Degreeless Teams and Loose Commitments

Consider following on social media!

Quick note: if you’re viewing this via email, come to the site for better viewing. Enjoy!

people looking into a laptop
Lee: Guys, I don’t like going to scriptingthewhy. Let’s just go back to work.
Jenn: Lee, you’re the intern, your opinion doesn’t matter. Now go get us coffee.
Photo by cottonbro studio, please support by following @pexel.com

Have you ever been on a team and no matter what or how hard any of you try, nothing seems to mesh well? You all get along and work well together but none of the ideas any of you provide for a project you’re working on yields any positive results.

Suffering the same circumstances of just being another failed new year’s resolution where either you or someone on the team falls off track by getting distracted causing scope creep.

Or no matter the pace that’s set it seems not to be fast enough and you’ll never see the project done.  How would you feel if I told you that adopting a different framework from what you’re familiar with might be the remedy to your and your teams’ problems?

As I have mentioned in a script before, this might be another process you will come to trust.

young running down the road
Tim: I have to be more agile; I can do that with sprints.
Z-Daddy: That’s the wrong agile, you don’t have to do CrossFit.
Photo by Our Anti Rafsanjani Gums, please support by following @pexel.com

Full Team Full Sprint

What’s this crazy new process, this insane new wave of thinking that’s going to see your party moving along so you can get done sooner rather than later?

You might want to switch to Agile. No, not being more agile although I see what they did there, and you will too. Agile methodology is a way to manage a project by breaking it up into several phases.

In software development, Agile practices include requirements discovery and solution improvement through a collaborative effort of self-organizing and cross-functional teams with their customers or end users.

Instead of betting everything on a “big bang” launch, an agile team delivers work in small, but consumable, increments. I know what you’re thinking, no this would not work at a casino if you tried this approach. In fact, this would see you being asked to leave the table with two well-dressed gentle-for-right-now-men wanting to “question” you and you’d be lucky to leave with a broken hand.

The Agile Manifesto for software development was a declaration of unifying philosophy from frameworks like Scrum, Extreme programming, and Feature-Driven Development (FDD). The Agile Manifesto greatly departed from the waterfall-style project management approaches that were widely in use prior to that time.  

The Waterfall methodology is a project management approach that emphasizes a linear progression from the beginning to the end of a project. This methodology, often used by engineers, is front-loaded to rely on careful planning, detailed documentation, and consecutive execution.

Translation, there’s an Everest amount of paperwork to do. So, if you look at it in a corporate way, Smokey the bear was right. You can prevent forest fires…by simply cutting down the forest.

Now, the following is in their words, and their wording is well… going to sound a bit interesting; “We are uncovering better ways to developing software by doing it and helping others do it.” Yes, this does sound like a spank me daddy moment. Come get yourself a Scrum Daddy. Okay, that was cringe, I’m sorry. Back to the manifesto,

Through this work, we have come to value:

  • Individuals and interactions over processes and tools
  • Working software over comprehensive documentation
  • Customer collaboration over contract negotiation
  • Responding to change over following a plan

That is, while there is value in the items on the right, we value the items on the left more.”

I think everyone would agree to add one more line saying, “pay to merit over able to punch the clock.”

a young man delivering items
Look at this and try not to have a Karen moment.
Karen: Sir, you don’t live here.
Photo by Kindel Media, please support by following @pexel.com

Taste of Agile

You may be wondering, who in their left-wing corporate America mind follows this way of thinking to get a project done? Well, you’ll be glad to know that there are a decent number of companies that use teams who operate in this fashion.

Agile is the best methodology to follow in cases of complex projects. A complex project may have various interconnected phases and each stage may be dependent on many others rather than one as in simple projects.

The most well-known companies that use Agile methodology are Apple and IBM (yes, we’re still not on speaking terms), Microsoft, and Procter & Gamble. However, there are many other companies that use agile as well, to great effect.

Yes, I know it might not taste like it, but you will be surprised to know McDonald’s uses Agile.  As you can figure Agile methods are preferred for large and complex projects.

So the next time you decide to go get yourself some McDonald’s, take a big bite and don’t chew, I want to watch you from the corner of the room swallow and take comfort in knowing a team of people puts that juicy maybe-it’s-real-meaty big bun action together for you to enjoy.  

