1
00:00:00,790 --> 00:00:06,590
Okay, welcome to my talk, COVID-1984, propaganda and surveillance during a pandemic.

2
00:00:08,090 --> 00:00:13,830
Before we start, I would like to make a brief introduction both to this talk and to myself.

3
00:00:14,550 --> 00:00:32,610
My name is Mauro Eldritch, I work as a cyber security architect, I'm the founder of DC5411 Argentina, and I was a speaker for DEF CON Las Vegas, Dragonjar Colombia, POSCON Iran, and Texas Cyber Summit, among other conferences.

4
00:00:32,610 --> 00:00:38,270
I'm a returning speaker to this village, I spoke here on DEF CON 26.

5
00:00:40,430 --> 00:00:53,510
And this talk is about explaining the political situation of surveillance and propaganda in Argentina, although it is also compatible with the same situation in other countries and regions.

6
00:00:53,510 --> 00:01:08,930
This will be explained from a hacker's point of view, using a hacker's toolbox, which in my case includes social engineering and open source intelligence, and there's even some application reverse engineering at the end.

7
00:01:10,270 --> 00:01:14,590
This talk will be divided into two chapters.

8
00:01:14,610 --> 00:01:22,170
The first propaganda about the Argentine pro-government propaganda apparatus and social networks seen from the inside.

9
00:01:22,170 --> 00:01:31,950
We will see the process from the scratch, from the infiltration of a sock puppet account into the apparatus to its internal operation.

10
00:01:32,890 --> 00:01:36,250
The second part is surveillance.

11
00:01:36,310 --> 00:01:44,750
We will dissect the Cuidar COVID-19 mobile application, which is now mandatory by law in order to circulate.

12
00:01:44,750 --> 00:01:56,130
So if you want to leave your home, if you want to step away from your doorstep, you have to have this application installed on your phone.

13
00:01:57,090 --> 00:02:11,390
And we will dissect this application uncovering many privacy abuses, bad practices, and lots of material worth of appearing on Reddit, especially on Programming Horror subreddit.

14
00:02:12,510 --> 00:02:20,370
Just a brief disclaimer, every item disclosed here is publicly available through OSINT.

15
00:02:20,370 --> 00:02:35,810
On my jurisdiction, it is totally legal to reverse engineer any application on any software, and I wasn't involved in any illegal activity directly or indirectly.

16
00:02:36,030 --> 00:02:41,870
So that being said, let's start with our first chapter, propaganda.

17
00:02:44,290 --> 00:02:48,890
So, what is propaganda, you might ask?

18
00:02:49,090 --> 00:03:07,330
Propaganda is a communication that is primarily focused on influencing an audience and furthering an agenda, which might not be objective or might not be real at all, and that may be presenting facts selectively.

19
00:03:07,330 --> 00:03:13,870
You might have heard the term alternative facts recently in media.

20
00:03:13,870 --> 00:03:18,590
Well, it's probably related to this kind of behavior.

21
00:03:20,390 --> 00:03:24,150
Online, agents of propaganda are called trolls.

22
00:03:24,630 --> 00:03:33,710
They massively comment on social networks, supporting a certain government, in this case, or a certain movement.

23
00:03:33,710 --> 00:03:38,450
It may not always be a government, but a political movement.

24
00:03:39,290 --> 00:03:42,970
They try to establish their own debates and trends.

25
00:03:42,970 --> 00:03:52,140
For instance, in my country, it's pretty popular to see trendings like thanks, President Fernandez, or we support you, President Fernandez.

26
00:03:53,530 --> 00:03:59,950
They are also maybe found diverting the focus from opposition debates.

27
00:03:59,950 --> 00:04:28,870
For example, every time an opposition part tries to open a thread or tries to communicate something, you might find the trolls leaving spam comments, fancams, or any other material that, when exposed repeatedly, could turn this thread into something really difficult to follow for legit users or for interested users.

28
00:04:29,130 --> 00:04:34,850
So it may turn the conversation into something unbearable.

29
00:04:35,900 --> 00:04:49,700
They also work by establishing negative trends against the opposition, and they are usually grouped into troll farms, where they work together in an organized manner, surprisingly.

30
00:04:51,700 --> 00:04:54,380
How do you recognize a troll?

31
00:04:54,960 --> 00:05:05,040
Okay, first, it's pretty simple, because lots of default configurations on their profile are present.

