Security – Page 2 – Scriptingthewhy.com

Google Ribbed Play Store

Consider following on social media!

Quick note: if you’re viewing this via email, come to the site for better viewing. Enjoy!

Tucker: What’s with this scriptingthewhy nonsense? You actually like this stuff?
Becky: Granddad, just read it. You might learn something.
Photo by cottonbro studio, please support by following @pexel.com

Picture this if you will, you’re on the Google Play Store. You’re clicking around, hopping in and out of application descriptions, and viewing all the potential great ideas that developers have worked tirelessly to create and you’re just having a beaming time.

While rifling through several apps, you find one particular to you and figure to download it. While watching the app’s progression in downloading you begin to get an eerie feeling like something may be off.

Let me script for you how things may get interesting in the days to come. Trust me, you’re not going to love it.

Oh come on Zeroclay, what about my phone isn’t safe now!?
Photo by Olha Ruskykh, please support by following @pexel.com

Few Malware Apps a Ton

If you have an Android product, then there is a high chance that you have spent some time on the Google Play Store viewing tons upon tons of applications just waiting to be installed on your phone.

Now while it is common knowledge that the Play Store is a trusted source, that does not necessarily mean that everything on the Play Store is a trusted product. As of recent there has been a surface of a malware called “Fleckpe”.

Fleckpe is an Android Trojan that first appeared at the start of 2022 and not only has it amassed more than 620,000 downloads, but it has been receiving upgrades as well.

But I can hear a few of you reading this saying “Z-Daddy, I’m not clear on what a trojan is.” And to those few, don’t worry, I got you. A trojan is malware that is disguised as a legitimate program and when installed, is released, and can wreak havoc on your machine. Clearly, this trojan isn’t ribbed for your pleasure.

Also, one of the upgrades has a nasty secret feature you’re not going to be happy about knowing. Needless to say, this trojan is packing and again, it’s not for your pleasure.

Evan: he said it had affected here, here, and here.
Ms. Simon: You’ve been reading scripts again instead of doing your homework, haven’t you?
Photo by Tima Miroshnichenko, please support by following @pexel.com

Packing the Details

So, what are some of the areas that are feeling this trojan’s imprint? Well, since this is on the Google Play Store and the Play Store has users in a lot of countries leading this to be pretty much set on a global scale, you can count on this imprint to be globally distributed.

Although, areas that have been confirmed to be affected are Thailand, Indonesia, Singapore, Malaysia, and Poland. As a side note, it has been noted that authors of novel viruses, malware, and trojans alike have said that they are pleased when their creations go places where they can’t.

One author had said that even though the US had kept him away, the fact they couldn’t do the same with his creation was a satisfying feeling.

Enjoy the read so far? Why don’t you consider subscribing so you can keep up to date?

What’s this nudemidgetcowgirlsfromouterspace subscription and why is it $29.89 a month? I never signed up for this!
Photo by MART PRODUCTION, please support by following @pexel.com

Unwanted Subscriptions and Spin

Are you wondering how this trojan worked? Once you had downloaded and installed one of the eleven infected applications from the Play Store, which were used either for photo editing, wallpapers for the background of your device, or an application that involved the camera, the good times would roll downhill…along with your credit score.

The infected app would request access to notification content that is required to capture subscription confirmation codes for an array of premium services. Fleckpe then springs into action, decoding its payload containing infected code. The payload contacts the command-and-control (C2) server that relays information back to the attacker about the newly infected device.

This includes the Mobile Country Code (MCC) and Mobile Network Code (MNC). Following this would be a paid subscription page that is opened on an invisible web browser window and attempts to subscribe on the victims’ behalf by abusing the granted permissions and obtaining the confirmation code required to complete this step.

Yes, this is exactly what you’re thinking. It’s like having your spouse sign you up for a spin class without your knowledge and opting for the highest difficulty so they can get a laugh.

