WEBVTT 00:00.960 --> 00:03.560 Okay, hi everyone. 00:04.400 --> 00:09.620 First, I need to clarify things about my slides. 00:09.620 --> 00:17.860 They're not built to be static, so a lot of things wouldn't make much sense. 00:18.880 --> 00:31.340 So this talk, it's one of my... it's my first talk ever, and it's been... I've been traveling for the last two years, giving this talk in many places. 00:31.940 --> 00:44.680 The last ones were in South Africa, besides Cape Town, and in... let me adjust my cell phone a little bit here. 00:44.680 --> 00:45.520 Okay. 00:46.040 --> 00:55.220 And the last one was in the United States, in this conference checkpoint. 00:56.940 --> 01:01.660 In New Orleans, just before COVID started. 01:02.700 --> 01:05.880 So, can you move the next slide, please? 01:08.620 --> 01:12.360 So, a little quick note. 01:12.360 --> 01:22.280 Just before the pandemic started, we were having a lot of demonstrations in my country. 01:22.280 --> 01:30.940 We had five months of demonstrations, just like... pretty similar to what's happening now in the U.S. 01:33.200 --> 01:47.460 So, what happened is that these four identities that I'm showing up here, Amnesty International, they developed reports about the situation, and they confirmed that human rights violations were happening in Chile. 01:47.980 --> 01:49.820 Next slide, please. 01:54.460 --> 01:59.940 So, I was pretty active during that time. 01:59.940 --> 02:02.140 Here you have some data. 02:03.720 --> 02:08.140 So, 35 people got killed by the police forces. 02:08.620 --> 02:13.040 25 people lost their lives because of rubber bullets. 02:13.340 --> 02:18.160 And two people lost their sight completely. 02:19.200 --> 02:21.160 Next one, please. 02:23.580 --> 02:26.900 I'm trying to go as fast as I can because it's a long one. 02:27.160 --> 02:31.160 So, as I told you before, I was pretty active at the time. 02:31.160 --> 02:36.520 We were rescuing wounded people from the, what we call it, the front lines. 02:36.980 --> 02:50.840 So, just a couple of days before the pandemic started, we rescued one guy that had brain trauma because of a tear gas canister launched by the police forces. 02:50.840 --> 02:52.300 And he died the next day. 02:52.300 --> 02:56.320 So, it was pretty stressful for us. 02:56.320 --> 03:02.220 So , in a way, the pandemic kind of released that stress. 03:02.220 --> 03:11.040 The one in the right side with the big shield is a shield built by a TV. 03:14.200 --> 03:24.060 So, she was helping us with the most critical cases. 03:24.160 --> 03:25.820 Next one, please. 03:28.420 --> 03:34.740 So, after that quick brief, I'm going to present myself. 03:34.740 --> 03:37.680 I'm a computer science engineer. 03:37.680 --> 03:43.300 It's a career that only exists in Chile, that it's six years long. 03:43.780 --> 03:45.300 But I really loved it. 03:45.300 --> 03:47.880 So, it took me nine years to get out of it. 03:49.060 --> 03:56.020 And like I said before, this is one of my, this is my first talk ever related to cybersecurity. 03:56.020 --> 03:59.320 And it got picked up by SkyTalks two years ago. 03:59.320 --> 04:06.420 And it was like the beginning of everything for me regarding DEF CON and cybersecurity. 04:06.680 --> 04:14.260 And I do a lot of classes as a professor in different type of instances. 04:14.260 --> 04:20.600 One is a free university that I teach CTF workshops. 04:20.600 --> 04:26.440 And with most of these guys, we went last year to DEF CON to present a workshop. 04:29.220 --> 04:34.840 I also work with a lot of projects related to health. 04:34.840 --> 04:47.020 So, recently, we want finance to get this, to do this project related to COVID-19 in my country. 04:47.780 --> 04:50.240 And right now, I'm learning ASINT. 04:50.240 --> 05:04.540 So, tomorrow, we're gonna participate in the Trace Labs CTF, which is a very good exercise to improve your Googling skills. 05:04.900 --> 05:08.580 And I have a small company, really small. 05:08.580 --> 05:12.080 So, I'm the founder, the CEO, and also the janitor. 05:13.460 --> 05:18.840 The things that I do most, I mean, all the time are workshops. 05:19.280 --> 05:21.400 So, next slide, please. 05:23.940 --> 05:26.420 So, last year, I went to DEF CON. 05:26.420 --> 05:30.480 So, I had the chance to meet Jason, Jason Street. 05:30.980 --> 05:35.120 And then, we went to DEF CON, DEF CON 27. 05:35.300 --> 05:37.880 That was an amazing experience. 05:40.200 --> 05:40.940 Yep. 05:40.940 --> 05:41.900 Next one. 05:41.900 --> 05:45.660 So, that's all about me. 05:47.220 --> 05:53.140 So, for you to understand this talk, I need to give you a little bit of context. 05:53.760 --> 06:03.580 So, in my country, we have a health system that is 80% public and 20% private. 06:03.580 --> 06:06.860 So, the public part is pretty much free. 06:06.860 --> 06:09.480 It's very different than the US. 06:09.780 --> 06:15.540 So, the public sector, we have around, now it's 15 million patients. 06:15.960 --> 06:23.380 So, in the top of the graph, you can see what's called MINSAL, which is basically the health department. 06:23.760 --> 06:27.980 And below that, you have 29, what they're called services. 06:27.980 --> 06:39.100 They're like institutions that they try to coordinate the different hospitals and institutions. 06:39.480 --> 06:45.380 So, I was working in one of those services, which is actually the biggest. 06:45.700 --> 06:50.120 We have around 2.5 million patients. 06:52.180 --> 06:52.460 Okay. 06:52.460 --> 06:53.680 Next slide. 06:53.820 --> 06:55.340 Slide, please. 06:57.660 --> 07:04.160 So, how bad, I have trouble pronouncing the word MACAB. 07:04.700 --> 07:06.440 So, how bad is this talk? 07:06.440 --> 07:16.140 When I was giving it, about to give it in Skype talks, I was receiving threats by some people that I knew. 07:16.180 --> 07:31.520 Some people involved in the police units were sending them messages that if I did the talk, they will wait for me at the airport, they will sue me. 07:32.040 --> 07:54.360 And I, at the time, I also received an email from somebody that they were ordering to shut down all the servers from this, the related to health institutions, because they were afraid that I will give information that will allow DEF CON attendees to hack all our systems, 07:54.360 --> 07:56.160 which is really stupid. 