Okay, hi everyone. First, I need to clarify things about my slides. They're not
built to be static, so a lot of things wouldn't make much sense.
So this talk, it's one of my... it's my first talk ever, and it's been... I've been traveling
for the last two years, giving this talk in many places. The last ones were in South Africa,
besides Cape Town, and in... let me adjust my cell phone a little bit here. Okay.
And the last one was in the United States, in this conference checkpoint.
In New Orleans, just before COVID started. So, can you move the next slide, please?
So, a little quick note. Just before the
pandemic started, we were having a lot of demonstrations in my country.
We had five months of demonstrations, just like... pretty similar to what's happening now in the U.S.
So, what happened is that these four identities that I'm showing up here,
Amnesty International, they developed reports about the situation, and they
confirmed that human rights violations were happening in Chile. Next slide, please.
So, I was pretty active during that time. Here you have some data.
So, 35 people got killed by the police forces. 25 people lost their lives because of rubber bullets.
And two people lost their sight completely. Next one, please.
I'm trying to go as fast as I can because it's a long one.
So, as I told you before, I was pretty active at the time. We were rescuing
wounded people from the, what we call it, the front lines. So, just a couple of days before
the pandemic started, we rescued one guy that had brain trauma because of a tear gas canister
launched by the police forces. And he died the next day. So, it was pretty stressful for us.
So, in a way, the pandemic kind of released that stress. The one in the right side with the big
shield is a shield built by a TV. So, she was helping us with the most critical cases.
Next one, please. So, after that quick brief, I'm going to present myself. I'm a
computer science engineer. It's a career that only exists in Chile, that it's six
years long. But I really loved it. So, it took me nine years to get out of it.
And like I said before, this is one of my, this is my first talk ever related to
cybersecurity. And it got picked up by SkyTalks two years ago. And it was like the beginning
of everything for me regarding DEF CON and cybersecurity. And I do a lot of classes as
a professor in different type of instances. One is a free university that I teach CTF
workshops. And with most of these guys, we went last year to DEF CON to present a workshop. I
also work with a lot of projects related to health. So, recently, we want finance to get
this, to do this project related to COVID-19 in my country. And right now, I'm learning
ASINT. So, tomorrow, we're gonna participate in the Trace Labs CTF, which is a very good
exercise to improve your Googling skills. And I have a small company, really small. So,
I'm the founder, the CEO, and also the janitor. The things that I do most, I mean,
all the time are workshops. So, next slide, please.
So, last year, I went to DEF CON. So, I had the chance to meet Jason, Jason Street.
And then, we went to DEF CON, DEF CON 27. That was an amazing experience.
Yep. Next one. So, that's all about me.
So, for you to understand this talk, I need to give you a little bit of context. So,
in my country, we have a health system that is 80% public and 20% private. So, the public part
is pretty much free. It's very different than the US. So, the public sector, we have around,
now it's 15 million patients. So, in the top of the graph, you can see what's called MINSAL,
which is basically the health department. And below that, you have 29, what they're called
services. They're like institutions that they try to coordinate the different hospitals and
institutions. So, I was working in one of those services, which is actually the biggest.
We have around 2.5 million patients. Okay. Next slide. Slide, please.
So, how bad, I have trouble pronouncing the word MACAB. So, how bad is this talk?
When I was giving it, about to give it in Skype talks, I was receiving threats
by some people that I knew. Some people involved in the police units were sending them messages
that if I did the talk, they will wait for me at the airport, they will sue me. And
I, at the time, I also received an email from somebody that they were ordering to shut down
all the servers from this, the related to health institutions, because they were afraid that I
will give information that will allow DEF CON attendees to hack all our systems, which is really
stupid. So, I asked if, they also told me that they were sending some people to watch my talk
and to record it. So, I asked if there were some government officials in the room and they actually
raised their hand. And months later, I received a recording from my talk that was surprising,
because Skype talks are pretty strict, you cannot take your cell phone away, it's not 100% safe.
Luckily, nothing happened after that. Well, not nothing, but you can say that. I don't want to
be, I don't want to give you spoilers. So, next one, please. So, I prepared different, some stories
that will help you understand the context of what I have to face at work pretty much every day.
