Introducing ourselves, basically because setting expectations and knowing what we came to do is an initiation workshop on security issues, understanding how technology works, opening your curiosity to how we can manipulate that technology and make it work differently to how it should be done.
For this, it is a workshop, it is not a talk, so we need this interaction.
We are going to try things out, we have a huge amount of things that we can try and probably we will not be able to do it in time.
So, we are going to adapt it a little to your interests.
From here it is difficult for me to get to you.
So, if you have... well, wherever you are, but if at some point you want to move forward, there is no problem either.
For the people who are streaming, of course, they will be able to see it, but the interaction with the workshop, which is the interesting thing, they will not be able to carry it out.
Let me introduce myself, my name is Raúl Siles from Dynosec and, well, I have been working on security issues for a long time because I am interested in how technology works, if it can be manipulated, what things can be done with it.
And this is what we have come to teach you.
First of all, and because of the interaction, we are going to try that you practice and draw conclusions with your technology and perhaps the most appropriate way to do it is with your mobile device.
More or less everyone has a smartphone, a tablet, and with that, well, let's see if we are learning things or what things can be done with these devices.
So, how many of you mess with technology?
You probably don't have a laboratory like that, or as advanced as that for mess-making, but you do like to play, practice and do things.
I imagine that most of you, if you are here, it is because of that concern of wanting to play with it.
We are going to try to get to know our mobile devices.
So, I need your interaction so that you can learn, practice, learn things about mobile devices.
So, if you want, what we are going to do initially is block the mobile, which is an interesting protection mechanism, and see the lock screen and see if you have some kind of access code that allows the owner or you to access the mobile and not a third party without authorization.
So, how many of you have a lock code?
Who doesn't have a lock code?
Well, probably no one will raise their hand and say it's me, but the idea is that you have it.
How many of you have a PIN?
And by PIN we mean a four-digit code, not the traditional PIN.
How many of you have a password?
In the case of Android, you know that those of you who raise your hand already know that you have Android, because a password does not exist in the IOS world.
Password?
I mean alphanumeric password, something longer, word, passphrase, less people, but some of you still raise your hand, good.
How many of you use biometrics?
Because most of you, I mean, now it's very fashionable.
Then we are going to see an interesting thing, which is how we can quickly disable the biometrics of the mobile and scenarios where I may need this.
And within biometrics, how many of you use fingerprint?
Most of you.
And how many of you use facial recognition?
There are fewer.
And I understand that you do not have any recognition of the iris and so on, right?
There are some Androids that have it.
There you go, perfect.
Unlock the device and see how long it takes you to unlock it.
Tell us.
One second, how many of you use biometrics?
The pattern, okay.
The pattern that you slide your finger, it does not take much time, right?
It is more or less comfortable.
Biometrics, even more comfortable.
Of course, when you put a password, things get complicated here, right?
And the user is the one who is protesting, is that I put an alphanumeric password and on top of that it is complex, then the issue gets complicated.
Okay.
More things.
If you look, if you lock the mobile device again and look at the lock screen, it is something that we will later insist that you collaborate with each other and so on.
What icons appear there?
Do you know all the icons that appear?
All the information?
Do we know what each of them means?
If you have any comment, you say, to me it is the only icon here that I have not seen, right?
Never one that appears and disappears, then you tell me.
Anyway, we will investigate later.
The idea is a bit that you inquire, right?
To see if I know the technology, my device and everything that appears out there.
Then we will ask you what things you see and keep in mind that what you are seeing on the lock screen could be seen by anyone.
So those icons would be revealing to anyone something that is very likely that you all have, which is who is your mobile phone operator, right?
And whatever appears there, right?
Movistar or Vodafone or Yoigo Orange or TikTok.
Is it correct?
Someone could use this to raise a fake phone base to try to get your phone to connect to it, for example.
A bit so that you think about it.
Can you see details of the operating system there, on the lock screen?
Would we know which ones are Android and which ones are iOS?
That is easier, right?
By the hardware, physically, what we have said about the pattern.
More things.
What version do you have of the operating system?
Look at it.
Do we use Kahoot for this?
For the version?
If you think so, let's do one thing.
We are going to use...
We have a couple of...
to make it more interactive and workshop-like.
Let's say...
Kahoot forms, right?
For those of you who don't know them, basically a series of questions and answers about the operating system.
Basically, what you have to do is...
I understand that you all have connectivity to the network, to Wi-Fi, I mean, or 4G.
This is not going to consume a lot of data.
Especially for those of you who are at home, you can also follow this part of Kahoot online.
In fact, we should see the answers you are giving as well.
Since we have the audience, especially aimed at families, children, teenagers and others, so that it can be followed as well.
One thing, because depending on how we are managing the workshop, we have to play with this part.
I introduce you, so that it is clear, to Mónica Salas, my colleague at Dynosec, that we will both teach the workshop.
And I haven't introduced her before, well, you'll see why.
So, we are with that part of Kahoot, we are going to do one thing, we are going to come here, I'm going to make a quick screen change, so that we all go to Kahoot, and so we give you time to be able to connect, to have connectivity, basically, to the Internet.
And so we see, if you are clear where we can find the code, sorry, the version of the operating system, and the level of patches, in the case of Android people.
