Speaker 1: So yeah, do logistics. Could I have you introduce yourself.
Speaker 1: My name's Jack ree Sider. I'm the host of the
Speaker 1: podcast Darknet Diaries.
Speaker 2: If you haven't heard of the Darknet Diaries podcast, let
Speaker 2: me explain the background a little bit here. So every
Speaker 2: episode they get into some real wild story that's usually
Speaker 2: about hackers, and that might be why Jack is so
Speaker 2: cautious about revealing his identity, because he knows what's out there.
Speaker 2: So maybe we should address the elephant on the screen here.
Speaker 2: For those of you watching.
Speaker 1: I'm an anonymous podcaster. I don't like showing myself my
Speaker 1: face or anything like that, so I'm using a filter
Speaker 1: to keep my privacy when I cover enough of these hacks.
Speaker 1: When I hear about breach after breach after breach, I
Speaker 1: think to myself, well, I guess all my data is
Speaker 1: out there. There's nothing I can do, and I become
Speaker 1: black pelt, I suppose, where I just feel completely hopeless
Speaker 1: about privacy. But then I realized, no, who's the ding
Speaker 1: dong who gave them my data?
Speaker 2: It was me.
Speaker 1: So in order to protect myself from being in breach
Speaker 1: after breach, I just stopped giving my data to anyone
Speaker 1: who asked for it. And so that's why, after you know,
Speaker 1: seven ten years of doing a podcast about hacking, this
Speaker 1: is where I've landed on being an extreme privacy advocate.
Speaker 1: And that's why I don't like to show my face anywhere.
Speaker 1: If you think about, like what your ex lover knew
Speaker 1: about you when you were in the height of your relationship,
Speaker 1: they do everything. They knew your password, they knew your photo,
Speaker 1: but they do everywhere you wet every day. But that
Speaker 1: was years ago. You've broken up with them, and now
Speaker 1: they don't know anything about what you're up to, right,
Speaker 1: and so there's still hope on recovering your privacy and
Speaker 1: getting it back. So I'm totally white piled now. I
Speaker 1: have a lot of optimism about my privacy.
Speaker 2: I love how we're starting this out like that because
Speaker 2: I feel like we're going to go there right because
Speaker 2: the time period that we're going to talk about very
Speaker 2: much was either a a lot of people didn't really
Speaker 2: care too much about their information being out there, or
Speaker 2: they didn't really think about it or very much were
Speaker 2: thinking in the sense that, uh, you know, everything's out there,
Speaker 2: what can I possibly do about this? You know? Yeah, yeah, exactly.
Speaker 2: On this week's episode, Jack is going to share one
Speaker 2: of the most bizarre, the most frustrating, but also honestly
Speaker 2: one of the most hopeful hacking stories that I've ever heard.
Speaker 2: It takes us back to a time when even the
Speaker 2: phrase hacker freaked everyone out. And if you were around
Speaker 2: in the MySpace days and you've been wondering why social
Speaker 2: media today looks so boring, maybe this week's story has
Speaker 2: some answers for you.
Speaker 3: I'm afraid.
Speaker 2: Kaleidoscope and iHeart podcasts. This is kill Switch. I'm Dexah Thomas.
Speaker 3: I'm all right, goodbye.
Speaker 2: Yeah. So take us back to two thousand and five.
Speaker 2: What was the Internet like back then?
Speaker 1: So we're going from Internet one point oh to Internet
Speaker 1: two point oho. In those days, and one point oh
Speaker 1: was basically read only. Everything was just posted there and
Speaker 1: you could read it, but you couldn't really interact with it.
Speaker 1: There's no upfolts, there's no likes, there's no shares, there's
Speaker 1: no oh let me create an account and comment on this.
Speaker 1: It's just read it and that's all you get. And
Speaker 1: then as Internet two point zero came around, we started
Speaker 1: getting sites like dig and read It and MySpace, where
Speaker 1: now you are creating content on this site. Now you
Speaker 1: have this little personal space on this website. This is
Speaker 1: the music I like, and this is the bands I follow,
Speaker 1: and this is the stuff I've been doing every day,
Speaker 1: and this is my comments about these things. And so
Speaker 1: it became this read write kind of era, where now
Speaker 1: I can read it and I can comment on it,
Speaker 1: and I can write about it now. I think everyone's
Speaker 1: favorite subject then and now is ourselves, and so we
Speaker 1: love talking about ourselves on the Internet. And so when
Speaker 1: my Space showed up, it's like, we want to know
Speaker 1: all about you, and you're like, yeah, let me jump
Speaker 1: on here and tell you what my interests are and
Speaker 1: show you pictures of what I've been doing and all
Speaker 1: the fun activities I've been up to. And so it
Speaker 1: was the first big social media to hit our Internet,
Speaker 1: and it was really fascinating.
Speaker 2: My Space started in two thousand and three, and the
Speaker 2: whole point of the site was to let you connect
Speaker 2: with your friends and maybe even make new ones. But
Speaker 2: probably the most the famous or infamous feature of MySpace
Speaker 2: was the top eight. So this was a feature that
Speaker 2: would allow you to publicly rank your top eight friends,
Speaker 2: and everyone who used it back then you probably remember
Speaker 2: agonizing over who you should put in that top eight
Speaker 2: and then accidentally having somebody get mad because they weren't
Speaker 2: included or didn't like where they were placed, and then
Speaker 2: it causing all sorts of weird beef and drama at school.
