start	end	text
790	6590	Okay, welcome to my talk, COVID-1984, propaganda and surveillance during a pandemic.
8090	13830	Before we start, I would like to make a brief introduction both to this talk and to myself.
14550	18390	My name is Mauro Eldritch, I work as a cyber security architect,
18870	27210	I'm the founder of DC5411 Argentina, and I was a speaker for DEF CON Las Vegas,
27210	32610	Dragonjar Colombia, POSCON Iran, and Texas Cyber Summit, among other conferences.
32610	38270	I'm a returning speaker to this village, I spoke here on DEF CON 26.
40430	46490	And this talk is about explaining the political situation of surveillance and propaganda in
46490	53510	Argentina, although it is also compatible with the same situation in other countries and regions.
53510	60410	This will be explained from a hacker's point of view, using a hacker's toolbox, which in my case
60410	66550	includes social engineering and open source intelligence, and there's even some application
66550	75790	reverse engineering at the end. This talk will be divided into two chapters. The first propaganda
76270	81310	about the Argentine pro-government propaganda apparatus and social networks seen from the
81310	88410	inside. We will see the process from the scratch, from the infiltration of a sock puppet account
88410	97650	into the apparatus to its internal operation. The second part is surveillance. We will dissect
97650	104750	the Cuidar COVID-19 mobile application, which is now mandatory by law in order to circulate.
104750	110750	So if you want to leave your home, if you want to step away from your doorstep,
110750	119030	you have to have this application installed on your phone. And we will dissect this application
119710	128250	uncovering many privacy abuses, bad practices, and lots of material worth of appearing on Reddit,
128250	137490	especially on Programming Horror subreddit. Just a brief disclaimer, every item disclosed here is
137490	145270	publicly available through OSINT. On my jurisdiction, it is totally legal to reverse
145270	153870	engineer any application on any software, and I wasn't involved in any illegal activity directly
153870	161870	or indirectly. So that being said, let's start with our first chapter, propaganda.
164290	172150	So, what is propaganda, you might ask? Propaganda is a communication that is primarily
172750	180410	focused on influencing an audience and furthering an agenda, which might not be objective or might
180410	188910	not be real at all, and that may be presenting facts selectively. You might have heard the term
188910	198590	alternative facts recently in media. Well, it's probably related to this kind of behavior.
200390	209090	Online, agents of propaganda are called trolls. They massively comment on social networks,
209090	215050	supporting a certain government, in this case, or a certain movement. It may not always be a
215050	222970	government, but a political movement. They try to establish their own debates and trends.
222970	226650	For instance, in my country, it's pretty popular to see trendings like
226650	232140	thanks, President Fernandez, or we support you, President Fernandez.
233530	241750	They are also maybe found diverting the focus from opposition debates. For example, every time
242610	250730	an opposition part tries to open a thread or tries to communicate something, you might find
250730	259990	the trolls leaving spam comments, fancams, or any other material that, when exposed repeatedly,
259990	266510	could turn this thread into something really difficult to follow for legit users or for
266510	274850	interested users. So it may turn the conversation into something unbearable.
275900	282670	They also work by establishing negative trends against the opposition, and they are usually
282670	289700	grouped into troll farms, where they work together in an organized manner, surprisingly.
291700	300860	How do you recognize a troll? Okay, first, it's pretty simple, because lots of default
302160	308480	configurations on their profile are present. For example, they don't have a picture,
308480	315620	a profile picture. They use a fake one or a stock one. There are lots of numbers in their
315620	321660	handlers. For instance, Mauro and a bunch of numbers. That's pretty common, pretty normal
321660	327520	on Twitter, actually, because that's the default username that Twitter gives you
327520	336080	and allows you to change later. They share common terms and phrases. They have their own languages,
336080	341800	surprisingly. They agree on a common version to answer debates. For example,
341800	345620	the president's offshore accounts are a media operation.
346200	353780	So they are basically saying that everyone else is lying, and they are not. And they obviously
353780	361100	work in swarm behavior. They never come alone. They act like a swarm.
