1
00:00:00,960 --> 00:00:03,560
Okay, hi everyone.

2
00:00:04,400 --> 00:00:09,620
First, I need to clarify things about my slides.

3
00:00:09,620 --> 00:00:17,860
They're not built to be static, so a lot of things wouldn't make much sense.

4
00:00:18,880 --> 00:00:31,340
So this talk, it's one of my... it's my first talk ever, and it's been... I've been traveling for the last two years, giving this talk in many places.

5
00:00:31,940 --> 00:00:44,680
The last ones were in South Africa, besides Cape Town, and in... let me adjust my cell phone a little bit here.

6
00:00:44,680 --> 00:00:45,520
Okay.

7
00:00:46,040 --> 00:00:55,220
And the last one was in the United States, in this conference checkpoint.

8
00:00:56,940 --> 00:01:01,660
In New Orleans, just before COVID started.

9
00:01:02,700 --> 00:01:05,880
So, can you move the next slide, please?

10
00:01:08,620 --> 00:01:12,360
So, a little quick note.

11
00:01:12,360 --> 00:01:22,280
Just before the pandemic started, we were having a lot of demonstrations in my country.

12
00:01:22,280 --> 00:01:30,940
We had five months of demonstrations, just like... pretty similar to what's happening now in the U.S.

13
00:01:33,200 --> 00:01:47,460
So, what happened is that these four identities that I'm showing up here, Amnesty International, they developed reports about the situation, and they confirmed that human rights violations were happening in Chile.

14
00:01:47,980 --> 00:01:49,820
Next slide, please.

15
00:01:54,460 --> 00:01:59,940
So, I was pretty active during that time.

16
00:01:59,940 --> 00:02:02,140
Here you have some data.

17
00:02:03,720 --> 00:02:08,140
So, 35 people got killed by the police forces.

18
00:02:08,620 --> 00:02:13,040
25 people lost their lives because of rubber bullets.

19
00:02:13,340 --> 00:02:18,160
And two people lost their sight completely.

20
00:02:19,200 --> 00:02:21,160
Next one, please.

21
00:02:23,580 --> 00:02:26,900
I'm trying to go as fast as I can because it's a long one.

22
00:02:27,160 --> 00:02:31,160
So, as I told you before, I was pretty active at the time.

23
00:02:31,160 --> 00:02:36,520
We were rescuing wounded people from the, what we call it, the front lines.

24
00:02:36,980 --> 00:02:50,840
So, just a couple of days before the pandemic started, we rescued one guy that had brain trauma because of a tear gas canister launched by the police forces.

25
00:02:50,840 --> 00:02:52,300
And he died the next day.

26
00:02:52,300 --> 00:02:56,320
So, it was pretty stressful for us.

27
00:02:56,320 --> 00:03:02,220
So , in a way, the pandemic kind of released that stress.

28
00:03:02,220 --> 00:03:11,040
The one in the right side with the big shield is a shield built by a TV.

29
00:03:14,200 --> 00:03:24,060
So, she was helping us with the most critical cases.

30
00:03:24,160 --> 00:03:25,820
Next one, please.

31
00:03:28,420 --> 00:03:34,740
So, after that quick brief, I'm going to present myself.

32
00:03:34,740 --> 00:03:37,680
I'm a computer science engineer.

33
00:03:37,680 --> 00:03:43,300
It's a career that only exists in Chile, that it's six years long.

34
00:03:43,780 --> 00:03:45,300
But I really loved it.

35
00:03:45,300 --> 00:03:47,880
So, it took me nine years to get out of it.

36
00:03:49,060 --> 00:03:56,020
And like I said before, this is one of my, this is my first talk ever related to cybersecurity.

37
00:03:56,020 --> 00:03:59,320
And it got picked up by SkyTalks two years ago.

38
00:03:59,320 --> 00:04:06,420
And it was like the beginning of everything for me regarding DEF CON and cybersecurity.

39
00:04:06,680 --> 00:04:14,260
And I do a lot of classes as a professor in different type of instances.

40
00:04:14,260 --> 00:04:20,600
One is a free university that I teach CTF workshops.

41
00:04:20,600 --> 00:04:26,440
And with most of these guys, we went last year to DEF CON to present a workshop.

42
00:04:29,220 --> 00:04:34,840
I also work with a lot of projects related to health.

43
00:04:34,840 --> 00:04:47,020
So, recently, we want finance to get this, to do this project related to COVID-19 in my country.

44
00:04:47,780 --> 00:04:50,240
And right now, I'm learning ASINT.

45
00:04:50,240 --> 00:05:04,540
So, tomorrow, we're gonna participate in the Trace Labs CTF, which is a very good exercise to improve your Googling skills.

46
00:05:04,900 --> 00:05:08,580
And I have a small company, really small.

47
00:05:08,580 --> 00:05:12,080
So, I'm the founder, the CEO, and also the janitor.

48
00:05:13,460 --> 00:05:18,840
The things that I do most, I mean, all the time are workshops.

49
00:05:19,280 --> 00:05:21,400
So, next slide, please.

50
00:05:23,940 --> 00:05:26,420
So, last year, I went to DEF CON.

51
00:05:26,420 --> 00:05:30,480
So, I had the chance to meet Jason, Jason Street.

52
00:05:30,980 --> 00:05:35,120
And then, we went to DEF CON, DEF CON 27.

53
00:05:35,300 --> 00:05:37,880
That was an amazing experience.

54
00:05:40,200 --> 00:05:40,940
Yep.

55
00:05:40,940 --> 00:05:41,900
Next one.

56
00:05:41,900 --> 00:05:45,660
So, that's all about me.

57
00:05:47,220 --> 00:05:53,140
So, for you to understand this talk, I need to give you a little bit of context.

58
00:05:53,760 --> 00:06:03,580
So, in my country, we have a health system that is 80% public and 20% private.

59
00:06:03,580 --> 00:06:06,860
So, the public part is pretty much free.

60
00:06:06,860 --> 00:06:09,480
It's very different than the US.

61
00:06:09,780 --> 00:06:15,540
So, the public sector, we have around, now it's 15 million patients.

62
00:06:15,960 --> 00:06:23,380
So, in the top of the graph, you can see what's called MINSAL, which is basically the health department.

63
00:06:23,760 --> 00:06:27,980
And below that, you have 29, what they're called services.

64
00:06:27,980 --> 00:06:39,100
They're like institutions that they try to coordinate the different hospitals and institutions.

65
00:06:39,480 --> 00:06:45,380
So, I was working in one of those services, which is actually the biggest.

66
00:06:45,700 --> 00:06:50,120
We have around 2.5 million patients.

67
00:06:52,180 --> 00:06:52,460
Okay.

68
00:06:52,460 --> 00:06:53,680
Next slide.

69
00:06:53,820 --> 00:06:55,340
Slide, please.

70
00:06:57,660 --> 00:07:04,160
So, how bad, I have trouble pronouncing the word MACAB.

71
00:07:04,700 --> 00:07:06,440
So, how bad is this talk?

72
00:07:06,440 --> 00:07:16,140
When I was giving it, about to give it in Skype talks, I was receiving threats by some people that I knew.

