Your birthday #1 hit single and survey scams

A couple of weeks ago, some of my Facebook friends were putting up messages telling the world what was number one in the charts the day they were born and in some cases providing a link to a video. While it was depressing to realize how young so many of my friends were – I was born at a time when there was no official chart in the UK, at any rate for recordings as opposed to sheet music – I didn’t see any real harm in this particular “status game”.

(Though it’s always a good idea to be cautious about accessing links to YouTube videos and the like: sometimes that link isn’t to the resource or site it appears to point to. Yes, I know, my job title should be Career Sceptic and Professional Killjoy.)

While I’m always on the lookout for Facebook memes* that might be used for malicious purposes, this one wasn’t specific enough about the poster’s birthdate to be a likely part of a data aggregation attack** – even a shortlived chart topper is going to be there at least seven days – and there was no app or weblink referenced.

However, it turns out that there is a malicious app that uses the same meme to implement a survey scam. Facecrooks, a useful site for tracking this sort of stuff reports that it’s spreading very successfully via a status post that reads something like this:

It also displays a colourful graphic of a cassette tape: for my younger readers, that’s an almost-obsolete recording medium. Yes, I still have dozens of them: isn’t that sad?

Sadly, the link “on.fb.me/itsmysong” isn’t, in fact, to your song but to a survey scam which has already accumulated  over a hundred thousand Likes, which must be quite profitable for the scammers, who don’t even give you a link to one of the many harmless sites that do give you this kind of information, if you still want to play that FB status game without spamming your friends with a malicious link. Here’s one that seems genuine, passed on by one of Facecrook’s readers: http://www.thisdayinmusic.com/birthdayno1 allows you to enter the date and you can choose to check which song was number one on that date in the US, UK or Australia.

* A meme is defined by Merriam-Webster as “an idea, behavior, style, or usage that spreads from person to person within a culture.” That’s a pretty dry summary of the extraordinarily interesting concept of a “unit of cultural transmission” analogous to the gene as a “unit of biological inheritance” as described by Richard Dawkins, so here are a few more references in case it’s not a concept you’re familiar with.

** A data aggregation attack is one where an attacker inconspicuously accumulates snippets of information about you that he can use by way of gaining access to (for example) account credentials, or even for a more comprehensive case of identity theft. The possible use of some other Facebook memes in such an attack is something I’ve actually talked about at more length in a forthcoming article for Virus Bulletin. I’ll flag it here when that issue comes out.

David Harley CITP FBCS CISSP
ESET Senior Research Fellow


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s