Forgot your password?
typodupeerror
Security Government The Courts News

MySpace Worm Creator Sentenced 387

Posted by CmdrTaco
from the wear-the-hat-and-sit-in-the-corner dept.
Aidan Steele writes "Remember Samy? The creator of the infamous worm was unfortunate enough to be the the target in MySpace's latest litigation. As was said in the earlier story, the script was "written for fun" and caused no damage. The source and technical explanation for the "attack" was not even released until after MySpace had patched the vulnerability. Apparently this was enough to get the 20 year old (19 at the time of writing the worm) three years of probation, three months of community service, pay restitution to MySpace and is also banned from the Internet. Clearly, disclosing security vulnerabilities doesn't pay."
This discussion has been archived. No new comments can be posted.

MySpace Worm Creator Sentenced

Comments Filter:
  • Idea (Score:4, Insightful)

    by mfh (56) on Sunday February 04, 2007 @11:29AM (#17881120) Journal
    Stop writing malicious scripts.
    • Re: (Score:3, Funny)

      by LiquidCoooled (634315)
      but Samy is my hero!
    • Re:Idea (Score:5, Insightful)

      by tomhudson (43916) <barbara.hudson@ ... a - h u dson.com> on Sunday February 04, 2007 @11:48AM (#17881236) Journal

      "Stop writing malicious scripts."

      1. Crack sites, get caught and punished
      2. Get job as internet security consultant
      3. PROFIT!

      The whole "It takes a thief to catch a thief" thing. Hey, it worked for Kevin Mitnick ... [kevinmitnick.com]

    • by Anonymous Coward on Sunday February 04, 2007 @01:18PM (#17881774)
      Stop writing scripts. Someone could deem them "malicious" and you're history. Just don't write any. To be on the safe side, do not engage in witchcraft practicing like IT, OSes etc. Leave dangerous experiments to professionals. It already takes a lot of time for them to manage their trade on bigger projects, so it's not for you anyway, you miserable kiddie.

      Which brings us to an analogous point, stop playing scientist, too. The government has extensive facilities to determinate current trends in climate behaviour change. Alarmist declarations which negatively impact sales by some of our respected oil industries will be considered criminal activity, for them deprive such noble corporations from their hard earned profits.

      Unfortunately, people won't get this, therefore I'm forced to explain the joke: it's sarcasm.
    • Re:Idea (Score:5, Informative)

      by jamshid (140925) on Sunday February 04, 2007 @01:38PM (#17881902)
      It's insane that he is getting in this much trouble, myspace should instead be thanking him for making their site more secure.

      His explanation of how he overcame a series of lame myspace.com attempts at security (http://fast.info/myspace/) should be mandatory reading for anyone writing a web application.
      • Re: (Score:3, Insightful)

        Yeah. And banks should thank Bonnie and Clyde for making their banks more secure.
      • Re:Idea (Score:4, Interesting)

        by daviddennis (10926) <david@amazing.com> on Sunday February 04, 2007 @02:47PM (#17882272) Homepage
        I can tell you that before I saw his account of the situation [namb.la], I wanted to let anyone do anything they wanted on my fledgling social networking site [amazing.com]. I agree, this account is required readng for anyone wanting to create a community site.

        What he did and how much time and effort he was willing to put into it shocked the heck out of me and caused me to put very strong anti-JavaScript code into my site. I didn't want to do it because I wish we could have given people the freedom to be creative in that arena. But after I saw what he did I felt I had no choice.

        That being said, the reality is that he did an enormous amount of damage. He says things were back to normal at myspace within a few hours, but I remember at the time that the system was highly unstable for a few weeks after the incident was supposedly cleaned up.

        From the point of view of the folks who ran myspace, what he did caused untold misery and pain for many people and i think he deserved a heavy punishment.

        Not that I really think he will avoid using the Internet for social purposes no matter what the courts say. And I really don't think probation or community service seems like that heavy a punishment for someone who deliberately disrupted a service, however disliked in some quarters, that many people rely on.

        Samy and people like him make it a difficult, miserable and thankless task to create services that hopefuly will do nice things for people. They make people like me waste our time trying to figure out how to restrict things, when we'd much rather produce fun features people will use and enjoy. Samy's account made me laugh, but it also made me furious that human nature is so pointlessly destructive.