73
00:07:16,180 --> 00:07:31,520
Some people involved in the police units were sending them messages that if I did the talk, they will wait for me at the airport, they will sue me.

74
00:07:32,040 --> 00:07:54,360
And I, at the time, I also received an email from somebody that they were ordering to shut down all the servers from this, the related to health institutions, because they were afraid that I will give information that will allow DEF CON attendees to hack all our systems,

75
00:07:54,360 --> 00:07:56,160
which is really stupid.

76
00:07:56,420 --> 00:08:06,580
So, I asked if, they also told me that they were sending some people to watch my talk and to record it.

77
00:08:06,580 --> 00:08:12,940
So, I asked if there were some government officials in the room and they actually raised their hand.

78
00:08:13,420 --> 00:08:29,020
And months later, I received a recording from my talk that was surprising, because Skype talks are pretty strict, you cannot take your cell phone away, it's not 100% safe.

79
00:08:29,100 --> 00:08:31,860
Luckily, nothing happened after that.

80
00:08:32,200 --> 00:08:35,220
Well, not nothing, but you can say that.

81
00:08:35,220 --> 00:08:38,940
I don't want to be, I don't want to give you spoilers.

82
00:08:38,940 --> 00:08:40,360
So, next one, please.

83
00:08:43,890 --> 00:08:57,330
So, I prepared different, some stories that will help you understand the context of what I have to face at work pretty much every day.

84
00:08:57,730 --> 00:09:09,830
So, I, the first story is called a very secure web service and the idea of this slide is just part by part and at the end you will see the image.

85
00:09:09,870 --> 00:09:17,950
So, the health department, they asked to every institution for the

86
00:09:22,100 --> 00:09:28,700
patients that attended the public sector around 15.

87
00:09:29,300 --> 00:09:45,260
So, they were, they gave me this assignment and I just find it weird that they will give you a web service, but you have to deploy your own web, their web service, which is very weird in my opinion.

88
00:09:45,260 --> 00:10:00,920
I worked as a developer for five years before getting into this job that I had at this place and I never seen that somebody sent you a binary of a web service for you to deploy and use it.

89
00:10:01,340 --> 00:10:06,820
And then you will upload the files to an FTP server, which is, again, really bad.

90
00:10:07,380 --> 00:10:09,040
Next slide, please.

91
00:10:10,920 --> 00:10:18,840
So, then I thought maybe I should check the security of it, right, the mindset of a hacker.

92
00:10:18,980 --> 00:10:36,060
And, you know, at first I was like checking out the 3DS algorithm, trying to find something that I could use, but at the end it was easier to decompile it and they have no obfuscation at all.

93
00:10:36,060 --> 00:10:58,920
It took me literally three minutes to decompile it and I found the key of the web service, so now I could download all these reports from the server and check all the data from all the pages.

94
00:10:59,960 --> 00:11:04,420
So, at least the key they're using was a good one.

95
00:11:04,760 --> 00:11:06,360
Next one, please.

96
00:11:19,600 --> 00:11:21,420
Now, okay.

97
00:11:21,640 --> 00:11:22,340
So, I reported...

98
00:11:52,340 --> 00:12:02,720
So, he demanded me, you know, a paper.

99
00:12:10,600 --> 00:12:19,910
And the answer was nothing.

100
00:12:19,910 --> 00:12:25,650
I never got any reply from him after that.

101
00:12:27,130 --> 00:12:29,630
So, next one.

102
00:12:31,870 --> 00:12:39,750
So, the second story is what we call it a very secure electronic health record.

103
00:12:40,770 --> 00:12:53,590
And this software had over a million pages of data, anything that you can imagine, exams, prescriptions.

104
00:12:55,070 --> 00:13:04,590
And they looked it up on the internet using Oracle, very expensive databases and the database was only 40 gigs.

105
00:13:05,210 --> 00:13:14,230
And there are not many transactions, so that's difficult in the public sector to buy expensive software.

106
00:13:15,070 --> 00:13:17,870
So, they have 18 developers.

107
00:13:17,870 --> 00:13:25,530
This is the part where the facts explain against me.

108
00:13:25,550 --> 00:13:33,870
So, CBS had 800 word files.

109
00:13:34,930 --> 00:13:38,190
Next one, please.

110
00:13:47,300 --> 00:13:49,340
Hello.

111
00:13:49,340 --> 00:13:51,280
Okay.

112
00:13:51,280 --> 00:13:59,700
So, what happened one day is that they were audited of this work.

113
00:14:00,000 --> 00:14:06,600
And I was invited, just as somebody that was a part of the project.

114
00:14:07,280 --> 00:14:15,440
And at some point, they asked this developer, so the project manager, about the security of this software.

115
00:14:15,460 --> 00:14:23,000
And he said, security, because they had implemented a five-digit password.

116
00:14:23,360 --> 00:14:30,540
And I couldn't, you know, I couldn't not raise my hand and ask them, are you serious?

117
00:14:30,540 --> 00:14:33,400
I mean, five digits?

118
00:14:33,940 --> 00:14:46,520
That almost got me fired, because I said I couldn't attack or do fairly fire to my own colleagues, even though they were not really my colleagues.

119
00:14:46,760 --> 00:14:48,480
And I have to apologize.

120
00:14:48,480 --> 00:14:58,860
I have to apologize, because even though they were stupid, I shouldn't have said that at this point.

121
00:14:59,180 --> 00:15:00,400
Next, please.

122
00:15:05,120 --> 00:15:10,140
So, at that point, not really understanding, I was thinking it was like

123
00:15:13,480 --> 00:15:14,000
something...

124
00:15:14,000 --> 00:15:18,560
and they attacked me for a couple of weeks.

125
00:15:18,560 --> 00:15:23,720
They were asking, some people were asking for me to be fired, you know, directly.

126
00:15:24,040 --> 00:15:25,700
I cannot work here anymore.

127
00:15:26,200 --> 00:15:31,720
So, I was lucky, because my boss, the director of the institution, supported me all the time.

128
00:15:33,600 --> 00:15:34,680
Next slide.

129
00:15:40,740 --> 00:15:49,740
So, one day, I went to work.

130
00:15:49,740 --> 00:15:52,360
I couldn't get into Gmail.

131
00:15:52,360 --> 00:15:56,580
We were using Gmail.

132
00:15:58,320 --> 00:16:01,700
So, I couldn't Google it.

133
00:16:02,360 --> 00:16:10,520
But if you could work, Twitter, you could get into an email, and all that.

134
00:16:13,840 --> 00:16:19,420
So, I mean, I was the only one from home.

135
00:16:20,420 --> 00:16:22,280
And how could I think about Google?

136
00:16:22,280 --> 00:16:25,180
I mean, they hired me to do something that I didn't know how to do it.

137
00:16:25,180 --> 00:16:28,300
So, I had to Google a lot.

138
00:16:28,300 --> 00:16:35,780
Basically, planning a data server, a big one in a hospital.

139
00:16:41,740 --> 00:16:45,120
So, I was very critical.

140
00:16:45,120 --> 00:16:50,200
I couldn't understand how something like this could happen in such a big institution.