32
00:05:05,080 --> 00:05:09,400
For example, they don't have a picture, a profile picture.

33
00:05:09,720 --> 00:05:13,400
They use a fake one or a stock one.

34
00:05:13,840 --> 00:05:16,320
There are lots of numbers in their handlers.

35
00:05:16,320 --> 00:05:20,000
For instance, Mauro and a bunch of numbers.

36
00:05:20,060 --> 00:05:30,280
That's pretty common, pretty normal on Twitter, actually, because that's the default username that Twitter gives you and allows you to change later.

37
00:05:31,440 --> 00:05:33,960
They share common terms and phrases.

38
00:05:33,960 --> 00:05:37,240
They have their own languages, surprisingly.

39
00:05:37,660 --> 00:05:40,960
They agree on a common version to answer debates.

40
00:05:40,960 --> 00:05:45,620
For example, the president's offshore accounts are a media operation.

41
00:05:46,200 --> 00:05:52,260
So they are basically saying that everyone else is lying, and they are not.

42
00:05:52,900 --> 00:05:55,880
And they obviously work in swarm behavior.

43
00:05:55,880 --> 00:05:58,300
They never come alone.

44
00:05:58,740 --> 00:06:01,100
They act like a swarm.

45
00:06:02,060 --> 00:06:07,920
Many governments are credited with having online propaganda apparatus and agents.

46
00:06:07,920 --> 00:06:13,380
For example, Russia, with the collapse of the Trolls of Olgino.

47
00:06:13,380 --> 00:06:16,320
China and the 57th party.

48
00:06:16,400 --> 00:06:19,660
North Korea, with the United Front Department.

49
00:06:19,680 --> 00:06:28,020
Venezuela, with the Armada Bolivariana de Trolls, which barely translated to English is Bolivarian Army of Trolls.

50
00:06:28,020 --> 00:06:43,340
And also Argentina, with the Ciber-Cas, or Tropa-Ca, which translated from Spanish is K-Troop or Cyber-K, which is not actually a K-pop supporting fandom.

51
00:06:44,040 --> 00:06:45,720
It's valid, the clarification.

52
00:06:47,620 --> 00:06:56,860
This global advance on propaganda apparatus around the world is such that there are social networks with firm positions towards them.

53
00:06:57,340 --> 00:07:09,460
For example, Counter-Social is against it, and countries with the highest propaganda incidents are absolutely banned, blocked entirely by their IP block.

54
00:07:09,460 --> 00:07:11,630
Some of them are listed here.

55
00:07:13,580 --> 00:07:23,220
And there are other social media sites, for example, this one in my country, that supports the propaganda behavior.

56
00:07:23,440 --> 00:07:34,980
Facebookular.net was an Argentine social network against establishment and imperialism, and it's a firm supporter of the Peronist party.

57
00:07:35,380 --> 00:07:43,540
It was a place where only its militants participated, and it was backed, supported, by the Ministry of Culture.

58
00:07:44,400 --> 00:07:55,480
At a first sight, you might obviously see that this is a bad rip-off of Facebook, and it even allows you to register with Facebook.

59
00:07:55,860 --> 00:08:09,700
This project is now defunct, and it's no longer active, but it was heavily used by users from Argentina and Venezuela some years ago.

60
00:08:12,220 --> 00:08:13,820
Trolls and censorship.

61
00:08:14,220 --> 00:08:20,740
The goal of a troll is not only to spread messages, but to prevent the opposition from doing so.

62
00:08:21,240 --> 00:08:28,940
Lots of groups participate in massively reporting legit posts or accounts from the opposition in order to take them down.

63
00:08:29,620 --> 00:08:40,240
They are actively abusing an automatic mechanism for reporting, so if a lot of users report someone, it must be true.

64
00:08:40,400 --> 00:08:47,640
And this automatic behavior takes down the post or the account without any real intervention.

65
00:08:49,480 --> 00:09:00,180
Argentina, it's an ideal terrain for this surveillance experiments, since many times the government have tried to control social networks to no avail.

66
00:09:01,460 --> 00:09:14,860
For example, Peronist legislators proposing that users who comment on websites identify themselves with their national identification number, which is like the social security number for US residents.

67
00:09:16,100 --> 00:09:24,140
Or a senator from the same party proposing a public and democratic regulation of social networks.