Speaker 2: Another thing that people probably remember is that when you
Speaker 2: first started your account, you were automatically friends with Tom,
Speaker 2: the co founder of the site. And then there was
Speaker 2: the options that you could use to categorize yourself.
Speaker 1: You could tell us what mood you were in or
Speaker 1: what relationship you were in, and you could connect your
Speaker 1: boyfriend or girlfriend to you to say, oh, I'm in
Speaker 1: a relationship with them, and then they could show that
Speaker 1: they're in a relationship with you. And then every now
Speaker 1: and then you'd see something where you'd go to your
Speaker 1: girlfriend's MySpace and she's no longer set to a relationship
Speaker 1: with you, and you're like, what's going on here? Is
Speaker 1: there something I don't know about? And you'd learned about things.
Speaker 1: It's a hard way.
Speaker 2: One of the big things about MySpace for people who
Speaker 2: might not remember is my space was customizable.
Speaker 1: Yeah, you could change the background and I think maybe
Speaker 1: the fonts, and when you land on it, you could
Speaker 1: even have music playing you could kind of theme it out. Yeah.
Speaker 2: I remember when Facebook came out. One of the reasons
Speaker 2: that some people initially did not like Facebook was because
Speaker 2: it wasn't customizable. And that was kind of a weird
Speaker 2: divibe because I actually felt like, good, I'm sick of
Speaker 2: going to somebody's MySpace page and I just want to
Speaker 2: message you, and you got like a Britney Spears MIDI
Speaker 2: playing like nah man like disable that. I don't want
Speaker 2: any of that. But there were some people who really
Speaker 2: really missed that personalization, and that personalization was pretty broad.
Speaker 2: You could change the background of your page, you could
Speaker 2: change the font, you could add music, you could have
Speaker 2: a custom flashing cursor if you wanted to. Most people
Speaker 2: just did this by copy pasting bits of code into
Speaker 2: a form on the site, but if you knew a
Speaker 2: little bit of HTML and CSS, you could really start
Speaker 2: making that page look like your own. It was a
Speaker 2: fun way for people who were even a little bit
Speaker 2: interested in computers to get to play around with code.
Speaker 2: And for nineteen year old Sammy Kumcar, who was already
Speaker 2: very familiar with coding, this was like being a kid
Speaker 2: in a candy store. October fourth, two thousand and five
Speaker 2: what happens.
Speaker 1: So MySpace has all this customizability, and Sammy was playing
Speaker 1: around with some of this because you can set on
Speaker 1: my Space that you're in a relationship. There's a drop
Speaker 1: down and where there are the options I'm in a
Speaker 1: solid relationship, a shaky relationship, whatever. There's like a few options,
Speaker 1: and you only get those options. Well, he's like, well,
Speaker 1: what if I just tell it that I'm in a
Speaker 1: hot relationship? And he was able to modify the code
Speaker 1: on his own computer and submit that to the server,
Speaker 1: and the server accepted it. So suddenly he's in a
Speaker 1: relationship that no one else is in a relationship with
Speaker 1: and it's like, well, how did he set that? And
Speaker 1: there was some other stuff like how many photos you
Speaker 1: could upload. I think there was a photo limit of twelve,
Speaker 1: but he had uploaded an extra one or thirteen.
Speaker 2: Growing up, Sammy loved computers and he loved messing around
Speaker 2: with him. When he was a kid, he'd figured out
Speaker 2: how to hack the computer game counter Strike so that
Speaker 2: he was essentially a god in the game. When he
Speaker 2: flipped that switch, nobody could beat him. And for some
Speaker 2: people that's all they want. They just want to win.
Speaker 2: But Sammy got bored after that. He didn't want to
Speaker 2: play counter Strike anymore.
Speaker 1: Yeah, because it became so easy for him. He could
Speaker 1: just beat anybody. But there was an anti cheat maker
Speaker 1: that came out that started detecting things that he was
Speaker 1: doing and saying, okay, well that's no longer doable in
Speaker 1: the game. And he's like, wow, well that gives me
Speaker 1: a whole new challenge here now, how to figure out
Speaker 1: how big cheats to not be detected by anti cheat
Speaker 1: And so he got back into it just to try
Speaker 1: to bypass the anti cheats there, and that became a
Speaker 1: whole new thing for him.
Speaker 2: Right, so it's not even playing counter Strike anymore, it's
Speaker 2: like playing the game off top of Counterstrike. It's like
Speaker 2: playing cat and mouse with the company. So you can
Speaker 2: kind of see that Sammy just likes taking stuff apart
Speaker 2: and putting it back together again. He likes challenges. And
Speaker 2: on MySpace, Sammy realized that he could just write some
Speaker 2: JavaScript code on the client side and get MySpace to
Speaker 2: display stuff that the creators had not intended, like he
Speaker 2: wrote a funny comment in the relationship status section. For him,
Speaker 2: this stuff was all pretty rudimentary, so he kept poking around.