141
00:16:50,300 --> 00:16:57,540
So, I did research on the IT manager and the director of the institution to know what happened.

142
00:16:58,160 --> 00:17:02,240
And the IT gave me a paper.

143
00:17:02,280 --> 00:17:16,320
So, that's how I learned so much.

144
00:17:16,720 --> 00:17:22,440
It said most that they blocked every Google service.

145
00:17:22,540 --> 00:17:31,740
Because through Google, you could get into forbidden sites, like porn sites or gaming sites.

146
00:17:31,740 --> 00:17:38,900
So, they are out of pretty bandwidth, or they set out a limit.

147
00:17:38,900 --> 00:17:45,480
I think I can remember it was like 2000 megabytes per IP.

148
00:17:46,320 --> 00:17:53,060
So, that's why every... which was mind-blowing.

149
00:17:53,060 --> 00:17:54,460
Next one, please.

150
00:17:59,240 --> 00:18:05,160
So, time, which reflects my reactions at the time.

151
00:18:06,240 --> 00:18:07,760
Next one.

152
00:18:15,310 --> 00:18:17,570
Start changing this part.

153
00:18:21,980 --> 00:18:30,380
So, how do you get a little bit of the context of what the work was about?

154
00:18:32,860 --> 00:18:38,480
Probably, I'm going to write not a book, but a blog.

155
00:18:38,740 --> 00:18:41,800
I have 50 of those.

156
00:18:42,500 --> 00:18:47,580
So, go to this part of this talk.

157
00:18:49,200 --> 00:18:53,300
And how everything started.

158
00:18:56,800 --> 00:18:59,140
Next slide, please.

159
00:19:02,420 --> 00:19:10,200
So, imagine that you're working, this is your new job, and you've been there for 10 months.

160
00:19:10,360 --> 00:19:18,840
And they ask you to find some IPs and add some bridges.

161
00:19:19,220 --> 00:19:21,840
But they didn't know which one I was looking for.

162
00:19:23,460 --> 00:19:28,480
And then they said, let me see if I could increase the range.

163
00:19:28,840 --> 00:19:34,260
So, I ended up finding 50,000 devices.

164
00:19:34,880 --> 00:19:48,280
And this is a part that you could really understand the transitions.

165
00:19:49,840 --> 00:19:53,300
There are now virtualization of the network.

166
00:19:53,300 --> 00:19:54,620
Not at all.

167
00:19:54,620 --> 00:20:00,340
So, you could see all the devices from the northern part of the country.

168
00:20:03,940 --> 00:20:13,120
So, I couldn't read why that was.

169
00:20:13,120 --> 00:20:28,140
I thought I had a list.

170
00:20:29,560 --> 00:20:31,600
Next slide, please.

171
00:20:33,760 --> 00:20:39,020
So, I started to check all those devices.

172
00:20:39,020 --> 00:20:43,340
And I was finding more and more.

173
00:20:43,340 --> 00:20:56,920
I mean, there are just so many that even the software that they give you does not respond properly because there are so many devices.

174
00:20:56,920 --> 00:21:02,100
They don't just take a long time to load on the screen.

175
00:21:02,220 --> 00:21:08,660
So, I found a lot of folders with public privileges.

176
00:21:08,760 --> 00:21:12,300
And some with public privileges.

177
00:21:12,300 --> 00:21:25,420
And even the they have all these hospital related files, architecture files.

178
00:21:25,420 --> 00:21:29,480
So, then I discovered they have public writing privileges.

179
00:21:29,480 --> 00:21:32,830
So, anyone could have deleted the server.

180
00:21:33,550 --> 00:21:47,710
And the things that I could see, I think the last part is not on the slide, but I could access a lot of

181
00:21:51,590 --> 00:21:54,390
things.

182
00:22:05,400 --> 00:22:15,240
Next one, please.

183
00:22:15,240 --> 00:22:22,160
So, after that, a couple of months went by.

184
00:22:22,920 --> 00:22:30,500
Trying to understand the problem, like, how this is possible, right?

185
00:22:30,500 --> 00:22:39,240
So, what I discovered is that the, you know, like, they didn't know how to share.

186
00:22:39,240 --> 00:22:45,880
So, imagine sharing, say, a 500 megabytes file.

187
00:22:45,880 --> 00:22:55,500
It will just share a folder, put it on the shared folder and send the address to another person without rechecking.

188
00:22:58,460 --> 00:23:02,300
Next one.

189
00:23:11,520 --> 00:23:13,320
It's not moving.

190
00:23:16,900 --> 00:23:30,020
So, my boss at the time told me, do you need to get about all your files and send email to them?

191
00:23:44,250 --> 00:23:53,150
So, can you hear me now?

192
00:23:54,710 --> 00:23:57,070
Okay.

193
00:23:57,070 --> 00:24:02,190
So, let's continue with the presentation.

194
00:24:02,780 --> 00:24:19,050
So, like I was saying, I sent this email report with the IP addresses, the folders, and the files that you could retrieve from the shared folders.

195
00:24:19,050 --> 00:24:39,770
So, the worst one is that you could find information of HIV patients, information that is protected by a special law in Chile that it's implemented for that information to be anonymous.

196
00:24:39,770 --> 00:24:48,510
Otherwise, you might be, you might suffer discrimination, looking for a job, et cetera.

197
00:24:48,690 --> 00:24:51,710
So, that was the worst part of it.

198
00:24:51,710 --> 00:24:54,410
Next one, next slide, please.

199
00:25:04,280 --> 00:25:08,300
And you know what?

200
00:25:08,300 --> 00:25:13,100
I didn't receive any answer directly to these emails.

201
00:25:13,160 --> 00:25:21,560
But then my boss sent me one of the emails she received as an answer.

202
00:25:21,560 --> 00:25:35,980
One of the things that I was more upset about, it was just that I didn't exist for them because I was like one month working, for a month working there.

203
00:25:37,000 --> 00:25:51,360
So, not even a reply directly to my email, not even a, let's say, congratulations for helping us or heads up for, I don't know, trying to help the institution.

204
00:25:52,060 --> 00:25:59,100
And then this guy, the IT support manager, was also the CSO, which is very weird.

205
00:25:59,100 --> 00:26:18,920
But they were chosen those like, let's say, roles, just if you've completed like an online course of ISO 2000, 2007, 2001.

206
00:26:19,060 --> 00:26:27,600
That was the only requisite to be part of the CSO, let's say, role.

207
00:26:27,840 --> 00:26:39,180
So, this guy sent an email saying that it was a big problem, but none of those IP addresses were from our institution.

208
00:26:39,680 --> 00:26:47,940
But the things that I didn't even think about it, you know, I didn't plan myself to find our IPs.

209
00:26:47,940 --> 00:26:54,200
So, after that, I sent another email with all the IPs that belong to us.

210
00:26:55,580 --> 00:26:57,740
Next slide, please.

211
00:26:58,620 --> 00:27:03,060
So, they didn't check anything, right?

212
00:27:03,460 --> 00:27:09,380
They just like tried to save their assets.

