YT YouTube2Text

YouTube2Text → Transcripts → Por qué ya no alcanza con descargar apps desde las tiendas oficiales

Por qué ya no alcanza con descargar apps desde las tiendas oficiales — Transcript

by ESET Latinoamérica · 4,883 words · 785 segments · language es · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00On July 14, 2026, the FBI arrested
0:02Siire don Tevius Samarion Wilkins,
0:05accused of distributing malware in
0:07Steam video games and infecting nearly
0:108,000 devices. During the nearly 2
0:13years this operation lasted, from May
0:152024 to February 2026, the
0:17cybercriminal stole $ 220,000 in crypto
0:19assets, according to the criminal
0:21complaint. The big question, then, is
0:24how did this happen if Steam has a
0:26review process and various controls?
0:28The truth is that neither Steam nor any
0:31other official download platform is
0:33infallible, and criminals know it. That
0:35is why they try to infiltrate those
0:37ecosystems, because they know they have
0:39something key and very valuable there:
0:40the trust of users.
0:42Connecting, connecting.
0:45Conexión Segura, the ESET Latin
0:47America podcast, your direct link to
0:49the world of cybersecurity.
0:53Hello everyone, welcome to a new
0:55episode of Conexión Segura. My name is
0:58Cristian Alibrando, and well, we are
0:59here as always; if you clicked play, we
1:01are here to talk about a topic linked
1:02to cybersecurity, but today we are
1:04going to talk about something more
1:05regarding trust. Specifically, about
1:09the trust that we as users often place
1:11in official download platforms and that
1:14perhaps can put us in a bind. Yes, in
1:18fact, a recent arrest made by the FBI
1:20reveals how a cybercriminal managed to
1:23sneak into an official platform like
1:25Steam. an infected video game and thus
1:29infect more than 8,000 computers and
1:31obtain various financial gains. Do I
1:34mean by this that you should no longer
1:36download applications from these
1:38official platforms? No, not at all. The
1:42advice will always be to use those
1:44repositories, but what we are going to
1:46analyze is why some of these controls
1:48are not infallible and why we should
1:50not trust 100%when we are downloading
1:52something, even if it is from an
1:54official platform. But to analyze this,
1:58I am not alone; I don't know, I don't
2:00want to say you are a guest because you
2:01are already part of this house. Mario
2:03Mikuchi, security researcher for Latin
2:05America. Well, Mario, a very important
2:08and everyday topic. We are going to
2:10analyze today
2:11an important topic, an everyday topic
2:14that involves all of us users who use
2:18mobile devices, basically, right? Uh,
2:23and that we use uh platforms in general
2:26, I mean, all users, basically.
2:28Totally. It is a general topic that
2:30impacts us daily. So well, specifically
2:33today what we are going to analyze is
2:35how cybercriminals manage to perhaps
2:37sneak a malicious application into an
2:39official repository. Why can't an
2:43official store guarantee that what is
2:45there is 100%reliable? And obviously,
2:48as users, what can we do in this
2:50scenario? So, well, without further ado
2:53, let's start the episode.
2:55For more information about today's
2:57episode, visit our website
2:58eset.com/atam. You can also visit our
3:02cybersecurity blog.
3:03welivesecurity.com/en.
