start	end	text
960	10320	Okay, hi everyone. First, I need to clarify things about my slides. They're not
11400	17860	built to be static, so a lot of things wouldn't make much sense.
18880	26940	So this talk, it's one of my... it's my first talk ever, and it's been... I've been traveling
26940	35680	for the last two years, giving this talk in many places. The last ones were in South Africa,
35680	45520	besides Cape Town, and in... let me adjust my cell phone a little bit here. Okay.
46040	55220	And the last one was in the United States, in this conference checkpoint.
56940	65880	In New Orleans, just before COVID started. So, can you move the next slide, please?
68620	74020	So, a little quick note. Just before the
76480	82280	pandemic started, we were having a lot of demonstrations in my country.
82280	90940	We had five months of demonstrations, just like... pretty similar to what's happening now in the U.S.
93200	98900	So, what happened is that these four identities that I'm showing up here,
98900	103200	Amnesty International, they developed reports about the situation, and they
103720	109820	confirmed that human rights violations were happening in Chile. Next slide, please.
114460	122140	So, I was pretty active during that time. Here you have some data.
123720	133040	So, 35 people got killed by the police forces. 25 people lost their lives because of rubber bullets.
133340	141160	And two people lost their sight completely. Next one, please.
143580	146900	I'm trying to go as fast as I can because it's a long one.
147160	152280	So, as I told you before, I was pretty active at the time. We were rescuing
152820	160040	wounded people from the, what we call it, the front lines. So, just a couple of days before
160040	168380	the pandemic started, we rescued one guy that had brain trauma because of a tear gas canister
169100	176320	launched by the police forces. And he died the next day. So, it was pretty stressful for us.
176320	186000	So, in a way, the pandemic kind of released that stress. The one in the right side with the big
186000	204060	shield is a shield built by a TV. So, she was helping us with the most critical cases.
204160	215180	Next one, please. So, after that quick brief, I'm going to present myself. I'm a
215180	221640	computer science engineer. It's a career that only exists in Chile, that it's six
221640	227880	years long. But I really loved it. So, it took me nine years to get out of it.
229060	234460	And like I said before, this is one of my, this is my first talk ever related to
235000	241020	cybersecurity. And it got picked up by SkyTalks two years ago. And it was like the beginning
241020	249900	of everything for me regarding DEF CON and cybersecurity. And I do a lot of classes as
250040	258540	a professor in different type of instances. One is a free university that I teach CTF
259300	269920	workshops. And with most of these guys, we went last year to DEF CON to present a workshop. I
269920	282100	also work with a lot of projects related to health. So, recently, we want finance to get
282100	289100	this, to do this project related to COVID-19 in my country. And right now, I'm learning
289100	297900	ASINT. So, tomorrow, we're gonna participate in the Trace Labs CTF, which is a very good
298560	308980	exercise to improve your Googling skills. And I have a small company, really small. So,
308980	316640	I'm the founder, the CEO, and also the janitor. The things that I do most, I mean,
316640	321400	all the time are workshops. So, next slide, please.
323940	330480	So, last year, I went to DEF CON. So, I had the chance to meet Jason, Jason Street.
330980	337880	And then, we went to DEF CON, DEF CON 27. That was an amazing experience.
340200	345660	Yep. Next one. So, that's all about me.
347220	354460	So, for you to understand this talk, I need to give you a little bit of context. So,
354460	364740	in my country, we have a health system that is 80% public and 20% private. So, the public part
365620	372700	is pretty much free. It's very different than the US. So, the public sector, we have around,
372700	380380	now it's 15 million patients. So, in the top of the graph, you can see what's called MINSAL,
380380	387000	which is basically the health department. And below that, you have 29, what they're called
387000	397260	services. They're like institutions that they try to coordinate the different hospitals and
398080	405380	institutions. So, I was working in one of those services, which is actually the biggest.
405700	415340	We have around 2.5 million patients. Okay. Next slide. Slide, please.
417660	426440	So, how bad, I have trouble pronouncing the word MACAB. So, how bad is this talk?
426440	432300	When I was giving it, about to give it in Skype talks, I was receiving threats
433100	442660	by some people that I knew. Some people involved in the police units were sending them messages
442660	452040	that if I did the talk, they will wait for me at the airport, they will sue me. And
452040	459280	I, at the time, I also received an email from somebody that they were ordering to shut down
459280	467360	all the servers from this, the related to health institutions, because they were afraid that I
467360	475180	will give information that will allow DEF CON attendees to hack all our systems, which is really
475180	485180	stupid. So, I asked if, they also told me that they were sending some people to watch my talk
485180	491480	and to record it. So, I asked if there were some government officials in the room and they actually
491480	500160	raised their hand. And months later, I received a recording from my talk that was surprising,
500160	509020	because Skype talks are pretty strict, you cannot take your cell phone away, it's not 100% safe.