213
00:27:11,120 --> 00:27:14,980
But they didn't know that I had many, many IP addresses.

214
00:27:17,510 --> 00:27:19,610
So, next one.

215
00:27:22,820 --> 00:27:32,120
So, on the third email, I only included IP addresses from our institution and from all of us.

216
00:27:38,170 --> 00:27:42,030
They belong to what is called a health network.

217
00:27:43,270 --> 00:27:52,590
So, we are responsible for what they do in terms of use of information.

218
00:27:52,590 --> 00:28:02,990
So, I sent them, I cannot read it from my cell phone, but they were the most important hospitals in the country.

219
00:28:02,990 --> 00:28:08,170
One of the hospitals is called Sotero de Rio.

220
00:28:08,170 --> 00:28:10,930
He has over 3 million patients.

221
00:28:11,250 --> 00:28:15,150
And they had a server with everything that you can imagine.

222
00:28:15,150 --> 00:28:21,830
They had passwords, servers, webcam, I mean, security cameras.

223
00:28:21,830 --> 00:28:31,520
They had backups of many machines, x-rays, whatever you can imagine.

224
00:28:31,520 --> 00:28:38,140
I don't even remember now, but it was so much information that I was not able to process all.

225
00:28:38,320 --> 00:28:39,540
Next one.

226
00:28:43,090 --> 00:28:48,970
So, the answer for 10 months was nothing at all.

227
00:28:51,630 --> 00:28:53,130
Next one, please.

228
00:28:56,650 --> 00:29:09,410
So, one of the classes that I teach now is one where I was a student.

229
00:29:11,150 --> 00:29:22,630
And while I was a student, my sound is not... I don't know if you can hear me well, but on my end, I'm getting a lot of noise.

230
00:29:24,090 --> 00:29:32,310
Well, I had this class with one of the IT managers of the health department.

231
00:29:32,990 --> 00:29:34,970
And we were both students.

232
00:29:34,970 --> 00:29:37,270
She was quite older than me, right?

233
00:29:37,670 --> 00:29:48,270
And during the coffee break, I told her that I was the one who sent those emails that I never got a reply back.

234
00:29:48,270 --> 00:29:50,990
And she said, we're fixing it.

235
00:29:50,990 --> 00:29:54,470
You know, like, cutting me off, like, giving me the hand.

236
00:29:54,470 --> 00:29:57,530
You know when somebody tells you, like, stop?

237
00:29:57,590 --> 00:29:59,350
Like, we're fixing it.

238
00:30:01,490 --> 00:30:03,550
And also, she said, I know.

239
00:30:03,650 --> 00:30:07,410
But then... Next one, please.

240
00:30:10,370 --> 00:30:16,510
She ignored me for the rest of the classes, like, for two weeks.

241
00:30:23,650 --> 00:30:31,710
She thought I was some crazy guy telling, like, things that she didn't know about.

242
00:30:32,730 --> 00:30:34,550
Okay, next one, please.

243
00:30:37,350 --> 00:30:41,590
So, after 10 months, no answer, no changes.

244
00:30:41,590 --> 00:30:43,990
I could still check all the IP addresses.

245
00:30:43,990 --> 00:30:51,290
I was running scanners, like, two times per week, two times per week, and everything was the same.

246
00:30:51,970 --> 00:30:56,270
And not even a thank you, you know, we're all hackers, we're all sensitive.

247
00:30:57,090 --> 00:30:58,930
So, I was very sad.

248
00:31:01,330 --> 00:31:02,790
Next one, please.

249
00:31:05,330 --> 00:31:11,370
So, how do you fix something that nobody cares about?

250
00:31:12,750 --> 00:31:22,410
So, I was, I contacted one of these journalist groups that are very, they're very important in Chile.

251
00:31:22,410 --> 00:31:26,050
They were part of the Panama Papers investigations.

252
00:31:26,050 --> 00:31:32,530
They discovered a lot of politicians from Chile on those, on those leaks.

253
00:31:32,530 --> 00:31:39,190
And I sent them the information, and just right away, they were like, we can't believe that this is true.

254
00:31:39,190 --> 00:31:44,690
We need, next, next slide, please.

255
00:31:46,770 --> 00:32:00,430
So, they wanted me to show them all this information from my computer in order for them to be sure that I was, that I was correct, I mean, that I didn't have, like, a special connection or whatever.

256
00:32:00,810 --> 00:32:09,930
So, I asked a journalist to sit next to me and to check all these folders.

257
00:32:10,050 --> 00:32:12,950
It was very, like, it was very scary for me.

258
00:32:13,190 --> 00:32:17,470
I was only thinking that I'm going to get caught and, you know, be fired or whatever.

259
00:32:18,290 --> 00:32:27,890
And after a while, when they processed all this information, they were asking me a lot, a lot of details, you know, like, send us an email,

260
00:32:30,930 --> 00:32:35,530
how many patients in total, how many patients with abortion.

261
00:32:36,670 --> 00:32:38,730
So, I had to work for a month.

262
00:32:39,830 --> 00:32:42,850
You know, like, sending them evidence.

263
00:32:44,550 --> 00:32:51,670
And at some point, they asked me to test the same thing in three different places.

264
00:32:53,730 --> 00:33:01,990
So, I needed to ask somebody to allow the journalist inside their offices.

265
00:33:02,870 --> 00:33:12,530
So, one of these guys that I asked him, a friend of a friend, he almost, he actually sent an email to their IT department.

266
00:33:19,260 --> 00:33:24,820
And he said, okay, I just sent an email to the IT department asking if this is possible.

267
00:33:24,820 --> 00:33:28,480
And I said, no, you're destroying this investigation.

268
00:33:33,820 --> 00:33:34,300
You're destroying this investigation .

269
00:33:34,300 --> 00:33:43,860
And he said that what I wanted to do was basically get into the folders and from another office, they said it was not possible.

270
00:33:44,000 --> 00:33:45,940
So, that saved me.

271
00:33:47,900 --> 00:33:50,080
But the journalists were very nervous.

272
00:33:50,080 --> 00:33:56,220
They even thought about publishing the information that day, the very same day.

273
00:33:57,800 --> 00:34:07,360
But this email with this guy is telling us it was not possible to just make things, make things a little more calm.

274
00:34:07,460 --> 00:34:08,720
Next one, please.

275
00:34:12,660 --> 00:34:14,840
So, how did I get this information?

276
00:34:14,840 --> 00:34:16,960
It's very simple.

277
00:34:17,040 --> 00:34:30,080
It's sometimes when I started doing hacking or I did some pretty big stuff, for example, in Brazil when I was living, I took control of over 3,000 routers.

278
00:34:30,500 --> 00:34:37,320
And it was so simple that I thought it was something that was not worthy, that it was pretty lame, you know?

279
00:34:37,760 --> 00:34:48,560
But after that, I learned that it doesn't matter how difficult it was, what is important is what you got out of it, what kind of information you can get.

280
00:34:48,940 --> 00:34:55,020
And now that I have more experience, it's like getting into Shodan and you can do a lot of things without knowing anything.