Speaker 1: So he was playing around with all these different things
Speaker 1: that you could do on MySpace, and he found a
Speaker 1: way to make it so that if somebody visited his page,
Speaker 1: it would make them follow him. I think it was
Speaker 1: JavaScript code that he was able to embed into his
Speaker 1: page that would force the person the visitor to follow him.
Speaker 1: But you'd still have to have someone come to your
Speaker 1: page in order to get someone to follow you.
Speaker 2: But then he.
Speaker 1: Figured out how to replicate this, how to make it
Speaker 1: so that anybody who visited his page would then get
Speaker 1: this code on their MySpace page, which would mean that
Speaker 1: everyone who visited someone else who had this code wouldn't
Speaker 1: follow Sammy, and not only would they follow him, but
Speaker 1: they would comment on their MySpace page Sabby is my Hero.
Speaker 2: Basically, Sammy embedded code on his page that spread to
Speaker 2: any page that looked at his and any page that
Speaker 2: looked at that page would also get infected with the
Speaker 2: code as well. Maybe you're starting to see where this
Speaker 2: is going, But the important part here is that on
Speaker 2: each page that had been infected, it would go after
Speaker 2: the person's bio and insert the text at the bottom.
Speaker 2: But most of all, Sammy is my hero.
Speaker 1: And so people would visit someone else's page, suddenly follow Sammy,
Speaker 1: and then have it say Sammy's my hero on their page,
Speaker 1: and they're like, wait, who's this guy Sammy? And why
Speaker 1: does it say he's my hero.
Speaker 2: At first, it's not really a big deal. It's spreading
Speaker 2: to his friends and maybe friends of friends. So Sammy
Speaker 2: goes to bed that night thinking that he's just played
Speaker 2: a silly prank on his friends on the internet.
Speaker 1: But then the next morning, when he woke up, he
Speaker 1: had ten thousand followers on MySpace, and that really blew
Speaker 1: his mind. He knew something had gone terribly wrong to
Speaker 1: get ten thousand followers.
Speaker 2: So remember this is two thousand and five, and back then,
Speaker 2: ten thousand friends was a really monumental number. I'm not
Speaker 2: even sure he knew that there were ten thousand people
Speaker 2: on MySpace.
Speaker 4: At that point, I just freak out. I have no
Speaker 4: idea what to do. I'm sitting in my apartment and
Speaker 4: I'm kind of baffled. So I realized, like, oops, I
Speaker 4: just wrote a virus and what should I do.
Speaker 2: That's the voice of Sammy on Jack's podcast, The Darknet Diaries.
Speaker 2: And because the spread was exponential, the numbers just kept
Speaker 2: going up. Another hour later, it was at fifty thousand.
Speaker 4: When fifty one hundred thousand, I couldn't think about anything.
Speaker 4: It was just refreshing. Went home, five hundred thousand, six
Speaker 4: hundred thousand. It hits a million. I just take a
Speaker 4: screenshot because I'm just like that. That's a lot of people.
Speaker 4: I had the idea that many people were even on
Speaker 4: my spence.
Speaker 2: Sammy now realizes that he's created a virus. Actually, it's worse.
Speaker 2: He's created a worm, a piece of code that is
Speaker 2: self replicating, and this worm is spreading through all of
Speaker 2: my space. But what happens next even Sammy couldn't predict.
Speaker 2: That's after break. Sammy's a little bit of code has started
Speaker 2: as a joke. He figured that maybe in a couple
Speaker 2: of weeks or so it reached a couple hundred people max.
Speaker 2: But in less than twenty hours, Sammy knkard had a
Speaker 2: million friends. This had gotten completely out of his control.
Speaker 1: He knows something has gone terribly awry. He thought maybe
Speaker 1: he'd get a few hundred followers or something out of
Speaker 1: this and then be able to turn it off. But
Speaker 1: at this point, it feels like the momentum is going
Speaker 1: so fast that he's having a hard time controlling it.
Speaker 1: And even if you go to Sammy's page and you
Speaker 1: unfollow him, what happens is it says, okay, you're no
Speaker 1: longer following them, and then it goes back to your page,
Speaker 1: and your page has the code to follow him, so
Speaker 1: people can't even unfollow him, and if they wanted to,
Speaker 1: they're like, why why am I permanently following you? This
Speaker 1: is ridiculous.
Speaker 2: So are people messaging Sammy at this point?
Speaker 1: Yeah, they're confused, like who are you? How do I
Speaker 1: unfollow you? And he's not sure because he can't pull
Speaker 1: this back. He can't go to everyone else's MySpace page
Speaker 1: and remove their code, so he's like, oh man, I
Speaker 1: don't know how to turn this off. It almost seems
Speaker 1: like everyone on my space is going to eventually follow
Speaker 1: him because there's no other logical end to this.
Speaker 2: This was all an accident. Sammy had no idea that
Speaker 2: what he'd created would spread this far, so he removes
Speaker 2: the code from his page, but that doesn't help because
Speaker 2: it's already spreading too fast. So he wants to help
Speaker 2: stop it, and he gets an idea he could go
Speaker 2: straight to my space like irol.