3:09Well, Mario, and I apologize to the
3:11whole audience, sorry if I'm being
3:13repetitive, but in this first section,
3:15I want to make it clear that the advice
3:17was, is, and will always be to download
3:19any type of application and software
3:21from official repositories. Yes, I want
3:24to make this very clear. Now, what we
3:26must not confuse is that it is the
3:29safest option; we must not confuse it
3:31with it being infallible. Right,
3:35because although any type of official
3:37repository like Google Play, Apple
3:40Store, or even Steam, they have their
3:42controls, those controls are not even
3:45close to a real security audit. So, it
3:49will never be infallible. What I want
3:52to ask you, Mario, taking advantage of
3:54your expertise, is where does the flaw
3:56in this review process lie? Or what is
3:58it that the initial review process that
3:59these platforms have can detect and
4:01what things can they not? Okay. Well,
4:05in principle, there is no single way in
4:08which these review processes are
4:10carried out. Let's say it depends on
4:14each of the developers who upload the
4:17applications. It is not the same as
4:20someone who has their first application
4:23to upload, whether we are talking about
4:26the App Store, Play Store, or
4:28marketplaces in general, because that
4:31also includes Steam and so on. In this
4:35case, the processes are slow because
4:38the platforms verify the reputation of
4:40this new developer. However, the
4:44developer goes through a lot of
4:46bureaucracy, let's say, fiscal, etc.,
4:49because they also validate their
4:52country of residence, if they invoice
4:55or not. Well, this is like a particular
4:59case that we are talking about, new
5:01developers, so to speak. In the past,
5:04you only needed to have an account, for
5:06example, on the App Store or Play Store
5:08when talking about mobile applications,
5:09and you could upload the app. Well,
5:11that changed because today if one wants
5:13to be an official developer, you have
5:15to get involved in a whole program and
5:17so on. Now, assuming that the developer
5:21already has a reputation and a track
5:24record in the world of application
5:26development uploading to the stores,
5:29well, the processes are more lax, so
5:31they focus more on the reviews of the
5:34applications themselves.
5:38And, well, they are done a bit more
5:40quickly. Why? Because the developer
5:43already has a reputation that validates
5:45them, right? Which doesn't mean that,
5:49well, someone might perhaps do their
5:52homework for a while, only to upload
5:55malicious code or applications with
5:58suspicious behaviors once they've
6:01reached that reputation, we could say,
6:04right? So, given this situation, what
6:08the platforms do is validate, well,
6:11whether the uploaded applications have
6:15malicious code, if they respect the
6:17terms of the privacy policy; the
6:20various marketplaces also validate the
6:23type of content that these applications
6:27will process. When we talk about the
6:30type of content, we are talking about,
6:33well, age rating, meaning that, for
6:35example, if there is a device that is
6:38configured to be used by minors,
6:41well, on that device, an application
6:44that doesn't, let's say, respect the
6:46content rules, won't be able to be
6:49installed, right? In other words, there
6:54are several checks that are performed
6:59regarding, let's say, the generation of
7:03new applications, right?
7:05Very well. In fact, why do we say that
7:07this initial control you just detailed,
7:09Mario, is insufficient? Apple, last
7:12year, in a report it released regarding
7:15what was 2025, acknowledged having
7:17removed almost 60,000 applications that
7:19, at first, seemed legitimate, that
7:22initially had passed all the checks,
7:24and that they, after subsequent reviews
7:26, realized were software that actually
7:29intended to commit financial fraud. So,
7:32does this mean that Apple and Google
7:34Play are insecure, right? But the
7:37review process is not perfect, it's not
7:39infallible, because an application can
7:41have a certain behavior that seems
7:43legitimate and real at one moment, but
7:45then change it later. And that's where
7:48I want to introduce, Mario, what we are
7:50going to see in the next section: the
7:52term "bait and switch," which I think
7:54is a bit of what will explain to us how
7:56cybercriminals manage to sneak an
7:57application into official repositories.
8:03Well, the term "bait and switch" is
8:05currently used to describe that
8:07technique we were just talking about,
8:09where an application presents itself as
8:11legitimate and, let's say, authentic
8:13during the platform's validation
8:15process, but then changes its behavior.
8:19In other words, to put it plainly, the
8:21"bait" is the app that presents itself
8:23as good, as something that will deliver
8:25what it promises, and the "switch" is
8:28when the change happens. Mario, what is
8:30that change about? How can malicious
8:33developers make that change? How do
8:35they manage to do it on a more
8:37technical level? Let's say,
8:39well, it's simply about incorporating
8:43these new malicious functionalities
8:46through the updates that are made
8:51to the applications, right? As you
8:55correctly say, the cybercriminal's
8:57first step is to earn the store's trust
9:00, for the store to consider them a,
9:02well, a legitimate developer free of
9:08fraud, basically, right? Once this is
9:12achieved and the cybercriminal can
9:15finally upload the app, well, it is
9:18well known that apps are constantly
9:21regenerating because they incorporate
9:23new features, fixing bugs; that is,
9:26they are also, uh, fixing security
9:29issues, let's say, in the traditional
9:32world, right? And this is where the
9:36cybercriminal takes advantage of these
9:39modifications to, well, change the
9:42rules of the game and add, well,
9:44perhaps, let's say, fraudulent
9:47behaviors, right? Which can, that can
9:51obviously range from, uh, establishing
9:54communication with external servers
9:57that download files to the device, or,
10:00uh, espionage. That is to say, there
10:06are multiple options that can occur in
10:09this situation of, well, installing an
10:12update. And what is important to
10:15highlight is the difference in the
10:17review processes. We were talking
10:20before about how the different, uh, uh,
10:25platforms carry out reviews that are,
10:28of course, very far from performing a
10:30penetration test audit, for example;
10:32they are not, it is a review
10:34That is done, in general terms, we
10:37could say, uh, that verifies the
10:39essentials, and when updates are made,
10:42a bit of the same thing happens, only
10:45the review times change. And well, uh,
10:50the problem is, as you rightly said,
10:53that the cybercriminals for those, uh,
10:56platforms, well, uh, are legitimate,
10:58they earned their trust, and so on,
11:01right?
