Sophos Cloud Optix
NOTE: This article was first posted in September 2010, but continues to receive a high amount of traffic as malicious scammers continue to use the story of a girl killing herself to spread their campaigns across Facebook. The scams use a variety of techniques and variations of the disguises to maximise their chances of tricking people into taking surveys or handing over personal information.
Be sure to join the Sophos group on Facebook to learn about the many different scams which are spreading, and share warnings with your online friends.
And now back to the original article from September 2010..
For a few days we’ve been monitoring a new spin on a Facebook scam, that claims a girl killed herself on Christmas Eve after her dad posted a message on her wall. Before we’ve documented both the related hoax warnings spread on Facebook, as well as scam pages that popped up trying to trick users into “liking” them, and the truth about the real woman’s death that has been exploited by heartless cybercriminals.
The latest scam is spreading virally, tricking users into liking pages which claim to offer you access to the “horrific wall post” that allegedly made a girl kill herself on Christmas Eve.
Girl killed herself, after her dad posted This to her Wall
If you click on the link then you are taken to a Facebook page which says you have to like it in order to view the father’s alleged message. In some cases, the page will use clickjacking techniques to trick you into sharing the page as a status update with your online friends. In others it will trick you into granting permission for a third-party application to post to your Facebook wall. But the end result is the same – you’ll be directed to a webpage which asks you to complete a survey.
And that’s what makes money for the scammers who create these pages.
So all that needs to be done is for Facebook to clean up the offending pages, educate their users about these types of scams, and police the community better in future to stop yet more scams popping up.
A quick search on Facebook found these “girl killed herself” pages popping up like mushrooms on the site.
Come on Facebook, can’t you get a handle on this?
If you believe you may have been hit by this attack, view the recent activity on your news feed and delete entries related to the above links. Furthermore, you should view your profile, click on your Info tab and remove any of the pages from your “Likes and interests” section.
You should also check which third party applications you have allowed to access your profile, and revoke the rights of anything suspicious via Account/ Privacy Settings/ Applications and Websites. If you don’t do this, you could be hit time and time again..
Here’s a YouTube video where I show you how to clean-up your Facebook account:
(Enjoy this video? You can check out more on the SophosLabs YouTube channel and subscribe if you like)
If you want to learn more about security threats on the social network and elsewhere on the internet, join the Sophos Facebook page.
so i clicked on that add a friend of mine had posted it on or facebook does that mean im in danger ?
Hi Sandy. If you believe you may have been hit by this attack, view the recent activity on your news feed and delete entries related to the dodgy links.
Furthermore, you should view your profile, click on your Info tab and remove any of the related pages from your "Likes and interests" section. You may have to click on "Show other pages" to see them.
In other words – Profile -> Info -> Click edit in "likes and interests" -> Click "show other pages" – > Now you can click "remove" on the pages that you don't want to like anymore.
Thank you for the advice! My friends just got hit with this today… I completed 70% of the survey. Other than deleting it from my "likes", should I be worried about anything else?
i click on it but nothing came up but a white screen but the internet bar was still there (address bar thing)
i clicked on it to.
you may not be in danger, but clicking on those ads scamers make money is like google AdSense where their get paid for people clicking on ads like on their page or blog
Same here , but i think this is all just hoey , cuz if it was real , why would the facebook creator leave it like tht , wouldnt it cause harm to his reputation , Think about it
Um. No. Facebook is now a publicly owned and traded company. It is now a machine for generating money. thats it. that’s as far as the humanity of Facebook goes. they are a nameless, faceless entity, who exists to generate wealth. If you think for one second they care about anything else. you are a fool. they are now just like every other corporate greed bag company in the US.
Hi Graham, I also clicked on this dodgy link that claims "a girl killed herself on Christmas Eve after her dad posted a message on her wall" but I just did what you told above in reply to Sandy's comment. I just want to know, am I safe now? does this scam 'HACK' your account, send virus, or what? pls do reply. thanks
Hey Sara. If you followed my advice above about how to clean-up the attack (which means that you won't be passing it onto any other Facebook users) then you should be safe.