07:56.420 --> 08:06.580 So, I asked if, they also told me that they were sending some people to watch my talk and to record it. 08:06.580 --> 08:12.940 So, I asked if there were some government officials in the room and they actually raised their hand. 08:13.420 --> 08:29.020 And months later, I received a recording from my talk that was surprising, because Skype talks are pretty strict, you cannot take your cell phone away, it's not 100% safe. 08:29.100 --> 08:31.860 Luckily, nothing happened after that. 08:32.200 --> 08:35.220 Well, not nothing, but you can say that. 08:35.220 --> 08:38.940 I don't want to be, I don't want to give you spoilers. 08:38.940 --> 08:40.360 So, next one, please. 08:43.890 --> 08:57.330 So, I prepared different, some stories that will help you understand the context of what I have to face at work pretty much every day. 08:57.730 --> 09:09.830 So, I, the first story is called a very secure web service and the idea of this slide is just part by part and at the end you will see the image. 09:09.870 --> 09:17.950 So, the health department, they asked to every institution for the 09:22.100 --> 09:28.700 patients that attended the public sector around 15. 09:29.300 --> 09:45.260 So, they were, they gave me this assignment and I just find it weird that they will give you a web service, but you have to deploy your own web, their web service, which is very weird in my opinion. 09:45.260 --> 10:00.920 I worked as a developer for five years before getting into this job that I had at this place and I never seen that somebody sent you a binary of a web service for you to deploy and use it. 10:01.340 --> 10:06.820 And then you will upload the files to an FTP server, which is, again, really bad. 10:07.380 --> 10:09.040 Next slide, please. 10:10.920 --> 10:18.840 So, then I thought maybe I should check the security of it, right, the mindset of a hacker. 10:18.980 --> 10:36.060 And, you know, at first I was like checking out the 3DS algorithm, trying to find something that I could use, but at the end it was easier to decompile it and they have no obfuscation at all. 10:36.060 --> 10:58.920 It took me literally three minutes to decompile it and I found the key of the web service, so now I could download all these reports from the server and check all the data from all the pages. 10:59.960 --> 11:04.420 So, at least the key they're using was a good one. 11:04.760 --> 11:06.360 Next one, please. 11:19.600 --> 11:21.420 Now, okay. 11:21.640 --> 11:22.340 So, I reported... 11:52.340 --> 12:02.720 So, he demanded me, you know, a paper. 12:10.600 --> 12:19.910 And the answer was nothing. 12:19.910 --> 12:25.650 I never got any reply from him after that. 12:27.130 --> 12:29.630 So, next one. 12:31.870 --> 12:39.750 So, the second story is what we call it a very secure electronic health record. 12:40.770 --> 12:53.590 And this software had over a million pages of data, anything that you can imagine, exams, prescriptions. 12:55.070 --> 13:04.590 And they looked it up on the internet using Oracle, very expensive databases and the database was only 40 gigs. 13:05.210 --> 13:14.230 And there are not many transactions, so that's difficult in the public sector to buy expensive software. 13:15.070 --> 13:17.870 So, they have 18 developers. 13:17.870 --> 13:25.530 This is the part where the facts explain against me. 13:25.550 --> 13:33.870 So, CBS had 800 word files. 13:34.930 --> 13:38.190 Next one, please. 13:47.300 --> 13:49.340 Hello. 13:49.340 --> 13:51.280 Okay. 13:51.280 --> 13:59.700 So, what happened one day is that they were audited of this work. 14:00.000 --> 14:06.600 And I was invited, just as somebody that was a part of the project. 14:07.280 --> 14:15.440 And at some point, they asked this developer, so the project manager, about the security of this software. 14:15.460 --> 14:23.000 And he said, security, because they had implemented a five-digit password. 14:23.360 --> 14:30.540 And I couldn't, you know, I couldn't not raise my hand and ask them, are you serious? 14:30.540 --> 14:33.400 I mean, five digits? 14:33.940 --> 14:46.520 That almost got me fired, because I said I couldn't attack or do fairly fire to my own colleagues, even though they were not really my colleagues. 14:46.760 --> 14:48.480 And I have to apologize. 14:48.480 --> 14:58.860 I have to apologize, because even though they were stupid, I shouldn't have said that at this point. 14:59.180 --> 15:00.400 Next, please. 15:05.120 --> 15:10.140 So, at that point, not really understanding, I was thinking it was like 15:13.480 --> 15:14.000 something... 15:14.000 --> 15:18.560 and they attacked me for a couple of weeks. 15:18.560 --> 15:23.720 They were asking, some people were asking for me to be fired, you know, directly. 15:24.040 --> 15:25.700 I cannot work here anymore. 15:26.200 --> 15:31.720 So, I was lucky, because my boss, the director of the institution, supported me all the time. 15:33.600 --> 15:34.680 Next slide. 15:40.740 --> 15:49.740 So, one day, I went to work. 15:49.740 --> 15:52.360 I couldn't get into Gmail. 15:52.360 --> 15:56.580 We were using Gmail. 15:58.320 --> 16:01.700 So, I couldn't Google it. 16:02.360 --> 16:10.520 But if you could work, Twitter, you could get into an email, and all that. 16:13.840 --> 16:19.420 So, I mean, I was the only one from home. 16:20.420 --> 16:22.280 And how could I think about Google? 16:22.280 --> 16:25.180 I mean, they hired me to do something that I didn't know how to do it. 16:25.180 --> 16:28.300 So, I had to Google a lot. 16:28.300 --> 16:35.780 Basically, planning a data server, a big one in a hospital. 16:41.740 --> 16:45.120 So, I was very critical. 16:45.120 --> 16:50.200 I couldn't understand how something like this could happen in such a big institution. 16:50.300 --> 16:57.540 So, I did research on the IT manager and the director of the institution to know what happened. 16:58.160 --> 17:02.240 And the IT gave me a paper. 17:02.280 --> 17:16.320 So, that's how I learned so much. 17:16.720 --> 17:22.440 It said most that they blocked every Google service. 17:22.540 --> 17:31.740 Because through Google, you could get into forbidden sites, like porn sites or gaming sites. 17:31.740 --> 17:38.900 So, they are out of pretty bandwidth, or they set out a limit. 