362060	368800	Many governments are credited with having online propaganda apparatus and agents. For example,
368800	377460	Russia, with the collapse of the Trolls of Olgino. China and the 57th party. North Korea,
377460	382960	with the United Front Department. Venezuela, with the Armada Bolivariana de Trolls,
382960	391740	which barely translated to English is Bolivarian Army of Trolls. And also Argentina, with the
391740	400000	Ciber-Cas, or Tropa-Ca, which translated from Spanish is K-Troop or Cyber-K,
400000	405720	which is not actually a K-pop supporting fandom. It's valid, the clarification.
407620	413680	This global advance on propaganda apparatus around the world is such that there are social
413680	421380	networks with firm positions towards them. For example, Counter-Social is against it,
421380	426840	and countries with the highest propaganda incidents are absolutely banned,
426840	431630	blocked entirely by their IP block. Some of them are listed here.
433580	440780	And there are other social media sites, for example, this one in my country, that supports
440780	447700	the propaganda behavior. Facebookular.net was an Argentine social network against
447700	454980	establishment and imperialism, and it's a firm supporter of the Peronist party.
455380	461200	It was a place where only its militants participated, and it was backed, supported,
461460	469680	by the Ministry of Culture. At a first sight, you might obviously see that this is a bad rip-off of
469680	478680	Facebook, and it even allows you to register with Facebook. This project is now defunct,
478680	486380	and it's no longer active, but it was heavily used by users from Argentina and Venezuela
487380	489700	some years ago.
492220	497660	Trolls and censorship. The goal of a troll is not only to spread messages,
497660	504020	but to prevent the opposition from doing so. Lots of groups participate in massively reporting
504020	511840	legit posts or accounts from the opposition in order to take them down. They are actively abusing
512730	520240	an automatic mechanism for reporting, so if a lot of users report someone, it must be true.
520400	527640	And this automatic behavior takes down the post or the account without any real intervention.
529480	535020	Argentina, it's an ideal terrain for this surveillance experiments, since many times
535560	540180	the government have tried to control social networks to no avail.
541460	546540	For example, Peronist legislators proposing that users who comment on websites identify
546540	552360	themselves with their national identification number, which is like the social security number
552360	561080	for US residents. Or a senator from the same party proposing a public and democratic
561080	569760	regulation of social networks. Or the cyber patrol protocol imposed this year,
569760	577340	which basically ended up with a lot of people being detained for tweeting or for expressing
577340	586100	themselves on social media. You know, there are a lot of projects and already installed measures
586820	592780	to control social networks, but what about the trolls? The trolls continue working together
592780	600500	and growing. So this is where we start after this introduction. Tracking trolls.
602200	606940	The Argentine apparatus has the particularity of being made up of real users
607340	612880	as well as trolls and bots, as you can see when exploring their hashtags.
614260	619820	Rumors indicated that many users received invitations to join this apparatus.
620380	627180	My goal was to get that invitation. You know, it's like a golden ticket to the chocolate factory.
627820	632460	So after a month of silent observation, I created a sock puppet account
632460	636000	mimicking the behavior of these users.
637480	643980	And it was configured using these settings. Profile photo, President Fernández and Vice
643980	651560	President Fernández together. The cover photo was Vice President Fernández giving a speech at Vélez
651560	660940	Stadium. And who was I following? The president and some ministers, along with a few real
661350	667640	pro-government accounts. What about the description and tweets?
668160	675780	Both I made them imitating the specific languages and symbolism used by these users.
675860	683480	How? Well, using Twitter API to monitor their hashtags and extracts the most repeated words.
683480	691680	You may find them here as a word cloud. Most of these are pejorative terms to refer to opponents
691680	695700	like Bolsonaro, the former president of Brazil, Bolsonaro.
696280	701100	And Piranha instead of Sebastián Piñera, the Chilean president.
702240	706840	So after learning how they speak, now that we speak the same languages,
706840	709760	it was a matter of time before getting the invitation.
712400	719920	This sub-puppet raised a hundred or so followers in a few hours. I have my original Twitter account
719920	730520	since 2015 and I think I have less than 300 users, just for comparing. Most of these were trolls,
730520	737300	but a few real users too. So I started retweeting official accounts and these real users and tweeting
737300	743680	with their same hashtags. For instance, Macri should be in jail, our ex-president from the
743680	751060	opposition. And after only three days, I received my invitation, this golden ticket from a user
751060	761200	we'll call DC. On the left, you can see the original conversation in Spanish and I translated
761200	767280	it the best I could to English. Hey buddy, we are making Twitter groups to install hashtags.