The primary aim of this attack appears to have been to drive traffic to a revenue-generating survey.
However, if you're at all concerned – there's no harm in changing your Facebook password. Remember never to make it the same as the password on any other website you access.
My mom clicked the link and it posted to her profile, now she is unable to delete it! What should she do?
If you have messages on your wall that you want to remove, go to your profile's wall and hover your mouse over the message. You should see an 'X" next to each entry – clicking on that X removes it from your wall.
In addition, view your profile, click on your Info tab and remove any of the related pages from your "Likes and interests" section. You may have to click on "Show other pages" to see them.
In other words – Profile -> Info -> Click edit in "likes and interests" -> Click "show other pages" – > Now you can click "remove" on the pages that you don't want to like anymore.
How do i delete it from my mobile phone?
Change your password, ASAP once you notice that! and start deleting all the posts that has been sent to others.
Don't click on the link, hoax. virus
I did what you said about removing it from Likes and Interests, but the page still shows under Movies. How do I remove it from there?
if you see it listed under "Movies", double-click on the name in the Movies box and you should see the word "Remove" appear on the right hand side.
Don't you love how consistent Facebook's user interface is? Ahem..
Took some doing, but that finally worked! It wasn't even listed as a movie, but in the movie category below the "list" that is supposed to show. It's gone now, though! Thanks for the help!
i almost clicked itt..glad i didnt
hi graham i am having a slight problem. ive done evreything that u have said in the previous comment such as removing from the profile page and like and interests page etc so thats done.
my main concern is on the left hand side of the page there is a bookmark section where all the bookmarks are placed such as application, photos, groups etc in that section the link is still there and there is nothing that i can do to remove it it says hide link or see hidden and there is nothing that it says remove. When i click on the X it says hide instead of remove.
As i said ive done evreything i even went into my application setting and i couldnt find it so how do i remove?? Pleae let me know as soon as you can because i really want to remove that section.
thank you
Sounds like you haven't properly revoked the application's rights to access your profile.
Go to Account /Privacy Settings
Then click on "Edit your settings" under "Applications and Websites" in the bottom left hand corner.
See "Applications you use"? Click on "Edit settings" next to that and revoke rights of any rogue applications.
Yes, Facebook could have probably made this easier to describe or simpler to navigate to…
oops wrong thing i meant to put here i click it too but nothing came up but white and the address bar was still there and stuff
Well, just check your profile and settings to ensure that nothing dodgy has been added, and all should be fine.
Oh, and think before you click next time. 🙂
i clicked it and i was able to remove it from my profile and it never came back so people dont worry!!!!! iam scared tooo but iam safe!!!
hey Graham, I've removed it form the "likes and interests" but i cant remove it from my wall. when i click on the X mark to remove, it says "
Failed to hide minifeed story". What now?
Sorry – don't know why that wouldn't be possible if you have removed the "likes" and revoked any rogue applications.. It may be worth contacting Facebook technical support. Good luck, and report back what happens. Others may find it helpful.
Me too….Same thing as Thandeka it's removed but says Failed to hide minifeed story?
I was actually able to remove everything o.o comment wall post nd all that xD and nothing happend to me o.O maybe if your refresh page? idk D: good luck! >o<
If you go to your profile instead of your home page and click the x there it should work
It's a facebook bug.
HUH WHOA R U SERIOUS?! i opened the "GIRL KILLED HERSELF BC HER FATHER POSTED THIS!" and i did that survey! does this mean my computer is at risk 4 a virus or something?!?! and y cant facebook just delete all that kind of stuff from comin on here 2 begin with? PLZ TELL ME IF MY COMPUTER IS GOING 2 HAVE A VIRUS NOW?!?!?!?! and this site isnt a scam is it????
No, your *computer* isn't at risk of a virus if you went through the survey process but your Facebook profile may well have passed on the "Girl killed herself" link to your online friends and Facebook pals – which ultimately might lead to them taking the survey too.
And the scammers benefit (by earning a commission) every time someone takes one of their surveys.
Furthermore, a rogue application might now have access to your Facebook profile, which means they could gather other information about you or post more messages to your wall.