11:02Anyway, well, going back to, let's say,
11:05the example of Apple, which we said
11:07acknowledged having removed 60,000
11:09fraudulent apps that initially did pass
11:11that first check. Well, what Apple also
11:15does is continue verifying the
11:17different apps, and if there is a new
11:19update, what Apple does is compare
11:21version 1.0 with 1.1. I mean, platforms
11:24are already incorporating this, I don't
11:26know if it's a second stage of review,
11:28but they are expanding the review
11:29process a bit. And Google perhaps
11:31doesn't talk about concrete data like
11:34Apple does, but Google does. Through
11:36Google Play Protect, what it ensures
11:38are instances of subsequent reviews
11:40even after an app has been approved,
11:42and clearly, if they are conducting
11:44subsequent reviews, it's because the
11:46app can change. So today, is it a
11:49challenge that these types of platforms
11:51face, the fact of perhaps adding more
11:53controls, reviews, I mean, is it really
11:55a challenge for these platforms?
11:59Without a doubt it is, and the
12:01differences are perhaps biased by the
12:04type of operating system on which the
12:07applications are, let's say, going to
12:09be installed. iOS is a very different
12:14operating system to, let's say, Android
12:17basically, right? Already, in and of
12:23itself, well, iOS has a very different
12:25security structure; so, that is why
12:28there is a difference in the protocols
12:30for carrying out the verifications. But
12:34it is a fact, the need to verify the
12:37differences between versions, eh, and
12:39well, and to increasingly apply more
12:42layers of security, even at a physical
12:45level, because every time new, um, new
12:50devices come out. Basically, in the
12:52case of iOS, we understand that, well,
12:54it is Apple who develops these devices.
12:58They are constantly adding security
13:00layers at the hardware level, that is,
13:02when applications are signed, well,
13:04they are verified at the hardware level
13:07to see if the certificates are
13:09compatible, if not, if they are
13:11legitimate. And in the case of Android,
13:15where obviously a range of device
13:18brands will come into play, eh, it is
13:21also seen how these security layers are
13:24being applied more and more. Eh,
13:28although we have to assume that
13:30security is always relativized by this
13:32factor that we mentioned before, which
13:35is trust, right?
13:40Everything we have been recounting in
13:42the previous sections, eh, we can
13:44perhaps anchor and develop through a
13:46real and recent case that happened very
13:48shortly ago. I'm going to read a bit
13:50here because there are difficult names.
