j027

You can likely disable developer mode after installing the app.

I’m not sure if you would have to re-enable it every time to sideload updates or new apps. You can also install via adb with no waiting period.

You can, but since android 7 IIRC apps don’t trust the user store by default (unless you have root and add it to the system store or patch the app to trust the user store)

There’s a limit of free hours per month that comes out to 2 cores and 12GB RAM. If you go over it then you get charged with the pay-as-you-go option.

It used to be 4 cores and 24GB RAM in the past for at least 4 or 5 years but it recently changed.

If you are on the pay-as-you-go tier, I would check if you are being billed. Always free for the ARM instances works by giving you a certain number of hours free, so if you go past that you may get billed

The suspension that was public facing lasted 90 minutes, but they couldn’t log into the account for hours

See https://bsky.app/profile/ezralevin.bsky.social/post/3my43atj...

The always free was recently cut to 12 GB RAM and 2 cores per month.

https://docs.oracle.com/en-us/iaas/Content/FreeTier/freetier...

Another major issue is google safe browsing whitelists many of these subdomains that the attackers like to host their scam pages on.

As a result, even though "Enhanced" safe browsing can use Gemini Nano to do client side detection of scams and then flag it in google safe browsing for everyone, the entire domain and all subdomains are whitelisted, so that detection never seems to actually fire. https://blog.google/security/using-ai-to-stop-tech-support-s...

I'm not sure which domains this applies to, but it seems to apply to most of the domains that these scammers actually like to use.

Wow I am surprised to see this.

I created a tool that automatically follows ads to try to find scams.

But that was usually reserved to typosquat domain ads or ads on porn websites. I didn't know scammers used normal page ads too.

I know tech support scams used to use google search ads, but I don't think they do that as much anymore, so maybe they have moved onto things like adsense.

These scammers usually do IP address checks to check for residential IP before showing the scam, and some also do some basic fingerprinting checks, so that is how they get past detection. That said, it shouldn't be too difficult for google to do some better checks if they actually cared.

I don’t understand this being a “national security” threat.

Besides, mobile proxies exist which work differently. All you need is a mobile data plan that you run a proxy server on. It allows for easy IP rotation and since it’s a pool shared with other customers you cannot easily block it. This is because of things like CGNAT.

IP rotation is easy because reconnecting to the network gives you a new IP address.

Static residential proxies also are a thing, even if they are less effective sometimes.

Depending on the IP reputation as well as the kind of IP address you have, this can happen.

Google also prefers if you have a Google account logged in.

Phone verification services exist to give you a real number for the purpose of passing this kind of verification.

They even have APIs for these services. They make money since they can use the same number to verify different things.

This sounds like some LLM to me

To add onto this, cloudflare switched away from recaptcha a while ago. https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptch...

I think they now use their own Cloudflare turnstile if I remember correctly, but back then they switched to hcaptcha.

You can still use the audio captcha, but I’m not sure how long that’ll be around.

Canvas seems like it’s not that great. But if you then use Blackboard Ultra it makes canvas look amazing.

OP here. My university was targeted by a recent phishing attack, and these are my findings. I hope this helps others, but this was my first experience with an Adversary in the Middle (AitM) attack.