509100	515760	Luckily, nothing happened after that. Well, not nothing, but you can say that. I don't want to
515760	529550	be, I don't want to give you spoilers. So, next one, please. So, I prepared different, some stories
529550	537330	that will help you understand the context of what I have to face at work pretty much every day.
537730	545470	So, I, the first story is called a very secure web service and the idea of this slide is just
545470	553610	part by part and at the end you will see the image. So, the health department, they asked
553610	568700	to every institution for the patients that attended the public sector around 15.
569300	576440	So, they were, they gave me this assignment and I just find it weird that they will give you
577000	584620	a web service, but you have to deploy your own web, their web service, which is very weird in
584620	592820	my opinion. I worked as a developer for five years before getting into this job that I had
592820	599680	at this place and I never seen that somebody sent you a binary of a web service for you to deploy
599680	606820	and use it. And then you will upload the files to an FTP server, which is, again, really bad.
607380	609040	Next slide, please.
610920	618840	So, then I thought maybe I should check the security of it, right, the mindset of a hacker.
618980	627780	And, you know, at first I was like checking out the 3DS algorithm, trying to find something
628540	636060	that I could use, but at the end it was easier to decompile it and they have no obfuscation at all.
636060	645920	It took me literally three minutes to decompile it and I found the key of the web service,
645920	658160	so now I could download all these reports from the server and check all the data from all the
658160	666360	pages. So, at least the key they're using was a good one. Next one, please.
679600	682340	Now, okay. So, I reported...
712340	722720	So, he demanded me, you know, a paper.
730600	745650	And the answer was nothing. I never got any reply from him after that.
747130	749630	So, next one.
751870	759750	So, the second story is what we call it a very secure electronic health record.
760770	771770	And this software had over a million pages of data, anything that you can imagine, exams,
771770	781510	prescriptions. And they looked it up on the internet using Oracle, very expensive databases
781510	788650	and the database was only 40 gigs. And there are not many transactions, so that's difficult
788650	798530	in the public sector to buy expensive software. So, they have 18 developers. This is the part
798530	805530	where the facts explain against me.
805550	818190	So, CBS had 800 word files. Next one, please.
827300	831280	Hello. Okay.
831280	841700	So, what happened one day is that they were audited of this work. And I was invited,
841700	850760	just as somebody that was a part of the project. And at some point, they asked this developer,
850760	856780	so the project manager, about the security of this software. And he said,
856780	865140	security, because they had implemented a five-digit password. And I couldn't, you know,
865140	874400	I couldn't not raise my hand and ask them, are you serious? I mean, five digits? That
874400	883300	almost got me fired, because I said I couldn't attack or do fairly fire to my own colleagues,
883300	889740	even though they were not really my colleagues. And I have to apologize. I have to apologize,
889740	898860	because even though they were stupid, I shouldn't have said that at this point.
899180	910140	Next, please. So, at that point, not really understanding, I was thinking it was like
913480	920800	something... and they attacked me for a couple of weeks. They were asking, some people were asking
920800	927340	for me to be fired, you know, directly. I cannot work here anymore. So, I was lucky,
927340	934680	because my boss, the director of the institution, supported me all the time. Next slide.
940740	960640	So, one day, I went to work. I couldn't get into Gmail. We were using Gmail. So, I couldn't
960640	970520	Google it. But if you could work, Twitter, you could get into an email, and all that.
973840	982700	So, I mean, I was the only one from home. And how could I think about Google? I mean,
982700	988300	they hired me to do something that I didn't know how to do it. So, I had to Google a lot.
988300	995780	Basically, planning a data server, a big one in a hospital.
1001740	1008720	So, I was very critical. I couldn't understand how something like this could happen in such a
1008720	1015960	big institution. So, I did research on the IT manager and the director of the institution
1015960	1036320	to know what happened. And the IT gave me a paper. So, that's how I learned so much.
1036720	1044280	It said most that they blocked every Google service. Because through Google,
1044280	1053540	you could get into forbidden sites, like porn sites or gaming sites. So, they are out of pretty
1054780	1065480	bandwidth, or they set out a limit. I think I can remember it was like 2000 megabytes per IP.
1066320	1074460	So, that's why every... which was mind-blowing. Next one, please.
1079240	1087760	So, time, which reflects my reactions at the time. Next one.
1095310	1109280	Start changing this part. So, how do you get a little bit of the context of what the work was
1109280	1121800	about? Probably, I'm going to write not a book, but a blog. I have 50 of those.
1122500	1139140	So, go to this part of this talk. And how everything started. Next slide, please.