13:54Well, in July of this year, Sairebius
13:56Samario Wilkins was arrested by the FBI
13:59because he was accused precisely of
14:01distributing an info stealer through
14:03video games that he managed to get
14:05published on Steam. Yes, this campaign
14:09itself lasted almost 2 years, from May
14:112024 to February 2026. In the process,
14:15he infected more than 8,000 computers
14:18and stole $ 220,000 in cryptocurrencies
14:20. Yes, I also want to read the short
14:23list here to be clear. Uh, the FBI saw
14:27that these video games are being
14:29distributed on platforms like Telegram
14:31and Discord, and we are talking about
14:34games like Blockblaster, Chemia, Dash
14:36FPS, Lampi, Lunara, and a few others. I
14:41mean, and although some details about
14:44this specific campaign are unknown,
14:46similar ones allow us to understand
14:49that the malicious actor managed to
14:51pass the initial checks so the games
14:53would be published on Steam. They
14:58published them, let's say, they spread
15:00them through these channels like
15:01Discord, Telegram, and others. And once
15:04the person, the victim, downloaded the
15:06game, they were immediately executing
15:09the malware. And on top of that, as an
15:12extra detail, which is also in the
15:15FBI's criminal complaint, the
15:17cybercriminal used chatbots to detect
15:20some victims with lucrative
15:21cryptocurrency wallets. So I say: it is
15:25a quite interesting case. I hope I
15:28pronounced the names correctly, but
15:30well, what we want to convey with this
15:32specific and current case is that the
15:34validation processes of platforms like
15:36Steam, which is one of the biggest in
15:38video games, are not infallible, and
15:40today cybercriminals don't really try
15:42to convince you, as a victim, to
15:44download an .exe, but rather to
15:46download an application. It is much
15:49simpler. Today, today cybercriminals
15:51are abusing this trust. But Mario, to
15:53go a little further, we are always
15:55talking about applications, but it
15:57seems to me, or rather, I want to ask
15:59you, the scenario is a bit broader
16:01because, can we include extensions,
16:03plugins, mods, and cheats in this? I
16:05mean, can all these types of software
16:08also be used to distribute malware,
16:10right?
16:11Exactly, exactly. As you rightly say,
16:15we don't have to limit the context to
16:18the mobile universe; we were mentioning
16:21the marketplaces of, well, the App
16:24Store or Play Store, which are the
16:27popular repositories where one is
16:29downloading applications all the time,
16:32right? Yes.
16:35But as you say, there is the gamer
16:38universe, which is currently
16:40popularized by the Steam platform, and
16:43in turn, the universe of plugins or
16:46add-ons that we use in browsers as well
16:49. Yes. We recently published a post on
16:52WeLiveSecurity, and I personally had to
16:55analyze a Chrome extension that
16:57promised to be a security tool, and
17:00instead, it was an info-stealer, that
17:03is, malicious software that steals
17:05credentials, right?
17:07Exactly. This leads us to, uh,
17:11double-check our attention when
17:14downloading software from the various
17:17platforms, even if they are official.
17:22Yes. Uh, because, well, we can never
17:25rule out everything we've been
17:27mentioning, right? Now that we
17:31understand that criminals can manage to
17:34gain trust and reputation in these
17:36applications and upload, well,
17:39different versions, let's say, of code
17:41that may have fraudulent activities,
17:44that is where, well, we have to pay
17:46more attention and not limit ourselves
17:49to one context, as I said before, which
17:52could be the mobile world, but whenever
17:55we have to install applications,
17:58double-check, well, the verification of
18:01the sources and so on, right?
18:04Well, without meaning to, you're almost
18:05setting me up for what we're going to
18:07talk about in the next section.
18:08Great. Well, as we were just saying,
18:13there is a big question that might
18:15serve to open this section, this new
18:16section, which is: how can we protect
18:18ourselves? We are presenting a scenario
18:22that is quite, let's say, worrying and
18:23real. So, well, perhaps a very good
18:27answer at first is a security solution.
18:31And I justify it, as they told us when
18:33we were studying, and I justify it
18:35because if official stores today have
18:37an initial security check, it is what
18:39we talked about: they check the
18:40application in question at that
18:42specific moment and then, what happens
18:44after, is kind of lost. Well, what a
18:47security solution allows today, thanks
18:49to advances in technology and the
18:51layers that the security solution
18:52involves, is to say, well, today this
18:54app is doing this, but I am going to
18:56monitor what it will do tomorrow, what
18:58it will do in 6 months. So, I want to
19:01bring it down to earth so it's
19:02understood. Although the security
19:05solution says: "Great, I know this app,
19:08it was approved, it is acting well," if
19:10in 6 months that app starts asking you
19:13for strange permissions, doing some
19:15behavior out of the ordinary, to this
19:17that you were saying, requesting
19:19connections with external servers and
19:22so on, well, it is the security
19:24solution that will sound the alarm for
19:26you. It is like a very good defense for
19:29this term we were just mentioning, the
19:31bait-and-switch. So, specifically,
19:34Mario, since with your expertise and
19:36technical background you'll explain it
19:38much better than I can, what exactly
19:40can a security solution detect that
19:43will help us if, at first, we thought
19:45we were installing a real and
19:46legitimate application, but then we say
19:49, "Hey, wait, it's doing something
19:51different now." It either wants to
19:54steal your cryptocurrency or it wants
19:56to install malware. I mean, what are we
19:58going to say? What specific warning
20:00signs can a security solution detect?