Speaker 1: He actually lived in the same town as them, both
Speaker 1: in Los Angeles, and he's like, should I just go
Speaker 1: over there and tell him I did this and to
Speaker 1: give him some suggestions on what to do.
Speaker 2: So at first, and I wish I was making this up.
Speaker 2: He thinks, Okay, maybe I could just like buy some
Speaker 2: coffee and donuts and show up at MySpace office and
Speaker 2: help them fix it, like give them the donuts, give
Speaker 2: the coffee, sit down, crack on knuckles, write some code,
Speaker 2: patch things up, all good. But then he thinks about
Speaker 2: it and he realizes, Okay, maybe that's not the best idea.
Speaker 2: Maybe I should just send them an anonymous message. So
Speaker 2: he emails them and says, here's some tips on how
Speaker 2: to handle this. It was vague but specific at the
Speaker 2: same time, like you didn't want to say who he was.
Speaker 2: But he was like, you might want to go in
Speaker 2: here and disable this or do this. Here's some SQL
Speaker 2: queries to look for these strings and you'll find the
Speaker 2: code and you can delete it off everyone's page. He
Speaker 2: wanted to be.
Speaker 1: Helpful, he did not because he realized, oh no, I've
Speaker 1: caused a big problem here. Fox had actually bought my
Speaker 1: Space just before this. He's thinking about this, like, Fox
Speaker 1: might be really mad. What do I do if they're
Speaker 1: coming after me? This is a big problem. He's trying
Speaker 1: to help what he can, but he also doesn't want
Speaker 1: to get himself in trouble. But it's really hard because
Speaker 1: everything is pointing to his page and it's got his
Speaker 1: name on it and everything.
Speaker 2: He's got his literal name on it.
Speaker 1: Yeah, so he's just refreshing it and looking at the
Speaker 1: numbers going up and up, and he's like, oh my gosh,
Speaker 1: what do I do? And then eventually one of the
Speaker 1: refreshes his page just says this page doesn't exist.
Speaker 2: It's gone.
Speaker 1: His page was deleted or at least disabled for a while,
Speaker 1: and he's like, okay, that's fine. So then he looks at,
Speaker 1: you know, some of his friend's pages and they're all deleted,
Speaker 1: they're all disabled. And he's looking at everybody who's trying
Speaker 1: to follow him and they're all disabled, and they're all deleted.
Speaker 1: And then he refreshes the page again and it says, sorry,
Speaker 1: my space is down. We are taking it all offline.
Speaker 1: We're doing some maintenance. We'll be back shortly.
Speaker 2: Sammy's a little bit of code ended up bringing MySpace
Speaker 2: to its knees. It shut the whole site down. So
Speaker 2: I kind of remember this happening. This was back when
Speaker 2: I was in college and there was this Bobo shop
Speaker 2: next to campus, and I think they had these three
Speaker 2: Windows computers installed on the wall so that you could
Speaker 2: use your computer while you waited for your order, and
Speaker 2: people who were a MySpace would go there and log
Speaker 2: in and check their messages. And yes, logging into your
Speaker 2: social media on an unsecured public machine is absolutely terrible
Speaker 2: security practice, but I don't know, people just didn't know
Speaker 2: any better, I guess. So Yeah, Anyway, one day, I
Speaker 2: think people were probably at home and their MySpace wasn't
Speaker 2: working on their home computer, so they came to the
Speaker 2: cafe to log in, and it didn't work there either,
Speaker 2: but they'd already bought their boba, so people just had
Speaker 2: to wait there awkwardly like normal human beings for the
Speaker 2: drink order. Kind of inconvenient, but for Sammy that day
Speaker 2: wasn't just inconvenient. Dude was sweating bullets. So after a while,
Speaker 2: MySpace fixes the problem and it comes back all nine.
Speaker 2: It's slow for a few days, but eventually it's back
Speaker 2: to normal and that's it. It's back, And for a while,
Speaker 2: Sammy thought that, Okay, maybe this is just a blip
Speaker 2: and everyone would just move on and forget it all happened.
Speaker 1: The days after that, nothing happened, and the weeks after that,
Speaker 1: nothing happened. She's like, Okay, I think I'll stay away
Speaker 1: from his space for a while. I'll just lay low
Speaker 1: because whatever happened there, I don't want to make it worse.
Speaker 1: So let's just hope this is in the past. So
Speaker 1: he went back to doing his work, and at that
Speaker 1: point he had started a business.
Speaker 2: During that time period, Sammy had co founded a company
Speaker 2: called Finality that used the Internet to make phone calls
Speaker 2: instead of relying on traditional phone lines, and at the time,
Speaker 2: this was pretty cool technology. So we just focused on that.
Speaker 2: That message he'd sent to MySpace never got answered, and
Speaker 2: my Space itself didn't really seem to be looking for him.
Speaker 2: Maybe they had just let it go. So Sammy got
Speaker 2: back to work.
Speaker 1: At some point, You're just like, Okay, everybody's just gone
Speaker 1: their way. They fixed it, and that's just it. You know,
Speaker 1: you fix incidents all the time at work, and I
Speaker 1: think he thought that everything was going to be fine.
