MySpace Worm Creator Sentenced 387
Aidan Steele writes "Remember Samy? The creator of the infamous worm was unfortunate enough to be the the target in MySpace's latest litigation. As was said in the earlier story, the script was "written for fun" and caused no damage. The source and technical explanation for the "attack" was not even released until after MySpace had patched the vulnerability. Apparently this was enough to get the 20 year old (19 at the time of writing the worm) three years of probation, three months of community service, pay restitution to MySpace and is also banned from the Internet. Clearly, disclosing security vulnerabilities doesn't pay."
Idea (Score:4, Insightful)
Re: (Score:3, Funny)
Re:Idea (Score:5, Funny)
RonB
Re: (Score:3, Funny)
Re:Idea (Score:5, Insightful)
"Stop writing malicious scripts."
The whole "It takes a thief to catch a thief" thing. Hey, it worked for Kevin Mitnick ... [kevinmitnick.com]
Re: (Score:2)
Re:Idea (Score:5, Informative)
A much better (and safer) idea (Score:5, Funny)
Which brings us to an analogous point, stop playing scientist, too. The government has extensive facilities to determinate current trends in climate behaviour change. Alarmist declarations which negatively impact sales by some of our respected oil industries will be considered criminal activity, for them deprive such noble corporations from their hard earned profits.
Unfortunately, people won't get this, therefore I'm forced to explain the joke: it's sarcasm.
Re:Idea (Score:5, Informative)
His explanation of how he overcame a series of lame myspace.com attempts at security (http://fast.info/myspace/) should be mandatory reading for anyone writing a web application.
Re: (Score:3, Insightful)
Re:Idea (Score:4, Interesting)
What he did and how much time and effort he was willing to put into it shocked the heck out of me and caused me to put very strong anti-JavaScript code into my site. I didn't want to do it because I wish we could have given people the freedom to be creative in that arena. But after I saw what he did I felt I had no choice.
That being said, the reality is that he did an enormous amount of damage. He says things were back to normal at myspace within a few hours, but I remember at the time that the system was highly unstable for a few weeks after the incident was supposedly cleaned up.
From the point of view of the folks who ran myspace, what he did caused untold misery and pain for many people and i think he deserved a heavy punishment.
Not that I really think he will avoid using the Internet for social purposes no matter what the courts say. And I really don't think probation or community service seems like that heavy a punishment for someone who deliberately disrupted a service, however disliked in some quarters, that many people rely on.
Samy and people like him make it a difficult, miserable and thankless task to create services that hopefuly will do nice things for people. They make people like me waste our time trying to figure out how to restrict things, when we'd much rather produce fun features people will use and enjoy. Samy's account made me laugh, but it also made me furious that human nature is so pointlessly destructive.
I hope the sentence deters people from doing similar things.
I wonder how much he had to pay Myspace. Does anyone know?
D
Re: (Score:3, Interesting)
I grew up when the Incompatible Timesharing System was running at MIT and anyone could log on to it by just making up an account. There were no passwords or restrictions. Ordinary users could spy on other people's terminals, and all files were public. Anyone could delete anyone else's files.
But they didn't, because there was an atmosphere of mutual respect that is tragically gone from computing today.
In the late 1970s, about when I left that environment, the administratio
Oh flippin' please (Score:3, Insightful)
Oh flippin' please... There's a difference between disclosing a vulnerability properly and actually exploiting it to your own ends.
To give you a RL example, publishing a paper about the vulnerability of locks
Re:Idea (Score:4, Insightful)
Indeed. When you discover an exploit, you should sell it to the highest bidder. It keeps your hands clean, and it punishes the people who would otherwise punish you.
Re:Idea (Score:5, Insightful)
Sony only got fined $175 maximum per incident [slashdot.org], and they didn't get banned from the internet
Restitution? (Score:3, Insightful)
Re:Restitution? (Score:5, Interesting)
Re: (Score:3, Informative)
Re: (Score:3, Interesting)
The cost of the whole episode less the cost of patching the vulnerability seems more fair.