17:38.900 --> 17:45.480 I think I can remember it was like 2000 megabytes per IP. 17:46.320 --> 17:53.060 So, that's why every... which was mind-blowing. 17:53.060 --> 17:54.460 Next one, please. 17:59.240 --> 18:05.160 So, time, which reflects my reactions at the time. 18:06.240 --> 18:07.760 Next one. 18:15.310 --> 18:17.570 Start changing this part. 18:21.980 --> 18:30.380 So, how do you get a little bit of the context of what the work was about? 18:32.860 --> 18:38.480 Probably, I'm going to write not a book, but a blog. 18:38.740 --> 18:41.800 I have 50 of those. 18:42.500 --> 18:47.580 So, go to this part of this talk. 18:49.200 --> 18:53.300 And how everything started. 18:56.800 --> 18:59.140 Next slide, please. 19:02.420 --> 19:10.200 So, imagine that you're working, this is your new job, and you've been there for 10 months. 19:10.360 --> 19:18.840 And they ask you to find some IPs and add some bridges. 19:19.220 --> 19:21.840 But they didn't know which one I was looking for. 19:23.460 --> 19:28.480 And then they said, let me see if I could increase the range. 19:28.840 --> 19:34.260 So, I ended up finding 50,000 devices. 19:34.880 --> 19:48.280 And this is a part that you could really understand the transitions. 19:49.840 --> 19:53.300 There are now virtualization of the network. 19:53.300 --> 19:54.620 Not at all. 19:54.620 --> 20:00.340 So, you could see all the devices from the northern part of the country. 20:03.940 --> 20:13.120 So, I couldn't read why that was. 20:13.120 --> 20:28.140 I thought I had a list. 20:29.560 --> 20:31.600 Next slide, please. 20:33.760 --> 20:39.020 So, I started to check all those devices. 20:39.020 --> 20:43.340 And I was finding more and more. 20:43.340 --> 20:56.920 I mean, there are just so many that even the software that they give you does not respond properly because there are so many devices. 20:56.920 --> 21:02.100 They don't just take a long time to load on the screen. 21:02.220 --> 21:08.660 So, I found a lot of folders with public privileges. 21:08.760 --> 21:12.300 And some with public privileges. 21:12.300 --> 21:25.420 And even the they have all these hospital related files, architecture files. 21:25.420 --> 21:29.480 So, then I discovered they have public writing privileges. 21:29.480 --> 21:32.830 So, anyone could have deleted the server. 21:33.550 --> 21:47.710 And the things that I could see, I think the last part is not on the slide, but I could access a lot of 21:51.590 --> 21:54.390 things. 22:05.400 --> 22:15.240 Next one, please. 22:15.240 --> 22:22.160 So, after that, a couple of months went by. 22:22.920 --> 22:30.500 Trying to understand the problem, like, how this is possible, right? 22:30.500 --> 22:39.240 So, what I discovered is that the, you know, like, they didn't know how to share. 22:39.240 --> 22:45.880 So, imagine sharing, say, a 500 megabytes file. 22:45.880 --> 22:55.500 It will just share a folder, put it on the shared folder and send the address to another person without rechecking. 22:58.460 --> 23:02.300 Next one. 23:11.520 --> 23:13.320 It's not moving. 23:16.900 --> 23:30.020 So, my boss at the time told me, do you need to get about all your files and send email to them? 23:44.250 --> 23:53.150 So, can you hear me now? 23:54.710 --> 23:57.070 Okay. 23:57.070 --> 24:02.190 So, let's continue with the presentation. 24:02.780 --> 24:19.050 So, like I was saying, I sent this email report with the IP addresses, the folders, and the files that you could retrieve from the shared folders. 24:19.050 --> 24:39.770 So, the worst one is that you could find information of HIV patients, information that is protected by a special law in Chile that it's implemented for that information to be anonymous. 24:39.770 --> 24:48.510 Otherwise, you might be, you might suffer discrimination, looking for a job, et cetera. 24:48.690 --> 24:51.710 So, that was the worst part of it. 24:51.710 --> 24:54.410 Next one, next slide, please. 25:04.280 --> 25:08.300 And you know what? 25:08.300 --> 25:13.100 I didn't receive any answer directly to these emails. 25:13.160 --> 25:21.560 But then my boss sent me one of the emails she received as an answer. 25:21.560 --> 25:35.980 One of the things that I was more upset about, it was just that I didn't exist for them because I was like one month working, for a month working there. 25:37.000 --> 25:51.360 So, not even a reply directly to my email, not even a, let's say, congratulations for helping us or heads up for, I don't know, trying to help the institution. 25:52.060 --> 25:59.100 And then this guy, the IT support manager, was also the CSO, which is very weird. 25:59.100 --> 26:18.920 But they were chosen those like, let's say, roles, just if you've completed like an online course of ISO 2000, 2007, 2001. 26:19.060 --> 26:27.600 That was the only requisite to be part of the CSO, let's say, role. 26:27.840 --> 26:39.180 So, this guy sent an email saying that it was a big problem, but none of those IP addresses were from our institution. 26:39.680 --> 26:47.940 But the things that I didn't even think about it, you know, I didn't plan myself to find our IPs. 26:47.940 --> 26:54.200 So, after that, I sent another email with all the IPs that belong to us. 26:55.580 --> 26:57.740 Next slide, please. 26:58.620 --> 27:03.060 So, they didn't check anything, right? 27:03.460 --> 27:09.380 They just like tried to save their assets. 27:11.120 --> 27:14.980 But they didn't know that I had many, many IP addresses. 27:17.510 --> 27:19.610 So, next one. 27:22.820 --> 27:32.120 So, on the third email, I only included IP addresses from our institution and from all of us. 27:38.170 --> 27:42.030 They belong to what is called a health network. 27:43.270 --> 27:52.590 So, we are responsible for what they do in terms of use of information. 27:52.590 --> 28:02.990 So, I sent them, I cannot read it from my cell phone, but they were the most important hospitals in the country. 28:02.990 --> 28:08.170 One of the hospitals is called Sotero de Rio. 28:08.170 --> 28:10.930 He has over 3 million patients. 28:11.250 --> 28:15.150 And they had a server with everything that you can imagine. 28:15.150 --> 28:21.830 They had passwords, servers, webcam, I mean, security cameras. 28:21.830 --> 28:31.520 They had backups of many machines, x-rays, whatever you can imagine. 