Enjoy the read so far? Why don’t you consider subscribing so you can keep up to date?

two men sitting at a computer
Mark: Eric… I know it looks like you’re working on the project, but looking at your tabs I also see you’re…
Eric: It’s Stack Overflow, they just turned their colors to black and orange.
Photo by cottonbro studio, please support by following @pexel.com

Fixing Loose Ends

Ever thought about who and how this framework helps? Me neither until now. The Agile framework is a powerful tool that helps managers, team members, and clients work more efficiently and more effectively while delivering the highest quality product within the constraints of the budget.

You can think of this as an assembly line in a factory where the belt can go back and forth instead of just one direction. Agile produces important metrics like lead time, cycle time, and throughput that measure the team’s performance, identify bottlenecks and make data-driven decisions to correct them.

It seems like a lot of back and forth, but this is better than pushing a product out only for it to come back with a monolith list of items to fix. If you worked in the market of flipping houses, you will know that it’s the worst when you’re about to put the house on the market only to find more things that need fixing.  

young lady in graduation outfit.
Sarah: You mean I didn’t have to get a degree to join an agile team?
Z-Daddy: No, nor do you have to join CrossFit.
Photo by Leeloo Thefirst, please show support by following @pexels.com

Framing Degreeless

Do you need a degree to be Agile? Well with this being a framework and not job placement, you don’t need a degree however, many employers prefer candidates with a bachelor’s degree in a relevant field, such as Information Technology.

The need to have a degree in the IT field or any other fields where people have displayed, they can land a job or start their careers without one, has always been one of those weird barriers put in place.

It’s like having a bouncer at a nightclub and to get passed him, you simply dress as a ladyboy. Companies, it’s okay, you don’t have to be in the closet anymore, stop keeping the degreeless jobless.

My ranting aside, you don’t have to be a person or team in IT to be introduced to Agile. Each team will benefit from collaboration, recurring interactions, recognizing failure early, incrementing fast results, and finally continuous learning. If you wanted a position, you could become a Scrum Daddy.

Scrum Daddies should have significant work experience working with Agile as well as excellent teamwork and communication skills. Always remember to be a good daddy and bond with your children.

older gentleman seat at laptop and on phone
Honey, we don’t have to worry about my hip, some guy named Z-Daddy said we were thinking of the wrong agile. So, cancel the CrossFit subscription.
Photo by Andrea Piacquadio, please support by following @pexel.com

Made it this far and found this to be entertaining? Then a big thanks to you and please show your support by cracking a like, sharing this with whomever, scripting a comment, or plug-in to follow.

Would like to give sincere thanks to current followers and subscribers, your support and actions mean a lot and has a play in the creation of each script.

Do you find the Agile framework interesting?

Script a comment below about how you think it could help you.

Fishing Made Fun with Bots!

Consider following on social media!

Quick note: if you’re viewing this via email, come to the site for better viewing. Enjoy!

You know, every time I read one of these scripts, I learn something new.
Photo by Andrea Piacquadio, please support by following @pexel.com

Okay, so the threat isn’t coming from the future to wipe us out as we once thought. Maybe, and by maybe meaning actually, the threat is here with us in the present day. They attack us every day when checking our email or simply picking up the phone because the scam likely function wasn’t working this go around.

The rise of ChatGPT has not only given people that little nerdy kid to complete their essays for them but people are using a bot to trick a bot in order to land job interviews. But again, with good intentions soon follows malicious ones. 

We’re going to be going over what kind of attack this is, who is using it, its functionality and effects upon release and what are some ways you could protect yourself from being on the receiving end of a malicious connection.

I haven’t been living underneath a Volvo, but I guess hiding isn’t doing me any good neither.
Photo by Mizuno K, please support by following @pexel.com

The Attack

Like most of the computing world and people who haven’t been living underneath a VW 1984 Volvo, that’s a little easter egg for all the old faithful readers. If you’re not one, feel ashamed. Again, for the better part of the internet, most people already know what phishing emails are, but in case you’re unfamiliar and have been living underneath that Volvo, worry not, we have you covered on that one.

Phishing is the act of posing as someone or as part of an organization that an individual may or may not know. The whole objective is to get you (the victim) to interact with the provided link and give up your sweet, sweet information. Once this happens, a number of things can happen, however, the main result is you lose money in some form or fashion.