For those of you who have not used Kahoot before, basically, let me increase this, and so we have it easier and you can see it better, what we are going to do is, we are going to launch the workshop option, what you have to do is, go to kahoot.com, as you can see there,
k-a-h-o-t.com, it asks you for a pin, well, yes, it redirects you one to another, right, Mónica?
And you put in a pin, and you choose a nickname, and you are already connected to Kahoot.
We see that CMS, GG, Jack, Arnaud, Joe are appearing.
We leave you there for a moment, and so you connect.
The idea is, we are going to ask you a couple of questions, in which menu do I find the operating system version, and with that we also see, if you are clear in which version it is, we already have more people there, you have about 60 seconds for each question,
so that this is more or less fast.
Well, a lot more people are coming in, so I'm going to start, okay?
It's not about competing either, but about putting you to the test, the questions are coming, the first one is for Android, and then you have four options, if you choose the color, depending on which is the menu that the operating system version provides you.
The one that does it faster, then it comes out better in the statistics, obviously.
What we also want is that you look at the version, which is the one that interests us, from a security point of view.
We already have enough answers, there are 40 seconds left, look at the version, and so I'm asking you.
As we are on Android, how many people have Android 10?
One person here, okay?
How many people?
Not bad.
Two, two, Raúl.
Two, I don't see... okay, another one over there.
I greet you so that you can see it, because with the light I have it difficult.
Android 10 came out in August of this year, and we are in December, practically, so that you can get an idea, several months.
Android 9, okay?
Android 9, yes, I count like 10 people, more or less, like that, Android 8, three, four people.
Android 7, okay?
Another three, four.
Android 6, okay?
So, from there, the rest doesn't have Android, I understand, or Android 6 or below.
Okay.
You see that it's right, well, it's there.
Many people have voted for option 2, of phone information version of Android.
Perfect.
We evolve, Verne is the first one who answered in time, and we go to the IOS part, okay?
Those of IOS, you have had more time, I mean, this is cheating, but, well, you have been able to look at it, and where do I find the IOS version?
Go answering, okay?
Several answers are coming in there quickly, perfect.
How many IOS 13 do you have?
Those of you who have IOS, okay?
13, careful, version 13.2.3, which is the last one there is.
Look at its version.
Just today, one of the Habuto members of the Hakaton jury showed me this morning, a vulnerability has been published, where there was already a campaign called Dreck Hotel, which commits hotels from Europe, Asia and America to try to attack the guests of these hotels with a new IOS exploit,
which seems to affect up to 13.2.2, so it's better to have the latest version.
How many people have IOS 12?
Some hand over there, IOS 11.
Those of you who have older versions, because the message is clear, okay?
Of 13, IOS 13 or Android 10, you should know that your devices are vulnerable, most likely to vulnerabilities that are widely known and of public domain.
So, from a security point of view, the issue is quite important, okay?
Well, many votes associated there, okay?
And perfect, we have the podium there, Arnau.
Now it's going out a bit in order, okay?
Cam speed and so on, okay?
We leave it there and with that we cut, okay?
Of course, those of IOS have had an advantage in preparing before, okay?
But that was a bit the idea with this, okay?
Do you already know what your operating system version is?
One second, let's switch screens again.
Very important from a security point of view and we will give you some examples, okay?
In what comes next now.
And that's it.
And with this we will talk later...
Localization services, do you have any?
Usually enabled?
Can you see it from the lock screen or not?
Who has the localization services enabled?
Do you know if it can be seen from the lock screen?
Let's see, yes, it is assumed that there are games that use the localization services, right?
Like Pokemon Go, to be able to give you points and so on.
And then other people who do not play games, right?
Well, they use them to take transport, okay?
Or search in maps, services and so on.
On the lock screen, I could see if those services are being used.
What do you think?
Sometimes yes, it depends on the configuration of the mobile, okay?
But if there is a symbol that indicates that they are being used, then we will see it from a defensive point of view, okay?
Perfect.
And there was also a question about the part of disabling biometrics.
Before knowing if you can disable it easily, do you think of any scenario in which you want or really need to disable biometrics?
Yes, any place where there are a lot of people, where?
If they take away your device, do you mean?
Imagine that you have the device locked, right?
But with a unlocking method that is based on biometrics.
So, not that you already have the device unlocked and someone takes it away from you, but being locked, you may need to disable biometrics for a certain situation.
So, right now you have it locked, but it allows you to unlock it with your face or fingerprint.
I don't know if you have seen, you have probably seen videos, we haven't brought that one in the videos we have, but the typical video of a child who attacks his father, besides, this is very Spanish, right?
Because we have that profile of the nap that attacks his father because he is sleeping during the nap and he grabs his finger and puts it on the fingerprint sensor and unlocks the phone.
Okay?
And the father doesn't find out, for example.
That is not the most critical example, but it is to open your mind.
It is the example we gave you for the family part, but we will try to adapt it a little.
No, no.
The typical example that is given, and that you can see on the screen, is going more into the technical part.
Okay?
We can adapt the workshop.
What happens if I go to the border, to the customs, I am traveling by plane and I arrive in the United States, for example, right?
And then at the customs they tell me that I have to unlock the mobile device.
You know that because of the Fifth Amendment you cannot blame yourself.
So I don't have, let's say, the reason to make it easier for the people of TSA what is my unlocking code of my mobile phone.
I may have forgotten, okay?
Because I don't want anyone to enter my private life of my device.
