Published:
March 26 2009, 12:49 PM
by
Eugene Bodenshtein
FanIQ is one of the numerous sport social networking sites. What makes it less ordinary is a viral social engineering technique they use to solicit new members to create a FanIQ account.
The technique includes:
- Sending an invitation letter to all contact addresses listed in a recently joined member’s address book, without providing clear notice to the user that this will occur and that the user’s name will then be used to market their services without explicit authorization.
- Making a user think they are registering for something they are not.
- Providing not enough information about their service at the time of registration.
- Misattributing their wording to lure new users.
- Presetting attributes on the registration page to settings that the vast majority of users probably do not want.
- Not clearly explaining how users may opt to send invitations only to selected contacts
- Sending follow up messages on behalf of the user without making him aware his name is used to send repeated invitations to everybody in his address book.
- Using “expiration” warning to make others think the invitation is something special.
Below in steps 1 through 7 I will walk you through the steps FanIQ takes to acquire new members.
Step 1. FanIQ invitation e-mail may arrive as a private message with the name of a person who is in recipient’s contact list. Here, FanIQ sends a message to a recipient from what the recipient would deem a “trusted source”, leveraging the trust of that individual without that individual knowingly initiating the communication.
Note that email addresses in red circles are legal private addresses, so even though sender’s e-mail address actually belongs to a FanIQ automated service, the user might get impression the email was intentionally and purposefully sent to him by the person he has in his contact list – may be even his friend.
Step 2. Hyperlink in this e-mail takes you to FanIQ registration web page:
The page looks like an invitation to pass some funny IQ quiz which allows comparing results. It might be tempting for a friend to do so. And again, the page contains the original e-mail address of a person who sent the invitation. Registration is also asking to provide the user’s favorite sport and the sport athlete, which looks exactly like password protection and restore questions at this stage.
Important note, the phrase: “Hey, this quiz was fun – do it so we can compare” looks as though it is the user’s wording. By sending a so-called “private message” and attributing those words to the person on whose behalf the message has been sent, FanIQ is trying to convince the new member the original user said it. It is obvious misattribution.
Step 3. After pressing the “Done” button, the user is presented with a webpage that looks like it is just another step in the registration process, connected to Google Account services.
Notes:
- Username field is prefilled with the user Gmail account.
- Checkbox right under "password" field is set by default.
- Fine print near the checkbox and on the bottom could easily be overlooked.
- No additional information is provided on the page regarding how exactly the invitation is implemented. (Looking ahead, FanIQ sends 2 messages on user's behalf to his contacts)
- Safety note at the bottom states "We will only send invitations to the friends you select". In case you leave "Invite everyone on my contact list" checkbox enabled, no choice will be given.
Step 4. Next page doesn’t look anything like the quiz that was promised. The “quiz,” which can be found at right bottom corner, is a poll of sorts and nothing close to an “IQ” test.
Since the page looks far from what a user would expect – it probably will be closed and forgotten right away.
Step 5. Remember the checkbox with fine print on previous page? Every contact in the user Gmail account, not just “Friends” but EVERYONE (for example, my “All Contacts” list contains over 500 e-mail addresses and everyone got spammed) will be sent a FanIQ invitation to participate in this “quiz” as a private message from the user.
It is clear to me, that FanIQ intentionally makes the spamming process vague and does not provide clear, sufficient information for the typical user to give an informed consent, particularly with regards to Step 3, above, so that they can spam the user’s entire contact list and then spam their contacts and on and on -- type of viral spamming through social engineering. It is obvious, the site uses spam techniques to make a person believe he/she registers for one thing while he/she is actually fooled to become a source for sending spam to all people on her/his contact list.
Step 6. After few days, every potential new user who received an initial invitation as part of the spamming, and did not register on that site, will receive another message, a warning, stating:
This time, there is a message expiration time set for users so they would think the invitation is something really special.
Step 7. Basically, in order not to “spam” all his contacts with the invitation, an attentive user should stop on Step 3 of the walkthrough and intentionally deselect the “Invite everyone on my contact list” checkbox under username/password form. Now, after pressing “Done”, only then will the user be presented a page where he can choose specifically who to send the message to.
Note that only here FanIQ explains properly what kind of message will be sent, and how many times. Those who didn’t opt-out by deselecting “Invite everyone on my contact list” checkbox, never get this information at the registration time. Personally, I would prefer to see that page right after I pressed “Done” on the Step 3, regardless of the checkbox selection, so I could select all, some or none of the contacts after reading the important info circled in red and know what those invitees will receive using my name.
Conclusion
FanIQ has developed a refined social engineering technique and uses a misleading quiz message to lure people in, then uses the email address book of new registrants to spam all contacts in the address book to gain new members. During registration, FanIQ does not present enough information to the user to inform them that all their contacts will be spammed by filling in their username and password. The emails sent to potential members originate from a trusted source, so these contacts are more likely to follow through with the registration and start the whole spamming process over. You might call this a “viral social engineering” technique.