A teenager’s 4KB joke took down MySpace in under a day

The message was six words long, and by the next morning it sat on more than a million profiles: “but most of all, samy is my hero.”

Nobody typed it. Nobody agreed to it. People just opened a page on MySpace, the biggest social network on earth at the time, and their own profile quietly rewrote itself. The worm added Samy as a friend, wrote the hero line and copied itself so the next visitor got infected too. Then the next. Then the next.

Six words, one million profiles

On Oct. 4, 2005, Samy Kamkar, then 19 and living in Los Angeles, posted a short piece of JavaScript to his own MySpace profile. By his own account of the timeline, he had a handful of new friend requests after the first hours. A little later it was hundreds, then thousands. Around 20 hours in, it passed one million.

That makes the Samy worm, by most counts, the fastest-spreading computer virus ever recorded. MySpace had roughly 30 million users at the time. The company’s fix was blunt: it took the site offline, scrubbed the code out of profiles and closed the hole.

Here’s what the headline version of this story gets wrong. The Samy worm didn’t “almost kill the internet.” It never touched routers, DNS or anybody’s servers outside MySpace. It broke one website for a few hours.

What it did was scarier, if you think about it for a second. It proved that a website itself could be the infection.

How you sneak code past a filter

MySpace let users decorate their pages with HTML, which is why every profile from that era looks like a glitter explosion. What it tried to block was JavaScript, the stuff that makes a page do things.

Kamkar published a technical breakdown of how he got around that, and it reads like a lockpicking manual for a door that was mostly cardboard.

The filter blocked the word “javascript.” So he split it with a line break, writing “java” on one line and “script” on the next. Internet Explorer, the browser most people used in 2005, read right through the gap and ran the code anyway. The filter saw two harmless words.

He hid the script inside a CSS style attribute, a place the filter wasn’t watching closely. When he needed characters or words the filter would catch, such as quote marks or “innerHTML,” he didn’t write them. He built them while the code ran, out of character codes, so they never existed in the text MySpace scanned.

Then came the part that turned a prank into a worm. MySpace protected profile edits with hidden tokens, a basic defense against forged requests. The script used AJAX, then a shiny new technique, to quietly load the edit page in the background, read the token and send it back with the change. To MySpace’s servers, every infected visitor looked like a real person editing their own profile.

The whole thing was about 4KB. Smaller than most email signatures with a logo.

The Secret Service doesn’t do jokes

Kamkar has said for years that he didn’t mean any harm. The payload backs that up: it added a friend and a line of text. No passwords taken, nothing deleted, no malware dropped.

The federal government took a different view of a stranger’s code rewriting a million accounts. The U.S. Secret Service raided his home in 2006. In 2007, he pleaded guilty to a felony charge under California’s computer crime law, according to his own account. His sentence: three years of probation, 90 days of community service, restitution to MySpace and a ban on using computers for anything but work.

That’s the tension at the center of this story, and it hasn’t gone away. On one side, a kid who found a hole in a system used by 30 million people, used it in the least harmful way he could think of, and showed his work. On the other, a company and a government that saw exactly what the same hole could do in worse hands.

Both sides were right. That’s what makes it uncomfortable.

What it looks like from your chair

Think about who actually got hit. Not MySpace’s engineers, who got a long night. The people who got hit were teenagers and bands and small businesses who opened a friend’s page and walked away carrying someone else’s code, without knowing, without clicking anything.

There was no attachment to avoid. No shady download. No “are you sure?” box. The old advice, don’t open strange files, did nothing here. You got infected by looking.

Now swap the payload. Instead of “samy is my hero,” the same code could have grabbed session cookies and hijacked accounts. It could have pushed every infected visitor to a malware site. It could have wiped profiles. Same speed, same million victims, same 20 hours. The only thing standing between a joke and a disaster was one teenager’s choice.

That’s not a security model. That’s luck.

What changed after the hero line

The pushback worth taking seriously: cross-site scripting, the class of bug Samy used, wasn’t new. Security researchers had warned about it for years. Samy didn’t invent anything; he just made it impossible to ignore.

And that’s exactly why it mattered. After October 2005, XSS stopped being a footnote in developer talks and became something companies budgeted for. Browsers and frameworks moved toward the defenses we lean on today: HttpOnly cookies that scripts can’t read, stricter sanitizing of user content and, later, Content Security Policy, which lets a site tell the browser which code it’s allowed to run at all.

The copycats came anyway. Twitter got hit by a self-spreading “onMouseOver” worm in 2010. TweetDeck had its own in 2014. Every one of them followed the playbook a 19-year-old wrote in an afternoon.

Kamkar went on to become a well-known security researcher, the guy behind the nearly unkillable “evercookie” and a long list of hacks on garage doors, car locks and drones. MySpace went on to become a place people mention mostly with a laugh.

Somewhere in a server backup, there’s probably still a profile that reads, under heroes, in a font nobody chose: but most of all, samy is my hero.

Sources

• Samy Kamkar, “MySpace Worm Explanation”: the author’s own account of the Oct. 4, 2005 worm, its spread and the legal aftermath.
• Samy Kamkar, technical explanation of the MySpace worm: annotated source code and filter-bypass techniques.

Photos

• Samy Kamkar, the security researcher who wrote the 2005 MySpace worm. Photo: Dan Tentler (vissago) / Wikimedia Commons, CC BY 2.0. Taken years after the worm.
• The MySpace logo. Image: News Corporation / Wikimedia Commons, public domain.
• Internet Explorer 6, the browser most people used in 2005, rendering a test page. Screenshot: Alessandro Antonelli / Wikimedia Commons, public domain.
• Illustration of a CRT computer monitor, the kind most people browsed MySpace on. Image: Pere Orga / Wikimedia Commons, CC BY-SA 4.0.
• Badge of the U.S. Secret Service. Image: U.S. Secret Service / Wikimedia Commons, public domain.
• A demonstration of Kamkar’s RollJam device, part of his later research into car and garage-door locks. Photo: EricB-92 / Wikimedia Commons, CC BY-SA 4.0.