Ugh, unwanted bills, spin class, and subscriptions. How do we stop this one now Z-Daddy?
Photo by Tima Miroshnickenko, please support by following @pexel.com

Watching Bill and Company

Are you ready to take some steps to ensure this doesn’t happen to you? There are a few steps you can take to ensure that you don’t get imprinted with this trojan on your device.

One way is just to be cautious of downloading apps from both trusted and unknown sources. Being vigilant when dealing with requested permissions during the installation process and keeping a watchful eye on your billing statements to catch any unauthorized activity such as subscriptions and charges.

Below are the comprised apps:

Beauty Camera Plus (com.beauty.camera.plus.photoeditor)
Beauty Photo Camera (com.apps.camera.photos)
Beauty Slimming Photo Editor (com.beauty.slimming.pro)
Fingertip Graffiti (com.draw.graffiti)
GIF Camera Editor (com.gif.camera.editor)
HD 4K Wallpaper (com.hd.h4ks.wallpaper)
Impressionism Pro Camera (com.impressionism.prozs.app)
Microclip Video Editor (com.microclip.vodeoeditor)
Night Mode Camera Pro (com.urox.opixe.nightcamreapro)
Photo Camera Editor (com.toolbox.photoeditor)
Photo Effect Editor (com.picture.pictureframe)

Make sure you check the reviews to see if anyone has had or is having issues with the application. If you find that you have downloaded one of the following applications that were compromised, uninstall them immediately and keep a watchful eye on your phone bill.

The main thing you can do is remain vigilant as scammer scamming is increasing on the marketplaces such as Google Play. All-in-all, it’s best practice to just keep a watchful eye on your bill seeing as though there is no real sure-fire way to protect from the bad guys getting in. Security is always secure enough, it’s never 100%.

Tom: I’m great goalie…but even I can only stop so much.
Photo by Tony Schnagl, please support by following @pexel.com

Made it this far and found this to be entertaining? Then a big thanks to you and please show your support by cracking a like, sharing this with whomever, scripting a comment, or plug-in to follow.

Would like to give sincere thanks to current followers and subscribers, your support and actions mean a lot and has a play in the creation of each script.

Do you feel like there is something I may have missed on Fleckpe? Script a comment below.

AI, Cloud Talk, Programming, Security, Tech

Big-Techs Bittersweet Symphony

Quick note: if you’re viewing this via email, come to the site for better viewing. Enjoy!

man waking up and stretching in bed — First thing in morning…I wonder what’s on Scriptingthewhy.com
Photo by Kampus Production, please support by following @pexel.com

Have you ever woken up, walked into the kitchen, put your hand into your toaster, flip it on, and while it was heating up thought to yourself,” This is a good idea, I mean my hand is starting to burn but I’m okay with this”? No, me neither but yet somehow, we complete this same action every day at work.

While “we the happy few” go to work and enjoy it there is a mass amount of people who do not but in either case, the result is the same, we take part in a cycle. Get up, get dressed, grab your bags, head to work, work your standard eighty hours, get your paycheck, pay your bills, complain throughout the process, and repeat.

We complete this cycle for various reasons but whatever those reasons may be, this cycle hides away a question from the forethought of our minds that we should be asking ourselves and searching for an answer. “What would I do if my employer had to let me go?”

In case you were wondering, the reaction to pulling your hand out from the toaster is the thought that you should be aspiring to do something more than your current position. This symbolism hits all too hard.

woman in bed holding smartphone in shock. — We know it’s your day off, but could you still come in and hand over your badge?
Photo by Andrea Piacquadio, please support by following @pexel.com

Heartbreaks and Layoffs

I don’t know how many of you reading this have ever experienced a layoff before, personally, I have not. I mean, I experienced being laid off in a relationship (it was her choice, not mine) but I could imagine the feeling of your heart dropping into your gut, and experience trembling throughout your very existence would be the result.

For those who don’t entirely have a good idea of what a layoff is; in short, the employer may come into a situation where they have to terminate your employment, the reasons can vary from trying to cut costs, lack of work, or funds because of reorganization, or even mergers and acquisitions.

