Samy Kamkar had 73 friends on MySpace when, shortly after midnight on Tuesday 4 October 2005, he put a short script into his profile. He was 19 and lived in Los Angeles; MySpace was the largest social network of its day, and News Corp had agreed in July to buy it for $580 million. Anyone logged in who looked at Kamkar's page ran the script without knowing it. Their browser sent him a friend request in their name, then wrote a copy of the script into the heroes section of their own profile, after the words “but most of all, samy is my hero”. Everyone who visited those profiles caught it in turn.
Kamkar's own write-up explains how it got through. MySpace let members decorate their pages with some HTML but removed anything that could run: script tags, event handlers such as onclick, links beginning with “javascript”. Internet Explorer and some versions of Safari would run script placed in a style sheet, so he put it in a style attribute. The filter deleted the word “javascript”; some browsers still read it with a line break in the middle. Quotation marks he built from character codes, and banned words such as innerHTML from fragments joined at run time. The requests went out through XMLHttpRequest, the object behind the new Ajax sites, carrying the viewer's own login cookies, and the script fetched each confirmation page first to copy the random hash MySpace required with the form.
By his own log it spread slowly, then all at once. About eight hours in he had 221 friend requests; by half past one in the afternoon, 2,503 friends and 6,373 requests; by twenty past six, 917,084 requests, and soon after more than a million. Shortly after seven that evening, pages across MySpace gave way to maintenance notices; when the site returned about two and a half hours later the script was gone, though the line about Samy lingered on many profiles. BetaNews called it the first self-propagating cross-site scripting worm, and Slashdot's summary on 14 October said it had spread at about a thousand users every few seconds before MySpace shut the site. It had turned a website against its own users without touching a flaw in anyone's computer.
The reckoning took longer. About six months later, with a warrant, the Secret Service and an Electronic Crimes Task Force searched his apartment and office and carried off his computers; “It was kinda scary,” he recalled. On 31 January 2007 he pleaded guilty in Los Angeles Superior Court to a felony charge and was spared prison. According to MySpace's statement, he was sentenced to three years' probation, 90 days of community service and restitution of an undisclosed sum, and barred from using the internet for personal purposes.
Fifteen Times the First Count
On Friday 7 October 2005 Dutch prosecutors announced the arrest of three young men, reported as aged 19, 22 and 27. They were suspected of controlling a network of Windows computers infected with Toxbot, also called Codbot, malicious software that opened a back door for whoever ran it. The Public Prosecution Service put the network at about 100,000 computers, which it called one of the largest yet dismantled, and alleged that it had been used to steal account details and to threaten an American company with a denial-of-service attack. On 20 October the prosecutors' spokesman, Wim de Bruin, put it at about 1.5 million machines — fifteen times the first figure, and an estimate rather than a count. The suspects were never named by the prosecutors. In 2007 a court in Breda sentenced the two men it held had built and run the network to 24 and 18 months in prison, with fines; what the prosecutors proved there was at least 50,000 infected computers.
A Test on New Year's Eve
On New Year's Eve 2004 Daniel Cuthbert, a security consultant, gave money to the Indian Ocean tsunami appeal through a donation site BT ran for the Disasters Emergency Committee, and grew suspicious when the site did not respond as he expected. Fearing a phishing site, he ran quick tests on it from his laptop, among them dot-dot-slash sequences typed into the address bar, an attempt to climb out of the site's directory. An intrusion detection system in a BT server room raised an alert, and BT called the police. On 6 October 2005, at Horseferry Road Magistrates' Court in London, District Judge Quentin Purdy convicted him under section 1 of the Computer Misuse Act 1990, fined him £400 with £600 costs, and told him he had “crossed an inappropriate line”. His counsel argued that his reasoning “was not reprehensible”; he had already lost his job at ABN Amro. “They've now set the bar so high that there should be thousands of convictions for people doing things like these,” he said. Peter Sommer, the defence's expert witness, said the court had taken a very strict view of the law's wording, and that security professionals would be “more wary” of helping police after the verdict. The Police and Justice Act rewrote the offences in November 2006, adding no defence for researchers.
The View From Above
In mid-October 2005 President A. P. J. Abdul Kalam, addressing senior police officers in Hyderabad, warned that detailed satellite pictures freely available online, such as Google Earth's, could help terrorists choose their targets. He complained that developing countries already exposed to terrorism had been singled out for high-resolution imagery, judged the existing national laws and the United Nations' recommendations on observing territory from above inadequate, and called for new laws to restrain the spread of such material. Parliament House, Rashtrapati Bhavan and some defence establishments could be seen in detail. Google, which had said in August that the service's benefits outweighed any potential abuse, said later in the year that it was willing to talk with representatives of individual countries.