68
00:09:24,660 --> 00:09:39,560
Or the cyber patrol protocol imposed this year, which basically ended up with a lot of people being detained for tweeting or for expressing themselves on social media.

69
00:09:40,040 --> 00:09:50,660
You know, there are a lot of projects and already installed measures to control social networks, but what about the trolls?

70
00:09:50,660 --> 00:09:53,980
The trolls continue working together and growing.

71
00:09:55,260 --> 00:09:59,120
So this is where we start after this introduction.

72
00:09:59,120 --> 00:10:00,500
Tracking trolls.

73
00:10:02,200 --> 00:10:12,880
The Argentine apparatus has the particularity of being made up of real users as well as trolls and bots, as you can see when exploring their hashtags.

74
00:10:14,260 --> 00:10:19,820
Rumors indicated that many users received invitations to join this apparatus.

75
00:10:20,380 --> 00:10:23,940
My goal was to get that invitation.

76
00:10:24,040 --> 00:10:27,180
You know, it's like a golden ticket to the chocolate factory.

77
00:10:27,820 --> 00:10:36,000
So after a month of silent observation, I created a sock puppet account mimicking the behavior of these users.

78
00:10:37,480 --> 00:10:40,760
And it was configured using these settings.

79
00:10:40,760 --> 00:10:46,180
Profile photo, President Fernández and Vice President Fernández together.

80
00:10:46,880 --> 00:10:52,960
The cover photo was Vice President Fernández giving a speech at Vélez Stadium.

81
00:10:53,840 --> 00:10:56,240
And who was I following?

82
00:10:56,240 --> 00:11:03,820
The president and some ministers, along with a few real pro-government accounts.

83
00:11:04,400 --> 00:11:07,640
What about the description and tweets?

84
00:11:08,160 --> 00:11:15,780
Both I made them imitating the specific languages and symbolism used by these users.

85
00:11:15,860 --> 00:11:17,320
How?

86
00:11:17,460 --> 00:11:23,480
Well, using Twitter API to monitor their hashtags and extracts the most repeated words.

87
00:11:23,480 --> 00:11:27,940
You may find them here as a word cloud.

88
00:11:28,100 --> 00:11:35,700
Most of these are pejorative terms to refer to opponents like Bolsonaro, the former president of Brazil, Bolsonaro.

89
00:11:36,280 --> 00:11:41,100
And Piranha instead of Sebastián Piñera, the Chilean president.

90
00:11:42,240 --> 00:11:49,760
So after learning how they speak, now that we speak the same languages, it was a matter of time before getting the invitation.

91
00:11:52,400 --> 00:11:58,420
This sub-puppet raised a hundred or so followers in a few hours.

92
00:11:58,420 --> 00:12:08,140
I have my original Twitter account since 2015 and I think I have less than 300 users, just for comparing.

93
00:12:08,480 --> 00:12:12,540
Most of these were trolls, but a few real users too.

94
00:12:12,860 --> 00:12:19,260
So I started retweeting official accounts and these real users and tweeting with their same hashtags.

95
00:12:19,520 --> 00:12:24,620
For instance, Macri should be in jail, our ex-president from the opposition.

96
00:12:25,240 --> 00:12:32,620
And after only three days, I received my invitation, this golden ticket from a user we'll call DC.

97
00:12:34,700 --> 00:12:44,320
On the left, you can see the original conversation in Spanish and I translated it the best I could to English.

98
00:12:44,320 --> 00:12:47,280
Hey buddy, we are making Twitter groups to install hashtags.

99
00:12:47,300 --> 00:12:48,540
Wanna join?

100
00:12:49,000 --> 00:12:50,120
Hey buddy, sure.

101
00:12:50,120 --> 00:12:51,740
What I'm supposed to do?

102
00:12:51,820 --> 00:12:56,260
Well, basically you have to tweet the hashtags that we send to the group.

103
00:12:56,840 --> 00:13:06,340
After agreeing this, I was added to the group number 300 and some of soldiers of the national project containing 50 people.

104
00:13:08,320 --> 00:13:12,520
One of the messages shared there was this.

105
00:13:12,520 --> 00:13:17,560
Guys, Ariel Garbarz is asking us to use LARRETAISRESPONSIBLE.

106
00:13:18,460 --> 00:13:21,940
LARRETA is the mayor of Buenos Aires city and a member of the opposition.

