable. Are they just trying to burn the world down and no matter how well we try to turn them in the right way, they're just going to destroy everything. Or is this somebody who we can use their skills for some net benefit on society or you know, it wasn't like he was trying to do anything malicious. I think at Samy's core, he's not a malicious person. He's just someone who's curious and interested in technology, and he's not trying to harm anybody or hurt anything. I've since met him and hung out with him quite a few times, and he is just such a sweetheart. He loves learning stuff, and he's just so deep down in the technology of it that he's extremely brilliant, like one of the more brilliant folks I know when it comes to not so much seeing what the technology does, but seeing what it could potentially do. He's just really fascinated with the way technology works and likes exploring it.
00:21:51
Speaker 2: Let's say it's two thousand and five. You're at MySpace. You're tom right. Yeah, you find out that somebody has done something to your website, taken it down for a day, You figure out who this kid is, what's the appropriate punishment here? What do you do? Press chargers?
00:22:11
Speaker 1: I wouldn't. I would feel like our code wasn't up to snuff. We had not you know, fortified it enough, and somebody found a vulnerability. So this was a surprise vulnerability assessment. That's that their ownership's on us, right, and we can't just assume everyone is just like a criminal if they've done something wrong on our website and try to take them down. But yeah, I think if I was, yeah, my Space exec, I'd try to take ownership of this and say, you know what, this was something we should have done better, and it's okay, we've solved it. We were only down for a day. That's not too bad. It's not like there was a lot of damage done. Somebody posted this little bit of JavaScript on their page and that accidentally spread everywhere. I don't think that's criminal behavior. I think that's just a problem that we we should have addressed.
00:22:58
Speaker 2: Sammy eventually managed to get back online, and we'll talk about that in just a minute, but first we need to talk about how the sami worm changed how the modern Internet looks. We'll get into that after the break. What do you think the industry learned after the sami worm? Have they learned anything?
00:23:24
Speaker 1: Yeah, definitely. So, as I was talking about, at that time, we were moving into the web two point zero stage, which is now users can add data to a website. They can put their pictures up there, they could put texts, they could put other things, and in this case, they can put JavaScript up there. And the internet has learned. The Internet providers or the web page runners, people, edmins, devs and stuff have learned don't trust anything that a user does, sanitizer inputs, check it for what's valid and not valid, and don't allow for anything to be uploaded that isn't on this strict allow list, because when you start letting people put up whatever they want, now you've run into huge problems like this Sammy werm And So I think this was a lesson that probably a lot of social media companies learn that. Don't allow people to put JavaScript up.
00:24:11
Speaker 2: That's a no no.
00:24:12
Speaker 1: And I don't think you could find a single social media site that allows the user to add JavaScript into the page, because that would you could add a cryptomindor to anybody who visited your website. Right, Like, there's lots of things that could go wrong by letting the user put JavaScript on their profile. You've got to really limit what users can do when they're adding content to your website.
00:24:35
Speaker 2: For example, Facebook, which eventually overtook MySpace as the biggest social media platform, it didn't allow you to customize anything. And that's pretty much how all our social media is now, and casual users don't know hdmil anymore like we used to, like back in the MySpace era, even somebody who wasn't really into computers could kind of navigate their way around little snippets of code because we were motivated to because look, if you want to put that sparkly Snoop Dogg animated gift on your profile, that is some pretty powerful motivation to start looking at some code. Is that the correct decision is to make things more sanitized, more flat?
00:25:14
Speaker 1: Maybe yeah, maybe that's the situation is that Facebook was like, look what you guys did over there, We're not going to let our users get crazy like that. And maybe that was the appropriate response just from a security level, because yeah, when users start adding their own stuff, they can take over the whole website and you've got to be very careful about what they can do there.