This needs to be posted so people will know its a scam!
these are obvious scams…you have to be a retard to fall for this and click "like"…hahaha…but it takes a dumbass to click "like" and then do the survey…LMAO!!
people really thought that was something serious thats why people clicked on the link.. it has nothing to do with being stupid. people really wanted to know if something like that really did happen. i think that you should choose your words carefully before you decide to put something where people can read it.
I agree, you do have to be a bit gullible to not realise this stuff is a scam. If you want to read news and current affairs, go to a news website. And before you click on any of these links, a simple google search will show them as a hoax. However, I remain unsurprised at the intense stupidity of people on facebook.
But seriously … Only freaks wants to see people killing themself.. “This guy killed himself in the webcam! Check it now! Sadly!” I see lot of people “likes” it… or this “Father catches daughter on her webcam!” if people really are such idiots wanna see this stuffs then they just deserve it…
Or just go to a damn porrn site or some youtube sh*t, but if they do it on Facebook then they just deserve it…
I can bet that most of you calling this "an obvious scam" have clicked on the link, at least once, to figure out that it was a hoax…you basically just called yourselves an idiot or stupid or a moron…there are more serious matters in the world…get over yourselves…they may be ignorant but you are just dumb!
I for one don't participate in any of the Facebook banter, but then I'm a IT Security Specialist, so I wouldn't anyway. The issue isn't the fake link, the issue is people have been posting rather personal info on these sites, and in my opinion, doing so has caused Facebook users to expect that to be the norm in most cases. So what you should take from this, is that Facebook is not CNN or FOX news, and wasn't intended to be used that way. Will people stop doing it? I doubt it, but then that's what evolution is for, right? Survival of the fittest or in this case, the less gullible. My thought are my own and do not represent the thoughts of others. Take it for what it's worth.
Thanks Jake…
This is why stupid people shouldn't own a computer. Too many people have viruses and keep people like my self working because they do stupid stuff.
If people understood things like scams over the internet like they do a bank robbery or loaning their credit card to a friend I would be out of a job.
then shouldn't u be happy about those people having computers?
I was going to say the samething….I would necessarily call these people stupid….you can't be an expert in everything…these "stupid people" could likely find an area in which you are also "stupid" in.
Liked that one Lisa.. what a smart-A** … I cant stand people like that. He should be gratful he has a Job instead of being nasty and calling people stupid. I think he is for not knowing that Gee.. he has a job in these hard times
Drew—I suggest next time you read through your post…thoroughly…you just made yourself sound like more of an idiot than any of those people you were just ripping on…you should "thank your lucky stars" people cannot avoid computer viruses…otherwise, I can almost guarantee, you wouldn't have a job…anywhere…such a MORON!
thankyou graham saved my ass!
Thanks Graham you helped me so much, I wasn’t sure either to click it or google it, i was so curious though!
When in doubt, GOOGLE! 😉
So curious about someone who you don't know killing themself? Wow that is truly horrible.
While I believe that Facebook should clean these sites up but at the same time I also believe people should think about those things before clicking on them. It’s their responsibility as well.
how about if you clicked the linked but exited before loading?? will anything happen to my account???
If you didn’t approve the application you should be fine. But always check your news feed just in case to make sure you haven’t posted anything promoting the link yourself.
Actually, I commented on the message explaining that it is a scam, with a link to this page…
I just hope people read the comment.
how can i remove it
He already explained how to remove several times both in his article and MANY replies to people above. If you read through you'll find out how to remove it.
why did she kill her self? what did the dad write?
the story is not true, eliza, the scammers made it up and as morbid as they possibly can so that people will "like" it. everything about that story is fake.
WOW!!!! Are you seriously asking that? You couldn't figure out from this article that the whole thing is a scam and that she didn't really kill herself?
How disgusting a person do you have to be to be excited by a story about someone killing themself???
Just a question: don't you find it strange that a group ask you to "like it" for you to see the content, when all the groups have opened information even before liking it?
Then… why do you click?
You do it a) so it shows on your profile as a reflection of your personality and interests, and b) so when that group or page posts an update, it shows in your feed and you don't have to check the page repeatedly. It's like an RSS feed.