The talks were still going on in February 2007, when the Times of India reported that Google had agreed to show sensitive Indian installations only in low resolution; Google India called the dialogue substantive and constructive but said no agreement had been made. ISRO built its own map: the Bhuvan portal, launched in beta on 12 August 2009, left military installations out. A draft Geospatial Information Regulation Bill of 2016, which would have licensed private mapping, was never passed, and on 15 February 2021 the Department of Science and Technology went the other way, loosening control of mapping data. Google's Street View, halted in 2011 after a letter from Bangalore police, returned in 2022 through Tech Mahindra and Genesys.
Stanford's Stanley wins the Grand Challenge
On 8 October 2005 twenty-three driverless vehicles left Primm, Nevada, for DARPA's second Grand Challenge, a 132-mile desert route revealed two hours beforehand; in the first, in March 2004, none had covered eight of its 142 miles. This time five finished, and Stanley, a Volkswagen Touareg entered by Sebastian Thrun's Stanford team, won the $2 million prize in 6 hours, 53 minutes and 58 seconds, about eleven minutes ahead of Carnegie Mellon's Sandstorm. Machine learning made the difference: Stanley's lasers mapped about 22 metres ahead, but a camera, trained continuously on ground the lasers had cleared, often saw 70 metres out; without it, the team reckoned, the car would have been held to 25 miles an hour and possibly beaten. Its makers wrote that “Stanley is unable to navigate in traffic”; in May 2006 DARPA moved its next race into town, and in October 2010 Google's driverless-car project under Thrun came to light. On 17 October 2005 ScanSoft, which had agreed in May to merge with the speech-recognition company Nuance, took Nuance's name.
Check Point agrees to buy Snort's maker
On 6 October 2005 Check Point Software Technologies, the Israeli maker of firewalls, agreed to buy Sourcefire, of Columbia, Maryland, for about $225 million. Sourcefire sold intrusion prevention built on Snort, the free detection program its founder, Martin Roesch, had begun in 1998 as a spare-time project for weekends and rainy days; about 800 customers paid for its commercial products, and Check Point's shares fell on the price. The sale never closed. On 6 February 2006 the Committee on Foreign Investment in the United States told Check Point it would investigate fully, and FBI and Pentagon officials objected, the Associated Press reported, partly because Snort guarded some classified military and intelligence computers; on 23 March the companies withdrew, promising to look for a partnership instead. Sourcefire stayed independent until an American buyer, Cisco, completed its purchase in October 2013. On 27 October 2005 the Anti-Spyware Coalition, whose members included Microsoft, AOL and the main security vendors, published its final definitions of spyware and offered for comment the criteria vendors would use to label programs.
⏳ Time capsule — October 2005
- On 12 October India's Right to Information Act, to which President Kalam had given his assent on 15 June, came fully into force: a public authority now had thirty days to answer a citizen's request for information, or 48 hours where life or liberty was at stake.
- On 12 October Shenzhou 6 lifted off from Jiuquan with Fei Junlong and Nie Haisheng, China's first crew of two and the first to enter the craft's orbital module. They landed in Inner Mongolia at 04:33 Beijing time on 17 October, after 76 orbits.
- On 13 October Harold Pinter, who had turned 75 three days earlier, won the Nobel Prize in Literature as the writer “who in his plays uncovers the precipice under everyday prattle and forces entry into oppression's closed rooms”. Illness kept him from Stockholm, and his Nobel lecture was recorded on video and shown at the Swedish Academy on 7 December.
- On 26 October the Chicago White Sox beat the Houston Astros 1–0 in Houston to complete a four-game sweep of the World Series, the club's first title since 1917; Jermaine Dye was named most valuable player.
Script in a Trusted Page
Samy's worm used no unpatched flaw in anyone's computer, only a site that trusted what its members typed and browsers that obeyed the page, and that is still the shape of the problem. Eight months later a script hidden in a message crossed Yahoo Mail as Yamanner, as June 2006 records; OWASP's Top 10 of 2021 still counted cross-site scripting within injection, its third-ranked risk. Content security policy, the browsers' later answer, was available but little used when twenty-two lines of script skimmed British Airways' customers in September 2018. MySpace's own records of 360 million accounts, taken from before its 2013 relaunch, were offered for sale in May 2016. Kamkar has worked since 2008 as an independent security researcher.
The month's other stories ended in the habits of police and the wording of law. Toxbot's count grew from 100,000 to 1.5 million in a fortnight on estimates alone, a gap between estimate and evidence that botnet cases still have to cross. Dutch police went on to turn a seized network, Bredolab, into a warning to its victims in October 2010, and with seven other countries to push an uninstaller through Emotet's own update channel in January 2021. Cuthbert's conviction left the harder question open. When BBC Click bought a botnet in March 2009, a lawyer's reading was that the Act needed no criminal intent and allowed no public-interest defence; the Home Office began a review in May 2021, and a statutory defence for researchers is, as November 2006 records, still only promised.