Re: (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
Re:Restitution? (Score:4, Funny)
Re:Restitution? (Score:5, Insightful)
More to the point, things like this statement (from the original post) get under my skin:
Clearly, disclosing security vulnerabilities doesn't pay.
That's not what he did. If that were his true intent, he would have contacted MySpace about the vulnerability. Instead, he pasted his name all over the place (I thought he was nineteen -- that sounds more like the actions of a nine year old). To call this an altruistic attempt to help MySpace is akin to calling the guy who broke into Buckingham Palace in the 80's [wikipedia.org] a security consultant. He didn't really hurt anything and clearly disclosed some problems with palace security procedures, but that wasn't his reason for doing it.
You can't commit a crime and then claim you were simply displaying a flaw in the system. "But your honor, I was simply showing my friend here how lax he was about avoiding punches to the face!"
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
Re: (Score:2)
I presume the law in this area is still immature, but i
Re: (Score:3, Interesting)
One rule for Sony and one rule for Samy (Score:3, Interesting)
Sony screwed up lots of computers too. But all they had to do was pay some fine that's just a small percent of Sony's profit.
How can anybody be banned from internet? (Score:4, Insightful)
Re: (Score:2)
It's not even as simple as being banned from the Internet. He's "banned from using the Internet for personal reasons for an unknown period of time". Basically, as long as nobody sees him on MySpace for a little while, he'll probably be fine.
I'm sure the whole sentence was handed down just to send a public message: Don't fuck with MySpace. They have a heavily vested interest in being online every minute of the day, and don't want to be taken down for 5 minutes.
Re:How can anybody be banned from internet? (Score:5, Funny)
Re: (Score:3, Funny)
Re:How can anybody be banned from internet? (Score:5, Informative)
He now has a probation officer.
If Samy violates the terms of his probation, he can go to jail.
This is how they enforce the internets banhammer.
If Samy leaves the country, much less leaves the state, he has violated the terms of his probation and probably goes to jail. If Samy downloads movies on his cellphone, for non-work related reasons, he has violated the terms of his probation and could go to jail.
Being banned from the internet is no different than being banned from driving, or from going into [place of business] or going near schools, or from possessing [item X], etc.
Judges have this type of power and use it frequently.
Banned from internet == banned from using phones (Score:3, Insightful)
A LOT of voice traffic is carried, at least in part, over the internet. The only way he can be banned from the internet is if he never, among other things, uses a phone (landline OR cellphone).
It also means being banned from certain fast food drive-through windows, where the person who says "can I take your order" is actually sitting in a center in another state.
It also means not using a bank ATM card.
Or digital cable TV.
Or the self-serve scanners at the local Wallyworld, since they're connected to
Re:Banned from internet == banned from using phone (Score:5, Funny)
Re:Banned from internet == banned from using phone (Score:5, Insightful)
Re: (Score:3, Insightful)
Re: (Score:2)
However what I think this means is the following for three years
must meet with his probation office once a week
may have to take a drug test on a regular basis (even if has never taken drugs)
gets his finger prints on record and the conviction.
aggrees not to use the internet for other than business purposes.
community service
The probation officer has the right to inspect the browser cache and files on any computer he has access to.
The bigest deal is that if he does
Re: (Score:2, Interesting)
Nice use of black and white. Clearly he can't use a library's website to check if a book is in stock, but if he went to the library and took out a book, and they asked him for his name, address, phone number, and the data is sent to their online server, is he using it then? If the librarian sudden got a bout of Carpal tunnel syndrome and asked him to type in the details would he be allowed to do that?
Does he simply have to ask someone else to enter thi
Re: (Score:2, Insightful)
Re: (Score:2)
In the same vein ... he uses computers, they use the internet.
Think the judge would buy it?