So, I, the first story is called a very secure web service and the idea of this slide is just
part by part and at the end you will see the image. So, the health department, they asked
to every institution for the patients that attended the public sector around 15.
So, they were, they gave me this assignment and I just find it weird that they will give you
a web service, but you have to deploy your own web, their web service, which is very weird in
my opinion. I worked as a developer for five years before getting into this job that I had
at this place and I never seen that somebody sent you a binary of a web service for you to deploy
and use it. And then you will upload the files to an FTP server, which is, again, really bad.
Next slide, please.
So, then I thought maybe I should check the security of it, right, the mindset of a hacker.
And, you know, at first I was like checking out the 3DS algorithm, trying to find something
that I could use, but at the end it was easier to decompile it and they have no obfuscation at all.
It took me literally three minutes to decompile it and I found the key of the web service,
so now I could download all these reports from the server and check all the data from all the
pages. So, at least the key they're using was a good one. Next one, please.
Now, okay. So, I reported...
So, he demanded me, you know, a paper.
And the answer was nothing. I never got any reply from him after that.
So, next one.
So, the second story is what we call it a very secure electronic health record.
And this software had over a million pages of data, anything that you can imagine, exams,
prescriptions. And they looked it up on the internet using Oracle, very expensive databases
and the database was only 40 gigs. And there are not many transactions, so that's difficult
in the public sector to buy expensive software. So, they have 18 developers. This is the part
where the facts explain against me.
So, CBS had 800 word files. Next one, please.
Hello. Okay.
So, what happened one day is that they were audited of this work. And I was invited,
just as somebody that was a part of the project. And at some point, they asked this developer,
so the project manager, about the security of this software. And he said,
security, because they had implemented a five-digit password. And I couldn't, you know,
I couldn't not raise my hand and ask them, are you serious? I mean, five digits? That
almost got me fired, because I said I couldn't attack or do fairly fire to my own colleagues,
even though they were not really my colleagues. And I have to apologize. I have to apologize,
because even though they were stupid, I shouldn't have said that at this point.
Next, please. So, at that point, not really understanding, I was thinking it was like
something... and they attacked me for a couple of weeks. They were asking, some people were asking
for me to be fired, you know, directly. I cannot work here anymore. So, I was lucky,
because my boss, the director of the institution, supported me all the time. Next slide.
So, one day, I went to work. I couldn't get into Gmail. We were using Gmail. So, I couldn't
Google it. But if you could work, Twitter, you could get into an email, and all that.
So, I mean, I was the only one from home. And how could I think about Google? I mean,
they hired me to do something that I didn't know how to do it. So, I had to Google a lot.
Basically, planning a data server, a big one in a hospital.
So, I was very critical. I couldn't understand how something like this could happen in such a
big institution. So, I did research on the IT manager and the director of the institution
to know what happened. And the IT gave me a paper. So, that's how I learned so much.
It said most that they blocked every Google service. Because through Google,
you could get into forbidden sites, like porn sites or gaming sites. So, they are out of pretty
bandwidth, or they set out a limit. I think I can remember it was like 2000 megabytes per IP.
So, that's why every... which was mind-blowing. Next one, please.
So, time, which reflects my reactions at the time. Next one.
Start changing this part. So, how do you get a little bit of the context of what the work was
about? Probably, I'm going to write not a book, but a blog. I have 50 of those.
So, go to this part of this talk. And how everything started. Next slide, please.
So, imagine that you're working, this is your new job, and you've been there for 10 months.
And they ask you to find some IPs and add some bridges. But they didn't know which one I was
looking for. And then they said, let me see if I could increase the range. So, I ended up finding
50,000 devices. And this is a part that you could really understand the transitions.
There are now virtualization of the network. Not at all. So, you could see all the devices
from the northern part of the country. So, I couldn't read why that was. I thought I had a
list. Next slide, please. So, I started to check all those devices. And I was finding more and
more. I mean, there are just so many that even the software that they give you does not respond
properly because there are so many devices. They don't just take a long time to load on the
screen. So, I found a lot of folders with public privileges. And some with public
privileges. And even the
they have all these hospital related files, architecture files. So, then I discovered
they have public writing privileges. So, anyone could have deleted the server.