But, for example, biometrics does not go into the Fifth Amendment.
So they can tell you, can you please put your face or finger here and unlock your device?
Eventually, also...
Well, we always talk about this in these workshops for families.
Eventually, a child may be in a place where he suspects that someone can take his device.
So imagine that he has Face ID enabled or any, let's say, the facial recognition system.
It is enough for someone to take his mobile phone and pass it on to him and he would be unlocked.
So, well, what we usually recommend to children in this case is if someone tries to take your mobile phone, don't worry, give it to him.
Your life and your safety are in front of you.
But eventually, if, in a simple way, he is able to disable the biometrics, someone would have to force him to go to the access code.
Or the attacker could think that he is unlocked, take it and really not be able to access it.
So, do you know how to unlock biometrics without any method and especially that it does not require access to the device configuration?
Like this, quickly.
I mean, it is not to unregister your number, but to unlock it.
Let's do one thing.
Since we are with this part, we show it to you here.
And if you want, we show it to you and that way you can see it.
Okay?
And that way it is easier.
Because we have it later and that way we hook it up with this part.
Perfect.
In both, in iOS and Android, right?
Well, you have to have Android 9, yes.
It is necessary because it is from that version.
If you make a long press on the power button, you will see that different options appear.
And one of them is the lockdown mode, which we call in English.
In Spanish they call it safe lock mode.
It is how it appears if you have your mobile in Spanish.
Here you have the references of where that mode is configured, which should be active by default, which is a good idea, in Android 9 and 10.
And basically, when you put safe mode, among other things, you can no longer use biometrics to unlock the mobile.
That is, it is like the first time you start your mobile, where you can not use biometrics.
If you make several failed attempts, usually five, you can no longer use biometrics.
And what you have to use instead is the backup access code that we have.
And in the case of IOS, it is usually associated with emergency services.
So, depending, as you can see here, if you are using an iPhone 7 or 8 and above, the combination of buttons is usually different.
We press the power button quickly five times and this screen appears, where make sure not to call the emergency services, but simply because this screen appears with the medical information or emergency services.
We have already disabled biometrics.
It is the grace it has.
In the case of the latest iPhone models, it works with volume keys up and down and on.
And we would get to the same situation.
So, perfect.
With this, I think we have it under control.
The next thing we are going to see is a bit of a mess of different things.
This was an initiation workshop where we talked about hackers for a day.
So, the first question would be, what is it to be a hacker?
Probably.
So, what do you think it is to be a hacker?
How would you define a hacker?
What is the preferred color of hackers?
Let's start there.
We need your collaboration.
It is a workshop.
Black, right?
Hackers are always black.
What else?
More stereotypes.
How do I identify if you are a hacker?
The hood, exactly.
Why the hood?
You want to go there in private, undercover, not to be discovered, and so on.
But you have already discovered them with the hood.
So, be careful that it does not work much.
What else?
A hacker is good or bad.
What is the number or the preferred numbers of a hacker?
Exactly.
0's and 1's in binary to know how technology works.
Thanks for the collaboration.
This is a hacker.
Black, hood, 0's and 1's, and so on.
We have the Hollywood stereotypes there.
All well nailed.
Children usually say they have a beard.
Yes, that's why I have more beard today.
Because it has happened to us at some point.
They have a beard.
I say, damn, I'm going to think about it from now on.
To try to continue being a hacker.
Joking aside, in the Royal Academy, the term was introduced in 2014.
And this was the term.
Computer pirate.
Someone who illegally makes other people's computer systems to manipulate them or appropriate them, and so on.
So, is the hacker good or bad?
Depending on what we are used to.
Of course, it's bad.
But by the description.
And what do you see in the news?
What do you see in the media?
A hacker has entered...
I don't know, this past week there have been several incidents with Spanish companies and so on.
If you use the term hacker, who has entered there?
We protest in the security or cybersecurity community.
And in December 2017, RAE incorporated another term, which is perhaps more realistic for some of us, that we do nothing illegal.
Which is basically someone who is an expert, has a lot of knowledge in the management of technologies.
Computers, normally.
Systems, networks.
Things like that.
That's kind of the idea.
In the past, and here we need your interaction.
I think I'm going to force you all to come forward so we can do a workshop.
Already in the 13th century, the term hacker was used, not the term hack with axes and cutting and so on.
So, a question.
If you had six hours to cut a tree, what would you do?
Let it be known.
Try not to reveal the rest.
But you have six hours.
You have to cut a relatively thick tree.
What would you do?
Indeed.
The idea is not to start cutting and see if as soon as I start, I will finish earlier.
But I prepare my tools.
As Abraham Lincoln said, I will spend a few hours, the first four, sharpening the ax, and then go quickly.
We have to be very precise in how we use the tools, what we want to do, the ingenuity, etc.
Where does the origin of hacker come from?
Without getting too involved.
From the myth.
How many of you know the myth?
To those of you who like Marvel.
Tony Starks and Iron Man.
He studied there, at the Massachusetts Institute of Technology in Boston.
What he had was, a long time ago, in the 60s, a train model club.
And these people received what you see there.
It was one of the first computers, the PDP-1.
In terms of computing power, compared to the mobile phone you have in your hands, it was nothing.
And in size, it was brutal.
And then, basically, they coined the term hack for people who had innovative solutions to solve problems that were in the models and so on.