Who is Greg from accounting, and why did he send me a link?
Photo by Andrea Piacquadio, please support by following @pexel.com

Who Could It Be Now

Unfortunately, no individual or group has been named for using ChatGPT for malicious scams but that doesn’t mean we can’t tell you why they’re doing it. Scammers vary in diversity in ethnicity but many of them don’t diversify in skill level and sometimes… in common sense. Yes, scammers will even try to scam cybersecurity professionals, we don’t know why they do it but, it’s a thing.

Scammers typically use social engineering attacks, mainly phishing. Why? Because it’s easy to obtain an email address for a company, however, they have resorted to spicing up these emails by using ChatGPT.

For those who don’t know what ChatGPT is, we’ll tell you. ChatGPT is a chatbot that is trained to offer humanlike responses in dialogue. In a nutshell, you ask it a question and it gives you something it thinks an average person would say.

Enjoy the read so far? Why don’t you consider subscribing so you can keep up to date?

Thomas: I told you we lure in more people with ChatGPT.
Simone: Shut up Thomas and keep entering their credit card information.
Photo by Tima Miroshnichenko, please support by following @pexel.com

That Sinking Feeling

How do scammers use ChatGPT to improve their phishing emails you ask? Well, simple, the same way people are using this little chatbot to beef up their resume to outsmart the resume reviewer bot. The scammers simply input into ChatGPT something professional to say to you, adding a few official logos here and there, and before you know it you have what seems to sound like an official email from someone you may know or that job opportunity you’ve been looking for.

Once you fall victim to the scam a number of things can happen and none of them are good. Interaction with a malicious link or attachment could have your system compromised by downloading or visiting a redirected site for a drive-by download, at this point depending on the programming in the payload, the file could execute with or without your interaction.

This, in turn, leads to a back door being created for data exfiltration—this is the act of collecting all the information on your machine and sending it to a command-and-control server for either personal use or marketing on the darknet, and possibly seizing control of your machine at a later date.

Learn the scam, then you can play ball.
Photo by RDNE Stock project, please support by following @pexel.com

The Prevention

So, what are some ways one could be able to protect oneself in the vast sea of the internet? Well, double-checking with people who send you emails with attachments to verify it was indeed them is one way of helping yourself.

Always carefully read the body of the message to see if you can spot any misspellings or grammatical errors as this will tip you off into saying, “I know Greg from accounting might be a bit special, but he wouldn’t write something like this.”

If you have encountered a phishing email and downloaded something or interacted with their link, changing all passwords on all accounts you own will be your next best course of action as this will quickly hinder the attacker’s progress into mucking up your life.

Pair this action with monitoring your accounts for any suspicious activity and keeping your financial institution’s number on speed dial in case you have to make that call saying, “Um, yeah, that latest activity wasn’t you,” will see you better in the years to come.

ChatGPT may be helping the scammer’s game, but common sense and a little know-how still outperform all.

I never thought protecting my information would be this easy. Thank you Scriptingthewhy. Love you Z-Daddy!
Photo by Andrea Piacquadio, please support by following @pexel.com

Made it this far and found this to be entertaining? Then a big thanks to you and please show your support by cracking a like, sharing this with whomever, scripting a comment, or plug-in to follow.

Would like to give sincere thanks to current followers and subscribers, your support and actions mean a lot and has a play in the creation of each script.

Do you feel like there is something I may have missed on Phishing with ChatGPT? Script a comment below.

Googles Banking on More Than Apps

Consider following on social media!

Quick note: if you’re viewing this via email, come to the site for better viewing. Enjoy!

Gina: Why does it seem like I never have any money?
Z-Daddy: Inflation. Politics and inflation will cause that.
Photo by Andrea Piacquadio, please support by following @pexel.com

You know, it seems like everyone wants to be like Capital One and find out what’s in your wallet, and with the recent threat on the Google Play Store, they may have found just that.

Trojans are clearly not a new problem seeing as though they’ve been around since it seemed like stuffing a wooden horse full of sweaty men ready to murder was a good idea, but as of late they have been on the rise, and this is especially when it comes to applications for Android devices. Yes, Android community, again in danger you are.

In an effort to sort this banking madness out, we’re going to look at what kind of attack this is, who used it, its functions and effects upon release, and what are some ways you can protect your bank account from decreasing due to the threat actor inflation.