767300	774040	Wanna join? Hey buddy, sure. What I'm supposed to do? Well, basically you have to tweet the hashtags
774040	780960	that we send to the group. After agreeing this, I was added to the group number 300 and some
781760	786340	of soldiers of the national project containing 50 people.
788320	795600	One of the messages shared there was this. Guys, Ariel Garbarz is asking us to use
796440	801940	LARRETAISRESPONSIBLE. LARRETA is the mayor of Buenos Aires city and a member of the opposition.
802520	808500	Now you may ask, who is Ariel Garbarz, by the way? No clue so far.
809680	817320	But in fact, both of these hashtags that made the top five in my country,
817980	823580	one of them being PESCADOPODRIDOEME and LARRETAISRESPONSIBLE are fabricated trends
823580	831140	proposed on propaganda groups. You may find the source on getthytrends.com. Just for confirmation,
831660	838980	I went to trending earlier and I found that this information was right. And these
839660	844680	trendings lasted for at least 12 hours, which gives us a lead on how toxic
845640	848020	are these propaganda interventions.
850540	857560	Another message on this group is, hey guys, with Ariel Garbarz, we formed a group where he's the
857560	864240	administrator and tells us what to publish and at what time, so we can get our trend to always be
864240	871560	in first place. Another user replies, it's like you say, we used to do the same long ago with the K
871560	877700	youth, a new group. You have to set a day and a time, it's the best.
878020	880520	Again, who is Ariel Garbarz?
882360	889960	Okay, remember DC, the original member who invited me here? Well, 10 days later, another account from
889960	896900	him tried to recruit me again. So he has probably forgot about my account. Hey buddy, we're making
896900	904060	Twitter groups to install hashtags. Wanna join? And I say, hey buddy, sure, go ahead. I was added once
904060	913060	again to another Soldiers of the National Project 300 and something. Now by accident, I was a member
913060	921540	of two propaganda groups. There was a six digit difference between each group ID, for example,
921540	932040	301 and 307. Each group can have up to 50 users, 49 if you do not take into account administrator.
934060	944440	So 49 users multiplied by six new groups are almost 300 new users in 10 days.
944440	952480	This is how fast can this apparatus grow without almost no any effort.
954260	962200	Currently, according to the last group ID I managed to find, there are at least about 350
962920	972320	propaganda groups on Twitter alone. This gives us a total of 17,150 users.
973500	977480	I imagine all these people, try to picture all these people tweeting
978040	983080	five or six times a day. They can make any trend they want.
984960	993120	Well, also, this doesn't end here. A WhatsApp group is shared with both groups I belong to.
993120	996160	And of course, hashtags are shared there too.
997360	1006220	This group is city seven. There are seven groups of around 256 users.
1006940	1016360	If we take into account 255 users, we are not taking into account administration,
1016360	1022820	multiplied by these seven groups, there are almost 2,000 new users here that may be repeated.
1024820	1031960	And adding them all together, we have almost 20,000 users. Again, there may be repeated users.
1032920	1038140	This doesn't end here. This group had members from the USA,
1038540	1046660	Spain, the United Arab Emirates, and even Germany. So, upon joining, the administrator started
1046660	1053620	sending hashtags. In this case, at half past seven, we come out with $Witness.
1053960	1058900	That administrator, as you may see in the message, or the leading message,
1058900	1064400	is Ariel Garbaros. And that name now definitely rings a bell for you, right?
1065320	1070460	So, okay, let's try to answer who is Ariel Garbaros.
1072260	1079120	He's the CEO of Protección Digital, which is digital protection, a company which was
1079120	1083760	favored with many contracts by the federal justice and various Argentine governments.
1083760	1089820	He was benefited to direct several state infrastructure projects.
1090080	1095290	He was appointed computer attorney general for the 17 and 19 elections.
1095520	1100980	And he's the leader of the propaganda apparatus on social networks, the lord of the trolls,
1100980	1108830	we might say. The source of this is the newspaper Perfil, where he answered an interview.
1112600	1120020	Here is a video of Ariel Garbaros instructing the trolls live, but it is in Spanish. And for
1120020	1127360	time reasons, I'm not going to show it here, but it will be shared on the GitHub repository along
1127360	1135020	with the slides. Obviously, since in Argentina, we speak Spanish, the video is in Spanish.