Then, this spread more to the computer world, programming, systems, networks, technology.
There are even more precise definitions about it.
A little because you have it as a reference.
There are other hackers.
We are going to show you the video, but very briefly.
We don't want to open your mind.
What is this about a hacker?
And really, when we talk about hackers, how can we extrapolate the idea?
The videos have no sound, so there is no problem.
Just let me put it here.
And let's switch.
So you can see other hackers that you probably didn't expect to see in this workshop.
But this way we have a bit of an idea of the term hacker and how to extrapolate it.
And this is the idea of hackers.
It is someone who looks for life to get what, let's say, interests him with his best skills.
That's the idea.
We see a couple of examples because there are some more interesting ones.
This one is quite interesting in terms of the approach to humans.
You will see that there are quite a few hacker characteristics.
This one, for sure, is making sure that the balloon that is being created is safe.
And you see that it doesn't let go, and it doesn't let go, and it doesn't let go until it is very sure that it is not going to fall.
So, safety is the first thing.
There are some others that, despite their size, are quite ingenious and get what they propose.
They make certain intrusions in places where they probably shouldn't.
Wait a second, I'll take this out of the way, and we'll fix it.
Logically, the issue of intrusion with protections, padlocks, locks, and so on, is also interesting and can be skipped.
And there are hackers, and many of them, who work as a team as well, which is another interesting issue.
That teamwork of the different members to achieve the goal.
Well, I think the idea is more or less clear.
Another thing that happens...
If you want, Mónica, you can tell us about this part.
These are challenges and challenges for hackers.
We are duplicating the output of both teams.
Typically, when you need to solve a problem, you are asked for a challenge.
What you have to do is look at the solution or the approach to the problem in a way that is not how you are usually asked.
You have to broaden your ability to reflect, to analyze, which is what any hacker will do, regardless of the person who faces the problem.
For example, the concept of lateral thinking is very fashionable now, the so-called thinking outside the box, which is precisely this.
I face a problem, but I don't just have to look at how they have posed it to me, but how I see it from the data and the information I have.
So, for example, one of the typical challenges we pose, and if there are people watching from home, we encourage you, especially if you are parents and kids, watching this workshop together, is that you try to think about how you can solve the challenge of going through all the points in this cube,
the nine points, with four straight lines or less and without lifting the pencil.
In this case, we leave you four.
So, think about it.
If you know it, don't say it.
And now we ask you.
So, the idea is that if I put the pencil on the paper and drew straight lines, with only four, I have to go through all the points.
I start trying it.
I am here at the points and I say, well, I am going to draw four lines.
One, two, three and four.
But I have left the one in the center, for example, without completing it.
If someone has the solution, raise your hand and tell us.
How is it going?
Does anyone have it?
What if we give you a clue?
We are still waiting because with this kind of challenge, especially if you have that hacker mentality, I don't know, someone can come and ask you the challenge, right?
Or the children who are more impatient and say, I'll tell you, I'll tell you.
And I say, don't tell me.
I have to figure this out.
Even if it takes me three days, I'll figure it out.
That's the idea of solving it.
How do you see it?
Does anyone have it?
Over there, yes.
Yes?
No, try, try to tell me and I'll figure it out.
You tell me what drawing I do, that way it's easier.
Where do I start?
Let's see, from the upper left corner to the lower right corner, that diagonal.
It's around here, up to here.
Now, to the left and extend, you get out of the cube.
I get out.
Now, diagonal from the middle, that's it.
Like this?
Keep extending, down.
And down, indeed.
What have we achieved?
That with any combination in which I get out of the box, I can go through all the points.
Because no one had told you that you couldn't get out of the box.
This is a bit the objective.
Typically, when people face this type of challenge, they are looking at the cube.
So, they are not thinking that they don't need to make a geometric figure of a cube.
That's why it's hard to solve it, because from the approach that one takes to the problem, he is already seeing what his head wants him to see and not what they have really told him he has to do.
So, this is the first element of lateral thinking.
I'm not going to put limitations on myself, which is one of the keys of any hacker, of any person who wants to solve something that is out of his reach at the moment.
We can complicate the challenge a bit more to do exactly the same.
With three straight lines.
No, but they have to be without lifting the pencil.
Ok, ok.
No, no.
The idea that he was saying is that I do 1, 2 and 3 vertically and that's it.
But remember that I can't lift the pencil from the paper.
That's where the fun is.
By moving it?
What do you mean?
No, but the idea is to assume that this is a paper.
A pencil and a paper.
Of course, and that you are doing it as such.
So, it doesn't matter in which position you put the sheet, you can't lift the pencil.
You tell us.
If someone has the solution, raise your hand.
Do we unveil it?
You know it's hard for me to unveil it without someone taking it out, but...
We have a limited time.
How can we do it?
If you want, we can also wait...
Do you want to think about it and we don't reveal the solution?
Yes, if someone thinks about it during the workshop, let him comment.
Let's do that.
I prefer that.
Wait, let's change here...
We have it easy, with the environment we have set up.
Just a moment, let's not unveil it inappropriately.
So, I'm going to put it like this.
We make this little change.
We skip there, perfect.
And we come back here.
Normally, we usually do this part of the presentation in another way.
Because, well, it's normal for the room to be fuller, for us to have a more objective audience.
And here, what we normally have prepared is to unlock someone's phone.