28:31.520 --> 28:38.140 I don't even remember now, but it was so much information that I was not able to process all. 28:38.320 --> 28:39.540 Next one. 28:43.090 --> 28:48.970 So, the answer for 10 months was nothing at all. 28:51.630 --> 28:53.130 Next one, please. 28:56.650 --> 29:09.410 So, one of the classes that I teach now is one where I was a student. 29:11.150 --> 29:22.630 And while I was a student, my sound is not... I don't know if you can hear me well, but on my end, I'm getting a lot of noise. 29:24.090 --> 29:32.310 Well, I had this class with one of the IT managers of the health department. 29:32.990 --> 29:34.970 And we were both students. 29:34.970 --> 29:37.270 She was quite older than me, right? 29:37.670 --> 29:48.270 And during the coffee break, I told her that I was the one who sent those emails that I never got a reply back. 29:48.270 --> 29:50.990 And she said, we're fixing it. 29:50.990 --> 29:54.470 You know, like, cutting me off, like, giving me the hand. 29:54.470 --> 29:57.530 You know when somebody tells you, like, stop? 29:57.590 --> 29:59.350 Like, we're fixing it. 30:01.490 --> 30:03.550 And also, she said, I know. 30:03.650 --> 30:07.410 But then... Next one, please. 30:10.370 --> 30:16.510 She ignored me for the rest of the classes, like, for two weeks. 30:23.650 --> 30:31.710 She thought I was some crazy guy telling, like, things that she didn't know about. 30:32.730 --> 30:34.550 Okay, next one, please. 30:37.350 --> 30:41.590 So, after 10 months, no answer, no changes. 30:41.590 --> 30:43.990 I could still check all the IP addresses. 30:43.990 --> 30:51.290 I was running scanners, like, two times per week, two times per week, and everything was the same. 30:51.970 --> 30:56.270 And not even a thank you, you know, we're all hackers, we're all sensitive. 30:57.090 --> 30:58.930 So, I was very sad. 31:01.330 --> 31:02.790 Next one, please. 31:05.330 --> 31:11.370 So, how do you fix something that nobody cares about? 31:12.750 --> 31:22.410 So, I was, I contacted one of these journalist groups that are very, they're very important in Chile. 31:22.410 --> 31:26.050 They were part of the Panama Papers investigations. 31:26.050 --> 31:32.530 They discovered a lot of politicians from Chile on those, on those leaks. 31:32.530 --> 31:39.190 And I sent them the information, and just right away, they were like, we can't believe that this is true. 31:39.190 --> 31:44.690 We need, next, next slide, please. 31:46.770 --> 32:00.430 So, they wanted me to show them all this information from my computer in order for them to be sure that I was, that I was correct, I mean, that I didn't have, like, a special connection or whatever. 32:00.810 --> 32:09.930 So, I asked a journalist to sit next to me and to check all these folders. 32:10.050 --> 32:12.950 It was very, like, it was very scary for me. 32:13.190 --> 32:17.470 I was only thinking that I'm going to get caught and, you know, be fired or whatever. 32:18.290 --> 32:27.890 And after a while, when they processed all this information, they were asking me a lot, a lot of details, you know, like, send us an email, 32:30.930 --> 32:35.530 how many patients in total, how many patients with abortion. 32:36.670 --> 32:38.730 So, I had to work for a month. 32:39.830 --> 32:42.850 You know, like, sending them evidence. 32:44.550 --> 32:51.670 And at some point, they asked me to test the same thing in three different places. 32:53.730 --> 33:01.990 So, I needed to ask somebody to allow the journalist inside their offices. 33:02.870 --> 33:12.530 So, one of these guys that I asked him, a friend of a friend, he almost, he actually sent an email to their IT department. 33:19.260 --> 33:24.820 And he said, okay, I just sent an email to the IT department asking if this is possible. 33:24.820 --> 33:28.480 And I said, no, you're destroying this investigation. 33:33.820 --> 33:34.300 You're destroying this investigation . 33:34.300 --> 33:43.860 And he said that what I wanted to do was basically get into the folders and from another office, they said it was not possible. 33:44.000 --> 33:45.940 So, that saved me. 33:47.900 --> 33:50.080 But the journalists were very nervous. 33:50.080 --> 33:56.220 They even thought about publishing the information that day, the very same day. 33:57.800 --> 34:07.360 But this email with this guy is telling us it was not possible to just make things, make things a little more calm. 34:07.460 --> 34:08.720 Next one, please. 34:12.660 --> 34:14.840 So, how did I get this information? 34:14.840 --> 34:16.960 It's very simple. 34:17.040 --> 34:30.080 It's sometimes when I started doing hacking or I did some pretty big stuff, for example, in Brazil when I was living, I took control of over 3,000 routers. 34:30.500 --> 34:37.320 And it was so simple that I thought it was something that was not worthy, that it was pretty lame, you know? 34:37.760 --> 34:48.560 But after that, I learned that it doesn't matter how difficult it was, what is important is what you got out of it, what kind of information you can get. 34:48.940 --> 34:55.020 And now that I have more experience, it's like getting into Shodan and you can do a lot of things without knowing anything. 34:55.520 --> 35:07.660 Just like running some scripts and, but at the time, I didn't have a lot of experience, so I didn't know. 35:07.660 --> 35:09.480 So, next one. 35:09.480 --> 35:21.440 I didn't know that doing something that is not technically complex, it's also valuable, you know? 35:21.440 --> 35:27.960 So, my approach was to gather everything, you know? 35:27.960 --> 35:31.960 Like, every file that was signed, every document. 35:32.000 --> 35:42.120 But the thing is that this network was so bad that some nodes, they were giving me 100 kilobytes per second of speed. 35:42.600 --> 35:48.040 So, it was like, I couldn't copy a lot of code. 35:48.060 --> 35:50.240 It would take me months, right? 35:50.240 --> 35:57.620 So, the other thing that I had to manage is that computers, most of those computers, even servers, they were turning off at 6 a.m. 35:59.200 --> 36:06.940 So, I only managed to copy 300 gigabytes out of more than a few terabytes of scan. 36:07.220 --> 36:23.820 And you're not really scared of copying those files because I was probably sending files to a firewall that somebody is copying or it's used in a unique way. 36:24.100 --> 36:31.340 And 24 hours, but then I learned that nobody takes the firewalls. 