Samy Kamkar (born December 10, 1985) is an American privacy and security researcher, computer hacker and entrepreneur.
Biography At the age of 16, he dropped out of high school. One year later, he co-founded Fonality, a unified communications company based on open-source software, which raised over $46 million in private funding. In 2005, he created and released the fastest spreading virus of all time, the MySpace worm Samy, and was subsequently raided by the United States Secret Service under the Patriot Act. He also created SkyJack, a custom drone which hacks into any nearby Parrot drones allowing them to be controlled by its operator and created the Evercookie, which appeared in a top-secret NSA document revealed by Edward Snowden and on the front page of The New York Times. He has also worked with The Wall Street Journal, and discovered the illicit mobile phone tracking where the Apple iPhone, Google Android and Microsoft Windows Phone mobile devices transmit GPS and Wi-Fi information to their parent companies. His mobile research led to a series of class-action lawsuits against the companies and a privacy hearing on Capitol Hill. Kamkar has a chapter giving advice in Tim Ferriss' book Tools of Titans.
Work
Samy worm
In 2005, Kamkar released the Samy worm, the first publicly released self-propagating cross-site scripting worm, onto MySpace. The worm carried a payload that would display the string "but most of all, Samy is my hero" on a victim's profile and cause the victim to unknowingly send a friend request to Kamkar. When a user viewed that profile, they would have the payload planted on their page. Within just 20 hours of its October 4, 2005 release, over one million users had run the payload, making it the fastest spreading virus of all time. The MySpace team temporarily shut down MySpace to fix the problem that allowed the worm to operate. In 2006, Kamkar was raided by the United States Secret Service and Electronic Crimes Task Force, expanded from the Patriot Act, for releasing the worm. After being presented with a plea bargain for no prison time, but paying a fine of US$20,000, serving three years of probation, working 720 hours of community service, Kamkar pled guilty to a felony charge of computer hacking in Los Angeles Superior Court. Also per the aforementioned agreement, Kamkar was allowed to keep a single computer that was not connected to a network, but explicitly prohibited from any internet access during his sentence. Since 2008, Kamkar has been doing independent computer security and privacy research and consulting.
Flaw in PHP In early 2010, Kamkar discovered a major flaw in all versions of the PHP programming language, specifically in the pseudorandom number generator, which allowed an attacker to hijack the session ID of a user and take over their session. Kamkar released a patch and once fixed, released exploit code demonstrating the attack which was possible on major banks, social networks, and forums.
Evercookie
In 2010, Kamkar released Evercookie, a cookie that "apparently cannot be deleted", which subsequently was documented on the front page of The New York Times. In 2013, a top-secret NSA document was leaked by Edward Snowden citing Evercookie as a method of tracking Tor users.
Mobile research
In 2011, Kamkar discovered the iPhone, Android and Windows Phone mobile devices were continuously sending GPS coordinates, correlated to Wi-Fi MAC addresses, back to Apple, Google and Microsoft respectively, and released his research through several front page The Wall Street Journal articles. The iPhone would continue to send location data "even when the location services were turned off". The Windows Phone would also continue to send location data "even when the user has not given the app permission to do so". He discovered that some of this data was exposed by Google and he released Androidmap, a tool exposing Google's database of Wi-Fi MAC addresses correlated to the physical coordinates populated by Android phones.
Parrot AR Drone research
In 2013, Kamkar created SkyJack, a combination of open source software and hardware to run on an unmanned aerial vehicle which was "engineered to autonomously seek out, hack, and wirelessly take over other Parrot drones within wifi distance, creating an army of zombie drones". The entire software and hardware specification was released as open source and detailed on his website. The software was released one day after Amazon.com announced Amazon Prime Air, a possible future delivery service using drones to deliver small packages in as early as 2015.
Automotive security research On July 30, 2015, Kamkar introduced OwnStar - a small electronic device that could be concealed on or near a General Motors vehicle to interpose itself between the vehicle's OnStar link and the driver's OnStar RemoteLink app. In this classic man-in-the-middle attack, Kamkar, or any unauthorized user, could substitute his OnStar commands to locate, unlock, or start the vehicle. By August 11, General Motors had released upgrades to the OnStar server software and RemoteLink app to block such attacks. In 2015, it was reported that Kamkar had built an inexpensive electronic device about the size of a wallet that could be concealed on or near a locked vehicle to capture a single keyless entry code to be used at a later time to unlock the vehicle. The device transmits a jamming signal to block the vehicle's reception of rolling code signals from the owner's fob, while recording these signals from both of his two attempts needed to unlock the vehicle. The recorded first code is sent to the vehicle only when the owner makes the second attempt, while the recorded second code is retained for future use. Kamkar stated that this vulnerability had been widely known for years to be present in many vehicle types, but was previously undemonstrated. A demonstration was announced for DEF CON 23.
… excerpt ends here. Continue reading the full article.