In this case, because of the distribution of the room, it has been complicated, but I would like someone to say if they recognize this text, right?
The Amus 14 station was destroyed three months ago.
Does anyone recognize a similar text?
Okay.
Can you tell people how you did it?
Because I know you have it and so on.
I hope so, because imagine if I'm able to know this, right?
I would have to have used a lot of telepathy to know this.
And then there was also something like this, like it stopped sending life signals, I don't know how long ago, right?
Okay, and how did I know?
Keep in mind that hackers don't always wear a hood, or go in black, or are boys, right?
Which is also a curious concept.
Does anyone know?
No.
Well, I don't know, do you have cameras?
Have you seen me writing it?
There are no cameras.
Promised.
Does anyone know how we know that?
It's because I have Bluetooth on.
Neither.
It's easier than that.
Much easier than you think.
Indeed.
I was behind you, not just you, but you.
I've also seen a joker out there, a comment like laughing.
So, where do we want to get here?
Notice how small the letter of your notepad is, compared to your lock screen.
You had a pattern.
Well, since I already had the information I needed, I left before I could pick up that pattern, but the typical thing I would have done would have been to look at this, right?
And why?
Because following some points is very easy.
Visually, I have been able to read this.
And you have not even noticed my presence.
Where do we want to get?
Many times we overlook who surrounds us.
And none of you, and I have accessed a lot of information visually, of the four people in front of me, have noticed that I was looking.
I could have picked up and waited for the time that would have been necessary to unlock the device.
I haven't done it anymore because we have been late with the workshop and all this.
But both with issues of digital access code, which is the typical thing that people use, and with patterns, it is very, very, very easy to detect it.
And in fact, you are in my situation.
In this case, the situation was not ideal, because, for example, he was with a notepad with a tiny letter.
I have good eyesight, it's true, but I could have used any other artifact, as you say, a camera, and you wouldn't even have seen it.
I don't even have to wait to launch the attack and take your phone away at that moment.
I can wait for any other moment when I'm leaving the room.
And our mobile device, today, has all our digital life.
But with everything you can imagine, and in this we want to emphasize a lot, especially for those of you who are watching us from Carlson Streaming or those of you who are going to access this presentation later, that visual access to the screen is one of the main factors of weakness of your device.
So, never, never, never, before entering a lock code, any type of confidential information, to make a noise and laugh at someone, do it without being sure that you don't have anyone who can use that information against you, especially with the access method.
Also, at this point, it is quite typical that people don't have a security option on mobile devices, which is really a problem for the manufacturer, because, especially Android, when Google installs the operating system version and you do the initial configuration of the mobile,
it lets you activate a series of options that compromise your security.
So, if we can, Raúl...
Yes, just a second...
We are going to show you...
Maybe because of how we have the devices mapped here right now...
If not, I can try to raise it and see if you have visual access there.
And yours will pass too, because...
If not, I invite you to lock the mobile device and unlock it if you see something strange.
As you can see, here we have an Android and an iOS, an iOS 13 and an Android 10.
We have the doubt that because of how we are sharing the screen...
If you notice...
Wait, lock it for a moment...
One of the things that Android...
Let's see...
Where do I have the pointer?
I don't see it...
There it is.
Yes, put it there for a moment.
For example, one of the important things that the Android lock screen shows is what kind of access method you have.
So, having the padlock here, for example, indicates that the device is locked.
So, if I'm a hacker and I want to steal...
Well, not a hacker, in this case it would be a criminal who only wants to steal a mobile phone.
The first thing I would do is look at what I have around me and see what kind of security measures it has.
For example, do any of you use smart lock on Android?
Do you know what smart lock is?
Yes, is there anyone who doesn't know it and is curious to know it?
Well, smart lock, I'm going to say it quickly also for those who see us from outside.
Smart lock is an automatic unlocking system.
In which, under certain situations, your device remains unlocked.
For example, in the presence of a Bluetooth device.
You may want that if you are in the car driving and you have it paired with a specific Bluetooth device, that device keeps the phone unlocked.
Or a smart watch, for example, also allows unlocking by presence, not by location.
So, you want that if you are at home, the device remains unlocked because you consider it a safe place.
We never recommend that kind of unlocking.
And especially if it is in a place like the office or any other public access site.
Because it compromises you unnecessarily.
So, the Android unlocking screen, when it is unlocked with smart lock, it would change that icon it has there and it would show a small padlock surrounded by a unlocking symbol.
Then, the mere fact of...
As Raúl says...
Yes, I'm going to see if it is possible.
Yes, yes.
In Android it is possible.
In iOS, I don't think so.
Okay.
As you can see here on the numeric keyboard, when I am typing the password, what is happening?
Can someone tell me what the password is?
Would you know what the password of that device is?
Yes?
Why?
You are seeing it.
Of course.
It is for usability.
The concept of making it easier for the user.
That's it.
It lets you see it visually.
If you notice, it gives a pulsation to a key.
If you see, the key that Raúl is pressing is appearing surrounded.
That allows anyone with visual access to your device to know the code.
And the same happens with the pattern.
When you are sliding your finger through the pattern, the dots will light up.
Therefore, given the size of the screen, you don't need to have a lens to be able to see it.
This feature can be secured if you access...
No.
Depending on the version of Android...
Don't you have to go into the pin itself?
Yes, yes.
No.
Ok.
So, in the pin...