36:32.920 --> 36:35.880 No one really pays attention to them. 36:35.880 --> 36:40.000 They just believe that they are not safe. 36:52.940 --> 36:57.060 So, after a while, I said I cannot get everything. 36:57.060 --> 37:06.540 I needed to just get rid of the things that we have in our brains that sometimes we want to store everything, you know? 37:07.180 --> 37:10.480 Simple and have issues, you know? 37:10.480 --> 37:15.680 They have information that they're never going to see again. 37:16.000 --> 37:19.320 People that buy books and buy books and never read them again. 37:20.080 --> 37:28.140 So, I have to, like, I did this only a couple of times. 37:28.480 --> 37:42.080 And then, you know, grabbing for terms, keywords, like HIV or, you know, well, there were things to look for. 37:42.800 --> 37:51.880 I published my article and I was trying to know that I was going to get fired. 37:51.880 --> 37:54.680 So, I didn't want to lose my vacation. 37:54.680 --> 37:58.540 So, I mean, we miss everything. 37:58.800 --> 38:06.880 Like, in the flight and the articles, people, I know they were all sentences. 38:06.880 --> 38:10.000 So, I prefer to be in another country. 38:10.720 --> 38:21.380 That way, I will be on the way with a proper structure or idea of what is good. 38:22.680 --> 38:24.280 And actually, that's what happened. 38:24.280 --> 38:27.020 The first day, the guy called me. 38:27.020 --> 38:47.420 He was calling me and she said, you know, since I talk too much, you know, she was always was too impulsive saying that things didn't work or that there were problems with everywhere. 38:47.420 --> 38:48.800 That was a head-scratcher. 38:48.800 --> 38:51.780 I said, I don't like it. 38:51.780 --> 38:57.700 So, probably some and then some journalists and that's what happened. 38:58.080 --> 39:02.700 Yeah, yeah, you do speak a lot. 39:09.060 --> 39:36.960 So, I could check the privileges they had and just put it on a file and just every time the journalist asked me for anything, I would just add information and then post it. 39:43.730 --> 39:46.470 So, now let's get serious. 39:46.530 --> 39:48.570 I'm really serious about this. 39:51.190 --> 39:53.910 So, this meme was really good. 39:54.170 --> 40:02.750 It was displayed after the title, but this is not that bad as when I did this talk in Beijing. 40:03.010 --> 40:07.790 Every joke that I made, every meme, there was no response. 40:07.950 --> 40:17.610 I did some hearts and claps for me, but it was only one of the worst talks ever I ever given. 40:17.870 --> 40:21.890 No response from the public. 40:31.110 --> 40:36.670 Examples are this server that I found blog. 40:37.250 --> 40:39.410 It was 23,000. 40:39.730 --> 40:49.270 And every update, email, phone number, cell phone number. 40:51.050 --> 40:55.610 The ID, we have a thing that's good. 40:55.670 --> 41:04.010 That is an ID number and with that ID number, you can do pretty much the social security number in the US. 41:06.250 --> 41:08.350 Next slide. 41:12.180 --> 41:17.240 So, another example is a server protection. 41:17.740 --> 41:31.340 Again, you have all the patient data and sensitive information that is protected by the two specific laws. 41:33.320 --> 41:38.460 This type of thing doesn't have to be in any way public. 41:52.230 --> 41:59.770 Next slide. 42:00.470 --> 42:06.070 Did something happen? 42:32.260 --> 42:34.580 Okay. 42:34.740 --> 42:35.380 Okay. 42:35.380 --> 42:38.580 So, I'm gonna look in again. 43:20.140 --> 43:20.780 I 43:31.460 --> 43:52.920 apologize everybody for interrupting the talk again, but the speaker needs to reenter this space because it is some problem from his end probably or from the Microsoft end, but we had Q4Q from Microsoft in here to reset the space and rectify whatever the issue was and it was earlier, 43:52.920 --> 43:53.520 right? 43:54.580 --> 43:58.360 But then, we are facing the same issue again. 43:58.360 --> 44:04.060 So, I think we have to wait for Philip to get back and continue his speech. 44:04.600 --> 44:08.840 So, until then, thanks a lot for your patience again. 44:22.760 --> 44:23.800 Okay. 44:25.000 --> 44:28.440 So, as soon as he'll be back, you need to continue the slides. 47:07.680 --> 47:09.620 Do you want me to send it now? 47:32.380 --> 47:33.880 I'm really sorry. 47:45.080 --> 48:04.380 I hope we will not face any such issues for the future talks, but like we hackers, we are not a big fan of being on Windows and this is a contradictory statement because we are on a platform that is backed up by Microsoft. 48:04.580 --> 48:07.120 But then, hackers love Linux. 48:07.120 --> 48:11.400 That is the whole truth, whole and sole truth that we know. 48:11.420 --> 48:19.400 So, some of the speakers like Philip himself, he was trying to run Allspace VR on Linux machine that he has. 48:19.400 --> 48:23.220 So, I think probably this is one of the issues that he is facing. 48:23.680 --> 48:34.840 So, thanks a lot for joining in and please stay for a while because we have another presentation coming up after Philip's. 48:36.540 --> 48:38.520 And thank you again. 52:50.060 --> 52:51.540 Okay, I'm back. 53:02.010 --> 53:04.810 All right, so... 53:58.880 --> 54:01.480 Can you hear me now? 54:02.300 --> 54:07.500 Can you, if you can still hear me, give me your claps. 54:09.180 --> 54:12.020 Okay, great. 54:12.020 --> 54:20.340 So, well, it's been very tiring to restore. 54:21.040 --> 54:33.410 Let me get my slides here, here, there. 54:34.390 --> 54:38.610 So, okay, just kind of trying to finish. 54:38.710 --> 54:42.230 I sent the logs that they asked me to. 54:43.190 --> 54:51.100 So, we can go to the next slide right here. 54:51.680 --> 54:54.720 Next slide, please. 55:02.980 --> 55:17.300 And another example of what I found, it's a 35 gigs of monographies, again, with all the patient data splurged on the right. 55:17.300 --> 55:20.520 The time is 4 o'clock p.m. 55:21.540 --> 55:24.700 Yeah, it was only one server. 55:25.300 --> 55:28.080 It's only three servers that I sampled. 55:28.520 --> 55:42.720 I was kind of, my computer or my laptop, so I deleted everything. 55:44.040 --> 55:48.160 I run, like, three cycles of shaders. 