Re: (Score:2)
I suspect that what the judgement meant to say was that he was banned from using a web browser. A classic example of how sloppy use of terminology leads to problems.
John
Two things are obvious (Score:4, Funny)
2. He can't surf for pr0n.
One is cruel. Both are inhuman.
Re: (Score:2)
It's called violation of parole. You do not leave the country. You do not carry a web-enabled cell phone.
Re: (Score:2)
The right to freedom of speech doesn't include a "due process" weasel out clause, it's a right no matter what else you do.
In the 21st century, it's like banning someone from publishing a newspaper, which no court would ever consider being able to get away with.
Re: (Score:2)
While it's true that it will be difficult to enforce, how on earth is it "unconstitutional"? Where, exactly, in the constitution does it guarantee a "right to use the internet"?
No. Rights are regularly removed when you break the law. Life, liberty, and property can all be taken away for crimes, provided that the
Re: (Score:2)
"Being part of a group of Samy's RL friends, we're not sure what his restitution is, but he is very likely not allowed to disclose it. "
Are the details of his sentence being kept secret for personal reasons or is there some sort of "secret punishment" clause in the patriot act that extends to script kiddies? If justice is being served here, why would the details need to be secret?
"disclosing security vulnerabilities doesn't pay" (Score:2)
Let's face it, a company selling a service should have a team who knows more than the customers do about the details of that service. If that were the norm, security vulnerabilities would be found before exploits came out.
Re:"disclosing security vulnerabilities doesn't pa (Score:2)
Look, this is like tons of other cases, Gary McKinnon [wikipedia.org], Adrien Lamo [wikipedia.org] and others. If you are breaking a rule or the law, do not expect leniency, regardless if you meant good or ill. Claiming th
Re:"disclosing security vulnerabilities doesn't pa (Score:2)
Personally I really like the idea of community service sentences as punishment for internet crimes
Re: (Score:2)
No, it's not OK. But if you are in a position of responsibility you should get the smartest people you can to protect your customers.
What if your bank manager told you, "sorry, your money has been stolen, but, of course, we have nothing to do with that, don't blame me for the criminal's action".
In a perfect world, there would be no burglars. No thieves or murderers. But this world is not perfect, and you should learn to live wi
Re: (Score:2)
RonB
Re:disclosing arrogance doesn't pay (Score:5, Interesting)
http://www.xs4all.nl/uk/overxs4all/voorwaarden/in
4.4 Without prejudice to article 4.3, customers are permitted to hack the XS4ALL system.
The first customer who succeeds in attaining a position equivalent to that of the XS4ALL system administrator will be offered six months' free use of the system, provided that the said customer explains how he or she succeeded in hacking the system, has not damaged the system or other customers and has respected the privacy of other customers. Each customer hereby gives consent for other customers to attempt to hack the system under the aforementioned conditions.
Would more companies have a similar and well published policy guys like Samy might not have to go through all this legal grief.
And the companies would gain a lot of security.
Banned from using the Internet? (Score:5, Funny)
Summary is wrong... (Score:5, Informative)
AFAIK, a civil court (which is where MySpace would have to sue Samy) doesn't ban people from the internets or sentance them to community service. And TFA says he pleaded guilty in LA Superior Court... you don't plead guilty in civil court.
Here's a better article [techspot.com]
Samy Kamkar (aka 'Samy is my Hero') plead guilty yesterday in Los Angeles Superior Court to a violation of Penal Code section 502(c)(8) as a felony and was placed on three years of formal probation, ordered to perform 90 days of community service, pay restitution to MySpace, and had computer restrictions placed on the manner and means he could use a computer - he can only use a computer and access the internet for work related reasons.
Undoubtedly, the prosecutor had MySpace's cooperation, but MySpace certainly didn't "target him" in court.
P.S. of the 3 articles on Google News [google.com] submitter picked the least informative one.
