Category: Random

Completely random posts.

Be careful with app signing keys

Recently, I received an email from Google Play services. “Your app has been removed from the Google Play Store for a policy violation”, or something like that. How odd, I thought. I don’t remember doing anything against their terms of service. The email revealed that I didn’t have a valid privacy policy inside the app or on the store listing.

Oh. Right. The whole GDPR thing. It was time to write some privacy policies. After doing so, I began the process of digging up old files to old apps to make the necessary changes to the code. After about 2 hours of reinstalling Android Studio (my hard drive was wiped as some readers may remember), I began the process of exporting the app from Unity to an .APK.

Eventually, I was able to upload the finished .APK to Google’s servers. However, the Play Console threw an error at me; “The signatures do not match”. Wait, what? It’d been too long since I’d actually done this process. I googled the error to remind myself and broke out into a cold sweat.

Apparently, you generate a .keystore file upon first creating an Android app to sign the application with. It prevents people from uploading versions that aren’t originally from you, in the event that a developer’s account got hacked or something. There was no way to recover said .keystore file if you didn’t have it anymore, meaning there was no way to update my app. Ever. A full, in-depth system scan revealed no .keystore files. Luckily, with the two brain cells that were still functioning, I managed to remember that the other day I had deleted the app-which-I-was-updating’s Android version off my hard drive, because there was no real difference between the iOS and Android version, and I thought it was redundant. Perhaps it was in there?

I checked my Recycle Bin and breathed a sigh of relief. I hadn’t emptied it. It was still there. Opening the folder, the first thing I saw was a “user.keystore” file at the very bottom of the file list. A quick test confirmed that was the one. Phew.

Apparently those things are important. Don’t lose ’em, kids.

HEY, LISTEN! It’d be really cool if you checked out the app here on the play store, since it just got updated. 😉

It helps me if you share this post
https://rose.dev/blog/2018/09/19/how-i-learned-about-google-play-app-signing-keys/

Published 2018-09-19 15:02:16

Small PSA: It’s doubtful hackers are watching you watch

This morning, I received an email from a scrambled Outlook email address that claimed they had explicit recordings of me and demanded I pay them Bitcoin. Their proof? A password of mine from a few years ago. They’d probably acquired it in one of the numerous database leaks that happen all the time. Here’s the message with sensitive information removed:

I do know, [OMITTED], is your password. You do not know me and you're most likely thinking why you are getting this mail, right?

In fact, I actually setup a malware on the adult vids (sexually graphic) site and do you know what, you visited this website to experience fun (you know what I mean). While you were watching video clips, your internet browser began functioning as a RDP (Remote Desktop) with a keylogger which provided me with accessibility to your screen and cam. Immediately after that, my software gathered all of your contacts from your Messenger, Facebook, and email.

What exactly did I do?

I created a double-screen video. First part shows the video you were watching (you've got a nice taste lol . . .), and next part displays the recording of your webcam.

What should you do?

Well, in my opinion, $3900 is a fair price tag for our little secret. You will make the payment via Bitcoin (if you don't know this, search "how to buy bitcoin" in Google).

BTC Address: [OMITTED]
(It is cAsE sensitive, so copy and paste it)

Note:

You have one day in order to make the payment. (I've a special pixel within this e mail, and now I know that you have read through this email). If I don't get the BitCoins, I will, no doubt send your video to all of your contacts including close relatives, coworkers, and so on. Nonetheless, if I receive the payment, I will destroy the video immidiately. If you need evidence, reply with "Yes!" and I definitely will send out your video to your 12 friends. It is a non-negotiable offer, so please do not waste my personal time and yours by responding to this e mail.

There are a few things wrong here, which is why I immediately knew it was scam.

  1. A keylogger records keystrokes, it doesn’t provide people with the ability to look at my screen and webcam. There are methods to gain access to these, but it is not called a keylogger. Someone knowledgeable enough to pull this off would know this and use the correct terminology.
  2. I don’t have a webcam.
  3. Browsers do not have the authority to share my desktop, nor did I give any one in the last month or two.
  4. I don’t use Messenger or Facebook.
  5. I have 0 friends on my non-existent Facebook account, not 12.
  6. Numerous spelling mistakes all throughout the email.
  7. The generic mention of “adult vids”. Yeah, sorry. No.

But I do have to wonder how many others fell for, and do fall for this kind of scam. Always make sure your antivirus is up to date, use common sense, and make sure you keep your passwords updated.

It helps me if you share this post
https://rose.dev/blog/2018/07/11/a-small-psa/

Published 2018-07-11 14:42:21