20:03Well, in principle, it's the behavior,
20:06right, of the applications.
20:10And often this behavior is biased by a,
20:18let's say, a, yes, a situation of
20:20privilege abuse in the system, as you
20:23rightly say, right? It asks you for, I
20:26don't know, confidential information or
20:29credentials all the time, et cetera.
20:32What is important to understand is that
20:35there isn't just one single
20:37cybersecurity solution that we can use
20:40on our device.
20:42There are basic solutions, that is,
20:45they detect malware; in the presence of
20:49malicious code, the solution will
20:52directly, well, quarantine that
20:55application or delete it outright. This
20:59depends on how we configure it, right?
21:02But then we have applications that come
21:05with add-ons, right? Where we can
21:08detect, for example, phishing, we can
21:10detect, I don't know, situations
21:12related to browsing malicious sites and
21:15that type of situation. Yes, it's
21:19important to highlight that in security
21:21, we have to bet on a layered model.
21:24Yes. To say that
21:26the security solution isn't going to
21:29solve all our problems; basically, we
21:32have to think of it as one more layer
21:35of security. We talked about how app
21:39stores have their own security systems.
21:42Well, that is the first line of defense
21:44when downloading an application. Well,
21:48then the other is our own behavior as
21:53users. Then we have the solutions we
21:58are highlighting, right? Meaning that
22:01if one of the layers fails, we have
22:03contingency with another that can, well
22:06, reverse a cybersecurity problem. But
22:10focusing on cybersecurity applications,
22:13it is important to consider them
22:15because they won't just protect us when
22:18downloading potentially malicious
22:20software, but it's about the entire
22:23context of the device. Uh, I don't know
22:27, if we are trying to connect to a
22:29public network, well, the security
22:31solution will limit access because it
22:33understands that you are connecting to
22:36Wi-Fi at an airport or a café. Right.
22:40If you are looking at emails, well, it
22:43will automatically detect if, well,
22:46it's talking about potential phishing
22:50or a fraudulent site. If you are
22:54downloading attachments, for example,
22:57from messaging systems, whether it’s,
22:59I don't know, WhatsApp or even social
23:01media messaging systems, well, that
23:04attachment will also be intercepted and
23:06analyzed by the solution. Meaning the
23:09solution is holistic, that is, it is
23:11integral across all layers of the
23:13system, right?
23:15Well, Mario, I’ll take that last
23:16concept of layers because we’re going
23:17to talk about that in the next section,
23:19but I think that’s where you’re
23:20headed. I mean, a security solution
23:23might not guarantee 100%of everything,
23:25but it will undoubtedly add certain
23:27necessary layers to build upon other
23:29actions we’ll review in the coming
23:31section, which are just as important as
23:33the ones we just went over. Well, as is
23:39usual in our episodes, the idea is
23:41always that those who listen to us take
23:44away, I don't know if a toolkit, but at
23:46least some useful tips for daily life,
23:49so their digital life is increasingly
23:51secure. And well, obviously this
23:53won’t be the exception. And well, I'm
23:56going to be repetitive today, but the
23:58first piece of advice we give is: keep
24:00downloading any type of application
24:03from official repositories. That is key
24:06. Uh, obviously I think the most
24:09important invitation is to distinguish
24:11between it being the safest option and
24:13it being infallible. They are two
24:16different concepts, but from our side,
24:18the advice will always be to download
24:20from official sources, read reviews,
24:22comments from other users, because I
24:24think that is perhaps the best
24:26yardstick to understand if we are
24:28looking at a truly legitimate app or
24:30not. And obviously, always avoid
24:34downloading pirated software, cheats,
24:37and the like from non-official
24:39repositories. Mario, while I have you,
24:41I want to take a walk down memory lane
24:43or take a trip to the past. The last
24:46time we chatted, we talked about
24:48hacking emotions, about, well, issues
24:49clearly linked to the emotional, and I
24:51think this, this episode also goes
24:53hand-in-hand because trust is at stake,
24:55which is also something that you have,
24:57that you earn, or that you don't. I
25:00mean, and it's, it's very interesting,
25:02and I say: the invitation is perhaps
25:04for us as users to change our mindset
25:06and say: "Yes, let's see, it's a good
25:08decision to keep downloading from
25:10official apps, uh, platforms, sorry,
25:12but I don't have to deposit all my
25:15security there, right?". And I think
25:17that's an invitation for this episode.