And the things that I could see, I think the last part is not on the slide, but
I could access a lot of
things. Next one, please. So, after that, a couple of months went by.
Trying to understand the problem, like, how this is possible, right? So, what I discovered is that
the, you know, like, they didn't know how to share. So, imagine sharing, say, a 500 megabytes
file. It will just share a folder, put it on the shared folder and send the address
to another person without rechecking. Next one. It's not moving.
So, my boss at the time told me, do you need to get about all your files and send email
to them? So, can you hear me now? Okay. So, let's continue with the presentation.
So, like I was saying, I sent this email report with the IP addresses, the folders,
and the files that you could retrieve from the shared folders. So, the worst one is that you
could find information of HIV patients, information that is protected by a special law
in Chile that it's implemented for that information to be anonymous. Otherwise,
you might be, you might suffer discrimination, looking for a job, et cetera. So, that was the
worst part of it. Next one, next slide, please. And you know what? I didn't receive any answer
directly to these emails. But then my boss sent me one of the emails she received as an answer.
One of the things that I was more upset about, it was just that I didn't exist for them because I
was like one month working, for a month working there. So, not even a reply directly to my email,
not even a, let's say, congratulations for helping us or heads up for, I don't know,
trying to help the institution. And then this guy, the IT support manager, was also the CSO,
which is very weird. But they were chosen those like, let's say, roles, just if you've completed
like an online course of ISO 2000, 2007, 2001. That was the only requisite to be part of the
CSO, let's say, role. So, this guy sent an email saying that it was a big problem, but
none of those IP addresses were from our institution. But the things that I
didn't even think about it, you know, I didn't plan myself to find our IPs. So, after that,
I sent another email with all the IPs that belong to us. Next slide, please.
So, they didn't check anything, right? They just like tried to save their assets.
But they didn't know that I had many, many IP addresses. So, next one.
So, on the third email, I only included IP addresses from our institution
and from all of us. They belong to what is called a health network.
So, we are responsible for what they do in terms of use of information. So, I sent them,
I cannot read it from my cell phone, but they were the most important hospitals in the country.
One of the hospitals is called Sotero de Rio. He has over 3 million patients.
And they had a server with everything that you can imagine. They had passwords, servers,
webcam, I mean, security cameras. They had backups of many machines, x-rays,
whatever you can imagine. I don't even remember now,
but it was so much information that I was not able to process all. Next one.
So, the answer for 10 months was nothing at all. Next one, please.
So, one of the classes that I teach now is one where I was a student.
And while I was a student, my sound is not... I don't know if you can hear me well, but
on my end, I'm getting a lot of noise.
Well, I had this class with one of the IT managers of the health department.
And we were both students. She was quite older than me, right? And during the coffee break,
I told her that I was the one who sent those emails that I never got a reply back.
And she said, we're fixing it. You know, like, cutting me off, like, giving me the hand.
You know when somebody tells you, like, stop? Like, we're fixing it.
And also, she said, I know. But then... Next one, please.
She ignored me for the rest of the classes, like, for two weeks.
She thought I was some crazy guy telling, like, things that she didn't know about.
Okay, next one, please. So, after 10 months, no answer, no changes. I could still check
all the IP addresses. I was running scanners, like, two times per week, two times per week,
and everything was the same. And not even a thank you, you know, we're all hackers,
we're all sensitive. So, I was very sad. Next one, please.
So, how do you fix something that nobody cares about?
So, I was, I contacted one of these journalist groups that are very,
they're very important in Chile. They were part of the Panama Papers investigations. They
discovered a lot of politicians from Chile on those, on those leaks. And I sent them the
information, and just right away, they were like, we can't believe that this is true. We need,
next, next slide, please. So, they wanted me to show them all this information from my computer
in order for them to be sure that I was, that I was correct, I mean, that I didn't have, like, a
special connection or whatever. So, I asked a journalist to sit next to me and to check all
these folders. It was very, like, it was very scary for me. I was only thinking that I'm going
to get caught and, you know, be fired or whatever. And after a while, when they processed all this
information, they were asking me a lot, a lot of details, you know, like, send us an email,
how many patients in total, how many patients with abortion. So, I had to work for a month.