Speaker 1: So it was a big surprise to him to find
Speaker 1: the Secret Service we're after him. The business was doing
Speaker 1: really well, so he actually bought himself a Porsche and
Speaker 1: was driving that thing around town and so he was
Speaker 1: having a good time. And one day he went out
Speaker 1: out to the parking lot to kit in his car
Speaker 1: and there was some guys standing around his car and
Speaker 1: he's like, oh, man, are these guys gonna rob me?
Speaker 1: Or what's going on? And one of them shouted, hey,
Speaker 1: are you Sammy. He's like, oh gosh, usually people who
Speaker 1: robbed me and they don't know your name. So let's
Speaker 1: see what's going on here, and it was the Secret Service.
Speaker 1: They took him to his house and they confiscated all
Speaker 1: his computers and I said, you're being investigated for taking
Speaker 1: down my Space.
Speaker 2: It had been six months since that worom took down MySpace,
Speaker 2: and now out of the blue, here's the Electronic Crimes
Speaker 2: Task Force of the LAPD and the Secret Service coming
Speaker 2: around asking questions. They had him under surveillance for months,
Speaker 2: and they had a search warrant for his house and
Speaker 2: his office. They took his laptop, they took his hard drives,
Speaker 2: even took his iPod. The DA ended up hitting Sammy
Speaker 2: with a felony hacking charge, and prosecutors wanted him to
Speaker 2: spend some time in prison and not be able to
Speaker 2: touch computers for the rest of his life. Sammy freaked
Speaker 2: out and he ended up taking a plea deal exchange
Speaker 2: for not having to go to prison. He paid a
Speaker 2: twenty thousand dollars fine, he had to complete seven hundred
Speaker 2: and twenty hours of community service and three years of probation. Oh,
Speaker 2: and he couldn't use computers. Well, he could use one computer,
Speaker 2: but that computer had to be registered with authorities and
Speaker 2: it couldn't access the Internet. Now keep in mind here,
Speaker 2: Sammy's whole life and work had revolved around technology to
Speaker 2: this point, so not being able to use an Internet
Speaker 2: enabled computer was kind of like telling them, Okay, yeah,
Speaker 2: here kid, have a typewriter, go do your job. At
Speaker 2: this point in his life, the Internet was his livelihood
Speaker 2: and it's how he was able to support his mom.
Speaker 1: He was paying her rent and helping her out and
Speaker 1: all that. And so his startup that he had started,
Speaker 1: he had a very difficult time doing any work there
Speaker 1: because that was all computer based work that he was doing.
Speaker 1: So I don't know if he was making a salary
Speaker 1: during that time to help her anymore anything, And it was.
Speaker 2: Tough for Sammy. It meant that he could do a
Speaker 2: lot of the stuff that he used to, but he
Speaker 2: tried to look at the bright side. Sammy told Vice
Speaker 2: his motherboard how it forced him to go outside and
Speaker 2: touch grass.
Speaker 4: I kind of started a new chapter of life because
Speaker 4: I spent my entire life just in front of the computer,
Speaker 4: and finally this like got me out. I just spent
Speaker 4: a lot of time doing other things that I think
Speaker 4: normal people did.
Speaker 2: But barring access to computers was like barring Sammy from
Speaker 2: accessing a part of himself. This was someone who really
Speaker 2: loved computers and who says that he didn't mean to
Speaker 2: write a worm in the first place.
Speaker 1: Some of these hackers who have been in trouble have
Speaker 1: had that sentence brought to them where they're banned from
Speaker 1: computers for life. It's always frustrating to me because there's
Speaker 1: obviously these people are very talented and skilled and trying
Speaker 1: to take their way of making money away their livelihood.
Speaker 1: I mean even a cash register as a computer at
Speaker 1: this point. It's so sad to see them take that
Speaker 1: away when that's the thing that their best at in
Speaker 1: life and the most passionate thing. I think what's better
Speaker 1: is to try to figure out how to use their
Speaker 1: skills for good and to determine is this person, you know, rehabbable.
Speaker 1: Are they just trying to burn the world down and
Speaker 1: no matter how well we try to turn them in
Speaker 1: the right way, they're just going to destroy everything. Or
Speaker 1: is this somebody who we can use their skills for
Speaker 1: some net benefit on society or you know, it wasn't
Speaker 1: like he was trying to do anything malicious. I think
Speaker 1: at Samy's core, he's not a malicious person. He's just
Speaker 1: someone who's curious and interested in technology, and he's not
Speaker 1: trying to harm anybody or hurt anything. I've since met
Speaker 1: him and hung out with him quite a few times,
Speaker 1: and he is just such a sweetheart. He loves learning stuff,
Speaker 1: and he's just so deep down in the technology of
Speaker 1: it that he's extremely brilliant, like one of the more
Speaker 1: brilliant folks I know when it comes to not so
Speaker 1: much seeing what the technology does, but seeing what it
Speaker 1: could potentially do. He's just really fascinated with the way
Speaker 1: technology works and likes exploring it.
Speaker 2: Let's say it's two thousand and five. You're at MySpace.