107
00:13:22,520 --> 00:13:25,640
Now you may ask, who is Ariel Garbarz, by the way?

108
00:13:26,560 --> 00:13:28,500
No clue so far.

109
00:13:29,680 --> 00:13:45,940
But in fact, both of these hashtags that made the top five in my country, one of them being PESCADOPODRIDOEME and LARRETAISRESPONSIBLE are fabricated trends proposed on propaganda groups.

110
00:13:46,600 --> 00:13:49,600
You may find the source on getthytrends.com.

111
00:13:49,600 --> 00:13:57,500
Just for confirmation, I went to trending earlier and I found that this information was right.

112
00:13:57,940 --> 00:14:08,020
And these trendings lasted for at least 12 hours, which gives us a lead on how toxic are these propaganda interventions.

113
00:14:10,540 --> 00:14:26,040
Another message on this group is, hey guys, with Ariel Garbarz, we formed a group where he's the administrator and tells us what to publish and at what time, so we can get our trend to always be in first place.

114
00:14:26,460 --> 00:14:33,560
Another user replies, it's like you say, we used to do the same long ago with the K youth, a new group.

115
00:14:33,980 --> 00:14:37,700
You have to set a day and a time, it's the best.

116
00:14:38,020 --> 00:14:40,520
Again, who is Ariel Garbarz?

117
00:14:42,360 --> 00:14:46,680
Okay, remember DC, the original member who invited me here?

118
00:14:46,840 --> 00:14:52,260
Well, 10 days later, another account from him tried to recruit me again.

119
00:14:52,300 --> 00:14:55,760
So he has probably forgot about my account.

120
00:14:55,920 --> 00:14:58,920
Hey buddy, we're making Twitter groups to install hashtags.

121
00:14:58,920 --> 00:15:00,020
Wanna join?

122
00:15:00,020 --> 00:15:02,420
And I say, hey buddy, sure, go ahead.

123
00:15:02,980 --> 00:15:09,220
I was added once again to another Soldiers of the National Project 300 and something.

124
00:15:10,160 --> 00:15:15,680
Now by accident, I was a member of two propaganda groups.

125
00:15:16,160 --> 00:15:23,940
There was a six digit difference between each group ID, for example, 301 and 307.

126
00:15:24,040 --> 00:15:32,040
Each group can have up to 50 users, 49 if you do not take into account administrator.

127
00:15:34,060 --> 00:15:44,440
So 49 users multiplied by six new groups are almost 300 new users in 10 days.

128
00:15:44,440 --> 00:15:52,480
This is how fast can this apparatus grow without almost no any effort.

129
00:15:54,260 --> 00:16:05,340
Currently, according to the last group ID I managed to find, there are at least about 350 propaganda groups on Twitter alone.

130
00:16:05,340 --> 00:16:12,320
This gives us a total of 17,150 users.

131
00:16:13,500 --> 00:16:20,400
I imagine all these people, try to picture all these people tweeting five or six times a day.

132
00:16:20,400 --> 00:16:23,080
They can make any trend they want.

133
00:16:24,960 --> 00:16:29,260
Well, also, this doesn't end here.

134
00:16:29,700 --> 00:16:33,120
A WhatsApp group is shared with both groups I belong to.

135
00:16:33,120 --> 00:16:36,160
And of course, hashtags are shared there too.

136
00:16:37,360 --> 00:16:40,620
This group is city seven.

137
00:16:40,620 --> 00:16:46,220
There are seven groups of around 256 users.

138
00:16:46,940 --> 00:17:02,820
If we take into account 255 users, we are not taking into account administration, multiplied by these seven groups, there are almost 2,000 new users here that may be repeated.

139
00:17:04,820 --> 00:17:09,620
And adding them all together, we have almost 20,000 users.

140
00:17:09,620 --> 00:17:11,960
Again, there may be repeated users.

141
00:17:12,920 --> 00:17:14,800
This doesn't end here.

142
00:17:15,660 --> 00:17:23,400
This group had members from the USA, Spain, the United Arab Emirates, and even Germany.

143
00:17:24,140 --> 00:17:28,300
So, upon joining, the administrator started sending hashtags.

144
00:17:28,340 --> 00:17:33,620
In this case, at half past seven, we come out with $Witness.

145
00:17:33,960 --> 00:17:40,400
That administrator, as you may see in the message, or the leading message, is Ariel Garbaros.