You know, like, sending them evidence. And at some point, they asked me to test the same thing in
three different places. So, I needed to ask somebody to allow the journalist inside their
offices. So, one of these guys that I asked him, a friend of a friend, he almost, he actually sent
an email to their IT department. And he said, okay, I just sent an email to the IT department
asking if this is possible. And I said, no, you're destroying this investigation. You're
destroying this investigation. And he said that what I wanted to do was basically get into the
folders and from another office, they said it was not possible. So, that saved me.
But the journalists were very nervous. They even thought about publishing the information that day,
the very same day. But this email with this guy is telling us it was not possible to just make
things, make things a little more calm. Next one, please.
So, how did I get this information? It's very simple. It's sometimes when I started doing
hacking or I did some pretty big stuff, for example, in Brazil when I was living,
I took control of over 3,000 routers. And it was so simple that I thought it was something that
was not worthy, that it was pretty lame, you know? But after that, I learned that it doesn't
matter how difficult it was, what is important is what you got out of it, what kind of information
you can get. And now that I have more experience, it's like getting into Shodan and you can do a
lot of things without knowing anything. Just like running some scripts and,
but at the time, I didn't have a lot of experience, so I didn't know.
So, next one. I didn't know that doing something that is not technically complex,
it's also valuable, you know? So, my approach was to gather everything, you know? Like,
every file that was signed, every document. But the thing is that this network was so bad
that some nodes, they were giving me 100 kilobytes per second of speed. So, it was like,
I couldn't copy a lot of code. It would take me months, right? So, the other thing that I had to
manage is that computers, most of those computers, even servers, they were turning off at 6 a.m.
So, I only managed to copy 300 gigabytes out of more than a few terabytes of scan.
And you're not really scared of copying those files because I was probably sending
files to a firewall that somebody is copying or it's used in a unique way.
And 24 hours, but then I learned that nobody takes the firewalls.
No one really pays attention to them. They just believe that they are not safe.
So, after a while, I said I cannot get everything. I needed to just get rid of
the things that we have in our brains that sometimes we want to store everything, you know?
Simple and have issues, you know? They have information that they're never going to see
again. People that buy books and buy books and never read them again.
So, I have to, like, I did this only a couple of times. And then, you know,
grabbing for terms, keywords, like HIV or, you know, well, there were things to look for.
I published my article and I was trying to know that I was going to get fired.
So, I didn't want to lose my vacation. So, I mean, we miss everything. Like, in the flight
and the articles, people, I know they were all sentences. So, I prefer to be in another country.
That way, I will be on the way with a proper structure or idea of what is good.
And actually, that's what happened. The first day, the guy called me. He was calling me and
she said, you know, since I talk too much, you know, she was always
was too impulsive saying that things didn't work or that there were problems with everywhere.
That was a head-scratcher. I said, I don't like it. So, probably some
and then some journalists and that's what happened. Yeah, yeah, you do speak a lot.
So, I could check the privileges they had and just put it on a file and just
every time the journalist asked me for anything, I would just add information and then
post it. So, now let's get serious. I'm really serious about this.
So, this meme was really good. It was displayed after the title, but
this is not that bad as when I did this talk in Beijing. Every joke that I made, every meme,
there was no response. I did some hearts and claps for me, but it was only one of the worst
talks ever I ever given. No response from the public. Examples are this server that I found
blog. It was 23,000. And every update, email, phone number, cell phone number.
The ID, we have a thing that's good. That is an ID number and with that ID number,
you can do pretty much the social security number in the US.
Next slide. So, another example is a server protection. Again, you have all the patient
data and sensitive information that is protected by the two specific laws.
This type of thing doesn't have to be in any way public.
Next slide.
Did something happen? Okay.
Okay. So, I'm gonna look in again.
I apologize everybody for interrupting the talk again, but the speaker needs to reenter this
space because it is some problem from his end probably or from the Microsoft end,
but we had Q4Q from Microsoft in here to reset the space and
rectify whatever the issue was and it was earlier, right?