Speaker 2: You're tom right. Yeah, you find out that somebody has
Speaker 2: done something to your website, taken it down for a day,
Speaker 2: You figure out who this kid is, what's the appropriate
Speaker 2: punishment here? What do you do? Press chargers?
Speaker 1: I wouldn't. I would feel like our code wasn't up
Speaker 1: to snuff. We had not you know, fortified it enough,
Speaker 1: and somebody found a vulnerability. So this was a surprise
Speaker 1: vulnerability assessment. That's that their ownership's on us, right, and
Speaker 1: we can't just assume everyone is just like a criminal
Speaker 1: if they've done something wrong on our website and try
Speaker 1: to take them down. But yeah, I think if I was, yeah,
Speaker 1: my Space exec, I'd try to take ownership of this
Speaker 1: and say, you know what, this was something we should
Speaker 1: have done better, and it's okay, we've solved it. We
Speaker 1: were only down for a day. That's not too bad.
Speaker 1: It's not like there was a lot of damage done.
Speaker 1: Somebody posted this little bit of JavaScript on their page
Speaker 1: and that accidentally spread everywhere. I don't think that's criminal behavior.
Speaker 1: I think that's just a problem that we we should
Speaker 1: have addressed.
Speaker 2: Sammy eventually managed to get back online, and we'll talk
Speaker 2: about that in just a minute, but first we need
Speaker 2: to talk about how the sami worm changed how the
Speaker 2: modern Internet looks. We'll get into that after the break.
Speaker 2: What do you think the industry learned after the sami worm?
Speaker 2: Have they learned anything?
Speaker 1: Yeah, definitely. So, as I was talking about, at that time,
Speaker 1: we were moving into the web two point zero stage, which
Speaker 1: is now users can add data to a website. They
Speaker 1: can put their pictures up there, they could put texts,
Speaker 1: they could put other things, and in this case, they
Speaker 1: can put JavaScript up there. And the internet has learned.
Speaker 1: The Internet providers or the web page runners, people, edmins,
Speaker 1: devs and stuff have learned don't trust anything that a
Speaker 1: user does, sanitizer inputs, check it for what's valid and
Speaker 1: not valid, and don't allow for anything to be uploaded
Speaker 1: that isn't on this strict allow list, because when you
Speaker 1: start letting people put up whatever they want, now you've
Speaker 1: run into huge problems like this Sammy werm And So
Speaker 1: I think this was a lesson that probably a lot
Speaker 1: of social media companies learn that. Don't allow people to
Speaker 1: put JavaScript up.
Speaker 2: That's a no no.
Speaker 1: And I don't think you could find a single social
Speaker 1: media site that allows the user to add JavaScript into
Speaker 1: the page, because that would you could add a cryptomindor
Speaker 1: to anybody who visited your website. Right, Like, there's lots
Speaker 1: of things that could go wrong by letting the user
Speaker 1: put JavaScript on their profile. You've got to really limit
Speaker 1: what users can do when they're adding content to your website.
Speaker 2: For example, Facebook, which eventually overtook MySpace as the biggest
Speaker 2: social media platform, it didn't allow you to customize anything.
Speaker 2: And that's pretty much how all our social media is now,
Speaker 2: and casual users don't know hdmil anymore like we used to,
Speaker 2: like back in the MySpace era, even somebody who wasn't
Speaker 2: really into computers could kind of navigate their way around
Speaker 2: little snippets of code because we were motivated to because look,
Speaker 2: if you want to put that sparkly Snoop Dogg animated
Speaker 2: gift on your profile, that is some pretty powerful motivation
Speaker 2: to start looking at some code. Is that the correct
Speaker 2: decision is to make things more sanitized, more flat?
Speaker 1: Maybe yeah, maybe that's the situation is that Facebook was like,
Speaker 1: look what you guys did over there, We're not going
Speaker 1: to let our users get crazy like that. And maybe
Speaker 1: that was the appropriate response just from a security level,
Speaker 1: because yeah, when users start adding their own stuff, they
Speaker 1: can take over the whole website and you've got to
Speaker 1: be very careful about what they can do there.
Speaker 2: Okay, Now, granted Facebook did start out pretty uncustomizable to
Speaker 2: begin with, but maybe the Sammy worn't for them was
Speaker 2: kind of an I told you so moment and they
Speaker 2: weren't wrong. I mean, if you look at the Internet today,
Speaker 2: you can see the impact. Everything kind of looks the same.
Speaker 2: There's this clean aesthetic, and customization is minimal to nonexistent.
Speaker 2: I mean, Twitter no customization, substack, basically none. I mean
Speaker 2: even website builders like Squarespace, they're basically just modular blocks
Speaker 2: that you can move bit to the page around. You
Speaker 2: almost never really get to mess with the code. And
Speaker 2: I'm not saying that this is because of the Sami worm,
Speaker 2: but the do it yourself customization that was part of
Speaker 2: what made MySpace fun is mostly gone or at least
Speaker 2: hidden from the Internet today. And you can understand why.
Speaker 2: If you open up your platform to let people tweak
Speaker 2: the code, you also open it up to vulnerabilities. But
Speaker 2: on top of that, the Sami worm also revealed that
Speaker 2: even reputable websites that we trust. I mean, remember again,
Speaker 2: MySpace was the social media platform back then. They might
Speaker 2: not be as secure as we would expect them to be.