146
00:17:40,520 --> 00:17:44,400
And that name now definitely rings a bell for you, right?

147
00:17:45,320 --> 00:17:50,460
So, okay, let's try to answer who is Ariel Garbaros.

148
00:17:52,260 --> 00:18:03,760
He's the CEO of Protección Digital, which is digital protection, a company which was favored with many contracts by the federal justice and various Argentine governments.

149
00:18:03,760 --> 00:18:09,820
He was benefited to direct several state infrastructure projects.

150
00:18:10,080 --> 00:18:15,290
He was appointed computer attorney general for the 17 and 19 elections.

151
00:18:15,520 --> 00:18:22,900
And he's the leader of the propaganda apparatus on social networks, the lord of the trolls, we might say.

152
00:18:22,900 --> 00:18:28,830
The source of this is the newspaper Perfil, where he answered an interview.

153
00:18:32,600 --> 00:18:39,680
Here is a video of Ariel Garbaros instructing the trolls live, but it is in Spanish.

154
00:18:39,680 --> 00:18:48,660
And for time reasons, I'm not going to show it here, but it will be shared on the GitHub repository along with the slides.

155
00:18:49,660 --> 00:18:55,020
Obviously, since in Argentina, we speak Spanish, the video is in Spanish.

156
00:18:56,260 --> 00:18:59,340
This was leaked on Twitter by a user.

157
00:19:00,880 --> 00:19:08,760
So, the final diagram of the trolls, or a simplified one, is here.

158
00:19:08,900 --> 00:19:29,520
Ariel Garbaros acts as a leader, sends the trending topics to be installed to its coordinators, the coordinators of each group, which then share this objective to both Twitter groups and WhatsApp groups, which then are executed by the trolls.

159
00:19:32,060 --> 00:19:34,500
So, is this illegal?

160
00:19:34,860 --> 00:19:38,460
In Twitter platform, it is against the terms of service.

161
00:19:38,660 --> 00:19:43,720
The Twitter safety team actively tracks and takes down state-linked propaganda groups.

162
00:19:43,860 --> 00:19:47,000
In our country, well, it is not.

163
00:19:47,000 --> 00:19:56,180
In fact, it looks suspiciously endorsed, like the Facebook ripoff social media I showed you some slides ago.

164
00:19:57,780 --> 00:20:00,500
What tools did you use for this chapter?

165
00:20:00,500 --> 00:20:16,080
Well, Trendinalia, Trends24in, Votometer, GetDayTrends, the Twitter API, the Twitter RubyGem, and my own tool, which is also in the repository, venator.lua, for recognizing bot or troll-like behavior.

166
00:20:17,400 --> 00:20:21,460
So, what is the propaganda apparatus up to right now?

167
00:20:21,500 --> 00:20:33,920
Generating hashtags supporting the use of the government application to monitor the coronavirus outbreak, you know, the Cuidar COVID-19 application, which leads us to the next part.

168
00:20:35,100 --> 00:20:40,360
Surveillance, or dissecting the ARGO coronavirus application.

169
00:20:41,820 --> 00:20:47,480
So, this is the tracking application proposed by the Argentine Ministry of Modernization.

170
00:20:47,700 --> 00:20:58,560
It is mandatory by law to circulate, so if you want to leave your home, you want to step outside your front door, you need to have this application installed.

171
00:20:59,320 --> 00:21:13,420
The current version is 3.3.1, but here we analyzed 1.0.2, 3.0.7, and 3.3, using the most common tools available for Android, the compiling and reverse engineering.

172
00:21:14,400 --> 00:21:31,060
At first glance, I noticed a lot of broken functions, and reviewing the code, I found many dyslexic errors, like for example, disabilidad instead of disabilidad, which in English means disabled.

173
00:21:31,060 --> 00:21:34,480
Bonotus instead of botones, buttons.

174
00:21:34,600 --> 00:21:40,220
And this problem is repeated regardless of the compiler user.

175
00:21:41,840 --> 00:21:44,600
Numeor instead of numero, number.

176
00:21:45,480 --> 00:21:48,180
Masculio instead of masculino, male.

177
00:21:50,240 --> 00:21:57,260
Autoevaluacoin instead of autoevaluación, which is a critical feature of this application, the auto-evaluation module.