1136260	1139340	This was leaked on Twitter by a user.
1140880	1148760	So, the final diagram of the trolls, or a simplified one, is here.
1148900	1156300	Ariel Garbaros acts as a leader, sends the trending topics to be installed to its coordinators,
1156300	1164520	the coordinators of each group, which then share this objective to both Twitter groups and WhatsApp
1164520	1176560	groups, which then are executed by the trolls. So, is this illegal? In Twitter platform, it is
1176560	1182220	against the terms of service. The Twitter safety team actively tracks and takes down state-linked
1182220	1190120	propaganda groups. In our country, well, it is not. In fact, it looks suspiciously endorsed,
1190840	1196180	like the Facebook ripoff social media I showed you some slides ago.
1197780	1205580	What tools did you use for this chapter? Well, Trendinalia, Trends24in, Votometer, GetDayTrends,
1205580	1210840	the Twitter API, the Twitter RubyGem, and my own tool, which is also in the repository,
1210840	1216080	venator.lua, for recognizing bot or troll-like behavior.
1217400	1223660	So, what is the propaganda apparatus up to right now? Generating hashtags supporting the use of
1223660	1228580	the government application to monitor the coronavirus outbreak, you know, the Cuidar
1228580	1237900	COVID-19 application, which leads us to the next part. Surveillance, or dissecting the
1237900	1245480	ARGO coronavirus application. So, this is the tracking application proposed by the Argentine
1245480	1252260	Ministry of Modernization. It is mandatory by law to circulate, so if you want to leave your home,
1252260	1258560	you want to step outside your front door, you need to have this application installed.
1259320	1267520	The current version is 3.3.1, but here we analyzed 1.0.2, 3.0.7, and 3.3,
1267520	1273420	using the most common tools available for Android, the compiling and reverse engineering.
1274400	1281420	At first glance, I noticed a lot of broken functions, and reviewing the code, I found many
1281420	1289480	dyslexic errors, like for example, disabilidad instead of disabilidad, which in English means
1289480	1298620	disabled. Bonotus instead of botones, buttons. And this problem is repeated regardless of the
1298620	1308180	compiler user. Numeor instead of numero, number. Masculio instead of masculino, male.
1310240	1315200	Autoevaluacoin instead of autoevaluación, which is a critical feature of this application,
1315200	1322320	the auto-evaluation module. And after digging a little bit further, I found a new rolegride-only
1322320	1326980	token discloser, which is not a vulnerability per se, but will become handy later.
1329060	1334640	Insecure JSON structure creation, vulnerable to injection or manipulation, instead of using
1335420	1344660	the Java-provided functions to build JSON. A reference to a long-dead product, Google Plus.
1345880	1350520	Lots of insecure and unsanitized execute calls,
1350520	1355740	really, a lot of them, and some even could lead to SQL injection.
1356740	1360520	The application communicates with foreign servers,
1360520	1365560	which is by national law or local law, it's not allowed.
1367060	1373380	These servers are not pretty much safe for storing medical data or, well, anything.
1374520	1383720	This is the map of the application. All of these assets inherit the qualification of C,
1383720	1390540	so it's not secure at all. A lot of missing security features.
1392180	1404020	And privacy is also at risk. Of a total score of 100, this application received a 61 score.
1404840	1410900	There are many write operations that record PII about the device,
1411780	1419300	which are in Base64. Whenever you decode them, you get that this application is trying to keep
1419300	1427000	track of the device ID, the build of the own application, and the device manufacturer.
1427660	1433620	Obviously, since this is an emulated device, the application was not able to extract any
1433620	1441240	valid information at all. From the very first version, the possibility of permanently tracking
1441240	1448060	the user was considered. As you may see, permiso de ubicación means access location permission,
1448560	1454500	and todo el tiempo means all the time. The application has far set of data that try to
1454500	1462000	run a startup. For example, show far set of date dialogue and device startup or on boot.
1463680	1469120	Also, this location tracker attempts to listen for boot events.
1471160	1477680	The app tracks and asks for medical history. For example, cancer, diabetes, pregnancy,
1477680	1483620	cardiac hepatic, renal, respiratory diseases, and all this data is stored abroad.
1485100	1490920	Auto-evaluations are not stored client-side, but rather sent to the server.