        I hope the sentence deters people from doing similar things.

        I wonder how much he had to pay Myspace. Does anyone know?

        D
    • Re:Idea (Score:4, Insightful)

      by 0xdeadbeef (28836) on Sunday February 04, 2007 @01:39PM (#17881910) Homepage Journal
      Stop writing malicious scripts.

      Indeed. When you discover an exploit, you should sell it to the highest bidder. It keeps your hands clean, and it punishes the people who would otherwise punish you.
    • Re:Idea (Score:5, Insightful)

      by legirons (809082) on Sunday February 04, 2007 @02:03PM (#17882024)
      "Stop writing malicious scripts."

      Sony only got fined $175 maximum per incident [slashdot.org], and they didn't get banned from the internet
  • Restitution? (Score:3, Insightful)

    by jfenwick (961674) on Sunday February 04, 2007 @11:32AM (#17881138)
    I'm curious what exactly paying restitution entails in this case, as there was no actual damage. The only thing I can imagine is paying the wages of the people who went into to remove him as a friend from all the people who were affected by the hack, and maybe the wages of the people who were analyzing what was going on.
    • Re:Restitution? (Score:5, Interesting)

      by BasharTeg (71923) on Sunday February 04, 2007 @12:15PM (#17881384) Homepage
      Being part of a group of Samy's RL friends, we're not sure what his restitution is, but he is very likely not allowed to disclose it. We're just glad he's staying out of prison. Everything else is a secondary concern.
      • Re: (Score:3, Informative)

        by Zen (8377)
        On one hand I feel really sorry for the guy. He didn't exactly get the whole book thrown at him, but being that young and knowing that something bad is going to happen to you for months and not being able to do anything except wait and see what the Judge says has got to be pure torture. On the other hand, using a flaw in somebody else's code to do something that benefits you (however hilarious and non physically damaging it is) is just ludicrous. If he stopped to think about it for just one minute he wou
    • by SnowZero (92219)
      He has to tell one million people "I am not your hero."
    • Re:Restitution? (Score:5, Insightful)

      by eck011219 (851729) on Sunday February 04, 2007 @12:24PM (#17881422)
      You've answered your own question -- that's where the expense is.

      More to the point, things like this statement (from the original post) get under my skin:

      Clearly, disclosing security vulnerabilities doesn't pay.

      That's not what he did. If that were his true intent, he would have contacted MySpace about the vulnerability. Instead, he pasted his name all over the place (I thought he was nineteen -- that sounds more like the actions of a nine year old). To call this an altruistic attempt to help MySpace is akin to calling the guy who broke into Buckingham Palace in the 80's [wikipedia.org] a security consultant. He didn't really hurt anything and clearly disclosed some problems with palace security procedures, but that wasn't his reason for doing it.

      You can't commit a crime and then claim you were simply displaying a flaw in the system. "But your honor, I was simply showing my friend here how lax he was about avoiding punches to the face!"
      • Re: (Score:3, Interesting)

        by Zen (8377)
        I couldn't agree more. The 'slant' on this story is completely ludicrous. He never intended to disclose a security vulnerability. The completely ethical crackers that disclose their work send the information to the company who owns the product and tell them that if it is not patched in a reasonable amount of time that they will release the information. The quasi-ethical crackers that disclose their work send it to the mailing lists as a 0-day often with working exploit code as a proof of concept. This
      • Re: (Score:3, Informative)

        Why not? It worked for Robert Morris, who is now a computer science professor at MIT after writing the most destructive worm in UNIX history. Of course, Robert's father was head of the NSA, which helps you get a "stay out of jail free" card when you go to court. Look for details at http://en.wikipedia.org/wiki/Robert_Tappan_Morris [wikipedia.org].
      • by viking80 (697716)
        You have to be careful when talking about "Criminal traspass" on a computer. I think the better allegory here is that somebody leaves all their savings in a pile in the driveway, and then somebody takes some of it. Of course it would be better to suggest to them that it is not a good idea to leave money laying in the drivway, but you can not convict someone of theft and criminal trespass unless the owner shows a decent effort to lock up the valuables.