1142420	1150200	So, imagine that you're working, this is your new job, and you've been there for 10 months.
1150360	1160680	And they ask you to find some IPs and add some bridges. But they didn't know which one I was
1160680	1170920	looking for. And then they said, let me see if I could increase the range. So, I ended up finding
1171460	1188280	50,000 devices. And this is a part that you could really understand the transitions.
1189840	1196560	There are now virtualization of the network. Not at all. So, you could see all the devices
1197390	1226540	from the northern part of the country. So, I couldn't read why that was. I thought I had a
1226540	1242940	list. Next slide, please. So, I started to check all those devices. And I was finding more and
1242940	1254560	more. I mean, there are just so many that even the software that they give you does not respond
1254560	1260760	properly because there are so many devices. They don't just take a long time to load on the
1260760	1270840	screen. So, I found a lot of folders with public privileges. And some with public
1271800	1272920	privileges. And even the
1274820	1286920	they have all these hospital related files, architecture files. So, then I discovered
1286920	1292830	they have public writing privileges. So, anyone could have deleted the server.
1293550	1303930	And the things that I could see, I think the last part is not on the slide, but
1305350	1307710	I could access a lot of
1311590	1342160	things. Next one, please. So, after that, a couple of months went by.
1342920	1353520	Trying to understand the problem, like, how this is possible, right? So, what I discovered is that
1353520	1364640	the, you know, like, they didn't know how to share. So, imagine sharing, say, a 500 megabytes
1364640	1371240	file. It will just share a folder, put it on the shared folder and send the address
1371740	1393320	to another person without rechecking. Next one. It's not moving.
1396900	1406740	So, my boss at the time told me, do you need to get about all your files and send email
1406740	1442190	to them? So, can you hear me now? Okay. So, let's continue with the presentation.
1442780	1452330	So, like I was saying, I sent this email report with the IP addresses, the folders,
1452330	1461590	and the files that you could retrieve from the shared folders. So, the worst one is that you
1461590	1472770	could find information of HIV patients, information that is protected by a special law
1472770	1480650	in Chile that it's implemented for that information to be anonymous. Otherwise,
1480650	1489530	you might be, you might suffer discrimination, looking for a job, et cetera. So, that was the
1489530	1510600	worst part of it. Next one, next slide, please. And you know what? I didn't receive any answer
1510600	1521560	directly to these emails. But then my boss sent me one of the emails she received as an answer.
1521560	1530220	One of the things that I was more upset about, it was just that I didn't exist for them because I
1530220	1539880	was like one month working, for a month working there. So, not even a reply directly to my email,
1539880	1548460	not even a, let's say, congratulations for helping us or heads up for, I don't know,
1548460	1557080	trying to help the institution. And then this guy, the IT support manager, was also the CSO,
1557080	1568840	which is very weird. But they were chosen those like, let's say, roles, just if you've completed
1570580	1582180	like an online course of ISO 2000, 2007, 2001. That was the only requisite to be part of the
1583340	1593360	CSO, let's say, role. So, this guy sent an email saying that it was a big problem, but
1593360	1600660	none of those IP addresses were from our institution. But the things that I
1601960	1609300	didn't even think about it, you know, I didn't plan myself to find our IPs. So, after that,
1609300	1617740	I sent another email with all the IPs that belong to us. Next slide, please.
1618620	1629380	So, they didn't check anything, right? They just like tried to save their assets.
1631120	1639610	But they didn't know that I had many, many IP addresses. So, next one.
1642820	1649820	So, on the third email, I only included IP addresses from our institution
1649820	1662030	and from all of us. They belong to what is called a health network.
1663270	1674750	So, we are responsible for what they do in terms of use of information. So, I sent them,
1674750	1682990	I cannot read it from my cell phone, but they were the most important hospitals in the country.
1682990	1690930	One of the hospitals is called Sotero de Rio. He has over 3 million patients.
1691250	1698870	And they had a server with everything that you can imagine. They had passwords, servers,
1698870	1709620	webcam, I mean, security cameras. They had backups of many machines, x-rays,
1709620	1713200	whatever you can imagine. I don't even remember now,
1713200	1719540	but it was so much information that I was not able to process all. Next one.
1723090	1733130	So, the answer for 10 months was nothing at all. Next one, please.
1736650	1749410	So, one of the classes that I teach now is one where I was a student.
1751150	1758870	And while I was a student, my sound is not... I don't know if you can hear me well, but
1760150	1762630	on my end, I'm getting a lot of noise.
1764090	1772310	Well, I had this class with one of the IT managers of the health department.
1772990	1780810	And we were both students. She was quite older than me, right? And during the coffee break,
1780810	1788270	I told her that I was the one who sent those emails that I never got a reply back.