281
00:34:55,520 --> 00:35:07,660
Just like running some scripts and, but at the time, I didn't have a lot of experience, so I didn't know.

282
00:35:07,660 --> 00:35:09,480
So, next one.

283
00:35:09,480 --> 00:35:21,440
I didn't know that doing something that is not technically complex, it's also valuable, you know?

284
00:35:21,440 --> 00:35:27,960
So, my approach was to gather everything, you know?

285
00:35:27,960 --> 00:35:31,960
Like, every file that was signed, every document.

286
00:35:32,000 --> 00:35:42,120
But the thing is that this network was so bad that some nodes, they were giving me 100 kilobytes per second of speed.

287
00:35:42,600 --> 00:35:48,040
So, it was like, I couldn't copy a lot of code.

288
00:35:48,060 --> 00:35:50,240
It would take me months, right?

289
00:35:50,240 --> 00:35:57,620
So, the other thing that I had to manage is that computers, most of those computers, even servers, they were turning off at 6 a.m.

290
00:35:59,200 --> 00:36:06,940
So, I only managed to copy 300 gigabytes out of more than a few terabytes of scan.

291
00:36:07,220 --> 00:36:23,820
And you're not really scared of copying those files because I was probably sending files to a firewall that somebody is copying or it's used in a unique way.

292
00:36:24,100 --> 00:36:31,340
And 24 hours, but then I learned that nobody takes the firewalls.

293
00:36:32,920 --> 00:36:35,880
No one really pays attention to them.

294
00:36:35,880 --> 00:36:40,000
They just believe that they are not safe.

295
00:36:52,940 --> 00:36:57,060
So, after a while, I said I cannot get everything.

296
00:36:57,060 --> 00:37:06,540
I needed to just get rid of the things that we have in our brains that sometimes we want to store everything, you know?

297
00:37:07,180 --> 00:37:10,480
Simple and have issues, you know?

298
00:37:10,480 --> 00:37:15,680
They have information that they're never going to see again.

299
00:37:16,000 --> 00:37:19,320
People that buy books and buy books and never read them again.

300
00:37:20,080 --> 00:37:28,140
So, I have to, like, I did this only a couple of times.

301
00:37:28,480 --> 00:37:42,080
And then, you know, grabbing for terms, keywords, like HIV or, you know, well, there were things to look for.

302
00:37:42,800 --> 00:37:51,880
I published my article and I was trying to know that I was going to get fired.

303
00:37:51,880 --> 00:37:54,680
So, I didn't want to lose my vacation.

304
00:37:54,680 --> 00:37:58,540
So, I mean, we miss everything.

305
00:37:58,800 --> 00:38:06,880
Like, in the flight and the articles, people, I know they were all sentences.

306
00:38:06,880 --> 00:38:10,000
So, I prefer to be in another country.

307
00:38:10,720 --> 00:38:21,380
That way, I will be on the way with a proper structure or idea of what is good.

308
00:38:22,680 --> 00:38:24,280
And actually, that's what happened.

309
00:38:24,280 --> 00:38:27,020
The first day, the guy called me.

310
00:38:27,020 --> 00:38:47,420
He was calling me and she said, you know, since I talk too much, you know, she was always was too impulsive saying that things didn't work or that there were problems with everywhere.

311
00:38:47,420 --> 00:38:48,800
That was a head-scratcher.

312
00:38:48,800 --> 00:38:51,780
I said, I don't like it.

313
00:38:51,780 --> 00:38:57,700
So, probably some and then some journalists and that's what happened.

314
00:38:58,080 --> 00:39:02,700
Yeah, yeah, you do speak a lot.

315
00:39:09,060 --> 00:39:36,960
So, I could check the privileges they had and just put it on a file and just every time the journalist asked me for anything, I would just add information and then post it.

316
00:39:43,730 --> 00:39:46,470
So, now let's get serious.

317
00:39:46,530 --> 00:39:48,570
I'm really serious about this.

318
00:39:51,190 --> 00:39:53,910
So, this meme was really good.

319
00:39:54,170 --> 00:40:02,750
It was displayed after the title, but this is not that bad as when I did this talk in Beijing.

320
00:40:03,010 --> 00:40:07,790
Every joke that I made, every meme, there was no response.

321
00:40:07,950 --> 00:40:17,610
I did some hearts and claps for me, but it was only one of the worst talks ever I ever given.

322
00:40:17,870 --> 00:40:21,890
No response from the public.

323
00:40:31,110 --> 00:40:36,670
Examples are this server that I found blog.

324
00:40:37,250 --> 00:40:39,410
It was 23,000.

325
00:40:39,730 --> 00:40:49,270
And every update, email, phone number, cell phone number.

326
00:40:51,050 --> 00:40:55,610
The ID, we have a thing that's good.

327
00:40:55,670 --> 00:41:04,010
That is an ID number and with that ID number, you can do pretty much the social security number in the US.

328
00:41:06,250 --> 00:41:08,350
Next slide.

329
00:41:12,180 --> 00:41:17,240
So, another example is a server protection.

330
00:41:17,740 --> 00:41:31,340
Again, you have all the patient data and sensitive information that is protected by the two specific laws.

331
00:41:33,320 --> 00:41:38,460
This type of thing doesn't have to be in any way public.

332
00:41:52,230 --> 00:41:59,770
Next slide.

333
00:42:00,470 --> 00:42:06,070
Did something happen?

334
00:42:32,260 --> 00:42:34,580
Okay.

335
00:42:34,740 --> 00:42:35,380
Okay.

336
00:42:35,380 --> 00:42:38,580
So, I'm gonna look in again.

337
00:43:20,140 --> 00:43:20,780
I

338
00:43:31,460 --> 00:43:52,920
apologize everybody for interrupting the talk again, but the speaker needs to reenter this space because it is some problem from his end probably or from the Microsoft end, but we had Q4Q from Microsoft in here to reset the space and rectify whatever the issue was and it was earlier,

339
00:43:52,920 --> 00:43:53,520
right?

340
00:43:54,580 --> 00:43:58,360
But then, we are facing the same issue again.

341
00:43:58,360 --> 00:44:04,060
So, I think we have to wait for Philip to get back and continue his speech.

342
00:44:04,600 --> 00:44:08,840
So, until then, thanks a lot for your patience again.

343
00:44:22,760 --> 00:44:23,800
Okay.

344
00:44:25,000 --> 00:44:28,440
So, as soon as he'll be back, you need to continue the slides.

345
00:47:07,680 --> 00:47:09,620
Do you want me to send it now?

346
00:47:32,380 --> 00:47:33,880
I'm really sorry.

347
00:47:45,080 --> 00:48:04,380
I hope we will not face any such issues for the future talks, but like we hackers, we are not a big fan of being on Windows and this is a contradictory statement because we are on a platform that is backed up by Microsoft.

348
00:48:04,580 --> 00:48:07,120
But then, hackers love Linux.

349
00:48:07,120 --> 00:48:11,400
That is the whole truth, whole and sole truth that we know.

350
00:48:11,420 --> 00:48:19,400
So, some of the speakers like Philip himself, he was trying to run Allspace VR on Linux machine that he has.