        I presume the law in this area is still immature, but i
        • Re: (Score:3, Interesting)

          by eck011219 (851729)
          IANAL, but I seem to recall this very thing coming up somehow in the past. I think it may have been people leaving lawn chairs in their shoveled-out parking spaces -- a common (though dumb and also illegal) practice here in Chicago in the winter to "reserve" that spot for when you get home from work. They left the chairs out, the chairs were taken, and whoever took the chairs was convicted of theft. Even though the chairs were clearly not secured in any way and were, in effect, abandoned in a public street.
      • One rule for Sony and one rule for Samy...

        Sony screwed up lots of computers too. But all they had to do was pay some fine that's just a small percent of Sony's profit.

  • by andres32a (448314) on Sunday February 04, 2007 @11:35AM (#17881156) Homepage
    I realize the sentence but... how can this be enforced? For how much time?
    • by Lazerf4rt (969888)

      It's not even as simple as being banned from the Internet. He's "banned from using the Internet for personal reasons for an unknown period of time". Basically, as long as nobody sees him on MySpace for a little while, he'll probably be fine.

      I'm sure the whole sentence was handed down just to send a public message: Don't fuck with MySpace. They have a heavily vested interest in being online every minute of the day, and don't want to be taken down for 5 minutes.

  • It won't pay until the blame is shifted to the real culprits: managers who hire the least competent possible technical people.


    Let's face it, a company selling a service should have a team who knows more than the customers do about the details of that service. If that were the norm, security vulnerabilities would be found before exploits came out.

    • WTF are you talking about? This guy wrote is worm. He didn't disclose any sort of vulnerability. Unless by disclose, you mean he exploited it. That is like saying a guy who writes a Windows virus that wipes out millions of hard drives world wide is not at fault, Microsoft it for leaving that vulnerability in there.

      Look, this is like tons of other cases, Gary McKinnon [wikipedia.org], Adrien Lamo [wikipedia.org] and others. If you are breaking a rule or the law, do not expect leniency, regardless if you meant good or ill. Claiming th
    • Ah yes, the old "throw a brick through a car window and blame it on the window manufacturer" argument. Samy didn't just identify an exploit, he actively exploited it, and even made it self replicating. That's a little bit more than "disclosing", don't you think? Considering that he effectively took down myspace, and probably cost them quite a bit in lost advertising revenue, I think he got off pretty easily.

      Personally I really like the idea of community service sentences as punishment for internet crimes
  • Banned from using the Internet? Is that like the opposite of house arrest?
  • Summary is wrong... (Score:5, Informative)

    by TubeSteak (669689) on Sunday February 04, 2007 @11:40AM (#17881188) Journal
    "The creator of the infamous worm was unfortunate enough to be the the target in MySpace's latest litigation."

    AFAIK, a civil court (which is where MySpace would have to sue Samy) doesn't ban people from the internets or sentance them to community service. And TFA says he pleaded guilty in LA Superior Court... you don't plead guilty in civil court.

    Here's a better article [techspot.com]

    Samy Kamkar (aka 'Samy is my Hero') plead guilty yesterday in Los Angeles Superior Court to a violation of Penal Code section 502(c)(8) as a felony and was placed on three years of formal probation, ordered to perform 90 days of community service, pay restitution to MySpace, and had computer restrictions placed on the manner and means he could use a computer - he can only use a computer and access the internet for work related reasons.

    Undoubtedly, the prosecutor had MySpace's cooperation, but MySpace certainly didn't "target him" in court.

    P.S. of the 3 articles on Google News [google.com] submitter picked the least informative one.
    • by TubeSteak (669689)
      hmm, i just read the MySpace press release in the techspot comments section

      "MySpace is committed to protecting our community from any abusive misuse of the site. We worked closely with the Los Angeles District Attorney's office in taking criminal action against Samy Kamkar (aka "Samy Is My Hero") for criminal activity related to launching a replicating worm attack on MySpace. We are pleased with the verdict and will continue to pursue criminal action against people who try to harm our members in any way."
      ..
    • Clearly, disclosing security vulnerabilities doesn't pay.

      Clearly. Especially when you disclose a vulnerability by bringing a popular service to it's knees through a self-propogating script and shut it down for extended periods of time while they try to repair the problem. And for that, he doesn't get any jail time, and has to spend some weekends picking up trash by the side of the road. The raging injustice.