25:19It could go that way, right? It's more,
25:20it's more emotional the
25:22exactly, it's, uh, it's exactly as you
25:25say. In fact, to be even more general,
25:31any cyberattack in its life cycle has a
25:35trust violation factor. I mean, we can
25:40even see, uh, I don't know, 70%of
25:43attacks have a social engineering
25:46technique involved in their life cycle
25:49that violates a user's trust. Yes. And
25:53that we have to start reviewing most of
25:55the techniques that are used. Well, uh,
26:00there's always, let's say, the value of
26:03, of, of trust, of the violation of
26:05trust as a radical element for any
26:08cyberattack to be successful, right? So
26:13, well, regarding what you're proposing
26:16to me, which makes perfect sense, uh,
26:18when we go to download an application,
26:21as you rightly say, we have to do it
26:23from an official repository. But if,
26:27after finishing the download, we open
26:30the application and we're talking about
26:33a calculator that suddenly starts
26:36asking for access to the camera, the
26:38Bluetooth, and a bunch of permissions,
26:41well, uh, something doesn't add up.
26:44Be, be alarmed.
26:46Right, there's something that doesn't
26:47make much sense, does it? Why would a
26:49simple calculator ask me for access to
26:52my contact list, for example?
26:54Totally.
26:56And so on with the type of, I mean, or
26:58the different types of applications
27:00that we are going to download, right?
27:03It's about having, uh, common criteria,
27:06yes? uh, common sense when starting to
27:11interact with applications that, well,
27:13often require these types of
27:15permissions, which in many cases are
27:18justified, but in many others are not.
27:22And that is where we have to pay
27:23attention. The same as we said before,
27:26it could be that we download a perfect
27:29application and then, I don't know,
27:31when we go to perform an update, that
27:33update suddenly comes with strange
27:35little things that ask for new
27:37permissions, and why does this
27:39application now ask for permissions
27:41that it didn't ask for before? Yes. So,
27:45having that common sense, right?
27:48Totally. Well, looking at the path
27:50we've been taking, I was thinking, we
27:52shouldn't just rely on saying, "Well, I
27:54downloaded it from an official
27:55repository," as that might be just the
27:57first step of control. Saying, okay, I
28:00got the first step right, which was
28:02downloading it from an official
28:03platform. Now, the second is to always
28:06keep an eye on what we said about how
28:08the application behaves. Whether what
28:11it's asking for is logical, if what
28:13it's proposing makes sense with what it
28:15does. Mario, you just gave me some tips
28:19to keep in mind, but I mean, what other
28:21things or what other strange behaviors
28:23should catch our attention as users? I
28:26think the example you gave about the
28:28calculator is great, like, why is it
28:30asking for this? Beyond that, is there
28:32any other alarm or signal that allows
28:34us to identify and say, hey, this isn't
28:36right, this isn't correct? Well, in
28:40principle, it's the behavior, right?
28:42What we mentioned before.
28:45Then it's important to understand that
28:47applications are dynamic, they are
28:49organic, meaning an application is
28:51changing all the time. Yes. We might
28:54tend to think that WhatsApp is just
28:57WhatsApp, but WhatsApp is actually
29:00changing all the time because with
29:03every new update, we basically have a
29:06new application.
29:07Totally.
29:08Right? That adds features or removes
29:11features. That is, this warns us that
29:16with every new update, every new
29:20download, well, we are facing a
29:24scenario that merits some, well,
29:29consideration. In principle, what we
29:32can detect most is, as we said before,
29:34behavior. Yes. Well, precisely the
29:38permissions it asks for. Then we can
29:42look at other subtleties that have to
29:44do with saying, "Ah, after I installed
29:46this app, the device runs slower."