1788270	1794470	And she said, we're fixing it. You know, like, cutting me off, like, giving me the hand.
1794470	1799350	You know when somebody tells you, like, stop? Like, we're fixing it.
1801490	1807410	And also, she said, I know. But then... Next one, please.
1810370	1816510	She ignored me for the rest of the classes, like, for two weeks.
1823650	1831710	She thought I was some crazy guy telling, like, things that she didn't know about.
1832730	1842490	Okay, next one, please. So, after 10 months, no answer, no changes. I could still check
1842490	1849650	all the IP addresses. I was running scanners, like, two times per week, two times per week,
1849650	1855130	and everything was the same. And not even a thank you, you know, we're all hackers,
1855130	1862790	we're all sensitive. So, I was very sad. Next one, please.
1865330	1871370	So, how do you fix something that nobody cares about?
1872750	1879650	So, I was, I contacted one of these journalist groups that are very,
1880170	1886290	they're very important in Chile. They were part of the Panama Papers investigations. They
1886290	1895050	discovered a lot of politicians from Chile on those, on those leaks. And I sent them the
1895050	1901350	information, and just right away, they were like, we can't believe that this is true. We need,
1902430	1911830	next, next slide, please. So, they wanted me to show them all this information from my computer
1912490	1918810	in order for them to be sure that I was, that I was correct, I mean, that I didn't have, like, a
1918810	1928970	special connection or whatever. So, I asked a journalist to sit next to me and to check all
1928970	1934510	these folders. It was very, like, it was very scary for me. I was only thinking that I'm going
1934510	1941150	to get caught and, you know, be fired or whatever. And after a while, when they processed all this
1941150	1947890	information, they were asking me a lot, a lot of details, you know, like, send us an email,
1950930	1958730	how many patients in total, how many patients with abortion. So, I had to work for a month.
1959830	1970130	You know, like, sending them evidence. And at some point, they asked me to test the same thing in
1970130	1980930	three different places. So, I needed to ask somebody to allow the journalist inside their
1980930	1989430	offices. So, one of these guys that I asked him, a friend of a friend, he almost, he actually sent
1989430	2002940	an email to their IT department. And he said, okay, I just sent an email to the IT department
2002940	2014300	asking if this is possible. And I said, no, you're destroying this investigation. You're
2014300	2017320	destroying this investigation. And he said that what I wanted to do was basically get into the
2017320	2025940	folders and from another office, they said it was not possible. So, that saved me.
2027900	2035020	But the journalists were very nervous. They even thought about publishing the information that day,
2035020	2042220	the very same day. But this email with this guy is telling us it was not possible to just make
2042220	2048720	things, make things a little more calm. Next one, please.
2052660	2059980	So, how did I get this information? It's very simple. It's sometimes when I started doing
2059980	2066740	hacking or I did some pretty big stuff, for example, in Brazil when I was living,
2067180	2073360	I took control of over 3,000 routers. And it was so simple that I thought it was something that
2073360	2080480	was not worthy, that it was pretty lame, you know? But after that, I learned that it doesn't
2080480	2087480	matter how difficult it was, what is important is what you got out of it, what kind of information
2087480	2092920	you can get. And now that I have more experience, it's like getting into Shodan and you can do a
2092920	2103340	lot of things without knowing anything. Just like running some scripts and,
2104140	2107660	but at the time, I didn't have a lot of experience, so I didn't know.
2107660	2117980	So, next one. I didn't know that doing something that is not technically complex,
2118960	2128160	it's also valuable, you know? So, my approach was to gather everything, you know? Like,
2128160	2134620	every file that was signed, every document. But the thing is that this network was so bad
2135300	2143880	that some nodes, they were giving me 100 kilobytes per second of speed. So, it was like,
2143880	2152040	I couldn't copy a lot of code. It would take me months, right? So, the other thing that I had to
2152040	2157620	manage is that computers, most of those computers, even servers, they were turning off at 6 a.m.
2159200	2166940	So, I only managed to copy 300 gigabytes out of more than a few terabytes of scan.
2167220	2174620	And you're not really scared of copying those files because I was probably sending
2174620	2183820	files to a firewall that somebody is copying or it's used in a unique way.
2184100	2191340	And 24 hours, but then I learned that nobody takes the firewalls.
2192920	2200000	No one really pays attention to them. They just believe that they are not safe.
2212940	2220360	So, after a while, I said I cannot get everything. I needed to just get rid of
2220360	2226540	the things that we have in our brains that sometimes we want to store everything, you know?
2227180	2234600	Simple and have issues, you know? They have information that they're never going to see
2234600	2239320	again. People that buy books and buy books and never read them again.