351
00:48:19,400 --> 00:48:23,220
So, I think probably this is one of the issues that he is facing.

352
00:48:23,680 --> 00:48:34,840
So, thanks a lot for joining in and please stay for a while because we have another presentation coming up after Philip's.

353
00:48:36,540 --> 00:48:38,520
And thank you again.

354
00:52:50,060 --> 00:52:51,540
Okay, I'm back.

355
00:53:02,010 --> 00:53:04,810
All right, so...

356
00:53:58,880 --> 00:54:01,480
Can you hear me now?

357
00:54:02,300 --> 00:54:07,500
Can you, if you can still hear me, give me your claps.

358
00:54:09,180 --> 00:54:12,020
Okay, great.

359
00:54:12,020 --> 00:54:20,340
So, well, it's been very tiring to restore.

360
00:54:21,040 --> 00:54:33,410
Let me get my slides here, here, there.

361
00:54:34,390 --> 00:54:38,610
So, okay, just kind of trying to finish.

362
00:54:38,710 --> 00:54:42,230
I sent the logs that they asked me to.

363
00:54:43,190 --> 00:54:51,100
So, we can go to the next slide right here.

364
00:54:51,680 --> 00:54:54,720
Next slide, please.

365
00:55:02,980 --> 00:55:17,300
And another example of what I found, it's a 35 gigs of monographies, again, with all the patient data splurged on the right.

366
00:55:17,300 --> 00:55:20,520
The time is 4 o'clock p.m.

367
00:55:21,540 --> 00:55:24,700
Yeah, it was only one server.

368
00:55:25,300 --> 00:55:28,080
It's only three servers that I sampled.

369
00:55:28,520 --> 00:55:42,720
I was kind of, my computer or my laptop, so I deleted everything.

370
00:55:44,040 --> 00:55:48,160
I run, like, three cycles of shaders.

371
00:55:49,860 --> 00:55:57,240
So, at the end, I don't have a lot of that information at the time.

372
00:55:57,240 --> 00:56:00,260
I just thought it was better to get rid of them.

373
00:56:01,720 --> 00:56:03,260
Next one, please.

374
00:56:10,900 --> 00:56:17,000
So, again, I'm saying a lot of so's and I try not to.

375
00:56:22,600 --> 00:56:33,540
So, I counted doc files, TXT, PDFs, and over 4 million files.

376
00:56:34,090 --> 00:56:37,340
But I didn't count all the types.

377
00:56:37,340 --> 00:56:39,500
Photographs, for example.

378
00:56:40,460 --> 00:56:45,180
ZIP files that had a lot of backups of many servers.

379
00:56:45,640 --> 00:56:47,840
Next slide, please.

380
00:56:54,650 --> 00:57:17,730
In this slide, you can see, for example, in this image, you can see PILs, the word PILs in Spanish, which is PILDRA, and how many files with the name PILDRA and format, and format, spreadsheet format, and there were 120.

381
00:57:19,190 --> 00:57:23,170
And this is the after PIL, or emergency PIL.

382
00:57:23,470 --> 00:57:33,230
And if you see the data, if you get inside those files, you can see reasons why they were asking those PILs.

383
00:57:33,230 --> 00:57:36,030
Some that were abused.

384
00:57:36,230 --> 00:57:41,070
Some people, some girls were raped.

385
00:57:41,130 --> 00:57:43,790
You can even see the situations.

386
00:57:49,660 --> 00:57:52,700
Okay, next one, please.

387
00:58:06,040 --> 00:58:08,180
And next one.

388
00:58:15,060 --> 00:58:18,860
And in this, no, the one before.

389
00:58:20,160 --> 00:58:23,120
One back, please.

390
00:58:23,120 --> 00:58:24,160
Sir.

391
00:58:27,810 --> 00:58:37,590
In this one, I was looking for files with the word HIV in Spanish.

392
00:58:38,030 --> 00:58:43,830
And I found 772 files.

393
00:58:44,250 --> 00:58:46,690
And you can see the file names.

394
00:58:46,690 --> 00:58:47,950
I don't know if you can see them.

395
00:58:47,950 --> 00:58:49,410
I don't know if you can read them.

396
00:58:49,710 --> 00:58:57,630
But believe me, there were IP addresses followed by the name.

397
00:58:58,710 --> 00:59:03,270
And then I could retrieve them and send them to the journalist.

398
00:59:04,250 --> 00:59:07,150
They were looking for bad stuff.

399
00:59:07,150 --> 00:59:10,030
You know, they were just, they were asking me, give me the worst.

400
00:59:10,030 --> 00:59:11,330
We want the worst.

401
00:59:11,330 --> 00:59:22,510
We want everything that you can give that will be pretty bad regarding to the laws and regarding the public interest.

402
00:59:22,650 --> 00:59:23,870
So next one.

403
00:59:23,970 --> 00:59:24,870
Next one.

404
00:59:24,870 --> 00:59:28,870
I'm about to finish, so be patient.

405
00:59:30,070 --> 00:59:31,690
I know it's been long.

406
00:59:32,810 --> 00:59:34,850
I'm feeling it.

407
00:59:40,410 --> 00:59:41,790
Next one.

408
00:59:41,790 --> 00:59:43,150
Let's move in.

409
00:59:44,390 --> 00:59:48,470
So, again, what happened?

410
00:59:48,470 --> 00:59:50,650
What was their strategy?

411
00:59:50,830 --> 01:00:14,470
The reason why they asked me for three places is they wanted to be sure that this was a more general problem that they were trying to, they were trying to find proof that there was a widespread problem, like I said, because I was sure, you know, I was telling them,

412
01:00:14,470 --> 01:00:20,410
I'm sure that this is not a thing about my computer, it's a network problem.

413
01:00:21,250 --> 01:00:30,930
And what they did is that they scheduled a meeting with this minister, with the health minister of the head of the health department.

414
01:00:30,950 --> 01:00:36,950
And they never said that they were part of this group called CIPER.

415
01:00:37,510 --> 01:00:55,810
So they presented themselves as a random guy, so after a month, I guess, they talked to her, they went to her office, and they asked for her computer to show her the problem.

416
01:00:55,910 --> 01:01:12,190
And from her computer, they managed to download all this information that I've given them, the IP addresses, they only put the IP address, the folder, and then you got many, many files with HIV patients.

417
01:01:12,230 --> 01:01:20,690
And she was, the journalist told me, she was a white woman, she was like, she was shocked.

418
01:01:20,950 --> 01:01:22,550
Next one, please.

419
01:01:22,930 --> 01:01:28,610
And they were pretty badass, you know, they say, you got 24 hours to fix it.

420
01:01:28,610 --> 01:01:31,030
They never said they were from a journalist group.

421
01:01:31,350 --> 01:01:35,710
So at that point, the minister, she didn't know what would happen.

422
01:01:35,710 --> 01:01:38,850
She thought it was just a problem that they needed to fix.

423
01:01:39,290 --> 01:01:52,270
So what happened after that is that they published 24 hours later, all this information that I've given them, and they were, it says in Spanish, and of course it's in Spanish, right?