55:49.860 --> 55:57.240 So, at the end, I don't have a lot of that information at the time. 55:57.240 --> 56:00.260 I just thought it was better to get rid of them. 56:01.720 --> 56:03.260 Next one, please. 56:10.900 --> 56:17.000 So, again, I'm saying a lot of so's and I try not to. 56:22.600 --> 56:33.540 So, I counted doc files, TXT, PDFs, and over 4 million files. 56:34.090 --> 56:37.340 But I didn't count all the types. 56:37.340 --> 56:39.500 Photographs, for example. 56:40.460 --> 56:45.180 ZIP files that had a lot of backups of many servers. 56:45.640 --> 56:47.840 Next slide, please. 56:54.650 --> 57:17.730 In this slide, you can see, for example, in this image, you can see PILs, the word PILs in Spanish, which is PILDRA, and how many files with the name PILDRA and format, and format, spreadsheet format, and there were 120. 57:19.190 --> 57:23.170 And this is the after PIL, or emergency PIL. 57:23.470 --> 57:33.230 And if you see the data, if you get inside those files, you can see reasons why they were asking those PILs. 57:33.230 --> 57:36.030 Some that were abused. 57:36.230 --> 57:41.070 Some people, some girls were raped. 57:41.130 --> 57:43.790 You can even see the situations. 57:49.660 --> 57:52.700 Okay, next one, please. 58:06.040 --> 58:08.180 And next one. 58:15.060 --> 58:18.860 And in this, no, the one before. 58:20.160 --> 58:23.120 One back, please. 58:23.120 --> 58:24.160 Sir. 58:27.810 --> 58:37.590 In this one, I was looking for files with the word HIV in Spanish. 58:38.030 --> 58:43.830 And I found 772 files. 58:44.250 --> 58:46.690 And you can see the file names. 58:46.690 --> 58:47.950 I don't know if you can see them. 58:47.950 --> 58:49.410 I don't know if you can read them. 58:49.710 --> 58:57.630 But believe me, there were IP addresses followed by the name. 58:58.710 --> 59:03.270 And then I could retrieve them and send them to the journalist. 59:04.250 --> 59:07.150 They were looking for bad stuff. 59:07.150 --> 59:10.030 You know, they were just, they were asking me, give me the worst. 59:10.030 --> 59:11.330 We want the worst. 59:11.330 --> 59:22.510 We want everything that you can give that will be pretty bad regarding to the laws and regarding the public interest. 59:22.650 --> 59:23.870 So next one. 59:23.970 --> 59:24.870 Next one. 59:24.870 --> 59:28.870 I'm about to finish, so be patient. 59:30.070 --> 59:31.690 I know it's been long. 59:32.810 --> 59:34.850 I'm feeling it. 59:40.410 --> 59:41.790 Next one. 59:41.790 --> 59:43.150 Let's move in. 59:44.390 --> 59:48.470 So, again, what happened? 59:48.470 --> 59:50.650 What was their strategy? 59:50.830 --> 01:00:14.470 The reason why they asked me for three places is they wanted to be sure that this was a more general problem that they were trying to, they were trying to find proof that there was a widespread problem, like I said, because I was sure, you know, I was telling them, 01:00:14.470 --> 01:00:20.410 I'm sure that this is not a thing about my computer, it's a network problem. 01:00:21.250 --> 01:00:30.930 And what they did is that they scheduled a meeting with this minister, with the health minister of the head of the health department. 01:00:30.950 --> 01:00:36.950 And they never said that they were part of this group called CIPER. 01:00:37.510 --> 01:00:55.810 So they presented themselves as a random guy, so after a month, I guess, they talked to her, they went to her office, and they asked for her computer to show her the problem. 01:00:55.910 --> 01:01:12.190 And from her computer, they managed to download all this information that I've given them, the IP addresses, they only put the IP address, the folder, and then you got many, many files with HIV patients. 01:01:12.230 --> 01:01:20.690 And she was, the journalist told me, she was a white woman, she was like, she was shocked. 01:01:20.950 --> 01:01:22.550 Next one, please. 01:01:22.930 --> 01:01:28.610 And they were pretty badass, you know, they say, you got 24 hours to fix it. 01:01:28.610 --> 01:01:31.030 They never said they were from a journalist group. 01:01:31.350 --> 01:01:35.710 So at that point, the minister, she didn't know what would happen. 01:01:35.710 --> 01:01:38.850 She thought it was just a problem that they needed to fix. 01:01:39.290 --> 01:01:52.270 So what happened after that is that they published 24 hours later, all this information that I've given them, and they were, it says in Spanish, and of course it's in Spanish, right? 01:01:52.270 --> 01:02:11.530 But it says 100,000 workers could, even companies that were given services or, let's say, outsourcing companies, they had access to all these files, all these files. 01:02:12.990 --> 01:02:20.430 And they put there that they have at least 3 million files that could be, that were unprotected. 01:02:21.330 --> 01:02:22.690 Next one, please. 01:02:22.690 --> 01:02:25.870 You can Google this information. 01:02:27.370 --> 01:02:36.030 And then all mainstream media pick up this information, even from other countries. 01:02:36.030 --> 01:02:41.410 I was checking everything from Colombia at the time. 01:02:41.410 --> 01:02:44.730 Even some Colombian newspapers pick up this information. 01:02:46.370 --> 01:02:50.090 And friends will tell me that it was all over the TV, all over. 01:02:50.290 --> 01:03:00.070 And I was receiving that, some of the people told me that some people wanted to talk to me at the office, but I was on vacation, so I was free of that. 01:03:00.350 --> 01:03:01.530 Next one, please. 01:03:05.980 --> 01:03:11.240 So this solved the problem in a couple of days. 01:03:11.260 --> 01:03:19.760 But what they did, they blocked the files from every institution, right? 01:03:19.760 --> 01:03:31.220 So you couldn't access share folders from another institution, but you could still access all the share folders from your, behind your router, right? 01:03:31.460 --> 01:03:33.740 I even tried, tested it. 01:03:33.900 --> 01:03:57.840 So you could access, for example, what it worked, I could access information from five hospitals, and I could still access a lot of information that it should have, they should have, you know, like forced everyone to unshare those folders, because it's, 01:03:57.840 --> 01:04:07.220 it's, it's against the law to have personal data, sensitive data exposed, right? 