Re: (Score:2)
"MySpace is committed to protecting our community from any abusive misuse of the site. We worked closely with the Los Angeles District Attorney's office in taking criminal action against Samy Kamkar (aka "Samy Is My Hero") for criminal activity related to launching a replicating worm attack on MySpace. We are pleased with the verdict and will continue to pursue criminal action against people who try to harm our members in any way."
..
Exactly. He's not exactly blameless. (Score:2)
Clearly. Especially when you disclose a vulnerability by bringing a popular service to it's knees through a self-propogating script and shut it down for extended periods of time while they try to repair the problem. And for that, he doesn't get any jail time, and has to spend some weekends picking up trash by the side of the road. The raging injustice.
This does not do justice to those security researchers who actually disclose vulnerabilities and a
Re:Exactly. He's not exactly blameless. (Score:4, Informative)
I don't like what this guy did, but it was clever and certainly not someone a script kiddie can do. Here's his explanation [namb.la] of his worm and how it worked. Clearly it took a lot of original effort and thought to do it.
D
Re: (Score:2)
RonB
Re: (Score:2)
But Samy is my hero (Score:5, Insightful)
From what I've heard of the quality of MySpace code and given it's popularity, the site is the nets #2 liability behind Windows zombies.
Missing the point (Score:5, Insightful)
Clearly, disclosing security vulnerabilities doesn't pay.
The summary misses the point by a country mile, as do some of the comments in response. Disclosing security vulnerabilities is fine and appreciated. But doing so in the way that this clown did it is not. He used poor judgment and is paying the price for that.
Poor Judgement (Score:2)
Re: (Score:2)
Except that said analogy is more wrong than car analogies. But seeing as you created it...
This was more along the lines of this guy taking a piss into said bully's open fly. Then the bully obviously realizes that there's piss in his underpants, and he sure didn't put it there, so he ponders what went on.. realizes his fly was open, then traces back past events until he realizes that it was a kid who
Summary biased? (Score:5, Interesting)
Re: (Score:2)
Does he need to be added to this list? (Score:4, Funny)
he's not from detroit is he?
Protected from "harm"? (Score:2)
Protect your members from the horrors of a harmless prank by helping get one of your members three years of probation, three months of community service, pay restitution to MySpace, banned using the Internet for personal uses, and having a tarnished CV.
/. that added everyone as their friend the admins would bru
I'd like to think that if someone managed to release a script onto
Report security holes only to open source authors (Score:2, Insightful)
The way things are in the U.S. today (and getting that way elsewhere as well), it looks to me like it's simply not worth revealing security holes to the corporations that have them. All they'll do is either sue you into oblivion or get you criminally prosecuted. They sure as hell won't thank you.
So I think it's time to let these corporations have what they want. Let them have their blissfully naive fantasy that they're invulnerable. They don't want to hear anything to the contrary, so why tell them
The wording of this article is horribly biased (Score:2)
He did not 'disclose a vulnerability'. He wrote a script that exploited it. It wasn't a script that was designed as a proof of concept that did nothing. It was a script added him to tons of people's friends list and put a phrase in their profile.
Banning someone from the Internet is a stupid punishment. And perhaps the whole thing was a bit harsh. IMHO, this was a prank that deserved the equivalent of the punishment you get for disorderly conduct or vandalism, not for a really serious crime.
But, this
Understandable really... (Score:2)
LOL (Score:2)
please explain (Score:2)
He got probation, so no jail time. Jeff Skilling of Enron fame got 24 years in prison. Andrew Fastow got 10 years.
Re: (Score:2)
No Damage? (Score:3, Insightful)
Punishment more than suits the offense. If you don't want to be inconvenienced and have your time taken from you by the legal system, don't inconvenience other people and steal their time.
Simple formula.