      This does not do justice to those security researchers who actually disclose vulnerabilities and a
  • by Anonymous Coward on Sunday February 04, 2007 @11:45AM (#17881212)
    The kid wasn't malicious, it was a joke. If anyone should be punished it's myspace for having such a crap web application that allowed a worm to replicate so quickly.

    From what I've heard of the quality of MySpace code and given it's popularity, the site is the nets #2 liability behind Windows zombies.
  • Missing the point (Score:5, Insightful)

    by cunamara (937584) on Sunday February 04, 2007 @11:48AM (#17881234)

    Clearly, disclosing security vulnerabilities doesn't pay.

    The summary misses the point by a country mile, as do some of the comments in response. Disclosing security vulnerabilities is fine and appreciated. But doing so in the way that this clown did it is not. He used poor judgment and is paying the price for that.

    • Yes he had poor judgement in creating a worm that did no evil. He should have created one that did very bad things and then he would have been on his gaurd and not have gotten caught. His poor judgement was telling a bully his fly was open and not thinking the bully would blame him for it.
      • "His poor judgement was telling a bully his fly was open and not thinking the bully would blame him for it."

        Except that said analogy is more wrong than car analogies. But seeing as you created it...

        This was more along the lines of this guy taking a piss into said bully's open fly. Then the bully obviously realizes that there's piss in his underpants, and he sure didn't put it there, so he ponders what went on.. realizes his fly was open, then traces back past events until he realizes that it was a kid who
  • Summary biased? (Score:5, Interesting)

    by anakin876 (612770) <anakin876@@@hotmail...com> on Sunday February 04, 2007 @11:54AM (#17881276)
    Wow - what a horribly biased summary. Was it written as a deliberate troll? It reads like a deliberate troll! Disclosing a security problem does not usually entail creating a virus that uses it. I realize that his virus did not "hurt" anybody - other than, apparently, him - but he did not just disclose the security hole. It sure would be nice if Commander Taco would read this stuff before approving the submission.
    • Actually, disclosing a vulnerability does often entail creating executable code to exploit it: how else do you prove the vulnerability really exists? Actually releasing said code ... that's a different matter.
  • by Geek_3.3 (768699) on Sunday February 04, 2007 @11:55AM (#17881288)
    http://uncyclopedia.org/wiki/Banned_from_the_Inter net [uncyclopedia.org]

    he's not from detroit is he? :-P
  • We are pleased with the verdict and will continue to pursue criminal action against people who try to harm our members in any way.

    Protect your members from the horrors of a harmless prank by helping get one of your members three years of probation, three months of community service, pay restitution to MySpace, banned using the Internet for personal uses, and having a tarnished CV.

    I'd like to think that if someone managed to release a script onto /. that added everyone as their friend the admins would bru

  • The way things are in the U.S. today (and getting that way elsewhere as well), it looks to me like it's simply not worth revealing security holes to the corporations that have them. All they'll do is either sue you into oblivion or get you criminally prosecuted. They sure as hell won't thank you.

    So I think it's time to let these corporations have what they want. Let them have their blissfully naive fantasy that they're invulnerable. They don't want to hear anything to the contrary, so why tell them

  • He did not 'disclose a vulnerability'. He wrote a script that exploited it. It wasn't a script that was designed as a proof of concept that did nothing. It was a script added him to tons of people's friends list and put a phrase in their profile.

    Banning someone from the Internet is a stupid punishment. And perhaps the whole thing was a bit harsh. IMHO, this was a prank that deserved the equivalent of the punishment you get for disorderly conduct or vandalism, not for a really serious crime.

    But, this

  • He's been acting a little strange since he failed the screen test [flickr.com] for Brokeback Mountain... cLive ;-)
  • He did less damage then the Enron guys, yet he'll still probably end up facing worse punishment.
    • He did less damage then the Enron guys, yet he'll still probably end up facing worse punishment.

      He got probation, so no jail time. Jeff Skilling of Enron fame got 24 years in prison. Andrew Fastow got 10 years.
  • No Damage? (Score:3, Insightful)

    by thedbp (443047) on Sunday February 04, 2007 @12:44PM (#17881544)
    I guess you don't value other people's time. Time spent cleaning up their profile. Bandwidth wasted on this stupid little look-at-me script.