Sorry, let's see.
Go looking depending on the version of Android, in your Android.
Because the problem with Android, with the diversity there is, is that different versions change the menu in different places.
But as long as you have the pin as a pattern, you will find an option that basically means...
Do you want it to show, let's say visually, the characters you are introducing?
Yes.
Yes, let me... I think...
Well, go looking and I'll tell you something.
Yes , yes .
Look at the case of IOS, right?
In the case of IOS, which is the one we have on the left, look.
If I go to Touch ID Passcode, how many digits is my access code in IOS?
Four, right?
It's obvious because I have four points, right?
That's the idea.
You can change it, change the passcode.
We have to enter the previous one.
And we can use a pin that Apple invented, which is six, right?
More likely than four.
But the idea is that we can go to this blue option, of passcode options, to basically choose other options, right?
We were talking about alphanumeric password, we were talking about four-digit code, or a numeric code, but longer.
And we can play with it.
This doesn't happen in Android, but it does happen in IOS.
And the idea is the following.
Let's see if we can get you to see it without unlocking, right?
And it's when the device is locked.
Excuse me.
Let's do one thing, I lock it again.
I'm going to try...
No, it's just that in this case...
Okay.
Why in this case, when I have an access code, it's not being locked?
What's going on?
This is also interesting.
You see that I lock it.
Okay?
I want to unlock it.
And it unlocks.
There are two temporizers to play with, right?
The state of inactivity of the device until it is locked again.
Okay?
This is important.
And then the issue of when it comes into play, right?
You see that it says, require the access code in 15 minutes.
I'm going to do one thing, excuse me, to make it easier, which is to put the language in Spanish.
Okay?
We change this quickly and so we can see that you probably have it in Spanish.
It's easier.
Okay?
So, you see in that option that we said, right?
Access code.
We enter.
And it tells me, how many times do I ask you?
Once it has been locked.
It's best if it was here immediately.
Okay?
So that as soon as I leave the screen, I lock the device.
Excuse me.
It's still...
Yes, well...
No, no, it's because...
Yes, one second.
No, but it's good for me because I just found out that...
She didn't like the language change, so now...
Android changes the menus.
So, this is crazy.
In addition, it depends on the version of the device you are using.
So, as you can see, before it was in the configuration part of the access method and now it's in the privacy section.
Here you have this switch, which is to show passwords.
And if you look closely, if you look at the screen, what it says is to show the characters briefly when writing.
And that option, by default, is active in the operating system configuration.
So, once the version is installed or configured, what you have to make sure of is that this switch is deactivated.
With that, when you type in the characters...
Well, something happens here too.
With this version.
You are going to see the difference.
Here we are.
The difference is this.
We are going to block it.
Here, in this case, in addition, if you are seeing, in addition to showing me the circle, it is showing me the character itself for a certain time.
Even easier.
So, you have to make sure, as you can see, that this option is disabled.
Because, in addition, the characters are kept on the screen long enough so that it is easy to point them out.
And the same with the pattern.
The pattern, when I mark it, the trace of the pattern is left and visually it is very easy to see it.
So, if you see the difference, for example, with the pattern...
I am showing you while IOS, while we change the pattern.
Look, in the case of IOS now, I have the device blocked.
How many digits is the access code?
Four, because I have four points.
This is absurd.
The logical thing is that an attacker could not know the length of my block code to be able to play with it.
So, all this, configure it properly through the settings so that there is no minimum length, if it is not a numeric password or even if it is only numeric but I do not specify the length.
So, an attacking potential has it much more difficult.
Okay, I'm going to show you...
With that option enabled, look at the lock screen.
Now I have replaced it with a pattern.
And look at what happens when I type.
Well, we have a problem with...
When you share the screen, you can see it here, but you do not share it here.
It does not have a camera on the device.
What happens with that deactivated option is that when I move my finger through my pattern, it would go... Raúl, wait a minute.
We have it very secure so that it locks automatically.
So, the trace of the pattern would appear, the trace of what is the marked line.
So, that option is one that you mainly have to deactivate when you install the device from scratch.
Moving quickly with that part, we are going to switch over here.
You will have seen it in other environments because we use access codes in many environments.
Also in cash registers, and they tell you to cover it with your hand.
Be very careful with the pins you use by default because in many cases they are known to be four-digit and some are the most used in statistics.
How many of you can tell me what is the code of that access door that is locked there?
What would it be?
Probably 3, 4, 5 and 6.
We are not sure.
It could be 6, 5, 4, 3 or another combination.
But, of course, that search space of possible patterns is greatly reduced.
It is a bit the idea we want to have in mind.
Then, that information that you can publish on social networks, personal information that is associated with the codes, other people can derive it.
I want to make a matrix for this, because the part where you think someone could unlock your device is the one we have told you that we have replaced with this part of the Nostradamus station.
Especially for those who are listening to us from home with the kids, it is important to make them aware from the first moment what is the responsibility of using a mobile device like this and not to publish or establish a code that is linked to them so that anyone else,
even without access to the device, can know it.
How many have you ever used as a code?
A date of birth of a relative, your own, an important date, I don't know, the day you gave the dog, information that you may have also published on social networks, not in that way, not saying my code is the birthday of my dog, but you have given me a dog.
Has anyone done that?
Typically, you have not raised your hand, but it is normal that many of us link the code to something that is related and that we know how to remember easily.