Too Bad People Don't Understand Technology (Score:5, Insightful)
I mean consider an appropriate physical analogy for what this kid did. It would be like if he walked into a bookstore that looked to be open but turned out that the staff had taken the day off and gone home but forgot to lock up but then instead of stealing anything rearranged all the books so they spelled out funny comments and left a little note on the cash register suggesting they lock the store next time. Now obviously it would be a bad idea to do this as it would be a bad idea to run this myspace worm, however, because the prosecutors, judges and juries would correctly see this as a mere youthful prank rather than a serious threat to public order and give him community service. This to a large part is how a good legal system operates, having strong punishments for behavior that can be used maliciously but showing mercy when used more innocently.
In the computer case the offended company (and eventually the prosecutor) talks about how the offender used "sophisticated computer hacking techniques" and spouts off all sorts of words the average person doesn't understand. Thus in their mind far from a kid playing a trick on a company that left the door open the situation becomes a precocious teen who used sophisticated criminal techniques to break into a locked store and thinks it's all a game. What is the real world equivalent of rearranging the books can be made to seem the activities of some kind of online underground.
Even the harm caused is easily distorted. While it might be clear to us that this kid was taking steps to avoid causing harm (not releasing info etc..) the prosecution just talks about how it was a DOS attack and the jury isn't going to know any better. In fact it is all to easy to spin horror stories about what the attack 'could have done' if it hadn't been dealt with by their computer people (the equivalent of saying what could have happened if the bookstore never resorted the books). Finally this lack of knowledge and the difficulty valuing IP makes it super easy (as in the mitnick case) to over estimate the seriousness of the harm. Even if it may have actually made more people visit myspace (I looked).
Obviously it isn't a good idea to release a javascript worm like this but it surely doesn't deserve more than community service and a good scolding. If the people in the system understood the technology it would do just that.
Re: (Score:2)
Breaking & Entering
Criminal Trespass
Burglary (even if nothing is stolen!)
Vandalism
Your little "j
Re: (Score:3, Interesting)
Ah, the plague of "If we can make it into a bad analogy, then obviously it's okay."
Other people have pointed out that the physical behavior you described actually would be illegal and could have noticeable consequences. But I want to pick on the analogy itself: this was not a case of "it looked like the store was open, the door was unlocked, so I went in and messed around with things." The store did not look open. He did not enter through the front door. It was very clear that he was exploiting something
Liability (Score:5, Insightful)
We ended up having a good 30 minutes of discussion about IT ethics. Obviously this case is different, but look at the case with the engineering student- what if they didn't find the person? Would they blame the engineering guy just to have someone to blame?
Just makes me wary of ever telling someone that their front door is open- "How did you know! You trying to break in!"
Should'a used AMP! (Score:2)
Just my $0.02 USD.
Corps like these deserve what they get (Score:2)
The ignorent may not listen but the dark market understands. The dark side is seductive.
He Exploited the Vulnerability (Score:2)
Slanted summary (Score:2)
Ummm, nice slant on that summary. Exploiting security vulnerabilities before disclosing them is an entirely different matter. This kid isn't anybody's hero for explaining about the hole after it had already been fixed, what was that supposed to have served anyhow?
Samy is my hero (Score:2)
He never used it in his spare time because he was always too busy being a sexy [enusbaum.com] man picking up women with his hot body [ytmnd.com].
We love you Samy!
- #L
He wouldn't have been caught... (Score:2, Insightful)
and didn't put his name everywhere
Banned from the Internet? (Score:3, Interesting)
Actually, he probably can't get a job as a programmer anywhere. What good is a programmer who can't search Google?
I'm very disappointed with courts' willingness to ban people from computers and/or the Internet. I think they fail to understand the full impact that has in this part of the 21st century.
Re: (Score:3, Funny)
Undisclosed amount vs fighting it (Score:4, Informative)
Yes he could have fought this further in court but when my $fighting > $settlement there's only one move to take. Plus if he went to jail then who would I go to Chipotles with?