178
00:21:59,040 --> 00:22:06,980
And after digging a little bit further, I found a new rolegride-only token discloser, which is not a vulnerability per se, but will become handy later.

179
00:22:09,060 --> 00:22:19,680
Insecure JSON structure creation, vulnerable to injection or manipulation, instead of using the Java-provided functions to build JSON.

180
00:22:20,780 --> 00:22:24,660
A reference to a long-dead product, Google Plus.

181
00:22:25,880 --> 00:22:35,740
Lots of insecure and unsanitized execute calls, really, a lot of them, and some even could lead to SQL injection.

182
00:22:36,740 --> 00:22:45,560
The application communicates with foreign servers, which is by national law or local law, it's not allowed.

183
00:22:47,060 --> 00:22:53,380
These servers are not pretty much safe for storing medical data or, well, anything.

184
00:22:54,520 --> 00:22:58,120
This is the map of the application.

185
00:22:58,220 --> 00:23:06,100
All of these assets inherit the qualification of C, so it's not secure at all.

186
00:23:06,840 --> 00:23:10,540
A lot of missing security features.

187
00:23:12,180 --> 00:23:15,520
And privacy is also at risk.

188
00:23:15,660 --> 00:23:24,020
Of a total score of 100, this application received a 61 score.

189
00:23:24,840 --> 00:23:34,200
There are many write operations that record PII about the device, which are in Base64.

190
00:23:34,500 --> 00:23:47,000
Whenever you decode them, you get that this application is trying to keep track of the device ID, the build of the own application, and the device manufacturer.

191
00:23:47,660 --> 00:23:55,700
Obviously, since this is an emulated device, the application was not able to extract any valid information at all.

192
00:23:56,580 --> 00:24:03,180
From the very first version, the possibility of permanently tracking the user was considered.

193
00:24:03,340 --> 00:24:10,960
As you may see, permiso de ubicación means access location permission, and todo el tiempo means all the time.

194
00:24:11,580 --> 00:24:15,980
The application has far set of data that try to run a startup.

195
00:24:16,120 --> 00:24:22,000
For example, show far set of date dialogue and device startup or on boot.

196
00:24:23,680 --> 00:24:29,120
Also, this location tracker attempts to listen for boot events.

197
00:24:31,160 --> 00:24:34,800
The app tracks and asks for medical history.

198
00:24:34,900 --> 00:24:43,620
For example, cancer, diabetes, pregnancy, cardiac hepatic, renal, respiratory diseases, and all this data is stored abroad.

199
00:24:45,100 --> 00:24:50,920
Auto-evaluations are not stored client-side, but rather sent to the server.

200
00:24:53,340 --> 00:25:01,920
The user's location, along with his or her DNI, the national document ID number, are sent to a remote server.

201
00:25:01,920 --> 00:25:09,940
Again, this identification number is like the social security number of U.S.

202
00:25:09,940 --> 00:25:11,180
residents.

203
00:25:12,240 --> 00:25:21,220
If the user's evaluation returns that he or she is infected, tracking service is activated in the background.

204
00:25:25,810 --> 00:25:33,090
Also, by default, the app allows backup mode, which may send private medical information to Google.

205
00:25:35,250 --> 00:25:46,990
Now, it's unreliable for an application to diagnose a disease, but it's less reliable for an app to say, okay, you're not contagious, bro.

206
00:25:47,150 --> 00:25:50,950
We are during a pandemic, but hey, you're not contagious.

207
00:25:50,950 --> 00:25:52,250
You are safe to go.

208
00:25:53,290 --> 00:25:56,270
No sos contagioso means in English you're not contagious.

209
00:25:56,650 --> 00:25:59,910
So, the app has an option or feature for that.

210
00:26:00,430 --> 00:26:05,150
Now, remember the last time you Googled your symptoms of some sort, anything you had.

211
00:26:05,150 --> 00:26:13,190
I had a slight fever, my ankle hurts, I have a headache.

212
00:26:13,570 --> 00:26:19,490
What is the first result that Google answered you?

213
00:26:20,750 --> 00:26:27,090
You know, it's probably not something good at all or not accurate at all.

214
00:26:29,170 --> 00:26:39,230
Again, for example, in this snippet of code, it tries to determine if a user is not infected or not contagious.

215
00:26:39,430 --> 00:26:44,110
Again, you might have to see a professional, not an application.