    Punishment more than suits the offense. If you don't want to be inconvenienced and have your time taken from you by the legal system, don't inconvenience other people and steal their time.

    Simple formula.
  • by logicnazi (169418) <logicnazi@NosPam.gmail.com> on Sunday February 04, 2007 @12:45PM (#17881550) Homepage
    The problem is that judges, juries and prosecutors aren't really comfortable and familiar with technology so they apply the law stupidly and literally. Kinda like the same way some earlier comment took 'no internet' to mean not using any device that happens to utilize the internet.

    I mean consider an appropriate physical analogy for what this kid did. It would be like if he walked into a bookstore that looked to be open but turned out that the staff had taken the day off and gone home but forgot to lock up but then instead of stealing anything rearranged all the books so they spelled out funny comments and left a little note on the cash register suggesting they lock the store next time. Now obviously it would be a bad idea to do this as it would be a bad idea to run this myspace worm, however, because the prosecutors, judges and juries would correctly see this as a mere youthful prank rather than a serious threat to public order and give him community service. This to a large part is how a good legal system operates, having strong punishments for behavior that can be used maliciously but showing mercy when used more innocently.

    In the computer case the offended company (and eventually the prosecutor) talks about how the offender used "sophisticated computer hacking techniques" and spouts off all sorts of words the average person doesn't understand. Thus in their mind far from a kid playing a trick on a company that left the door open the situation becomes a precocious teen who used sophisticated criminal techniques to break into a locked store and thinks it's all a game. What is the real world equivalent of rearranging the books can be made to seem the activities of some kind of online underground.

    Even the harm caused is easily distorted. While it might be clear to us that this kid was taking steps to avoid causing harm (not releasing info etc..) the prosecution just talks about how it was a DOS attack and the jury isn't going to know any better. In fact it is all to easy to spin horror stories about what the attack 'could have done' if it hadn't been dealt with by their computer people (the equivalent of saying what could have happened if the bookstore never resorted the books). Finally this lack of knowledge and the difficulty valuing IP makes it super easy (as in the mitnick case) to over estimate the seriousness of the harm. Even if it may have actually made more people visit myspace (I looked).

    Obviously it isn't a good idea to release a javascript worm like this but it surely doesn't deserve more than community service and a good scolding. If the people in the system understood the technology it would do just that.

    • I mean consider an appropriate physical analogy for what this kid did. It would be like if he walked into a bookstore that looked to be open but turned out that the staff had taken the day off and gone home but forgot to lock up but then instead of stealing anything rearranged all the books so they spelled out funny comments and left a little note on the cash register suggesting they lock the store next time.

      Breaking & Entering
      Criminal Trespass
      Burglary (even if nothing is stolen!)
      Vandalism

      Your little "j
    • Re: (Score:3, Interesting)

      by Garse Janacek (554329)

      Ah, the plague of "If we can make it into a bad analogy, then obviously it's okay."

      Other people have pointed out that the physical behavior you described actually would be illegal and could have noticeable consequences. But I want to pick on the analogy itself: this was not a case of "it looked like the store was open, the door was unlocked, so I went in and messed around with things." The store did not look open. He did not enter through the front door. It was very clear that he was exploiting something

  • Liability (Score:5, Insightful)

    by bryan1945 (301828) on Sunday February 04, 2007 @12:48PM (#17881566) Journal
    I'm taking a grad course in infosec, and our prof told us about a case where an engineering student found a vulnerability in his department's website. Wasn't even looking, just stumbled upon it. He reported it to his adviser, who told the department, and it got fixed. The next semester someone exploited the mathematics department's site, and the first person they questioned was the engineering student. Different department, different exploit, but they focused on him first since he reported a vulnerability. They eventually found the real person responsible.

    We ended up having a good 30 minutes of discussion about IT ethics. Obviously this case is different, but look at the case with the engineering student- what if they didn't find the person? Would they blame the engineering guy just to have someone to blame?