This is why... (Score:3, Insightful)
Besides, Myspace is evil anyway.
creating vulnerabilities does pay, however (Score:4, Insightful)
Unlike physical security, making a computer system secure against teenage hackers is not rocket science. This vulnerability was clearly a MySpace screwup, and they should be held responsible and pay the price for it. That principle may not be so important when it comes to MySpace (because there is little of value there), but it becomes of paramount importance when it's your bank or your hospital.
People who offer commercial services using software should be responsible for the safety and security properties of that software. And in order to prevent those companies from blame-shifting, the people breaking in should be held responsible only if they demonstrably attempted to commit a real-world crime other than simply breaking into the computer system.
I know Samy (Score:3, Insightful)
This is no different from the Morris worm. The sad fact is that he got prosecuted whereas the hundreds of botnet operators overseas and here in the US continue to wreak the real havoc on networks and infrastructure totally immune from prosecution.
Samy got caught because he put his name on what he did. It's sad that that is the only basis for prosecution of computer crimes in this country. The good guys at the FBI and USSS don't have enough clue helping them to bring in the real criminals.
-david
Re:The moral of this story... (Score:5, Insightful)
Precisely (Score:5, Insightful)
Same is true of a computer. Just because there's a security hole on a system, doesn't give you any right to access that system. You need to leave it alone unless you have permission from the owner.
In general, you shouldn't even go looking for security holes without permission. If you notice my door is hanging open and tell me, I'll be appreciative, however if I catch you jiggling the door knobs, checking the windows, etc I'm likely to interpret that has malicious, even if you intent is just to check for vulnerabilities. Ask first. Same with computers. If you run across something, by all means tell the person in charge. However don't sniff around looking for holes unless they've given you the OK.
This isn't complicated and really just comes back to basic kindergarten morals: Don't take things that aren't yours, ask before playing with someone else's toys, don't break things on purpose, etc. The rules don't change just because it's computers and not something else.
Re: (Score:2)
His actual crime was embarassing people.
Re: (Score:3, Informative)
I was under the impression that it:
added Samy as a friend of anyone hit by it
used computing resources without permission
required human intervention to clean up afterwards (removing the data, not just patching the hole)
Even if you discount the second two points, the first is indisputable - it had a payload. The payload wasn't malicious, but it was still a payload.
It's like trying to rob a bank with an orange water gun.
Depending on the circumstances and how you do it, that could get
Re: (Score:2)
In what way is writing a virus to exploit a security weakness "informing those affected"?
Re:I still insist (Score:5, Insightful)
(b) Kamkar used this exploit in the real world, effecting one million accounts (and even he isn't being 'put away').
The writeup is misleading when it says:
The source and technical explanation for the "attack" was not even released until after MySpace had patched the vulnerability.
The author used the script it to add over one million 'friends' to his profile, MySpace then addressed the issue. Obviously the source was released *before* it was patched (that's fundamental to how the exploit worked). All he did after the event was post a more detailed explanation of how he developed the exploit.
Note, he didn't circulate that that to anyone before hand or tell MySpace about what he had found - he just decided to go right ahead exploit the vulnerability.
I don't believe for a minute MySpace - as much as I dislike the site and most of it's users - would go after someone who, on discovering the issue, actually went to them first and told them about what they had found (or even if they'd just published notice of a theoretical vulnerability via something like a known and respected security mailing list).
Kamkar did none of those things, he just decided to go right ahead and exploit the hole and play at being a haxor. Given he was 19 and so clearly old enough to have known better, three months of community service and being forced to pay restitution to MySpace sounds about right to me.
One less guy like that on the Internet for a while is something I'd welcome too.
Re: (Score:2)
It always has been a web site,in the real world, maintained by real people who cost real money to employ to run the site and to clean up after this sort of thing, it has real advertisers and real owners too. It exists to generate money for people, it's a business.
In what way does it not exist in "the real world"?
Re: (Score:3, Informative)