01:04:07.220 --> 01:04:14.080 But I'm gonna tell you later why this, this fix was enough for them. 01:04:14.860 --> 01:04:16.460 Next one, please. 01:04:18.920 --> 01:04:39.900 The funny thing is, not the funny, but the worst thing is that before doing all this, the press, we tested that in many places, 100% of the places that we tested, you only needed to connect to a network cable, and that was it. 01:04:39.900 --> 01:04:50.100 There were no restrictions, just connecting to, to any, to any plug, and you will access to the entire network. 01:04:51.180 --> 01:05:00.380 So, she was called to, she was called to Congress to give a, an explanation, but she just lied. 01:05:00.960 --> 01:05:05.800 And again, she was saving a lot of people's asses. 01:05:05.800 --> 01:05:21.600 And the good thing, well, the bad thing is that they created a feeling of panic, you know, nobody wanted to give you any information at all, not even the one they were required to give you, you know, like, they were like saying, no, because of what happened, 01:05:21.600 --> 01:05:29.140 I cannot give you anything, but I'm allowed to have it, I mean, internally as a, as a part of the same institution. 01:05:29.140 --> 01:05:30.600 So, it created a panic. 01:05:30.860 --> 01:05:39.940 And then, they were not sharing any information, like, like, it created the opposite effect, you know, like the extreme effect. 01:05:40.540 --> 01:06:01.080 And for me, it was, it was a good, what happened afterwards, afterward was good in my, in my, in my job, because I, they gave me, the director of the institution told me to create a security department specializing on finding these issues, right? 01:06:01.180 --> 01:06:10.700 But we were, we were too against the world, you know, we were, nobody wanted to being told that they had a problem. 01:06:10.700 --> 01:06:18.960 So, I found, for example, that you could, they had default password in 5,000 email accounts. 01:06:19.260 --> 01:06:24.680 And I, I told them, and I did a presentation explaining them why it was bad. 01:06:24.680 --> 01:06:28.140 And their answer were, their answer was crazy. 01:06:28.140 --> 01:06:37.920 They said, public servants are public, I mean, no, no, it's wrongly proposed, it didn't say correctly. 01:06:38.700 --> 01:06:42.960 Since they were public servants, they say that their emails should be public. 01:06:42.960 --> 01:06:54.280 So, for them, it was okay that you could look in from the internet, from, not even from the inside the net, from the internet, you could log in on their accounts and check their email. 01:06:54.400 --> 01:07:00.300 And inside those email accounts, they have patient information again. 01:07:00.920 --> 01:07:07.700 So, at some point, we're just like, we're not, we're not going anywhere, we're, it's just us against the world. 01:07:08.260 --> 01:07:09.500 Next one, please. 01:07:11.900 --> 01:07:34.680 So, again, after the government change, after the, this right-wing government that set foot or created this scenario for demonstration that lasted for five months, that I told you at the beginning, they fire me on the first day, you know, like, first hour, 01:07:34.680 --> 01:07:42.740 they fired, they sent me an email to fire me, but I knew it, they were gonna do it, so I was, again, on my holidays, I was on vacation. 01:07:43.260 --> 01:07:47.380 So, that forced them to fire me by email. 01:07:48.200 --> 01:08:12.960 But that gave proof and evidence that they fired me with no reason, because they never gave a reason on the email, because they thought that they were entitled to, but they didn't know that the law, it's complicated, but they didn't know that the laws changed regarding whether you can fire without any cause a public employee. 01:08:13.640 --> 01:08:37.160 So, they fired me, and a lot of projects that I was in charge of with the UCL, for example, University College of London, and the Job Hopkins, which is the best university in the world regarding to the health sciences, but I sued them, you know, I knew before they fired me that I could sue them, 01:08:37.160 --> 01:08:55.720 I knew exactly what part of the law changed, the Supreme Court ruled that every public servant, even though they had temporary contracts, they're allowed to be compensated if they had a permanent role, and I have a permanent role, so when they fired me, 01:08:55.720 --> 01:09:14.600 they were just like, ah, nothing's gonna happen, just fire this guy, and that's it, but then I sued them, and that ended up in the media, they accused me of being a hacker, that I stole information, that I destroyed servers, and again, it was this lawsuit, 01:09:14.600 --> 01:09:35.980 it was just about proving that I worked there or not, not about me, but the China, you know, assassination of character, and they said I was a bad hacker, that I went to DEF CON, they even copied the screenshot of the talk that I gave Sky Talks as a proof that I was bad, 01:09:35.980 --> 01:09:39.260 even though the talk was after I was fired. 01:09:39.760 --> 01:09:41.120 Next one, please. 01:09:44.340 --> 01:09:48.020 So after that, this government is still in power, right? 01:09:48.420 --> 01:10:15.560 I've been banned from working with any government agency, I was about to do a pen test, and in the last day, they said that they lost their resources, but then a friend of mine told me, and even sent me the WhatsApp conversations, they told this person that she was going to be fired if she hired me. 01:10:17.200 --> 01:10:25.920 So I got very famous at the time, in a bad way, but that didn't stop there. 01:10:25.920 --> 01:10:46.420 I wanted to know, because I did a formal investigation of what happened, I went there as a witness and blah, blah, blah, and I got the investigation report, I got the documents, there were over 1200 pages, I had to pay $50 for them to give it to me, because they have to print it, 01:10:46.420 --> 01:10:57.700 and they have to remove all the sensitive information, which is stupid, because they removed their email addresses that I could get easily, and I wanted to know what happened. 01:10:57.700 --> 01:11:12.780 I wanted to know why nobody did anything, the reasons, or at least I wanted to know, even though I was a witness, or I testified in a way, they never gave me any feedback. 