1493340	1499700	The user's location, along with his or her DNI, the national document ID number,
1499700	1507360	are sent to a remote server. Again, this identification number is like the social
1507360	1517800	security number of U.S. residents. If the user's evaluation returns that he or she is infected,
1517800	1527230	tracking service is activated in the background. Also, by default,
1527230	1533090	the app allows backup mode, which may send private medical information to Google.
1535250	1542970	Now, it's unreliable for an application to diagnose a disease, but it's less reliable
1542970	1549950	for an app to say, okay, you're not contagious, bro. We are during a pandemic, but hey,
1549950	1555370	you're not contagious. You are safe to go. No sos contagioso means in English you're not
1555370	1562330	contagious. So, the app has an option or feature for that. Now, remember the last time you Googled
1562330	1572070	your symptoms of some sort, anything you had. I had a slight fever, my ankle hurts, I have a
1572070	1583590	headache. What is the first result that Google answered you? You know, it's probably not something
1583590	1594190	good at all or not accurate at all. Again, for example, in this snippet of code,
1594190	1601030	it tries to determine if a user is not infected or not contagious. Again, you might have to see
1601170	1610330	a professional, not an application. And this is not the first time we do something like this on
1610330	1615810	the Argentine government. We were featured a lot of times on Programming Horror on Reddit
1616610	1622010	for this kind of things. For example, this was the application that the Argentine government
1622010	1628110	forces people to download when they land in Argentina to control coronavirus infections.
1628670	1638930	As you can see, it is really long if it might give you a little sample of how we work here.
1641070	1647970	Now, on the first version, the 1.0.2 that I have reversed, I found this string all across the code
1647970	1655870	base, all across. So, who is Sergio C? We won't disclose its full name. Who is Sergio? A possible
1655870	1664870	author, a project lead. After some Google foo, after some Google queries, I landed on his personal
1664870	1672070	site. He has worked on a lot of government apps before, including transport, local government,
1672070	1677990	national government, healthcare, and even now on the government's main application,
1678330	1688520	which is MyArgentina. So, following the email he provided on his site,
1688520	1693000	I found out that he was leaked a good couple of times.
1693000	1698220	So, this might even rise the attacks on face for this kind of application.
1699680	1706060	Now, what is everybody else doing? What are all our neighbors doing?
1706780	1713060	All of them are dropping centralized solutions or centralized contact tracing.
1713620	1720160	But we insist on keeping this model and pushing forward this model.
1721400	1727720	And so, to close this chapter, this application was launched without publishing an audit,
1727720	1734300	report, or penetration test. And it isn't even HIPAA compliant, not at all.
1734300	1740460	This is especially serious knowing that it handles medical information and sends it to
1740460	1747040	servers abroad. Now, ask yourself, please, what will happen if you develop an application
1747040	1757030	of this poor quality for your employer? Let's jump to the conclusions and questions and answers.
1758130	1765030	Although it may seem obvious for us, who are techies, geeks, hackers, or whatever,
1766050	1772390	always inform yourself through professional, neutral, and verified sources. They are not easy
1772390	1779070	to get, and again, it may seem obvious to us, but not to the rest of the world out there.
1779130	1785870	Just because a term or a phrase is trending does not mean that it is real or automatically
1785870	1793290	represents the thinking of the majority, right? Every day, somewhere, and at all times,
1793290	1799250	there are groups of people and machines designed to install biased thoughts and debates in society.
1799810	1806930	Surveillance and monitoring of citizens is not the answer, particularly in the hands of governments
1806930	1813010	that have constantly committed systematic abuses against freedom of expression, especially in
1813010	1819110	digital media, and obviously, especially in Argentina. You have seen some examples in this talk.
1820030	1824450	Investing thousands in technology and applications after neglecting the health
1824450	1831810	infrastructure is not the solution. An expensive app does not replace a doctor at all.
1833210	1838890	You can get in touch with me via Telegram or GitHub, where these slides will be shared,
1838890	1846450	and the video that I didn't have the time to play. And feel free to follow me on Twitter
1846450	1853330	at Mauro Eldritch. As you may see, I have a few followers since I'm not into trolls, actually.
1854070	1859970	I really hope you enjoyed this talk, and if you have any questions, I'm glad to help you and to
1859970	1867710	answer. So please feel free to drop in and ask whatever you like. Thanks for watching this,
1867710	1870210	and I hope to see you again next year.