Samy (computer worm)

From Wikipedia, the free encyclopedia
  (Redirected from Samy (XSS))
Jump to: navigation, search

Samy (also known as JS.Spacehero) is a XSS worm that was designed to propagate across the MySpace social-networking site. At the time of release, it gained significant media attention.

Samy Kamkar, the author of the worm, was raided by the United States Secret Service and Electronic Crimes Task Force in 2006 for releasing the worm.[1] He entered a plea agreement on January 31, 2007 to a felony charge.[2] The action resulted in Kamkar being sentenced to three years probation without computer use, 90 days community service, and an undisclosed amount of restitution.

The worm carried a payload that would display the string "but most of all, samy is my hero" on a victim's MySpace profile page. When a user viewed that profile page, the payload would be planted on their own profile page. Within just 20 hours[3] of its October 4, 2005 release, over one million users had run the payload,[4] making Samy the fastest spreading virus of all time.[5]

Execution of the payload resulted in a "friend request" automatically being made to the author of the virus and in messages containing the payload being left on the profiles of the friends of the victim. MySpace has secured their site against the vulnerability that allowed the attack; however, the phrase "Samy is my hero" remains in two MySpace profiles.[6]


External links[edit]