“Samy is my hero”: the worm that spread through friend requests

The story

MySpace let users customize their profile pages, but tried to block anything that could run code. On October 4, 2005, Samy Kamkar found a way around those filters.

He added hidden code to his own profile. When anyone viewed it while logged in, the code added the line “but most of all, samy is my hero” to the visitor’s profile, sent Samy a friend request and copied itself onto the visitor’s page. Anyone who then viewed that page caught it too.

Within about 20 hours, more than a million users had run it. MySpace has since closed the flaw.

The worm itself did no real harm. Kamkar was still charged, and in 2007 he pleaded guilty to a felony and was sentenced to probation and community service.

Why it mattered

It has been called the fastest-spreading computer virus of all time. It spread through the website itself, using a technique called cross-site scripting, so simply viewing a page was enough to catch it. It showed that a website’s own pages can be what gets infected, and that a site must check everything its users are allowed to post.

The lesson today

Nobody who spread the Samy worm clicked anything unusual. They just looked at a page on a site they trusted. Flaws in websites and web apps can be used against the people who visit them, which is why the software you use, and the browser you use it in, need to stay up to date.