00:25:33
Speaker 2: Okay, Now, granted Facebook did start out pretty uncustomizable to begin with, but maybe the Sammy worn't for them was kind of an I told you so moment and they weren't wrong. I mean, if you look at the Internet today, you can see the impact. Everything kind of looks the same. There's this clean aesthetic, and customization is minimal to nonexistent. I mean, Twitter no customization, substack, basically none. I mean even website builders like Squarespace, they're basically just modular blocks that you can move bit to the page around. You almost never really get to mess with the code. And I'm not saying that this is because of the Sami worm, but the do it yourself customization that was part of what made MySpace fun is mostly gone or at least hidden from the Internet today. And you can understand why. If you open up your platform to let people tweak the code, you also open it up to vulnerabilities. But on top of that, the Sami worm also revealed that even reputable websites that we trust. I mean, remember again, MySpace was the social media platform back then. They might not be as secure as we would expect them to be.
00:26:43
Speaker 1: I think just us as a society assumes that people have taken care of the security of their app and site and all that stuff. And it's like, well, obviously one hundred thousand people wouldn't have downloaded this if it's not secure, so I'll trust it as well. And so you have this kind of social proof. But also you just have this expectation that the website you're dealing with it uses the highest security and the best privacy and all that sort of stuff, and you don't question it. You just assume it. And I think that's our problem. I've kind of switched it in my mind after covering stories like this myself. I assume that they're not using the best security of privacy, and therefore I'm definitely not going to share my data with them. I don't give my real name, or I use a burner email and a burner phone and the fake address and even a burner credit card when interacting with most sites today.
00:27:36
Speaker 2: So Jack takes his digital security to another level. And again it makes sense from all those hackers he's talked to on Dark Knight diaries because he knows how vulnerable your information can be if you just put it out there. But not all hackers are out there to steal your information. Sammy's an example of someone who's curiosity led him to look for those vulnerabilities and then to warn people about them. In two thousand and eight, after three years of being banned from the Internet, Samy was finally allowed to be back online. So he left the courthouse that day, drove straight to the Apple store, bought a PowerBook, and started messing around. And one of the first things he did was he started looking into credit cards.
00:28:15
Speaker 1: There's a NFC readers in some of these cards, you know how you tap to pay, Those are using NFC technology. And he was saying to himself, well, wait a minute, what's the communication that happens between these sort of things, And is there a way that I can steal someone's credit card if I tap up against them? And so that was one of his research projects that he did, was to figure out how to clone NFC cards. And again, he wasn't trying to steal credit cards in order to sell them on the dark web or any of that sort of thing. He was simply trying to understand this technology so that he could share it with the world make it a better security system, because I don't want somebody bumping up to me in the line at the store and stealing my card and then being able to use it. So if he could tell the credit card makers, hey, here's some problems with your card, maybe you should make your card more secure, then I think that does help make our cards more secure.
00:29:07
Speaker 2: You've spoken to a pretty wide range of people, some of whom have done some pretty you know, nefarious stuff. Where does Sammy rank on that for you?
00:29:15
Speaker 1: Sammy's a good guy. He's not out there to try to make a bunch of money or steal things or destroy the world. He's really just curious at his core, and he loves finding things that the computer can do that he might think to himself, well, if I can do this, then it's probably the case that a lot of other people can do this. So it's not like I'm inventing something new or breaking something. I'm just showing you how this technology works that somebody could use it in this way. It's not like he's trying to give the world a weapon and say here go mess up the world. He's trying to show the world, Hey, the other people might be able to do this, and now you can too, so let's even the playing field or the people who make this technology should fix this.
00:29:56
Speaker 2: This was a pretty wild outcome for someone who again only a few years before that. It started out just screwing around with Counterstrike. And there's probably some kids out there who are also exploring video games just like Sammy, but nowadays there are some more established roots to do some pretty nefarious stuff.