216
00:26:46,490 --> 00:26:51,870
And this is not the first time we do something like this on the Argentine government.

217
00:26:52,010 --> 00:26:59,050
We were featured a lot of times on Programming Horror on Reddit for this kind of things.

218
00:26:59,230 --> 00:27:08,110
For example, this was the application that the Argentine government forces people to download when they land in Argentina to control coronavirus infections.

219
00:27:08,670 --> 00:27:18,930
As you can see, it is really long if it might give you a little sample of how we work here.

220
00:27:21,070 --> 00:27:29,850
Now, on the first version, the 1.0.2 that I have reversed, I found this string all across the code base, all across.

221
00:27:30,190 --> 00:27:31,890
So, who is Sergio C?

222
00:27:31,890 --> 00:27:33,990
We won't disclose its full name.

223
00:27:33,990 --> 00:27:35,070
Who is Sergio?

224
00:27:35,150 --> 00:27:38,230
A possible author, a project lead.

225
00:27:39,550 --> 00:27:45,970
After some Google foo, after some Google queries, I landed on his personal site.

226
00:27:46,390 --> 00:28:00,770
He has worked on a lot of government apps before, including transport, local government, national government, healthcare, and even now on the government's main application, which is MyArgentina.

227
00:28:03,340 --> 00:28:13,000
So, following the email he provided on his site, I found out that he was leaked a good couple of times.

228
00:28:13,000 --> 00:28:18,220
So, this might even rise the attacks on face for this kind of application.

229
00:28:19,680 --> 00:28:23,440
Now, what is everybody else doing?

230
00:28:23,440 --> 00:28:26,060
What are all our neighbors doing?

231
00:28:26,780 --> 00:28:33,060
All of them are dropping centralized solutions or centralized contact tracing.

232
00:28:33,620 --> 00:28:40,160
But we insist on keeping this model and pushing forward this model.

233
00:28:41,400 --> 00:28:50,060
And so, to close this chapter, this application was launched without publishing an audit, report, or penetration test.

234
00:28:50,060 --> 00:28:54,300
And it isn't even HIPAA compliant, not at all.

235
00:28:54,300 --> 00:29:02,100
This is especially serious knowing that it handles medical information and sends it to servers abroad.

236
00:29:02,360 --> 00:29:10,540
Now, ask yourself, please, what will happen if you develop an application of this poor quality for your employer?

237
00:29:12,870 --> 00:29:17,030
Let's jump to the conclusions and questions and answers.

238
00:29:18,130 --> 00:29:31,390
Although it may seem obvious for us, who are techies, geeks, hackers, or whatever, always inform yourself through professional, neutral, and verified sources.

239
00:29:31,870 --> 00:29:39,070
They are not easy to get, and again, it may seem obvious to us, but not to the rest of the world out there.

240
00:29:39,130 --> 00:29:49,350
Just because a term or a phrase is trending does not mean that it is real or automatically represents the thinking of the majority, right?

241
00:29:50,450 --> 00:29:59,250
Every day, somewhere, and at all times, there are groups of people and machines designed to install biased thoughts and debates in society.

242
00:29:59,810 --> 00:30:16,110
Surveillance and monitoring of citizens is not the answer, particularly in the hands of governments that have constantly committed systematic abuses against freedom of expression, especially in digital media, and obviously, especially in Argentina.

243
00:30:16,110 --> 00:30:19,110
You have seen some examples in this talk.

244
00:30:20,030 --> 00:30:27,090
Investing thousands in technology and applications after neglecting the health infrastructure is not the solution.

245
00:30:27,370 --> 00:30:31,810
An expensive app does not replace a doctor at all.

246
00:30:33,210 --> 00:30:44,190
You can get in touch with me via Telegram or GitHub, where these slides will be shared, and the video that I didn't have the time to play.

247
00:30:44,370 --> 00:30:48,330
And feel free to follow me on Twitter at Mauro Eldritch.

248
00:30:48,730 --> 00:30:53,330
As you may see, I have a few followers since I'm not into trolls, actually.

249
00:30:54,070 --> 00:31:00,850
I really hope you enjoyed this talk, and if you have any questions, I'm glad to help you and to answer.

250
00:31:01,150 --> 00:31:05,690
So please feel free to drop in and ask whatever you like.

251
00:31:06,010 --> 00:31:10,210
Thanks for watching this, and I hope to see you again next year.