Until recently, when we wrote security guides, we recommended using passwords and complicated alphanumeric codes compared to biometrics.
And lately, what we have come to realize is that with all these configuration issues that mobile devices have, visual access is something that compromises a lot.
So, we have changed that recommendation and now what we recommend regarding the protection of the device is to establish a very robust password method that is not shared with any other service, that, of course, is not linked to the user in any way, but that you do not have to put it in many times throughout the day.
Because once you put it in, maybe a possible attacker, who may be around you, can see a fraction.
Once you unlock it, another fraction.
So, what we usually recommend is, just as you do not leave the lights on at home all the time when you are not there, turn off the mobile device when you do not have to use it for a prolonged period.
In that period, before unlocking it, a sufficiently robust access code is used and for the unlocks that will require some continuity, as I am here in the workshop or at work, I use biometrics, if you have it.
Why did we recommend biometrics before?
Because there have been many studies that have violated both the fingerprint methods and even Face ID itself.
I don't know if it's a topic that...
Let's see, it's what we were saying.
We have a lot of flexibility in things to teach you.
The idea is that it is a workshop and more interactive.
Are you interested in the subject of how to skip, for example, Touch ID or Face ID?
If you want to see it, there is a lot of interest.
Well, that's it.
We change and we see it.
Perfect, give me a second.
I put it here and we show you a couple of videos on how these methods have been avoided.
And you will see that it is nothing very advanced and it is still a possible option.
If we talk about movies, let's start with Touch ID.
The digital fingerprint reading in IOS.
And then we change to Face ID because it arrived later, if you like.
So, if we talk about movies, how would I get...
Imagine that I have to get access to a user's mobile device.
How do I get it?
How do you do it?
How do I get your fingerprint?
With jealousy I have to go for you, right?
How does it usually happen in movies?
Of course, wherever you have left it.
And what happens in the movies, for example, of James Bond?
I invite you to a whiskey, right?
And then you take the glass and the fingerprint is in the glass.
We can save the whiskey.
Don't worry, I'll tell you.
Where is your fingerprint?
In the device itself, that you are touching it all day, indeed, and it is marked there.
So, look, this attack...
Well, this is an important nuance.
This attack was made by a group associated with CCC, the Chaos Computer Club in Berlin, Germany.
Very well known, a hacking group.
They hold a conference every year at the end of the year, since a long time ago.
How long do you think it took to violate the iPhone's fingerprint reader when it was released on the first iPhone, which, if I remember correctly, was on the iPhone 5s, since the device was on the market?
How long?
A week, around here?
On the same day?
They had to go buy it, too, eh?
Of course, they didn't have it before.
But it is close, 24 hours.
It was released, if I remember correctly, on September 19th.
On September 20th, this video was already published, and so on.
Look at what they do, so you have it.
Of course, it is not complicated at all.
They have the phone, and as you said, the fingerprint is on the screen.
I don't have to invite you to a whiskey.
What do I do?
I use a standard HP scanner, which you can have at home most of the time, and I scan it.
I scan the screen of the phone to get the fingerprint.
A good recommendation is that you have to wash your hands often, for safety, so as not to leave traces of the pattern on Android, so as not to leave fingerprints on the screen too marked on iOS.
Do you see that there is a little clearer?
Well, with the video it looks difficult, but now they are going to increase it.
They are just taking a fingerprint that is on the screen.
They capture that part of the image.
They increase it.
There we have it.
And basically, two things are done.
A color inversion is done, so that it highlights more in black, let's say, the particularities of the fingerprint.
And now what they do is to reverse it 180 degrees, so that when I create the mold, the mold can put it on my finger and I can use it against the device itself.
They also reverse the colors to highlight white over black.
And here, 180 degrees, to be able to create a mold that can put it on the finger.
And basically, they print it on tracing paper, so that it is well marked.
And that's it.
This is the part where maybe we all don't have this equipment.
These people do a lot of biometrics, and that's why they do it.
They use ultraviolets on a PCB.
A PCB is a board where, now, due to ultraviolet rays, there will be radiation and it will be more highlighted.
Slightly highlighted.
What was the fingerprint.
The different identifying features of the fingerprint.
With that, what they do is, basically, let that PCB process, that material plate, so that the fingerprint is well imprinted there and with an acid, a small dissolution can be made and that 3D highlight appears.
Because, remember, what we are creating is a mold.
What they do now, sorry for the pause, is that they put graphite just to harden that mold, and I can use it multiple times, and now they are going to create the replicas of the fingerprint of the victim user.
And the replicas are made with white glue to stick the furniture.
Don't think about any advanced material or latex.
No, no.
White glue to stick the furniture.
I've done it.
I let it dry in my mold, and when it has dried, I carefully lift it up so as not to damage the fingerprint representation.
And I already have a replica of the fingerprint of the victim user.
And now we are going to see how they use it so that you can see that it works and that there is no cheating.
This is the victim user who is registering his fingerprint on the iPhone for the first time.
So, he has to put it on multiple times so that he can see all the contours of the finger, etc.
That's kind of the idea.
You see?
There is the contour part.
He is doing the initial registration.
And now we are going to see how the other user can identify himself as him with the fingerprint replica.
Here he blocks it.
And since it is the first time he accesses with fingerprint, it does not work.
He has to enter the backup access code.
And now, the second time, the fingerprint works.