Breaking this down in relationship terms, this is the classic “It’s not you, it’s me” situation. This differs from being fired because, well… being fired is something that happened on your end. So, again, in relationship terms, this is the classic “I’m breaking up with you because we’re just not meant to be” situation.

Breaking hearts aside, if you have been living under a rock, the company Google, is a subsidiary of Alphabet Inc that focuses on various business areas such as advertising, search, platform, and operating systems, and the list goes on, had to perform a massive layoff and people were informed via email, that they were being let go despite their longstanding with Google.

Again, haven’t been laid off before but I could imagine your world becoming microscopic after reading the email. This is heartbreaking because there are many people who spent their better years trying to acquire a spot in Google only to be treated like a mishandled Door Dash order and be left out curbside.

a team of people at a table going over data. — We should start making plans in case this company starts downsizing.
Door Dash here I come.
Photo by RF._.studio, please support by following @pexel.com

Letting Go by Numbers

You may be curious to know how many people and why is Google laying off. As of right now Google either has or seeking to let go of about 12,000 employees. And interns looking to land a job with Google have been put on freeze with a chance of having to pivot their plans because landing a job at Google isn’t looking promising anymore.

Google’s CEO Sundar Pichai informed employees this decision resulted from the realization of unrealized growth expectations. This translates to, if you have ever thrown a house party, I invited too many people and a good chunk of you have to go. So sorry folks but don’t forget to tip your bartender and close your tab on the way out.

This makes Google the latest tech giant to “trim the fat” after the rapid expansion during the COVID-19 pandemic had worn off. Pichai did take full responsibility for the decision however, this doesn’t soften the blow but at least he did address his muck up.

Yours truly even applied at Google and like most of the companies I’ve applied to, they scoffed at my achievements because I didn’t come from a university or have the certifications, they were screening for but after applying for their apprenticeship program and never hearing anything more about it, this all makes sense now.

young man sat worried. — I have spent years in school, I never gave much thought into pursing other skills.
Photo by cottonbro studio, please support by following @pexel.com

Being The Jack of Spades

This brings things back into perspective from the introduction I made earlier. Not the toaster part but that has a play in it too. What would you do if you had to part ways with your employer and either have a small chance of coming back or none?

After spending years on the conveyer belt traveling from school to college and from college to fall into a position in a company that you hope to carry you into your golden years, you find the world is changing and companies of yesterday have less of a care for their current longstanding and hope-filled potential employees due to having to rapidly change.

A thing about jobs is that they are meant to be a short-term service while having a career, on the other hand, is better but not the best since you must specialize in something. The problem with this is you have to be careful with whatever specialization you choose because it could either contribute to oversaturating the market or end up being such a small niche in the wrong area that people have no use for it.

A solution to preparing for this situation if you are ever so unlucky to come face-to-face with it is to treat your skills like a stock portfolio and be diverse as possible. Be the Jack of All Trades and master of none because in this case, it’s better than being a master of one.

I’m sure there are a few people in Google who were able to shrug off being laid off because either they have a decent amount saved in their savings plan or they have other skills they can rely on. But for a large amount of them, this is removing the blinders and a rude awakening. If you noticed, in school you’re never taught how to adapt to change.

highway near trees under cloudy sky. — Either experience the storm of change or be the storm of change.
Photo by Lucas Martins, please support by following @pexel.com

Made it this far and found this to be entertaining? Then a big thanks to you and please show your support by cracking a like, scripting a comment, or plug-in to follow.

Would like to give sincere thanks to current followers and subscribers, your support and actions mean a lot and has a play in the creation of each script.

Have you ever been laid off before?

Script a comment below about it.

Security, Tech

Caller ID is Inop, Please Try Again.

Consider following on social media!

Quick note: if you’re viewing this via email, come to the site for better viewing. Enjoy!