I know right? I don't understand one bit. And it's not that people trust everybody, hell it seems like they trust no one. In my opinion it's just plain stupidity. Gullibility, maybe, but to me it's one and the same.
I clicked on it and when it went to the next page instead of the Video or article I knew it was no good. I people went thru all the crap that they sent them on the they were dumb enough to get it they deserve it. The only thing dumber is if they asked for their Cell # and then charged them $10 a month! Yep keeps me in business. THanks "Dumbasses"!
YOU are the dumbass – because if you keep doing this – you will some day be in jail. Why are you advertising your criminal activities?….That is how dumbasses get caught!
I clicked on it but didn't "like". am i still at risk?
If you don't approve the application's request to access your profile you should be ok. But check your profile anyway to ensure that you haven't – without your knowledge – passed on any messages regarding it.
Seriously people do you think a "dead girl" made a Facebook page to say she committed suicide because her Dad (who probably pays for the service) posted something on her wall. Where has all the common sense gone? Are you so bored with your own lives that you'd fall for this scam ola?
i am trying to delet the post but it says failed to do so over and over again ?
If that happens delete it from your profile page…
It worked for me… 🙂
Not to scare munger but the main purpose of these "hoaxes" is to easily obtain profile and feed information from people who "like" these kind of pages.
Then these hoaxers can simply access all your visible data (personal info, friend lists, photos, videos, comments) via the facebook app API and do what ever they want with it…
Eventually there will be hundreds of sources of your information that will likely find it's way to the black market for $1 per 1000 records.
Notice how facebook defaultly has no concept of privacy until YOU restrict your content. This is dangerous to anyone who has no idea about information security simply because it means everyone/thing you associate yourself with on facebook is able to see everything about you unless you have said otherwise in your privacy settings.
It's worth noting that any information that IS given to people like these hoaxers has been freely given by you at YOUR request, this is how social network works, so if you value your privacy don't use these types facebook apps/pages or even social networking services….
You my friend are a moron. These are just affiliate marketers who get paid a certain amount per survey filled out. You and your long, intelligent stories.
I agree with Marty, 100%… Jessika3, don't be rude.
IS THERE ANYTHING I CAN DO TO STOP THEM BEING AS I JUST WATCHED THE VIDEO ON THE HARMLESS PRANK TURNS TO TRAGEDY? I ALREADY DELETED IT FROM MY WALL AND MY APPLICATIONS. CHANGED MY PASSWORD TOO. ANYTHING ELSE?
Make sure that you have revoked permissions for the application to access your profile too (as described in the article)
What are you talking about? They get 2 bucks from each survey people complete… This is the key for these your so called "hoaxes"… Do research before writing nonsense.
To make matters worse, you don't ever really know when Facebook updates their privacy policy. And each time they do, all of your settings revert back to their default settings, which lets everyone view everything on your page. I don't understand why they don't make the default settings so that nobody, or at the very least your only your friends, can view your page and the info on it. Just idiotic!!
thanks for the info..good thing i checked it out before following the link…
i didnt realise fb could have this sort of things
I know right
If u like somthing like this can u get hakked??
I clicked on it but nothing happend.
Well generally when I see crap like that posted I say to myself, " If it is such a big story, why wasn't it on the news tonight?" I know it's a crock of crap. Just like the, " I will never eat McDonalds again" crap. I wish people would get a life and stop trying to make money by screwing up peoples computers….
When I clicked on the link posted on a friends wall for one of these, I saw that you had to like it and give it access to a lot of unnecessary information to use it. Then I saw you had to do a survey to access the content. So I reported the application as SPAM. Will this do any good towards getting it removed?
i clicked as well and did those surveys..had to put my cell number and like an idiot i did 3 times…whats going to happen now?
Often they want your cell number because they intend to sign you up for an expensive premium rate service. The small print should have told you how to unsubscribe from. In the UK you can contact an organisation like PhonePayPlus: http://www.phonepayplus.org.uk/ who regulate such services. Other countries may have similar bodies.
you need to change your password…and not click on any type of these links anymore….oh and make sure you run your antivirus software….i know that should seem obvious..but………………………………
I have clicked on a similar post that said "click here to see the status update that got a girl expelled from school" after a friend posted it to my wall. It sent the link to everyone of my friends with a message saying "ha ha she is so busted" that I couldn't delete. A couple days later my account was hacked.