2240080	2250020	So, I have to, like, I did this only a couple of times. And then, you know,
2250020	2262080	grabbing for terms, keywords, like HIV or, you know, well, there were things to look for.
2262800	2271880	I published my article and I was trying to know that I was going to get fired.
2271880	2280160	So, I didn't want to lose my vacation. So, I mean, we miss everything. Like, in the flight
2280160	2290000	and the articles, people, I know they were all sentences. So, I prefer to be in another country.
2290720	2301380	That way, I will be on the way with a proper structure or idea of what is good.
2302680	2308140	And actually, that's what happened. The first day, the guy called me. He was calling me and
2308140	2319980	she said, you know, since I talk too much, you know, she was always
2320860	2327420	was too impulsive saying that things didn't work or that there were problems with everywhere.
2327420	2332460	That was a head-scratcher. I said, I don't like it. So, probably some
2332460	2342700	and then some journalists and that's what happened. Yeah, yeah, you do speak a lot.
2349060	2367100	So, I could check the privileges they had and just put it on a file and just
2367980	2375000	every time the journalist asked me for anything, I would just add information and then
2375000	2388570	post it. So, now let's get serious. I'm really serious about this.
2391190	2397250	So, this meme was really good. It was displayed after the title, but
2397990	2405630	this is not that bad as when I did this talk in Beijing. Every joke that I made, every meme,
2405630	2413670	there was no response. I did some hearts and claps for me, but it was only one of the worst
2413670	2434810	talks ever I ever given. No response from the public. Examples are this server that I found
2435530	2449270	blog. It was 23,000. And every update, email, phone number, cell phone number.
2451050	2458010	The ID, we have a thing that's good. That is an ID number and with that ID number,
2458010	2464010	you can do pretty much the social security number in the US.
2466250	2480580	Next slide. So, another example is a server protection. Again, you have all the patient
2480580	2491340	data and sensitive information that is protected by the two specific laws.
2493320	2498460	This type of thing doesn't have to be in any way public.
2512230	2519770	Next slide.
2520470	2554580	Did something happen? Okay.
2554740	2558580	Okay. So, I'm gonna look in again.
2600140	2617220	I apologize everybody for interrupting the talk again, but the speaker needs to reenter this
2617220	2624020	space because it is some problem from his end probably or from the Microsoft end,
2624020	2627840	but we had Q4Q from Microsoft in here to reset the space and
2629640	2633520	rectify whatever the issue was and it was earlier, right?
2634580	2641540	But then, we are facing the same issue again. So, I think we have to wait for Philip to get
2641540	2648840	back and continue his speech. So, until then, thanks a lot for your patience again.
2662760	2668440	Okay. So, as soon as he'll be back, you need to continue the slides.
2827680	2829620	Do you want me to send it now?
2852380	2870060	I'm really sorry. I hope we will not face any such issues for the future talks, but
2871600	2874580	like we hackers, we are not a big fan of
2875780	2882140	being on Windows and this is a contradictory statement because we are on a platform that
2882140	2889400	is backed up by Microsoft. But then, hackers love Linux. That is the whole truth, whole
2889400	2894980	and sole truth that we know. So, some of the speakers like Philip himself, he was trying to
2894980	2901620	run Allspace VR on Linux machine that he has. So, I think probably this is one of the issues
2901620	2908820	that he is facing. So, thanks a lot for joining in and please stay for a while because we have
2908820	2918520	another presentation coming up after Philip's. And thank you again.
3170060	3171540	Okay, I'm back.
3182010	3184810	All right, so...
3238880	3241480	Can you hear me now?
3242300	3247500	Can you, if you can still hear me, give me your claps.
3249180	3253760	Okay, great. So,
3253760	3273410	well, it's been very tiring to restore. Let me get my slides here, here, there.
3274390	3282230	So, okay, just kind of trying to finish. I sent the logs that they asked me to.
3283190	3294720	So, we can go to the next slide right here. Next slide, please.
3302980	3308120	And another example of what I found, it's
3309940	3317300	a 35 gigs of monographies, again, with all the patient data splurged on the right.
3317300	3320520	The time is 4 o'clock p.m.
3321540	3338100	Yeah, it was only one server. It's only three servers that I sampled. I was kind of,
3338100	3342720	my computer or my laptop, so I deleted everything.
3344040	3354600	I run, like, three cycles of shaders. So, at the end, I don't have a lot of
3354600	3360260	that information at the time. I just thought it was better to get rid of them.
3361720	3363260	Next one, please.
3370900	3377000	So, again, I'm saying a lot of so's and I try not to.
3382600	3393540	So, I counted doc files, TXT, PDFs, and over 4 million files.
3394090	3399500	But I didn't count all the types. Photographs, for example.
