Monday, 25 March 2013

Identifying Facebook scams and why you should not spread them

Ed: This is intended towards my friends but can be shared with others. I really want people to stop participating in these scams because they do far more harm than good.

Let me start by saying that I hate Facebook. It has pretty much managed to infiltrate almost every aspect of our modern lives and as a result it's pretty much inescapable. As a result, I am on Facebook but I would not shed a tear if it were to disappear tomorrow.

However, I want to rant about something that irritates me that I see people doing quite often and as a result if I see you posting this on the site, you're going to get this link. It's for your benefit and not mine because these problems will not affect me but I do wish to look out for you.



The above really does irritate me.

It is unlikely that you'll get a free mobile phone or tablet on Facebook

Here is a pretty popular scam going around the site, the infamous "free phone giveaway" ones:
We are giving away 5000 Samsung Galaxy S4 to 5000 Lucky Fans for FREE. All that you need to do is complete the easy steps below to participate! (Worldwide)

1. Like this photo.
2. Share this photo.
3. Like this page -> Samsung Galaxy S4

4. Choose your color (white/black)

The lucky winners will be selected in 7-10 days but will get their gifts at 30 April. Only people that have completed all steps can participate.
Winners will be announced at our Facebook fan page or in private message so make sure you like us on Facebook.

Good luck !!


You see similar posts for iPhones, iPads, other Android devices, car GPS, cars, laptops, et cetera. You usually see these posts with some obvious grammatical mistakes--of course, I may have made some in this entry too.

I see one of these pop up on my feed about once or twice a week. There are some people who constantly go about liking pages and sharing them for the sole purpose of perhaps being the one 5,000 people to get a phone. With 80,000 likes on the page itself, you have a 1 in 16 chance of being a lucky winner, which is far better than the chances you have with a lottery ticket. However, Samsung does not go about doing this at all.

For example, shortly after the Galaxy S3 came out, a Canadian fellow messaged Samsung about getting a free phone in exchange for his customer loyalty and a cute drawing of a dinosaur. The company's response was to send back an image of a kangaroo on a unicycle but stating that they could not send him a free phone. It went viral and because of this Samsung did in the end send him a phone as he probably did more to benefit Samsung than a silly giveaway.

This is a unique case and only cost the company so much as I had pointed out. And this is the key point: there is a cost that has to be taken into account.

I cannot find firm numbers, but supposedly it is around $230 USD for the production cost of an S4. For Samsung to give away all of those phones, it would cost them nearly $1.15 million USD just to make them. Retail prices of the phone are not concrete, but it has been reported that a 16 GB model will be $629.99 USD, so that would mean that $3.14 million USD would have to be spent. There are additional costs too that need to be taken into account but this is quite a lot of money for a promotional event.

To further drill this into context: at 80,000 likes, you're looking at anywhere between spending $14 and $40 per person at the end of this promotion depending on how you choose to look at its overall cost. Unlike my brother, I am not much into marketing and sales, but I do imagine that if your marketing costs require you to spend that much per person on a promotion, it's not very effective. A commercial spot during the Superbowl costs just above the extreme total cost of those phones (around $4 million USD), but that spot only costs about $0.04 per person as it has the ability to reach over 110,000,000 people.

It's prohibitively expensive to give away phones for free. You are more likely to see these phones made available in promotional give-aways at restaurants and whatnot.

Speaking of which, there's no free coffee, food, or gift cards in general either

I've seen this a bit less often these days, but it is not unusual for me to see Starbucks or Tim Horton's gift cards as prizes for sharing a page on Facebook. In fact, I've seen this behaviour from those who work at Starbucks themselves. Guess what? Neither do this.

I won't go too far into those two companies, but it is covered quite well in this Naked Security article from Sophos.

However, I've seen this for for a number of other places including Staples, Milestones, Real Canadian Superstore (aka Loblaws, etc), The Brick, Home Depot, and Indigo/Chapters. If it is a major chain, then I have likely seen it with one of the scam pages.

There are times where smaller businesses may actually go about doing this, but I'll explain something in a moment.

OK. Why should I not then?

Simply put: there is no such thing as a free lunch. You're giving away something to get these things and it's unlikely that they're going to be used for getting you the prize that you desire. You're also risking your privacy, safety, and your friends as well.

By liking a page and sharing the details, it is easier for those with malicious intents to harvest your details to do some of the following:


  • Sending you malicious messages via e-mail or Facebook that contain malware.

  • Getting phishers to impersonate you to your friends.

  • Selling your and your friends' data to third parties to be used for all sorts of reasons.



You're not just doing a disservice to yourself, but you're also doing a disservice to your friends. There may people on your list who do not wish to have their details exposed but are not adept enough to go through the hell that is Facebook's privacy settings to set it so these pages cannot get their hands on their details. Just because "well I might actually win" comes to mind does not mean that it is worth the hassle.

What else?

Just keep the above in mind when browsing around on Facebook and thinking about sharing the page.

Here's a simple thing to ponder: if the sweepstakes requires you to like a page that is not the official page itself, then it is unlikely to be real. It doesn't matter if there is a giant photo of boxes of phones inside of the page, it makes no business sense for these companies to direct you to a page that is not the official page itself. What happens when the Galaxy S5 comes out? Why do you have to go to a page separate from the mainstream one? Once the promotion is over then all they've done is spent money on you and haven't gotten anything in return, which is a like on their page.

Also watch out for the name of the company in question. I've seen Apple show up as "Apple.", "Apple's", "Apple Computers'" and so forth. There's just one page: Apple Inc. Look for the page and if the promotion is not on that site as posted by them, then it's not real and you should not spread it.

I provide this information because I want you to be safe and I hope that this isn't taken the wrong way.

Friday, 15 March 2013

BSides Vancouver recap




BSides Vancouver has come and gone and I'll have to say that it went quite well. I've been meaning to write a post-conference write-up and finally I've found some time to do so.

One of the highlights of the conference was the fact that there was a large attendance. I think it worked out to just over a hundred people in attendance and a full speaker track.

(Shamelessly stolen from the BSides Vancouver site itself.)

Most of the slides including my own have been posted here. If you're looking for my bug-ridden source code, you can find it by visiting my Github repository for it!

Basically I gave a talk on capturing personal data from Twitter. Nothing special, but it allows for you to pull phone numbers, Blackberry PINs, and IP addresses 'automagically'.


(My lovely girlfriend captured me talking about some nonsense.)

It was quite nice to meet the speakers who came to the dinner we had the night after. Admittedly it was a bit difficult the day after, but that is par for the course.

Also, I'd like to point out that I do have a new domain:
colin.keigher.ca

Finally got around to registering the domain after a buddy of mine kept pestering me to do so. This domain will stick around as my blog but slowly I'll be migrating things off of it. Not much of a BSides recap I guess, but I definitely am looking forward to next year.