Why would anybody in their morbid mine be sooooo curious to find out more information? This is the reason why scams, and viruses spread so quickly around the internet. This is why people get hurt and this is why computers get fried. Grow up!
lmao…is this rlly serious?…my sister-in-law just clicked it…
I also clicked on it. It was posted in the info area of a fb friend. Like it was her own link. Anyhow, facebook has blocked it. It will not allow anyone to connect to it. And it doesn't leave a virus. Only way to get a virus is by executing a program onto your computer.
Have a good anti-virus program and firewall and you shouldn't have much of a problem. If you have a mac, you wont ever get attacked. I use Norton and it blocks everything it's supposed to. Also, firefox browser is the safest you can use and will also block bad sites..
yes.. this should be post at facebook. so people,( especially here in the philippines who were found of liking those pictures or articles that will come out in each pages) will be alarm!!!
I clicked like an the had me chose from a quiz an when I finish they still didn't let me see the post
If you clicked on the link and think you could possibly have a virus, then I'd do a virus check with your computer. I have received viruses from Facebook.
Maximise? Really?
What's wrong with that? Do you mean the spelling? I'm English y'know.
Is there really a girl that killed herself on xmas eve? If there is can you tell me what happened? I already took the survey and I'm afraid the post will keep coming back. It does! What should I do? Please answer both questions. Please!
No. Did you even read the article? The whole thing is a scam.
I clicked on that page but it did not open..Good for me!haha..
i have been doing the survey and now the page is written happening now
what should i do now….?????????
please give me advice…. thank you
There's advice at the end of the article on how to clean-up your Facebook account.
i jus went thru that whole thing and gave my cell number and my email what do i do!!!
I know its a hoax but I still want to hear the story on that, a girl killed her self over a facebook post by her father? Thats pretty sad. Even if it is fake, made up or exagerated.
It's all made up, Rex.
thanks for the info sir.. i almost had to click it…
if you're concerned if something is legitimate, people should try searching for that particular "headline" string on google and see what comes up … for this one, "Girl killed herself, after her dad posted This to her Wall" a lot of the first ten hits mention "hoax" or "warning" or "scam" .. these are great indicators that you probably want to avoid that page. ^_^
I clicked on my friends link, and it asked me to "allow" certain information, then it asked me to take a survey to prove I'm at least 16 years of age due to certain content, I did click on a survey to take, but didn't take it because I figured it might be a scam. I "x'd" out of it immediately, and said to heck with it. Do you think I'm okay? I haven't had any trouble AS OF NOW, but it was only like 30 minutes ago…
Jess
Check your profile to see if any messages have been posted from your account promoting the scam further to your friends. Also, check your list of applications (as described in the article) to see if you need to revoke permissions for anything, so they can no longer access your account or make postings up there.
oh i clicked on it too but i didn't accept anything …this is office computer please help me i hope id idn't get virus
If you didn't give the application permission to access your profile, and haven't had any references to the girl killing herself appear on your Facebook page, then you should be fine.
Why on earth would you want to even look at these links even if not spam?
So what IS the actual story?
well 1 thing is certain for you Graham, job security. until we internet users as a whole gain enough sense to know what is what and what isn't.
If I'm not mistaken, the photo is of a girl who committed suicide after a neighborhood mother pretended to be a teenage boy and tricked this poor young lady into thinking she had a boyfriend. Then, still posing as the boyfriend, broke up with her and said very mean things to her. This is what caused her to kill herself. This was all a couple of years ago, and I think the mother ended up getting little more than a slap on the wrist.
This is just a mean trick to get money.
The message is attractive, so one is curious.
But with each click or view the person that posted this gets money per click.
yea i took a survey and put in my number. but its disconnected right now but im get it back soon with the same number i put in the survey but i did all the stuff u wrote wat happens now?