3400460	3405180	ZIP files that had a lot of backups of many servers.
3405640	3407840	Next slide, please.
3414650	3418510	In this slide, you can see, for example, in this image, you can see
3418510	3428730	PILs, the word PILs in Spanish, which is PILDRA, and how many files with the name PILDRA and
3428730	3437730	format, and format, spreadsheet format, and there were 120.
3439190	3445550	And this is the after PIL, or emergency PIL. And if you see the data,
3446690	3453230	if you get inside those files, you can see reasons why they were asking those PILs.
3453230	3463790	Some that were abused. Some people, some girls were raped. You can even see the situations.
3469660	3472700	Okay, next one, please.
3486040	3488180	And next one.
3495060	3498860	And in this, no, the one before.
3500160	3504160	One back, please. Sir.
3507810	3523830	In this one, I was looking for files with the word HIV in Spanish. And I found 772 files.
3524250	3528610	And you can see the file names. I don't know if you can see them. I don't know if you can read
3528610	3540850	them. But believe me, there were IP addresses followed by the name. And then I could retrieve
3540850	3548290	them and send them to the journalist. They were looking for bad stuff. You know, they were just,
3548290	3554230	they were asking me, give me the worst. We want the worst. We want everything that you can give
3554230	3562510	that will be pretty bad regarding to the laws and regarding the public interest.
3562650	3571690	So next one. Next one. I'm about to finish, so be patient. I know it's been long.
3572810	3583150	I'm feeling it. Next one. Let's move in.
3584390	3593290	So, again, what happened? What was their strategy? The reason why they asked me for three places
3593290	3605510	is they wanted to be sure that this was a more general problem that they were trying to,
3605510	3611770	they were trying to find proof that there was a widespread problem, like I said,
3611770	3617530	because I was sure, you know, I was telling them, I'm sure that this is not a thing about
3617530	3624950	my computer, it's a network problem. And what they did is that they scheduled a meeting with
3624950	3632510	this minister, with the health minister of the head of the health department. And they never said
3632510	3641750	that they were part of this group called CIPER. So they presented themselves as a random guy,
3642470	3652070	so after a month, I guess, they talked to her, they went to her office, and they asked for her
3652070	3661350	computer to show her the problem. And from her computer, they managed to download all this
3661350	3666650	information that I've given them, the IP addresses, they only put the IP address, the folder, and then
3666650	3675510	you got many, many files with HIV patients. And she was, the journalist told me, she was a white
3675510	3685190	woman, she was like, she was shocked. Next one, please. And they were pretty badass, you know,
3685190	3691030	they say, you got 24 hours to fix it. They never said they were from a journalist group.
3691350	3696570	So at that point, the minister, she didn't know what would happen. She thought it was
3696570	3702990	just a problem that they needed to fix. So what happened after that is that they published 24 hours
3702990	3710990	later, all this information that I've given them, and they were, it says in Spanish, and of course
3710990	3724410	it's in Spanish, right? But it says 100,000 workers could, even companies that were given
3724410	3731530	services or, let's say, outsourcing companies, they had access to all these files, all these files.
3732990	3740430	And they put there that they have at least 3 million files that could be, that were unprotected.
3741330	3753750	Next one, please. You can Google this information. And then all mainstream media
3753750	3759830	pick up this information, even from other countries. I was checking everything from
3759830	3764730	Colombia at the time. Even some Colombian newspapers pick up this information.
3766370	3772230	And friends will tell me that it was all over the TV, all over. And I was receiving that,
3772230	3775370	some of the people told me that some people wanted to talk to me
3775370	3781530	at the office, but I was on vacation, so I was free of that. Next one, please.
3785980	3793660	So this solved the problem in a couple of days. But what they did, they blocked the
3795740	3803580	files from every institution, right? So you couldn't access share folders from another
3803580	3810400	institution, but you could still access all the share folders from your, behind your router,
3810400	3818280	right? I even tried, tested it. So you could access, for example, what it worked,
3818280	3826480	I could access information from five hospitals, and I could still access a lot of information
3828140	3836520	that it should have, they should have, you know, like forced everyone to unshare those folders,
3836520	3843660	because it's, it's, it's against the law to have personal data, sensitive data
3845620	3855680	exposed, right? But I'm gonna tell you later why this, this fix was enough for them. Next one,
3855680	3866500	please. The funny thing is, not the funny, but the worst thing is that before doing all this,
3866500	3874180	the press, we tested that in many places, 100% of the places that we tested,
3874600	3881980	you only needed to connect to a network cable, and that was it. There were no restrictions,
3881980	3890100	just connecting to, to any, to any plug, and you will access to the entire network.