But then, we are facing the same issue again. So, I think we have to wait for Philip to get
back and continue his speech. So, until then, thanks a lot for your patience again.
Okay. So, as soon as he'll be back, you need to continue the slides.
Do you want me to send it now?
I'm really sorry. I hope we will not face any such issues for the future talks, but
like we hackers, we are not a big fan of
being on Windows and this is a contradictory statement because we are on a platform that
is backed up by Microsoft. But then, hackers love Linux. That is the whole truth, whole
and sole truth that we know. So, some of the speakers like Philip himself, he was trying to
run Allspace VR on Linux machine that he has. So, I think probably this is one of the issues
that he is facing. So, thanks a lot for joining in and please stay for a while because we have
another presentation coming up after Philip's. And thank you again.
Okay, I'm back.
All right, so...
Can you hear me now?
Can you, if you can still hear me, give me your claps.
Okay, great. So,
well, it's been very tiring to restore. Let me get my slides here, here, there.
So, okay, just kind of trying to finish. I sent the logs that they asked me to.
So, we can go to the next slide right here. Next slide, please.
And another example of what I found, it's
a 35 gigs of monographies, again, with all the patient data splurged on the right.
The time is 4 o'clock p.m.
Yeah, it was only one server. It's only three servers that I sampled. I was kind of,
my computer or my laptop, so I deleted everything.
I run, like, three cycles of shaders. So, at the end, I don't have a lot of
that information at the time. I just thought it was better to get rid of them.
Next one, please.
So, again, I'm saying a lot of so's and I try not to.
So, I counted doc files, TXT, PDFs, and over 4 million files.
But I didn't count all the types. Photographs, for example.
ZIP files that had a lot of backups of many servers.
Next slide, please.
In this slide, you can see, for example, in this image, you can see
PILs, the word PILs in Spanish, which is PILDRA, and how many files with the name PILDRA and
format, and format, spreadsheet format, and there were 120.
And this is the after PIL, or emergency PIL. And if you see the data,
if you get inside those files, you can see reasons why they were asking those PILs.
Some that were abused. Some people, some girls were raped. You can even see the situations.
Okay, next one, please.
And next one.
And in this, no, the one before.
One back, please. Sir.
In this one, I was looking for files with the word HIV in Spanish. And I found 772 files.
And you can see the file names. I don't know if you can see them. I don't know if you can read
them. But believe me, there were IP addresses followed by the name. And then I could retrieve
them and send them to the journalist. They were looking for bad stuff. You know, they were just,
they were asking me, give me the worst. We want the worst. We want everything that you can give
that will be pretty bad regarding to the laws and regarding the public interest.
So next one. Next one. I'm about to finish, so be patient. I know it's been long.
I'm feeling it. Next one. Let's move in.
So, again, what happened? What was their strategy? The reason why they asked me for three places
is they wanted to be sure that this was a more general problem that they were trying to,
they were trying to find proof that there was a widespread problem, like I said,
because I was sure, you know, I was telling them, I'm sure that this is not a thing about
my computer, it's a network problem. And what they did is that they scheduled a meeting with
this minister, with the health minister of the head of the health department. And they never said
that they were part of this group called CIPER. So they presented themselves as a random guy,
so after a month, I guess, they talked to her, they went to her office, and they asked for her
computer to show her the problem. And from her computer, they managed to download all this
information that I've given them, the IP addresses, they only put the IP address, the folder, and then
you got many, many files with HIV patients. And she was, the journalist told me, she was a white
woman, she was like, she was shocked. Next one, please. And they were pretty badass, you know,
they say, you got 24 hours to fix it. They never said they were from a journalist group.
So at that point, the minister, she didn't know what would happen. She thought it was
just a problem that they needed to fix. So what happened after that is that they published 24 hours
later, all this information that I've given them, and they were, it says in Spanish, and of course
it's in Spanish, right? But it says 100,000 workers could, even companies that were given
services or, let's say, outsourcing companies, they had access to all these files, all these files.
And they put there that they have at least 3 million files that could be, that were unprotected.
Next one, please. You can Google this information. And then all mainstream media
pick up this information, even from other countries. I was checking everything from
Colombia at the time. Even some Colombian newspapers pick up this information.