You ever get that feeling like your wallet is getting fisted?
Photo by Pixabay, please support by following @pexel.com

The Attack

The Google Play Store is getting hit with banking trojans but the latest one is racking up some numbers under its belt. Banking trojans for those who may not be familiar are malware that tries to steal your credentials to gain access to your financial institution.

This one has been around since 2021 and has gone by other names such as TeaBot and Toddler but its current name is Anatsa. What makes Anatsa interesting is that it was spotted hiding among utility apps like PDF (Portable Document Format) readers and QR (Quick Response) code scanners.

The use of these allows for credentials to be siphoned from its users. Anatsa is proving to be a large threat by targeting over 400 financial institutions across the world, making it the most prolific banking malware to date.

The best never get caught, kid. Never meet your heroes.
Photo by Connor Danylenko, please support by following @pexel.com

Who Can It Be Now

As with all good threat actors who use malicious software and evade detection, no one person or group has been appointed for using the Anatsa malware.

But it has been noted that threat actors are hiding the malware among applications for people to download in hopes of collecting their information.

This was pointed out by ThreatFabric which is a firm that provides expertise and security tools to mitigate fraud to banks.

Enjoy the read so far? Why don’t you consider subscribing so you can keep up to date?

From the sewers to the main street and now into your wallet. We’re all floating to the big time Georgie.
Photo by Wilson Vitorino, please support by following @pexel.com

The Sinking Feeling

Anatsa can perform overlay attacks—this is the act of having what looks like a legitimate window (i.e., a fake Google webpage) when really it is tricking the user to give sensitive information, stealing credentials as well as logging activities, it does this by abusing the permissions to Android’s accessibility services API (Application programming interfaces).

In the latest activity, it has seen the dropper apps (trojan apps) after being installed, perform a pull request from GitHub page that is pointing to another GitHub URL (Uniform Resource Locator) housing the malicious payload. This aims to trick the victim by posing itself as application add-ons.

This is thought to be done by using sketchy advertisements. Another thing that the droppers make use of is the restricted “REQUEST_INSTALL_PACKAGES” permission. This is commonly exploited by most rogue apps hosted on the Google Play Store.

If you find you have any of the apps listed below, then you may have been infected.

  • All Document Reader & Editor (com.mikjaki.documentspdfreader.xlsx.csv.ppt.docs)
  • All Document Reader and Viewer (com.muchlensoka.pdfcreator)
  • PDF Reader – Edit & View PDF (lsstudio.pdfreder.powerfultool.allinonepdf.goodpdftools)
  • PDF Reader & Editor (com.proderstarler.pdfsignature) / (moh.filemanagerrespdf)

These five apps have been updated since the first publication, this is most likely in a sneaky attempt to cargo the malicious functionality after passing the app review process during the first submission.

Google Play Store dropper apps have grossed over 30,000 installations to date which indicates there is an official storefront app for distribution of Anatsa. There is a list of countries that are of interest to Anatsa based on the number of financial applications that have been targeted.

This latest campaign shows the threat landscape that banks and financial institutions face in today’s digital world is shaping to be a bit of a problem. Imagine what would happen if we switched to an all-digital currency.

Oh god, I have to edit and raffle through apps too. I HATE THE INTERNET!
Photo by energepic.com, please support by following @pexel.com

The Prevention

The interesting problem is since transactions are being made from the same device, it’s proving to be very challenging for anti-fraud systems to find. Some ways that may help in securing your information are reading comments, reviews, and fishing through past user reviews before opting to download and install.

Be mindful that when it comes to downloading from third parties who require downloading from an unknown source you are to exercise extreme caution and scan before choosing to complete the installation.

Running scans and digging through comments can be a bit of a hassle but trying to quickly recover from having people leave with everything in your wallet could be more of a hassle.

Tish: Okay, so Scriptingthewhy is somewhat informative.
Dave: It’s more than you knew yesterday, I’d say they’re pretty informative.
Photo by Edmond Dantes, please support by following @pexel.com

Made it this far and found this to be entertaining? Then a big thanks to you and please show your support by cracking a like, sharing this with whomever, scripting a comment, or plug-in to follow.

Would like to give sincere thanks to current followers and subscribers, your support and actions mean a lot and has a play in the creation of each script.

Do you feel like there is something I may have missed on Anatsa Trojan? Script a comment below.