01:11:13.220 --> 01:11:21.240 They don't call you and tell you this is what happened, or no, nothing, and they just tell you to get the information using the proper channels. 01:11:21.520 --> 01:11:36.060 So I got this, next slide please, I got this big chunk of paper, you know, it's like a big pile of papers, next one please. 01:11:36.980 --> 01:11:49.320 So I started to read them, you know, through every page, and they have a lot of, a lot of people say that they didn't know me at all. 01:11:49.320 --> 01:11:58.480 A lot of people lied, they said they never received an email, never heard about it, that they didn't know about me. 01:11:58.680 --> 01:12:13.420 But then they have this part of the document, they say that it was possible to fix it, but it would have taken a big impact on their operation. 01:12:14.160 --> 01:12:18.860 Which was not true, because they fixed it in a day, without any disruption. 01:12:19.200 --> 01:12:40.180 And then they say that it's every person's responsibility, and it's a personal issue, which is not true, because the law entitles every person in charge of sensitive information for patient data to be responsible for it. 01:12:40.640 --> 01:12:51.200 And this guy just, you know, it's all about, you know, this typical thing about working in IT, that everyone blames the user, the same. 01:12:51.200 --> 01:12:54.840 It's the user's problem, it's the sharing information, it's their problem. 01:12:54.940 --> 01:12:56.080 Next one please. 01:12:56.080 --> 01:12:58.960 So this was the excuse number one. 01:13:00.860 --> 01:13:17.340 And then, excuse number two, again, another guy in the top rank of the institution said that it's, again, the user's responsibility, and it's very complex to identify these folders. 01:13:17.340 --> 01:13:24.280 And you remember that the script that I run, it was like five lines, it was really easy to do it. 01:13:24.280 --> 01:13:27.360 They had access to everything, all the tools that I didn't have. 01:13:27.540 --> 01:13:35.320 And the last one, again, 14 says it's a fault, they're blaming the users, again. 01:13:39.740 --> 01:13:45.640 Because I should have informed them, or my boss, which I did. 01:13:48.040 --> 01:13:50.440 And again, they didn't know anything about it. 01:13:50.880 --> 01:13:58.260 Even though I sent many emails, I tried to reach them in many channels, but nobody wanted to listen. 01:13:58.420 --> 01:13:59.620 Next one please. 01:14:04.070 --> 01:14:31.910 The main reason, and this is like the most incredible thing that I discovered in this investigation, is the main excuse, even from the minister, is that the ISP provider, the internet provider, and the email provider, which is the same, they couldn't fix their email for a year. 01:14:31.910 --> 01:14:42.450 So the main person, the minister of the health department, didn't have an email working properly for a year. 01:14:42.450 --> 01:14:43.930 And that was the excuse. 01:14:43.930 --> 01:14:56.350 And even this email, it was sent by the ISP provider, which is a big contract, it's $4 million per month contract they have. 01:14:56.910 --> 01:15:01.510 They say, it's correct, her email didn't work for a year. 01:15:01.570 --> 01:15:03.870 So, next one please. 01:15:08.180 --> 01:15:28.720 So the latest update, because this lasted for, this happened two years ago, and November the 8th, last year, it was the final, the final step, the Supreme Court rule, my favorite, so they had to pay me $25,000 in compensations, which is not what I wanted, 01:15:28.720 --> 01:15:30.360 but it's not that bad. 01:15:31.500 --> 01:15:32.800 Next one please. 01:15:34.680 --> 01:15:42.960 But the funny thing is that with that money, I had to pay the money that I spent going to DEF CON for two years. 01:15:43.200 --> 01:15:47.800 So I ended up with, I don't know, like $500. 01:15:51.160 --> 01:15:55.080 So what can we do to avoid these situations? 01:15:55.080 --> 01:16:04.540 In my country, as well as the entire world, we don't have a lot of people knowing that, that are experts in security. 01:16:04.840 --> 01:16:19.740 And people hiring, they don't, they don't even know what a computer science degree, it's different from a, from a, here we have different types, but it's a technical degree, you know, they don't have any, they don't know the differences. 01:16:19.740 --> 01:16:23.260 So when they hire someone, they will ask you, do you know about security? 01:16:23.260 --> 01:16:30.120 And say, yeah, I did this certification, okay, so you're, you're ready to help us with this issue. 01:16:30.120 --> 01:16:31.660 And it's the opposite. 01:16:32.080 --> 01:16:35.020 So we need to change our laws. 01:16:35.020 --> 01:16:39.260 I mean, we have the laws, but they're not enforced, right? 01:16:39.260 --> 01:16:54.040 The, and it, and I do, I have this, these topics in my classes that I do in this masters, that I explained some things that happen in other problems that ended up nowhere. 01:16:54.040 --> 01:17:02.480 I mean, the CTO of this health department, he was fined with 10% of his salary for one month. 01:17:02.480 --> 01:17:05.020 That was the only punishment. 01:17:07.000 --> 01:17:12.500 And we need, what I learned is that we need less robsters and more mentors. 01:17:12.500 --> 01:17:17.060 And I'm actually mentoring a lot of students, five or six. 01:17:17.060 --> 01:17:19.180 Well, now it's weird because of COVID, right? 01:17:20.180 --> 01:17:29.500 Everything stopped, but we were competing tomorrow, actually, with four of them in the OSINT Trace Labs CTF. 01:17:30.080 --> 01:17:31.560 Next one, please. 01:17:33.800 --> 01:17:35.820 So which ticket is the last one? 01:17:35.820 --> 01:17:42.020 Well, me now, a lot of images of me sad or whatever. 01:17:43.080 --> 01:17:44.280 Next one. 01:17:44.380 --> 01:17:45.960 And I think it's the last one. 01:17:48.300 --> 01:17:49.540 Well, thank you. 01:17:49.540 --> 01:17:52.780 It was a long talk, a lot of problems involved. 01:17:53.040 --> 01:17:56.300 There's a link to the slides. 01:17:57.360 --> 01:18:01.640 That's my Twitter account and my LinkedIn account. 01:18:01.860 --> 01:18:03.600 I hope you liked it. 01:18:03.620 --> 01:18:08.160 And thank you to all of the organizers as well. 01:18:08.160 --> 01:18:11.300 I know that they're working a lot to get this through. 01:18:12.560 --> 01:18:13.740 Have a good day.