29:49No, that's more useful.
29:51Right. But well, it's still a situation
29:54we have to notice, or after installing
29:57this, my battery doesn't last at all.
30:00Or the phone consumes more data, for
30:03example,
30:03or it uses more data, right? So, those
30:05are things that should make us
30:08suspicious. Of course, the context
30:11changes if we already have a security
30:13solution on the device or not.
30:17Uh, because the security solution can
30:19start, it can warn us, right? Well, if
30:23this is, uh, strange, or if it’s
30:26malicious code or a fraudulent
30:29application, the solution can take
30:32action directly. But today we still see
30:36that a number of users don’t have
30:38security solutions on their devices. So
30:42, in a context like this, you have no
30:45choice but to say, "Okay, let's analyze
30:48using the metrics that devices give us
30:51today, which application is consuming
30:54the most, I mean, consuming space,
30:57consuming data." We can check the
31:02activity of each one, but that is
31:04undoubtedly a tedious task, especially
31:07for people who aren't technical and
31:09aren't interested, which they have
31:11every right to be.
31:14Where I think we conclude on the
31:16importance of having security solutions
31:19, right?
31:20Very well. So, as a summary, I’d like
31:23to say that to be, I don't know if
31:25prepared, but at least much safer in
31:28this scenario, first, always download
31:30from official repositories. Second,
31:34don't trust the initial installation
31:36100%, but always keep an eye on what
31:39the app is doing, and obviously, in
31:41what you said, keep our device
31:43protected, whether through a security
31:45solution or by keeping it updated. I
31:48think with that combo, returning to the
31:50idea of multiple layers, we can
31:52significantly reduce the risk of being
31:54surprised by a malicious one on our
31:56phone.
31:57Absolutely. Well, to close this episode
32:02, we want to reinforce the golden rule
32:05again, which is that any type of
32:07application and software you download
32:09must be downloaded from official
32:11repositories. Now, the invitation is
32:14not to confuse the fact that an
32:17official download platform is the
32:19safest with it being infallible. So
32:23also, as users, we have to do our part
32:26with follow-up checks, having a
32:28security solution, and being attentive
32:31to the updates the device requests;
32:34because, as we said, today,
32:36cybercriminals no longer want to
32:38convince you to install malware, but an
32:41app. So, we have to be alert because
32:45they continue to exploit trust today
32:47through these new methodologies, and I
32:49always say, cybercrime is always
32:51looking for new ways, and we have to
32:53update ourselves too; we can't stick
32:55with how things were a decade ago. So,
32:58well, that is the invitation. Mario, as
33:00always, thank you. Like I always say,
33:03you're part of the family, but still,
33:05we appreciate the time and the
33:06knowledge you shared with us today.
33:08It’s always a pleasure for me to
33:10share this space, so thank you very
33:12much.
33:13Very well. And for those listening, we
33:15invite those of you in Argentina, Chile
33:17, Colombia, Mexico, and Peru to take
33:19advantage of the discount code
33:21CONEXION20. Specifically, you will get
33:24a 20%discount on ESET Home Security
33:26Essential in our online store. So,
33:28since you’ve listened this far, just
33:30pause, click, and go visit the store.
33:33And, well, obviously, we invite you to
33:34browse and visit our social media
33:36channels. We are on Facebook, Instagram
33:39, and Twitter as ESETLA, and on
33:40LinkedIn as ESET Latinoamérica. So, I
33:43hope you enjoyed it. If you liked it,
33:46share it, leave a like, and any
33:48constructive comment, idea, or proposal
33:50is always welcome. So, until next time.
33:53Until next time.
33:54See you later.
33:58This was Conexión Segura, the ESET
34:00Latinoamérica podcast and your direct
34:02link to the world of cybersecurity.
34:05We’ll connect in the next episode.

About this transcript

This page contains the full transcript of Por qué ya no alcanza con descargar apps desde las tiendas oficiales by ESET Latinoamérica, generated from the public captions YouTube serves with the video. The transcript has 4,883 words across 785 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to translate the transcript into 100+ languages.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, translation to 100+ languages, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.