Behavioral Archetype
THE PROOF-OF-CONCEPT ARTIST – Subject wrote a few lines of JavaScript, added them to his MySpace profile, and twenty hours later had over one million friends and had forced MySpace to take the entire platform offline. The code did three things: added every visitor to his friends list, modified their profile to include “but most of all, samy is my hero,” and copied itself onto their profile to propagate further. The fastest-spreading worm in history, and it was a vanity project.
Essence Indicators
- Nineteen years old when the Samy worm launched on October 4, 2005
- The worm exploited cross-site scripting (XSS) vulnerabilities in MySpace’s profile customization system
- Over one million infections in twenty hours
- MySpace was forced offline to remediate
- Payload was entirely cosmetic – no data theft, no system damage, just “samy is my hero”
- Secret Service raided his home in 2006. Felony plea. Three years’ probation, 720 hours of community service, $20,000 fine, three-year computer ban
- Subsequently became a respected security researcher
- Tells the origin as an accident of curiosity, not a plan: he expected “maybe in a month I’ll have like 100 friends,” woke to 500, then thousands an hour – “apparently I had written a virus or worm I didn’t really realize or think about at the time.” The first-party account matches the cosmetic payload: a limits-tester who tripped a platform’s scale, not a saboteur who aimed at one (talk below)
On Camera
TNW Conference talk. Kamkar walks through his craft and tells the MySpace-worm story in his own words – the month-one expectation, the overnight thousands, the “oh no” when he realized Fox had just bought the platform he’d accidentally taken down. Embedded as a primary source for the Ch. 7 account: the worm as curiosity overrunning a system, with a payload that never did anything but say “samy is my hero.”
Social Persona / Impression Management
Immediate impression: A teenager who wanted more MySpace friends. The worm was not ideological, not criminal in intent, and not designed to cause harm. It was a technical demonstration wrapped in vanity, executed with elegance and punished with a sledgehammer.
Energy: Playful, technically gifted, slightly bewildered by the consequences. The worm’s payload – “samy is my hero” – is the energy signature. This is not a manifesto. This is a kid who thought it would be funny.
Impression management strategy: TECHNICAL SHOWMANSHIP. The worm itself was the resume. After the legal consequences resolved, Kamkar leveraged his notoriety into a legitimate security research career, demonstrating that the skills that broke MySpace could be applied constructively.
Forensic Archetype Comparison
| Pattern | Match Level | Evidence |
|---|---|---|
| The Enfant Provocateur | EXTREME | Nineteen. MySpace. “Samy is my hero.” The classification writes itself. |
| The Accidental Revolutionary | HIGH | Did not intend to demonstrate that MySpace was fundamentally insecure. Demonstrated it anyway. |
| The Social Engineer | LOW | The worm was technical, not social. No manipulation of people – manipulation of code. |
| The Calculated Predator | LOW | The payload was vanity, not predation. |
Psychometric Assessment
Big Five (OCEAN):
| Trait | Score | Evidence |
|---|---|---|
| Openness | 85/100 | Technically creative. The worm was elegant – exploiting XSS in a novel way. Post-conviction career shows sustained technical creativity. |
| Conscientiousness | 45/100 | The worm was crafted, but the decision to deploy it suggests limited consideration of consequences. Nineteen years old. |
| Extraversion | 60/100 | Moderate. The worm was inherently attention-seeking (“samy is my hero”). The post-conviction career involves public speaking and demonstrations. |
| Agreeableness | 55/100 | The worm was not malicious. “Samy is my hero” is not a hostile payload. It is an annoying one. |
| Neuroticism | 30/100 | Relatively low. Handled the legal consequences and transitioned to a legitimate career. |
Dark Triad:
| Trait | Score | Notes |
|---|---|---|
| Narcissism | 45/100 | “Samy is my hero” on a million profiles. The narcissism is performed, transparent, and kind of charming. |
| Machiavellianism | 15/100 | Low. No strategic objective beyond vanity. |
| Psychopathy | 5/100 | Minimal. No intent to harm. |
MBTI: ENTP (“The Debater”) – Sees a system, sees the vulnerability, exploits it to see what happens. The MySpace worm is a pure ENTP product: technically creative, socially provocative, consequentially underthought.
Threat Assessment
| Category | Level | Notes |
|---|---|---|
| Physical threat | NONE | Teenager with JavaScript. |
| Institutional threat | MODERATE | Demonstrated that MySpace – then the largest social network in the world – could be taken down by a teenager’s vanity project. The demonstration’s value to the security industry exceeded any damage – though, like weev’s later web-exploit case and Kevin Mitnick’s before it, the prosecution treated a nonviolent proof-of-concept as a serious crime. |
| Memetic threat | HIGH | “Samy is my hero” became a meme. The Samy worm became a case study in every web security course. The 19-year-old’s MySpace exploit is more technically impressive than most corporate security audits. |
| Posthumous threat | N/A | Subject is alive and employed in security research. |
Deception Analysis
Primary deception modality: TECHNICAL EXPLOITATION. The worm deceived MySpace’s content filtering, not people. The XSS vulnerability was the entry point. The deception was machine-targeted, not human-targeted.
Authenticity assessment: MAXIMUM. The worm said “samy is my hero.” It meant “samy is my hero.” There was no hidden agenda, no secondary objective, no ideological payload. It was exactly what it appeared to be: a teenager’s vanity project that accidentally proved the entire platform was insecure.
Flame Warrior Classification
Primary: Enfant Provocateur / Hacker Secondary: None needed. Notes: ATK 8 – a million infections in twenty hours. DEF 3 – no attempt to conceal identity; the worm literally had his name in the payload. HP 7 – survived the Secret Service raid, the felony plea, the three-year computer ban, and emerged with a career – unlike Jonathan James, the teenage hacker the same federal apparatus pursued to a far worse end. The resilience score is high.
Sources: Samy Kamkar, “The MySpace Worm” (sa.my); Wikipedia: Samy (computer worm); SC Media: “MySpace superworm creator sentenced”; TNW Conference — Samy Kamkar, “Secret Hacking Techniques” (video).
Prefer RSS? Subscribe here.