3891180	3900380	So, she was called to, she was called to Congress to give a, an explanation, but she just lied.
3900960	3909180	And again, she was saving a lot of people's asses. And the good thing, well, the bad thing is that
3909780	3916120	they created a feeling of panic, you know, nobody wanted to give you any information at all,
3916120	3920280	not even the one they were required to give you, you know, like, they were like saying,
3920280	3925160	no, because of what happened, I cannot give you anything, but I'm allowed to have it,
3925160	3930600	I mean, internally as a, as a part of the same institution. So, it created a panic.
3930860	3936420	And then, they were not sharing any information, like, like,
3936420	3944640	it created the opposite effect, you know, like the extreme effect. And for me, it was, it was a good,
3944640	3952420	what happened afterwards, afterward was good in my, in my, in my job, because I, they gave me,
3952420	3959420	the director of the institution told me to create a security department specializing on finding
3959420	3965700	these issues, right? But we were, we were too against the world, you know, we were,
3965700	3974340	nobody wanted to being told that they had a problem. So, I found, for example, that you could,
3974340	3982660	they had default password in 5,000 email accounts. And I, I told them, and I did a presentation
3982660	3989500	explaining them why it was bad. And their answer were, their answer was crazy. They said,
3989500	3997920	public servants are public, I mean, no, no, it's wrongly proposed, it didn't say correctly.
3998700	4002960	Since they were public servants, they say that their emails should be public.
4002960	4009480	So, for them, it was okay that you could look in from the internet, from, not even from the
4009480	4014280	inside the net, from the internet, you could log in on their accounts and check their email.
4014400	4021840	And inside those email accounts, they have patient information again. So, at some point,
4021840	4027700	we're just like, we're not, we're not going anywhere, we're, it's just us against the world.
4028260	4029500	Next one, please.
4031900	4041400	So, again, after the government change, after the, this right-wing government that
4042600	4049660	set foot or created this scenario for demonstration that lasted for five months,
4049660	4053640	that I told you at the beginning, they fire me on the first day, you know, like,
4053640	4059760	first hour, they fired, they sent me an email to fire me, but I knew it, they were gonna do it,
4059760	4067380	so I was, again, on my holidays, I was on vacation. So, that forced them to fire me by email.
4068200	4075740	But that gave proof and evidence that they fired me with no reason, because they never
4075740	4081060	gave a reason on the email, because they thought that they were entitled to, but they didn't know
4081580	4088360	that the law, it's complicated, but they didn't know that the laws changed regarding whether you
4088360	4098920	can fire without any cause a public employee. So, they fired me, and a lot of projects that I was
4098920	4104920	in charge of with the UCL, for example, University College of London, and the Job Hopkins, which is
4104920	4113600	the best university in the world regarding to the health sciences, but I sued them, you know,
4114040	4120540	I knew before they fired me that I could sue them, I knew exactly what part of the law changed,
4120540	4127460	the Supreme Court ruled that every public servant, even though they had temporary contracts,
4127460	4134580	they're allowed to be compensated if they had a permanent role, and I have a permanent role,
4134580	4138400	so when they fired me, they were just like, ah, nothing's gonna happen, just fire this guy,
4138400	4144960	and that's it, but then I sued them, and that ended up in the media, they accused me of being
4145100	4154600	a hacker, that I stole information, that I destroyed servers, and again, it was this lawsuit,
4154600	4161360	it was just about proving that I worked there or not, not about me, but the China, you know,
4161360	4167100	assassination of character, and they said I was a bad hacker, that I went to DEF CON,
4167100	4175980	they even copied the screenshot of the talk that I gave Sky Talks as a proof that I was bad,
4175980	4181120	even though the talk was after I was fired. Next one, please.
4184340	4191960	So after that, this government is still in power, right? I've been banned from working with any
4192820	4203180	government agency, I was about to do a pen test, and in the last day, they said that they lost
4203180	4209580	their resources, but then a friend of mine told me, and even sent me the WhatsApp conversations,
4209580	4215560	they told this person that she was going to be fired if she hired me.
4217200	4226960	So I got very famous at the time, in a bad way, but that didn't stop there. I wanted to know,
4226960	4232620	because I did a formal investigation of what happened, I went there as a witness and blah,
4232620	4242640	blah, blah, and I got the investigation report, I got the documents, there were over 1200 pages,
4242640	4247300	I had to pay $50 for them to give it to me, because they have to print it, and they have to
4247300	4252680	remove all the sensitive information, which is stupid, because they removed their email addresses
4252680	4260720	that I could get easily, and I wanted to know what happened. I wanted to know why nobody did
4260720	4269360	anything, the reasons, or at least I wanted to know, even though I was a witness, or I testified
4269360	4276240	in a way, they never gave me any feedback. They don't call you and tell you this is what happened,
4276240	4281240	or no, nothing, and they just tell you to get the information using the proper channels.