424
01:01:52,270 --> 01:02:11,530
But it says 100,000 workers could, even companies that were given services or, let's say, outsourcing companies, they had access to all these files, all these files.

425
01:02:12,990 --> 01:02:20,430
And they put there that they have at least 3 million files that could be, that were unprotected.

426
01:02:21,330 --> 01:02:22,690
Next one, please.

427
01:02:22,690 --> 01:02:25,870
You can Google this information.

428
01:02:27,370 --> 01:02:36,030
And then all mainstream media pick up this information, even from other countries.

429
01:02:36,030 --> 01:02:41,410
I was checking everything from Colombia at the time.

430
01:02:41,410 --> 01:02:44,730
Even some Colombian newspapers pick up this information.

431
01:02:46,370 --> 01:02:50,090
And friends will tell me that it was all over the TV, all over.

432
01:02:50,290 --> 01:03:00,070
And I was receiving that, some of the people told me that some people wanted to talk to me at the office, but I was on vacation, so I was free of that.

433
01:03:00,350 --> 01:03:01,530
Next one, please.

434
01:03:05,980 --> 01:03:11,240
So this solved the problem in a couple of days.

435
01:03:11,260 --> 01:03:19,760
But what they did, they blocked the files from every institution, right?

436
01:03:19,760 --> 01:03:31,220
So you couldn't access share folders from another institution, but you could still access all the share folders from your, behind your router, right?

437
01:03:31,460 --> 01:03:33,740
I even tried, tested it.

438
01:03:33,900 --> 01:03:57,840
So you could access, for example, what it worked, I could access information from five hospitals, and I could still access a lot of information that it should have, they should have, you know, like forced everyone to unshare those folders, because it's,

439
01:03:57,840 --> 01:04:07,220
it's, it's against the law to have personal data, sensitive data exposed, right?

440
01:04:07,220 --> 01:04:14,080
But I'm gonna tell you later why this, this fix was enough for them.

441
01:04:14,860 --> 01:04:16,460
Next one, please.

442
01:04:18,920 --> 01:04:39,900
The funny thing is, not the funny, but the worst thing is that before doing all this, the press, we tested that in many places, 100% of the places that we tested, you only needed to connect to a network cable, and that was it.

443
01:04:39,900 --> 01:04:50,100
There were no restrictions, just connecting to, to any, to any plug, and you will access to the entire network.

444
01:04:51,180 --> 01:05:00,380
So, she was called to, she was called to Congress to give a, an explanation, but she just lied.

445
01:05:00,960 --> 01:05:05,800
And again, she was saving a lot of people's asses.

446
01:05:05,800 --> 01:05:21,600
And the good thing, well, the bad thing is that they created a feeling of panic, you know, nobody wanted to give you any information at all, not even the one they were required to give you, you know, like, they were like saying, no, because of what happened,

447
01:05:21,600 --> 01:05:29,140
I cannot give you anything, but I'm allowed to have it, I mean, internally as a, as a part of the same institution.

448
01:05:29,140 --> 01:05:30,600
So, it created a panic.

449
01:05:30,860 --> 01:05:39,940
And then, they were not sharing any information, like, like, it created the opposite effect, you know, like the extreme effect.

450
01:05:40,540 --> 01:06:01,080
And for me, it was, it was a good, what happened afterwards, afterward was good in my, in my, in my job, because I, they gave me, the director of the institution told me to create a security department specializing on finding these issues, right?

451
01:06:01,180 --> 01:06:10,700
But we were, we were too against the world, you know, we were, nobody wanted to being told that they had a problem.

452
01:06:10,700 --> 01:06:18,960
So, I found, for example, that you could, they had default password in 5,000 email accounts.

453
01:06:19,260 --> 01:06:24,680
And I, I told them, and I did a presentation explaining them why it was bad.

454
01:06:24,680 --> 01:06:28,140
And their answer were, their answer was crazy.

455
01:06:28,140 --> 01:06:37,920
They said, public servants are public, I mean, no, no, it's wrongly proposed, it didn't say correctly.

456
01:06:38,700 --> 01:06:42,960
Since they were public servants, they say that their emails should be public.

457
01:06:42,960 --> 01:06:54,280
So, for them, it was okay that you could look in from the internet, from, not even from the inside the net, from the internet, you could log in on their accounts and check their email.

458
01:06:54,400 --> 01:07:00,300
And inside those email accounts, they have patient information again.

459
01:07:00,920 --> 01:07:07,700
So, at some point, we're just like, we're not, we're not going anywhere, we're, it's just us against the world.

460
01:07:08,260 --> 01:07:09,500
Next one, please.

461
01:07:11,900 --> 01:07:34,680
So, again, after the government change, after the, this right-wing government that set foot or created this scenario for demonstration that lasted for five months, that I told you at the beginning, they fire me on the first day, you know, like, first hour,

462
01:07:34,680 --> 01:07:42,740
they fired, they sent me an email to fire me, but I knew it, they were gonna do it, so I was, again, on my holidays, I was on vacation.

463
01:07:43,260 --> 01:07:47,380
So, that forced them to fire me by email.

464
01:07:48,200 --> 01:08:12,960
But that gave proof and evidence that they fired me with no reason, because they never gave a reason on the email, because they thought that they were entitled to, but they didn't know that the law, it's complicated, but they didn't know that the laws changed regarding whether you can fire without any cause a public employee.

465
01:08:13,640 --> 01:08:37,160
So, they fired me, and a lot of projects that I was in charge of with the UCL, for example, University College of London, and the Job Hopkins, which is the best university in the world regarding to the health sciences, but I sued them, you know, I knew before they fired me that I could sue them,

466
01:08:37,160 --> 01:08:55,720
I knew exactly what part of the law changed, the Supreme Court ruled that every public servant, even though they had temporary contracts, they're allowed to be compensated if they had a permanent role, and I have a permanent role, so when they fired me,

467
01:08:55,720 --> 01:09:14,600
they were just like, ah, nothing's gonna happen, just fire this guy, and that's it, but then I sued them, and that ended up in the media, they accused me of being a hacker, that I stole information, that I destroyed servers, and again, it was this lawsuit,

468
01:09:14,600 --> 01:09:35,980
it was just about proving that I worked there or not, not about me, but the China, you know, assassination of character, and they said I was a bad hacker, that I went to DEF CON, they even copied the screenshot of the talk that I gave Sky Talks as a proof that I was bad,

469
01:09:35,980 --> 01:09:39,260
even though the talk was after I was fired.

470
01:09:39,760 --> 01:09:41,120
Next one, please.

471
01:09:44,340 --> 01:09:48,020
So after that, this government is still in power, right?

472
01:09:48,420 --> 01:10:15,560
I've been banned from working with any government agency, I was about to do a pen test, and in the last day, they said that they lost their resources, but then a friend of mine told me, and even sent me the WhatsApp conversations, they told this person that she was going to be fired if she hired me.

473
01:10:17,200 --> 01:10:25,920
So I got very famous at the time, in a bad way, but that didn't stop there.