Speaker 1: I think just us as a society assumes that people
Speaker 1: have taken care of the security of their app and
Speaker 1: site and all that stuff. And it's like, well, obviously
Speaker 1: one hundred thousand people wouldn't have downloaded this if it's
Speaker 1: not secure, so I'll trust it as well. And so
Speaker 1: you have this kind of social proof. But also you
Speaker 1: just have this expectation that the website you're dealing with
Speaker 1: it uses the highest security and the best privacy and
Speaker 1: all that sort of stuff, and you don't question it.
Speaker 1: You just assume it. And I think that's our problem.
Speaker 1: I've kind of switched it in my mind after covering
Speaker 1: stories like this myself. I assume that they're not using
Speaker 1: the best security of privacy, and therefore I'm definitely not
Speaker 1: going to share my data with them. I don't give
Speaker 1: my real name, or I use a burner email and
Speaker 1: a burner phone and the fake address and even a
Speaker 1: burner credit card when interacting with most sites today.
Speaker 2: So Jack takes his digital security to another level. And
Speaker 2: again it makes sense from all those hackers he's talked
Speaker 2: to on Dark Knight diaries because he knows how vulnerable
Speaker 2: your information can be if you just put it out there.
Speaker 2: But not all hackers are out there to steal your information.
Speaker 2: Sammy's an example of someone who's curiosity led him to
Speaker 2: look for those vulnerabilities and then to warn people about them.
Speaker 2: In two thousand and eight, after three years of being
Speaker 2: banned from the Internet, Samy was finally allowed to be
Speaker 2: back online. So he left the courthouse that day, drove
Speaker 2: straight to the Apple store, bought a PowerBook, and started
Speaker 2: messing around. And one of the first things he did
Speaker 2: was he started looking into credit cards.
Speaker 1: There's a NFC readers in some of these cards, you
Speaker 1: know how you tap to pay, Those are using NFC technology.
Speaker 1: And he was saying to himself, well, wait a minute,
Speaker 1: what's the communication that happens between these sort of things,
Speaker 1: And is there a way that I can steal someone's
Speaker 1: credit card if I tap up against them? And so
Speaker 1: that was one of his research projects that he did,
Speaker 1: was to figure out how to clone NFC cards. And again,
Speaker 1: he wasn't trying to steal credit cards in order to
Speaker 1: sell them on the dark web or any of that
Speaker 1: sort of thing. He was simply trying to understand this
Speaker 1: technology so that he could share it with the world
Speaker 1: make it a better security system, because I don't want
Speaker 1: somebody bumping up to me in the line at the
Speaker 1: store and stealing my card and then being able to
Speaker 1: use it. So if he could tell the credit card makers, hey,
Speaker 1: here's some problems with your card, maybe you should make
Speaker 1: your card more secure, then I think that does help
Speaker 1: make our cards more secure.
Speaker 2: You've spoken to a pretty wide range of people, some
Speaker 2: of whom have done some pretty you know, nefarious stuff.
Speaker 2: Where does Sammy rank on that for you?
Speaker 1: Sammy's a good guy. He's not out there to try
Speaker 1: to make a bunch of money or steal things or
Speaker 1: destroy the world. He's really just curious at his core,
Speaker 1: and he loves finding things that the computer can do
Speaker 1: that he might think to himself, well, if I can
Speaker 1: do this, then it's probably the case that a lot
Speaker 1: of other people can do this. So it's not like
Speaker 1: I'm inventing something new or breaking something. I'm just showing
Speaker 1: you how this technology works that somebody could use it
Speaker 1: in this way. It's not like he's trying to give
Speaker 1: the world a weapon and say here go mess up
Speaker 1: the world. He's trying to show the world, Hey, the
Speaker 1: other people might be able to do this, and now
Speaker 1: you can too, so let's even the playing field or
Speaker 1: the people who make this technology should fix this.
Speaker 2: This was a pretty wild outcome for someone who again
Speaker 2: only a few years before that. It started out just
Speaker 2: screwing around with Counterstrike. And there's probably some kids out
Speaker 2: there who are also exploring video games just like Sammy,
Speaker 2: but nowadays there are some more established roots to do
Speaker 2: some pretty nefarious stuff.