4281520	4290400	So I got this, next slide please, I got this big chunk of paper, you know, it's like
4293320	4303180	a big pile of papers, next one please. So I started to read them, you know, through every page,
4303180	4309820	and they have a lot of, a lot of people say that they didn't know me at all. A lot of people
4309820	4317040	lied, they said they never received an email, never heard about it, that they didn't know
4317040	4328760	about me. But then they have this part of the document, they say that it was possible to fix it,
4328760	4333420	but it would have taken a big impact on their operation.
4334160	4340540	Which was not true, because they fixed it in a day, without any disruption. And then they say
4340540	4350340	that it's every person's responsibility, and it's a personal issue, which is not true, because
4350340	4357620	the law entitles every person in charge of sensitive information for patient data
4357620	4365780	to be responsible for it. And this guy just, you know, it's all about, you know, this typical
4365780	4372440	thing about working in IT, that everyone blames the user, the same. It's the user's problem,
4372440	4378960	it's the sharing information, it's their problem. Next one please. So this was the excuse number one.
4380860	4389460	And then, excuse number two, again, another guy in the top rank of the institution said
4390320	4397340	that it's, again, the user's responsibility, and it's very complex to identify these folders.
4397340	4404280	And you remember that the script that I run, it was like five lines, it was really easy to do it.
4404280	4410500	They had access to everything, all the tools that I didn't have. And the last one, again, 14 says
4411640	4415320	it's a fault, they're blaming the users, again.
4419740	4425640	Because I should have informed them, or my boss, which I did.
4428040	4433520	And again, they didn't know anything about it. Even though I sent many emails, I tried to
4433520	4439620	reach them in many channels, but nobody wanted to listen. Next one please.
4444070	4451630	The main reason, and this is like the most incredible thing that I discovered in this
4453450	4464770	investigation, is the main excuse, even from the minister, is that the ISP provider,
4464770	4470970	the internet provider, and the email provider, which is the same, they couldn't fix their email
4470970	4479810	for a year. So the main person, the minister of the health department, didn't have an email
4479810	4487610	working properly for a year. And that was the excuse. And even this email, it was sent
4488330	4496350	by the ISP provider, which is a big contract, it's $4 million per month contract they have.
4496910	4503870	They say, it's correct, her email didn't work for a year. So, next one please.
4508180	4514280	So the latest update, because this lasted for, this happened two years ago,
4514280	4521560	and November the 8th, last year, it was the final, the final step, the Supreme Court rule,
4521560	4528720	my favorite, so they had to pay me $25,000 in compensations, which is not what I wanted,
4528720	4538120	but it's not that bad. Next one please. But the funny thing is that with that money,
4538120	4545440	I had to pay the money that I spent going to DEF CON for two years. So I ended up with,
4545440	4557540	I don't know, like $500. So what can we do to avoid these situations? In my country,
4558040	4563740	as well as the entire world, we don't have a lot of people knowing that, that are experts in
4563740	4570980	security. And people hiring, they don't, they don't even know what a computer science degree,
4570980	4577120	it's different from a, from a, here we have different types, but it's a technical degree,
4577120	4580760	you know, they don't have any, they don't know the differences. So when they hire someone,
4580760	4585880	they will ask you, do you know about security? And say, yeah, I did this certification,
4585880	4592640	okay, so you're, you're ready to help us with this issue. And it's the opposite. So
4593260	4600900	we need to change our laws. I mean, we have the laws, but they're not enforced, right? The,
4600900	4607040	and it, and I do, I have this, these topics in my classes that I do in this masters,
4607400	4614900	that I explained some things that happen in other problems that ended up nowhere. I mean,
4614900	4622480	the CTO of this health department, he was fined with 10% of his salary for one month.
4622480	4631800	That was the only punishment. And we need, what I learned is that we need less robsters and more
4631800	4637920	mentors. And I'm actually mentoring a lot of students, five or six. Well, now it's weird
4637920	4644520	because of COVID, right? Everything stopped, but we were competing tomorrow, actually,
4644520	4651560	with four of them in the OSINT Trace Labs CTF. Next one, please.
4653800	4662020	So which ticket is the last one? Well, me now, a lot of images of me sad or whatever.
4663080	4665960	Next one. And I think it's the last one.
4668300	4676300	Well, thank you. It was a long talk, a lot of problems involved. There's a link to the slides.
4677360	4684500	That's my Twitter account and my LinkedIn account. I hope you liked it. And thank you
4684500	4691300	to all of the organizers as well. I know that they're working a lot to get this through.
4692560	4693740	Have a good day.