And friends will tell me that it was all over the TV, all over. And I was receiving that,
some of the people told me that some people wanted to talk to me
at the office, but I was on vacation, so I was free of that. Next one, please.
So this solved the problem in a couple of days. But what they did, they blocked the
files from every institution, right? So you couldn't access share folders from another
institution, but you could still access all the share folders from your, behind your router,
right? I even tried, tested it. So you could access, for example, what it worked,
I could access information from five hospitals, and I could still access a lot of information
that it should have, they should have, you know, like forced everyone to unshare those folders,
because it's, it's, it's against the law to have personal data, sensitive data
exposed, right? But I'm gonna tell you later why this, this fix was enough for them. Next one,
please. The funny thing is, not the funny, but the worst thing is that before doing all this,
the press, we tested that in many places, 100% of the places that we tested,
you only needed to connect to a network cable, and that was it. There were no restrictions,
just connecting to, to any, to any plug, and you will access to the entire network.
So, she was called to, she was called to Congress to give a, an explanation, but she just lied.
And again, she was saving a lot of people's asses. And the good thing, well, the bad thing is that
they created a feeling of panic, you know, nobody wanted to give you any information at all,
not even the one they were required to give you, you know, like, they were like saying,
no, because of what happened, I cannot give you anything, but I'm allowed to have it,
I mean, internally as a, as a part of the same institution. So, it created a panic.
And then, they were not sharing any information, like, like,
it created the opposite effect, you know, like the extreme effect. And for me, it was, it was a good,
what happened afterwards, afterward was good in my, in my, in my job, because I, they gave me,
the director of the institution told me to create a security department specializing on finding
these issues, right? But we were, we were too against the world, you know, we were,
nobody wanted to being told that they had a problem. So, I found, for example, that you could,
they had default password in 5,000 email accounts. And I, I told them, and I did a presentation
explaining them why it was bad. And their answer were, their answer was crazy. They said,
public servants are public, I mean, no, no, it's wrongly proposed, it didn't say correctly.
Since they were public servants, they say that their emails should be public.
So, for them, it was okay that you could look in from the internet, from, not even from the
inside the net, from the internet, you could log in on their accounts and check their email.
And inside those email accounts, they have patient information again. So, at some point,
we're just like, we're not, we're not going anywhere, we're, it's just us against the world.
Next one, please.
So, again, after the government change, after the, this right-wing government that
set foot or created this scenario for demonstration that lasted for five months,
that I told you at the beginning, they fire me on the first day, you know, like,
first hour, they fired, they sent me an email to fire me, but I knew it, they were gonna do it,
so I was, again, on my holidays, I was on vacation. So, that forced them to fire me by email.
But that gave proof and evidence that they fired me with no reason, because they never
gave a reason on the email, because they thought that they were entitled to, but they didn't know
that the law, it's complicated, but they didn't know that the laws changed regarding whether you
can fire without any cause a public employee. So, they fired me, and a lot of projects that I was
in charge of with the UCL, for example, University College of London, and the Job Hopkins, which is
the best university in the world regarding to the health sciences, but I sued them, you know,
I knew before they fired me that I could sue them, I knew exactly what part of the law changed,
the Supreme Court ruled that every public servant, even though they had temporary contracts,
they're allowed to be compensated if they had a permanent role, and I have a permanent role,
so when they fired me, they were just like, ah, nothing's gonna happen, just fire this guy,
and that's it, but then I sued them, and that ended up in the media, they accused me of being
a hacker, that I stole information, that I destroyed servers, and again, it was this lawsuit,
it was just about proving that I worked there or not, not about me, but the China, you know,
assassination of character, and they said I was a bad hacker, that I went to DEF CON,
they even copied the screenshot of the talk that I gave Sky Talks as a proof that I was bad,
even though the talk was after I was fired. Next one, please.
So after that, this government is still in power, right? I've been banned from working with any
government agency, I was about to do a pen test, and in the last day, they said that they lost
their resources, but then a friend of mine told me, and even sent me the WhatsApp conversations,
they told this person that she was going to be fired if she hired me.