Speaker 1: I've seen this character arc and a lot of hackers though,
Speaker 1: is that they play video games and they get bored
Speaker 1: with it, then they try to hack it, and then
Speaker 1: they do, and then they're like, well, but that was
Speaker 1: just for fun. And then they learn more about hacking
Speaker 1: and other circles and stuff, and they learn, oh wow,
Speaker 1: that people are actually making money with this interesting and
Speaker 1: so then that transfers into okay, here's how to earn
Speaker 1: roebucks website and just try to get little kids to
Speaker 1: come to our website to earn roebucks free roebucks, but
Speaker 1: then we never give it to them. You now scamming
Speaker 1: the kids that are before you, which you're now familiar
Speaker 1: with the roebucks because you just played the game for
Speaker 1: the last ten years or something, and you're like, I
Speaker 1: know everything about this game, so obviously I know how
Speaker 1: to exploit it or exploit the user base or something
Speaker 1: like that. And then you start finding users that want
Speaker 1: to join you and they're like, hey, how do I
Speaker 1: make money like you? And then starts scamming them even more,
Speaker 1: and so you end up in that circle, and then
Speaker 1: that just keeps going to something bigger, like cryptocurrency or
Speaker 1: something else where you're just like, oh, well, why am
Speaker 1: I looking at small potatoes. I could be stealing millions
Speaker 1: instead of just a few robots here and there, and
Speaker 1: that just turns you into the super criminal at that
Speaker 1: point or something. And there is this path that I
Speaker 1: see again and again where it starts with video games
Speaker 1: and you get into these circles of people hacking and
Speaker 1: scamming the game, and then it just keeps going from there.
Speaker 2: And Sammy just got some extra friends. Yeah, that's what
Speaker 2: he did. Given the punishment that Sammy had to go through,
Speaker 2: it's kind of amazing that he still bounced back and
Speaker 2: he's now continuing to work to help people by publicly
Speaker 2: disclosing company security and privacy flaws and kind of holding
Speaker 2: their feet to the fire to actually fix them.
Speaker 1: History has kind of proven that the hackers are on
Speaker 1: the right side. Before we even had hackers, we had
Speaker 1: people who were testing the safety of cars and saying, hey,
Speaker 1: we should be wearing seat belts, and the car makers
Speaker 1: are like, nah, and it's fine, you don't need that.
Speaker 1: And they're like, look, here's what's happening when people crash
Speaker 1: without seat belts. You should have them wear seat belts.
Speaker 1: They were thinking, these people were wrong to make such
Speaker 1: a stink out of this right, stop making it look
Speaker 1: like our cars aren't safe.
Speaker 2: Our cars are safe.
Speaker 1: And eventually those people want they said, yeah, seat belts
Speaker 1: are incredibly safe. So that became the new thing of like, okay,
Speaker 1: let's embrace these people who are crash testing our cars
Speaker 1: and making sure that they are more of the solution
Speaker 1: instead of more of the problem. And I think that's
Speaker 1: the side we should look at here, which is do
Speaker 1: we have a vulnerability in this technology or this website,
Speaker 1: And if so, that's on us to fix that and
Speaker 1: thank you for showing me that vulnerability. That will make
Speaker 1: our whole system safer. But it's kind of frustrating because
Speaker 1: if somebody comes to you and says, hey, your zippers down,
Speaker 1: you have this instant feeling of shame and embarrassment and
Speaker 1: the sort of thing. And so I think a lot
Speaker 1: of people do feel that. When they get told their
Speaker 1: website has a vulnerability, you get this emotional reaction. We
Speaker 1: don't need that emotional reaction. Your slippers down, but thank
Speaker 1: you for telling me. I appreciate him. Gonna get it
Speaker 1: back up. It's hard to handle criticism sometimes.
Speaker 2: And Okay, maybe he did technically force over a million
Speaker 2: people to say it, But twenty years later, it turns
Speaker 2: out Sammy's little bit of code held some truth for hackers.
Speaker 2: Sammy really is a hero.
Speaker 1: Sammy is my hero. Is what you would hear people
Speaker 1: shouting when you go to death Count. I mean, he's legendary.
Speaker 1: You hear about him everywhere you go.
Speaker 2: Your big shout out to Jack Resider for talking with us,
Speaker 2: and I'd definitely encourage you to check out his full
Speaker 2: interview with Sammy Camcarr on the podcast The Dark Knight Diaries,
Speaker 2: where they get into some other details that we couldn't
Speaker 2: touch on here, like Sammy's work on drones, his podcast
Speaker 2: in general, is a really good look at the hacking
Speaker 2: culture that we were talking about today. So if any
Speaker 2: of this interested you, definitely check it out and we'll
Speaker 2: leave a link in the show notes to check that out.
Speaker 2: But that being said, back to our show. Thank you
Speaker 2: so much for listening to another episode of kill Switch.
Speaker 2: If you want to talk to us, you can email
Speaker 2: us at kill Switch at Kalaidoscope dot NYC, or on
Speaker 2: Instagram or at kill switch pod. And while you're still
Speaker 2: listening to this, you could think about leaving us a review.
Speaker 2: It helps other people find the show, which helps us
Speaker 2: keep doing our thing, and it lets us know what
Speaker 2: people want to hear more of. And once you've done that,
Speaker 2: did you know it? Kill Switch is also on YouTube
Speaker 2: and the link for that and everything else is in
Speaker 2: the show notes. Kill Switch is hosted by Me Dexter Thomas.
Speaker 2: It's produced by sen Ozaki, Dar Luck Potts, and Julian Nutter.
Speaker 2: Our theme song is by me and Kyle Murdoch, and
Speaker 2: Kyle also mixed the show from Kalidoscope. Our executive producers
Speaker 2: are Oswa lashin On, Geshat Togador and Kate Osborne from iHeart.
Speaker 2: Our executive producers are Katrina norbl And nikki E Tour.
Speaker 2: That's it from us. We'll catch ya next week. M