00:30:14
Speaker 1: I've seen this character arc and a lot of hackers though, is that they play video games and they get bored with it, then they try to hack it, and then they do, and then they're like, well, but that was just for fun. And then they learn more about hacking and other circles and stuff, and they learn, oh wow, that people are actually making money with this interesting and so then that transfers into okay, here's how to earn roebucks website and just try to get little kids to come to our website to earn roebucks free roebucks, but then we never give it to them. You now scamming the kids that are before you, which you're now familiar with the roebucks because you just played the game for the last ten years or something, and you're like, I know everything about this game, so obviously I know how to exploit it or exploit the user base or something like that. And then you start finding users that want to join you and they're like, hey, how do I make money like you? And then starts scamming them even more, and so you end up in that circle, and then that just keeps going to something bigger, like cryptocurrency or something else where you're just like, oh, well, why am I looking at small potatoes. I could be stealing millions instead of just a few robots here and there, and that just turns you into the super criminal at that point or something. And there is this path that I see again and again where it starts with video games and you get into these circles of people hacking and scamming the game, and then it just keeps going from there.
00:31:30
Speaker 2: And Sammy just got some extra friends. Yeah, that's what he did. Given the punishment that Sammy had to go through, it's kind of amazing that he still bounced back and he's now continuing to work to help people by publicly disclosing company security and privacy flaws and kind of holding their feet to the fire to actually fix them.
00:31:50
Speaker 1: History has kind of proven that the hackers are on the right side. Before we even had hackers, we had people who were testing the safety of cars and saying, hey, we should be wearing seat belts, and the car makers are like, nah, and it's fine, you don't need that. And they're like, look, here's what's happening when people crash without seat belts. You should have them wear seat belts. They were thinking, these people were wrong to make such a stink out of this right, stop making it look like our cars aren't safe.
00:32:15
Speaker 2: Our cars are safe.
00:32:16
Speaker 1: And eventually those people want they said, yeah, seat belts are incredibly safe. So that became the new thing of like, okay, let's embrace these people who are crash testing our cars and making sure that they are more of the solution instead of more of the problem. And I think that's the side we should look at here, which is do we have a vulnerability in this technology or this website, And if so, that's on us to fix that and thank you for showing me that vulnerability. That will make our whole system safer. But it's kind of frustrating because if somebody comes to you and says, hey, your zippers down, you have this instant feeling of shame and embarrassment and the sort of thing. And so I think a lot of people do feel that. When they get told their website has a vulnerability, you get this emotional reaction. We don't need that emotional reaction. Your slippers down, but thank you for telling me. I appreciate him. Gonna get it back up. It's hard to handle criticism sometimes.
00:33:07
Speaker 2: And Okay, maybe he did technically force over a million people to say it, But twenty years later, it turns out Sammy's little bit of code held some truth for hackers. Sammy really is a hero.
00:33:19
Speaker 1: Sammy is my hero. Is what you would hear people shouting when you go to death Count. I mean, he's legendary. You hear about him everywhere you go.
00:33:28
Speaker 2: Your big shout out to Jack Resider for talking with us, and I'd definitely encourage you to check out his full interview with Sammy Camcarr on the podcast The Dark Knight Diaries, where they get into some other details that we couldn't touch on here, like Sammy's work on drones, his podcast in general, is a really good look at the hacking culture that we were talking about today. So if any of this interested you, definitely check it out and we'll leave a link in the show notes to check that out. But that being said, back to our show. Thank you so much for listening to another episode of kill Switch. If you want to talk to us, you can email us at kill Switch at Kalaidoscope dot NYC, or on Instagram or at kill switch pod. And while you're still listening to this, you could think about leaving us a review. It helps other people find the show, which helps us keep doing our thing, and it lets us know what people want to hear more of. And once you've done that, did you know it? Kill Switch is also on YouTube and the link for that and everything else is in the show notes. Kill Switch is hosted by Me Dexter Thomas. It's produced by sen Ozaki, Dar Luck Potts, and Julian Nutter. Our theme song is by me and Kyle Murdoch, and Kyle also mixed the show from Kalidoscope. Our executive producers are Oswa lashin On, Geshat Togador and Kate Osborne from iHeart. Our executive producers are Katrina norbl And nikki E Tour. That's it from us. We'll catch ya next week. M