So I got very famous at the time, in a bad way, but that didn't stop there. I wanted to know,
because I did a formal investigation of what happened, I went there as a witness and blah,
blah, blah, and I got the investigation report, I got the documents, there were over 1200 pages,
I had to pay $50 for them to give it to me, because they have to print it, and they have to
remove all the sensitive information, which is stupid, because they removed their email addresses
that I could get easily, and I wanted to know what happened. I wanted to know why nobody did
anything, the reasons, or at least I wanted to know, even though I was a witness, or I testified
in a way, they never gave me any feedback. They don't call you and tell you this is what happened,
or no, nothing, and they just tell you to get the information using the proper channels.
So I got this, next slide please, I got this big chunk of paper, you know, it's like
a big pile of papers, next one please. So I started to read them, you know, through every page,
and they have a lot of, a lot of people say that they didn't know me at all. A lot of people
lied, they said they never received an email, never heard about it, that they didn't know
about me. But then they have this part of the document, they say that it was possible to fix it,
but it would have taken a big impact on their operation.
Which was not true, because they fixed it in a day, without any disruption. And then they say
that it's every person's responsibility, and it's a personal issue, which is not true, because
the law entitles every person in charge of sensitive information for patient data
to be responsible for it. And this guy just, you know, it's all about, you know, this typical
thing about working in IT, that everyone blames the user, the same. It's the user's problem,
it's the sharing information, it's their problem. Next one please. So this was the excuse number one.
And then, excuse number two, again, another guy in the top rank of the institution said
that it's, again, the user's responsibility, and it's very complex to identify these folders.
And you remember that the script that I run, it was like five lines, it was really easy to do it.
They had access to everything, all the tools that I didn't have. And the last one, again, 14 says
it's a fault, they're blaming the users, again.
Because I should have informed them, or my boss, which I did.
And again, they didn't know anything about it. Even though I sent many emails, I tried to
reach them in many channels, but nobody wanted to listen. Next one please.
The main reason, and this is like the most incredible thing that I discovered in this
investigation, is the main excuse, even from the minister, is that the ISP provider,
the internet provider, and the email provider, which is the same, they couldn't fix their email
for a year. So the main person, the minister of the health department, didn't have an email
working properly for a year. And that was the excuse. And even this email, it was sent
by the ISP provider, which is a big contract, it's $4 million per month contract they have.
They say, it's correct, her email didn't work for a year. So, next one please.
So the latest update, because this lasted for, this happened two years ago,
and November the 8th, last year, it was the final, the final step, the Supreme Court rule,
my favorite, so they had to pay me $25,000 in compensations, which is not what I wanted,
but it's not that bad. Next one please. But the funny thing is that with that money,
I had to pay the money that I spent going to DEF CON for two years. So I ended up with,
I don't know, like $500. So what can we do to avoid these situations? In my country,
as well as the entire world, we don't have a lot of people knowing that, that are experts in
security. And people hiring, they don't, they don't even know what a computer science degree,
it's different from a, from a, here we have different types, but it's a technical degree,
you know, they don't have any, they don't know the differences. So when they hire someone,
they will ask you, do you know about security? And say, yeah, I did this certification,
okay, so you're, you're ready to help us with this issue. And it's the opposite. So
we need to change our laws. I mean, we have the laws, but they're not enforced, right? The,
and it, and I do, I have this, these topics in my classes that I do in this masters,
that I explained some things that happen in other problems that ended up nowhere. I mean,
the CTO of this health department, he was fined with 10% of his salary for one month.
That was the only punishment. And we need, what I learned is that we need less robsters and more
mentors. And I'm actually mentoring a lot of students, five or six. Well, now it's weird
because of COVID, right? Everything stopped, but we were competing tomorrow, actually,
with four of them in the OSINT Trace Labs CTF. Next one, please.
So which ticket is the last one? Well, me now, a lot of images of me sad or whatever.
Next one. And I think it's the last one.
Well, thank you. It was a long talk, a lot of problems involved. There's a link to the slides.
That's my Twitter account and my LinkedIn account. I hope you liked it. And thank you
to all of the organizers as well. I know that they're working a lot to get this through.
Have a good day.