If you gave them your cellphone number it's *possible* that you might now be signed up for a premium rate cellphone service. You may need to unsubscribe from that to prevent getting billed further.
I clicked on it but saw it was a hoax and then to avoid survey shut down windows had to force restart but it came up on my wall anyway, then I followed your advice but it wont go.
So, you've revoked permissions for the application to access your wall *and* you've deleted all the references to it from your newsfeed?
Well, i think the truth is being said: “let’s educate the
lot!”
I cant believe scammers would use HER for a scam!! Thats pretty damn heartless!!!
These scammers really piss me off! No respect for the girl!> 🙁
I think its all fake! Reply if ya agree
I know it was all fake but i would realy like to know what the story side. Can sombody please tell me.
IT DIDN'T SAY ANYTHING!!!!!!!!!
WOW yous are quick on the uptake!
Everytime i go on facebook my friends post one of the things on my wall i click on it and then i leave it my friend wont listen to me when i tell them its a scam and they keep doing it i need some professional to tell them its a scam!!!
I can't believe people are actually clicking on a link that says "This girl killed herself".. How sick are yous!!?? Actually disgusting behaviour.
Hi Graham, I too click it and got sent to a survey which DID NOT complete, I got to the part where they wanted my email, phone#, home address and name. I exited out of it so am I still at risk? I don't have anything that I can find that refers to that link. Like I said as soon as I saw that they wanted my home info and about the 3rd party stuff I quit the survey. Am I ok? Thanks in advance.
If you follow the instructions in the video, you should be able to clean-up your Facebook profile (if it's been affected)
Hope that helps
i did it on my mums all the survey.. to my mums adress sayin i could win tickets to thorpepark.. what does this mean??????? i removed it from profile will it be ok?? wb pls!
My mom clicked the link and it posted to her profile, now she is unable to delete it! What should she do?
I'd recommend following the advice we give in the video.
More details here: http://nakedsecurity.sophos.com/2010/12/20/how-to…
I just saw this one a friend status, and when I clicked to check it out I saw that it was an app. So I looked this up online before I went any further.
I have received a same kind of message in which the link takes us to a Facebook App.
i did allow but i didn't like the page… is my comp now on risk to have those scam..???
i need help because i already took the survey and sent in details and i dotn know what to do because im not sure if i will get hacked or not so what do i do if i already took the survey as i never knew itr was a hoax:S please help:(
hey mine keeps sending to everyone on chat can you help me please!!!
Ive got a question…i realised that i authomatically liked 2 scam pages without confirming but now when i click on them it takes me to error 404…so i cant unlike them by clicking "unlike" on the actual page.
Is there a chance to remove it from my likes and interest??
Thanks 🙂
I think we should leave the scammers be. This helps us identify and weed out the idiots and keep them off of the internet.
i may have accidently completed survey- does this mean that i am paying?
I saw this post and thought it was terrible. But I didn't go and click like or anything because I was feeling a bit suspicious today. So I copy and pasted into google, and you were the first result. Thank God I read this first, because now I can follow your video advice and get rid of all the other scams I've so naively fallen for. Thank you so much, you have no idea what a help you are!! 🙂
My mom almost clicked on the adds but she aid just to look it up on google and we found this on google good thing we didn't do the survey i just got this laptop on christmas and she was using it. tht was close
Teenagers Need Privacy!!!!!
i closed my FB account last weekend after 5 years… im sick of it. Between scammers, hoaxer, bullies and all driven by advertisers who will do anything for 'likes'… im sick of people [posting pics of dying children without permission and leading others to believe that clicking will somehow provide cash or help to child._Now online gambling is the next step for facebook, they will help to breed a generation of gambling addict and all the associated problems…_Their data ploicies and security suck, once FB became a mutinational trading business it started its downward spiral which will accellerate in the race to the bottom._
i clicked on it by mistake and it took me to a new page with a video that couldn't load so i exited out of it right away but it showed up in my recent activity under likes and won't let me delete it. what do i do? why won't it let me delete it?
I click on these all the time and nothing ever happens. It’s called AntiVirus, NoScript, and AdBlockPlus. Use’em, People.