474
01:10:25,920 --> 01:10:46,420
I wanted to know, because I did a formal investigation of what happened, I went there as a witness and blah, blah, blah, and I got the investigation report, I got the documents, there were over 1200 pages, I had to pay $50 for them to give it to me, because they have to print it,

475
01:10:46,420 --> 01:10:57,700
and they have to remove all the sensitive information, which is stupid, because they removed their email addresses that I could get easily, and I wanted to know what happened.

476
01:10:57,700 --> 01:11:12,780
I wanted to know why nobody did anything, the reasons, or at least I wanted to know, even though I was a witness, or I testified in a way, they never gave me any feedback.

477
01:11:13,220 --> 01:11:21,240
They don't call you and tell you this is what happened, or no, nothing, and they just tell you to get the information using the proper channels.

478
01:11:21,520 --> 01:11:36,060
So I got this, next slide please, I got this big chunk of paper, you know, it's like a big pile of papers, next one please.

479
01:11:36,980 --> 01:11:49,320
So I started to read them, you know, through every page, and they have a lot of, a lot of people say that they didn't know me at all.

480
01:11:49,320 --> 01:11:58,480
A lot of people lied, they said they never received an email, never heard about it, that they didn't know about me.

481
01:11:58,680 --> 01:12:13,420
But then they have this part of the document, they say that it was possible to fix it, but it would have taken a big impact on their operation.

482
01:12:14,160 --> 01:12:18,860
Which was not true, because they fixed it in a day, without any disruption.

483
01:12:19,200 --> 01:12:40,180
And then they say that it's every person's responsibility, and it's a personal issue, which is not true, because the law entitles every person in charge of sensitive information for patient data to be responsible for it.

484
01:12:40,640 --> 01:12:51,200
And this guy just, you know, it's all about, you know, this typical thing about working in IT, that everyone blames the user, the same.

485
01:12:51,200 --> 01:12:54,840
It's the user's problem, it's the sharing information, it's their problem.

486
01:12:54,940 --> 01:12:56,080
Next one please.

487
01:12:56,080 --> 01:12:58,960
So this was the excuse number one.

488
01:13:00,860 --> 01:13:17,340
And then, excuse number two, again, another guy in the top rank of the institution said that it's, again, the user's responsibility, and it's very complex to identify these folders.

489
01:13:17,340 --> 01:13:24,280
And you remember that the script that I run, it was like five lines, it was really easy to do it.

490
01:13:24,280 --> 01:13:27,360
They had access to everything, all the tools that I didn't have.

491
01:13:27,540 --> 01:13:35,320
And the last one, again, 14 says it's a fault, they're blaming the users, again.

492
01:13:39,740 --> 01:13:45,640
Because I should have informed them, or my boss, which I did.

493
01:13:48,040 --> 01:13:50,440
And again, they didn't know anything about it.

494
01:13:50,880 --> 01:13:58,260
Even though I sent many emails, I tried to reach them in many channels, but nobody wanted to listen.

495
01:13:58,420 --> 01:13:59,620
Next one please.

496
01:14:04,070 --> 01:14:31,910
The main reason, and this is like the most incredible thing that I discovered in this investigation, is the main excuse, even from the minister, is that the ISP provider, the internet provider, and the email provider, which is the same, they couldn't fix their email for a year.

497
01:14:31,910 --> 01:14:42,450
So the main person, the minister of the health department, didn't have an email working properly for a year.

498
01:14:42,450 --> 01:14:43,930
And that was the excuse.

499
01:14:43,930 --> 01:14:56,350
And even this email, it was sent by the ISP provider, which is a big contract, it's $4 million per month contract they have.

500
01:14:56,910 --> 01:15:01,510
They say, it's correct, her email didn't work for a year.

501
01:15:01,570 --> 01:15:03,870
So, next one please.

502
01:15:08,180 --> 01:15:28,720
So the latest update, because this lasted for, this happened two years ago, and November the 8th, last year, it was the final, the final step, the Supreme Court rule, my favorite, so they had to pay me $25,000 in compensations, which is not what I wanted,

503
01:15:28,720 --> 01:15:30,360
but it's not that bad.

504
01:15:31,500 --> 01:15:32,800
Next one please.

505
01:15:34,680 --> 01:15:42,960
But the funny thing is that with that money, I had to pay the money that I spent going to DEF CON for two years.

506
01:15:43,200 --> 01:15:47,800
So I ended up with, I don't know, like $500.

507
01:15:51,160 --> 01:15:55,080
So what can we do to avoid these situations?

508
01:15:55,080 --> 01:16:04,540
In my country, as well as the entire world, we don't have a lot of people knowing that, that are experts in security.

509
01:16:04,840 --> 01:16:19,740
And people hiring, they don't, they don't even know what a computer science degree, it's different from a, from a, here we have different types, but it's a technical degree, you know, they don't have any, they don't know the differences.

510
01:16:19,740 --> 01:16:23,260
So when they hire someone, they will ask you, do you know about security?

511
01:16:23,260 --> 01:16:30,120
And say, yeah, I did this certification, okay, so you're, you're ready to help us with this issue.

512
01:16:30,120 --> 01:16:31,660
And it's the opposite.

513
01:16:32,080 --> 01:16:35,020
So we need to change our laws.

514
01:16:35,020 --> 01:16:39,260
I mean, we have the laws, but they're not enforced, right?

515
01:16:39,260 --> 01:16:54,040
The, and it, and I do, I have this, these topics in my classes that I do in this masters, that I explained some things that happen in other problems that ended up nowhere.

516
01:16:54,040 --> 01:17:02,480
I mean, the CTO of this health department, he was fined with 10% of his salary for one month.

517
01:17:02,480 --> 01:17:05,020
That was the only punishment.

518
01:17:07,000 --> 01:17:12,500
And we need, what I learned is that we need less robsters and more mentors.

519
01:17:12,500 --> 01:17:17,060
And I'm actually mentoring a lot of students, five or six.

520
01:17:17,060 --> 01:17:19,180
Well, now it's weird because of COVID, right?

521
01:17:20,180 --> 01:17:29,500
Everything stopped, but we were competing tomorrow, actually, with four of them in the OSINT Trace Labs CTF.

522
01:17:30,080 --> 01:17:31,560
Next one, please.

523
01:17:33,800 --> 01:17:35,820
So which ticket is the last one?

524
01:17:35,820 --> 01:17:42,020
Well, me now, a lot of images of me sad or whatever.

525
01:17:43,080 --> 01:17:44,280
Next one.

526
01:17:44,380 --> 01:17:45,960
And I think it's the last one.

527
01:17:48,300 --> 01:17:49,540
Well, thank you.

528
01:17:49,540 --> 01:17:52,780
It was a long talk, a lot of problems involved.

529
01:17:53,040 --> 01:17:56,300
There's a link to the slides.

530
01:17:57,360 --> 01:18:01,640
That's my Twitter account and my LinkedIn account.

531
01:18:01,860 --> 01:18:03,600
I hope you liked it.

532
01:18:03,620 --> 01:18:08,160
And thank you to all of the organizers as well.

533
01:18:08,160 --> 01:18:11,300
I know that they're working a lot to get this through.

534
01:18:12,560 --> 01:18:13,740
Have a good day.