    Just makes me wary of ever telling someone that their front door is open- "How did you know! You trying to break in!"
  • Nah, seriously... I'm sure that the Coldfusion platform has similar abilities:

    1. Delete "Sammy's" profile from the database
    2. Search for all occurrences of the "malicious" code in the database and remove it
    3. Return to ruining the social world


    Just my $0.02 USD.
  • When the good and neutral are being punished for bringing attention to what needs attention... It's just not worth it to be honest and true.

    The ignorent may not listen but the dark market understands. The dark side is seductive.
  • The poster said that exposing the vulnerability didn't pay. Now, while I think banned from the Internet (yeah, however THAT works) is extreme, keep in mind he didn't just disclose the vulnerability - exploited it. Had he just exposed it - and was mindful to disclose it first to MySpace - I'd feel more sympathy toward the guy.
  • Clearly, disclosing security vulnerabilities doesn't pay.

    Ummm, nice slant on that summary. Exploiting security vulnerabilities before disclosing them is an entirely different matter. This kid isn't anybody's hero for explaining about the hole after it had already been fixed, what was that supposed to have served anyhow?
  • In all fairness, Samy is still allowed to use the internet for work reasons.

    He never used it in his spare time because he was always too busy being a sexy [enusbaum.com] man picking up women with his hot body [ytmnd.com].

    We love you Samy!

    - #L
  • If he had only knew about proxy servers :(...
    and didn't put his name everywhere
  • by Schraegstrichpunkt (931443) on Sunday February 04, 2007 @02:07PM (#17882042) Homepage

    and is also banned from the Internet.

    Actually, he probably can't get a job as a programmer anywhere. What good is a programmer who can't search Google?

    I'm very disappointed with courts' willingness to ban people from computers and/or the Internet. I think they fail to understand the full impact that has in this part of the 21st century.

  • by jjshoe (410772) on Sunday February 04, 2007 @02:21PM (#17882114) Homepage
    What you don't read is that Samy actually settled with Myspace, which is what they probably planned to do in the first place. They obviously wanted to make an example of him and they did. Samy was on every one's profile twice, once was his doing, and once was Tom's doing... [joel.io]


    Yes he could have fought this further in court but when my $fighting > $settlement there's only one move to take. Plus if he went to jail then who would I go to Chipotles with? :(

  • This is why... (Score:3, Insightful)

    by dacarr (562277) on Sunday February 04, 2007 @04:04PM (#17882832) Homepage Journal
    This is why, in the real world, if you're going to do "sneaker attacks", you make absolutely positively sure you have a contract. It gives them an understanding as to what can happen, and more importantly, it covers your ass if you find something that blows up the system.

    Besides, Myspace is evil anyway.

  • by oohshiny (998054) on Sunday February 04, 2007 @05:11PM (#17883254)
    It seems, however, that creating security vulnerabilities does pay. Why, companies like MySpace and Microsoft can always shift the blame on some teenager or "computer error" or a careless employee.

    Unlike physical security, making a computer system secure against teenage hackers is not rocket science. This vulnerability was clearly a MySpace screwup, and they should be held responsible and pay the price for it. That principle may not be so important when it comes to MySpace (because there is little of value there), but it becomes of paramount importance when it's your bank or your hospital.

    People who offer commercial services using software should be responsible for the safety and security properties of that software. And in order to prevent those companies from blame-shifting, the people breaking in should be held responsible only if they demonstrably attempted to commit a real-world crime other than simply breaking into the computer system.
  • I know Samy (Score:3, Insightful)

    by davidu (18) on Sunday February 04, 2007 @06:05PM (#17883506) Homepage Journal
    I know Samy personally and he is one of the smartest and most level-headed individuals I know. This is the case where a joke went a bit awry but it could have happened to any of us. He specifically made sure he wasn't malicious in what he did but the side effect over overwhelming MySpace's server was unintended.

    This is no different from the Morris worm. The sad fact is that he got prosecuted whereas the hundreds of botnet operators overseas and here in the US continue to wreak the real havoc on networks and infrastructure totally immune from prosecution.

    Samy got caught because he put his name on what he did. It's sad that that is the only basis for prosecution of computer crimes in this country. The good guys at the FBI and USSS don't have enough clue helping them to bring in the real criminals.

    -david

ASHes to ASHes, DOS to DOS.

Working...