Oh a new post, I guess I get to see what all this Scriptingthewhy nonsense is about.
Photo by Mike Jones, please support by following @pexel.com

Scammers are trying to get people with the old hook, line, and sinker. Phishing emails aren’t the only thing you have to be on the lookout for, well, in this case, keeping an ear out for.

Scammers have turned to fishing phone calls to lure potential victims into giving most if not all their information. We will be looking at what kind of attack this is, who used it, the functionality, and effects upon release, and what are some ways to keep safe when you’re just trying to use the phone to call Nana.

Who are these people that keep calling me fam?
Photo by Liliana Drew, please support by following @pexel.com

The Attack

What are the latest attacks on the internet coming up like gas prices and rising panic of the future? Look no further than what’s called “vishing.” This version has been named “LetsCall”. If you’re under a rock and have no clue, don’t worry, we got you.

Vishing is similar to email phishing; this is the act of posing as someone the victim may know or a reputable business in hopes they fall victim and leak sensitive information.

Vishing is done differently because this attack uses the phone instead of sending the victim a letter saying “I’m a prince with a lot of money and I need your account to hide it in.” And before you ask, yes, people still fall for that.

Hello, it’s me. I was wondering if all these years you’d like to meet.
Photo by Tan Danh, please support by following @pexel.com

Who Can It Be Now

Since its release on the market and a lot of threat actors are using it, no one person or group has been made a name for using it but that doesn’t mean someone won’t slip up in the future.

It is believed that the group of threat actors consists of both front-and-backend developers, designers, and operators who specialize in voice social engineering.

This is a nice little mix of; down let your guard down but don’t get your hopes up.

Enjoy the read so far? Why don’t you consider subscribing so you can keep up to date?

When it comes to the world, it’s a game of chess.
Photo by Pixabay, please support by following @pexel.com

That Sinking Feeling

LetsCall has been used to target users in South Korea but given how crafty it is, it’s believed that attacks have expanded since its release to European Union countries. This is a growing concern because LetsCall comes ready to go out of the box and this means anyone can use it.

It has been noted that there are three parts to this attack. The first step is, as with many phishing attempts where a fake site is created for the victim to interact with, in this case, it’s the Google Play Store. From there they download the first portion of the application chain attack.

Once the application is installed and run, it redirects all incoming calls to a call center controlled by the threat actors. In the call center, there are trained operators posing as bank employees, this is done with the intent to extract sensitive bank information.

To facilitate connections and bypass firewalls, threat actors make use of the Voice over Internet Protocol (VoIP)— is a technology that allows the user to make internet-based calls instead of using a standard phone, and Web Real-Time Communication (WebRTC)—which allows for audio and video to work within webpages by allowing peer-to-peer communication.

So in short, once this is on your phone, the only people you will be able to contact is the call center.

When it comes to your information, operate with top secret clearance.
Photo by Caleb Oquendo, please support by following @pexel.com

The Prevention

At this point, we’re assuming you don’t want to make friends with people from a random call center and you’re looking to protect yourself. A good form of protection is to use and do not disclose your 2MFA (Two-Multifactor Authentication), password, and any other possibly sensitive information.

Check your caller ID before answering as you could more likely tell by the number that it’s a scammer calling you. If you choose to engage with the scammers, explore how much information they are willing to give you regarding their full name, the company they’re working for, and the reason pertaining to the call, and request an extension number in case the call drops.

You should red flag anyone requesting payment via prepaid or gift cards as this will be the payment method of scammers and not a legitimate organization. Any questionable or suspicious interaction should be documented, and authorities should be involved.

Remember, the best kept secrets are the ones no one finds out about.
Photo by Ty Huynh, please support by following @pexel.com

Made it this far and found this to be entertaining? Then a big thanks to you and please show your support by cracking a like, sharing this with whomever, scripting a comment, or plug-in to follow.

Would like to give sincere thanks to current followers and subscribers, your support and actions mean a lot and has a play in the creation of each script.

Do you feel like there is something I may have missed on LetsCall? Script a comment below.