Perfect.
So, he blocks it.
And now the user with the new fingerprint can access.
First, he has the finger diagonally and it does not fit very well.
He has to put it a little more.
You see?
And it works.
And now the fingerprint is removed so that you can see that this finger is not registered either and that there is no cheating and that it is a second fingerprint.
And in that case, it is blocked.
As simple as that.
A little bit with the right material.
And that's it.
And now we are going to show you Face ID quickly.
In the case of Face ID, it is a Vietnamese company that is dedicated to biometrics.
Who has violated it?
I just want you to see the mask with which they do it.
I do not know if you know it, but the idea of ​​what Apple says in its implementation of Face ID is that now we have this super-advanced front camera on the iPhone which is capable of detecting 30,000 points of your face by infrared in 3D and with that get a representation of your face.
So, one thinks that with the 30,000 points you have to make a mask that represents your face very faithfully and so on.
And the curious thing you are going to see in this attack is that it is not like that.
This takes a minute, it is very fast, much faster than the video.
Look, the mask that these people have created only needs to have your representation, it has to be in 3D, but basically it focuses on the eyes, nose and mouth.
That is to say, the 30,000 points end up limiting, as you can see there, the mask has unlocked the device and now they focus it.
For you to see, it is basically that representation of some characteristics of your face.
That is what is quite curious to take into account.
So, I think now, just at the end of the video, because you see it a little closer, especially the part of the mask, you see?
Basically, it is eyes, nose and mouth.
Of course, with this, you say, how do I get eyes, nose and mouth of a possible victim?
But today, with all the cameras, you will have heard a lot of news, countries where there are more and more public cameras recording you, facial recognition and so on.
With a few high-quality photos, it is very easy to make that 3D representation of the face.
Before leaving the subject of the lock screen and so on, and on the part of securing it, have we all ever had to lend the device to someone?
And in fact, especially in families, maybe you have to entertain the child in some way and you say, come on, give me the device, I'm going to look for a video on YouTube, or I'm going to do this thing.
Or a person who, eventually, on the street, you see in trouble, and you say, an older person, oh, I've fallen, let's see if you can let me call, I'm out of battery.
Do you know how you can temporarily lend the device to someone, making sure that he is not going to do anything more than what he says he is going to do?
And without being able to skip that screen?
In iOS or Android?
It is basically a kind of, you will have seen it in other environments, a kiosk mode.
A kiosk mode, that is, to turn your phone into a device that acts in a kiosk mode.
That is , if I have to leave the YouTube to the child, then I can't leave YouTube or the person who has to call by phone, who can only call by phone.
Well, Android has been including it for many versions.
I think I remember that it was already in 5, if not in 5, in 6 for sure.
And they have included it in this latest version, in version 13.
So, I'm going to show you that the Android version, the functionality is called, set screen.
Does anyone with the name of set screen know it?
Well, in the settings menu, I'm there.
If you go to the security part, and you go down here a little bit, let's see...
Yes, I'm going to look for it directly, because as this phone...
Okay, security, set screen.
You see that here the switch is activated, okay?
And I have, of course, to ask that when the screen is stopped, it requests the access code.
So, what happens when I have this menu configured?
If, for example, I have Chrome open, and what I want is that they can only use the browser, what I have to do is slide the start button...
Sorry, my phone is jumping.
I have to slide the start button up, and here it appears at the top of the menu.
If I click here, it will tell me...
Sorry.
I click on
a menu that says, the screen remains visible until you stop looking at it.
What would happen with this?
If I interact with the device, I try to do anything, go back, click the start button, it would appear with the start button.
Keep pressing the start and back buttons, okay?
Which is what I would do, because as you can see, I interact, I can't do anything with the device.
To get out of this application...
To get out of here, I would have to come and press both sides, okay?
Oh, it's gone.
Back and start, back and start.
Well...
To get out of...
It's just... wait a minute.
As I have it there...
The idea is not...
Yes, I want them to see it.
With back and start, there it is.
You will see that having given it, it shows me the lock screen and I need to unlock the device to get out of that mode.
iOS 13 has included it here in a slightly strange way, because it has put it as an accessibility feature.
And they call it, it's super complicated, the guided access.
So, the guided access is the one that keeps, as you can see there, the iPhone in the same app, so that you can control which functions of the device are available.
So, in this case, for example, if we open the browser, and I click here three times, well, in a prolonged way...
Oh, the Siri.
Forgive me.
I'm going to support it.
Let's see if I've got it.
Wait, we've put the option right.
Accessibility.
I hadn't activated it.
In fact, here you can define the code, a specific code that is not your own access code, or, for example, in this case, the Touch ID.
Since I don't have it configured, let's configure the same one we have.
It shouldn't be the same, I'm telling you.
And now, when I come here to Safari, and I click the start button three times, I click here to start.
And at this point, if I did anything with the device, it wouldn't let me, and it would keep me all the time in that part of Safari.
Okay?
Yes, then clicking again three times.
Clicking three times, it would ask me for the code I had configured.
To get out of the mode.
I could get out of here.
And it also has a function that I find very interesting.
I don't know if you know it, it's the restriction function.
Has anyone heard of it?
This option is also very interesting, because what it allows you to do is block what settings you have available to configure on the device.
And I also don't know why Apple hasn't made this function more visible.
It also has it set within the use time characteristic that was invented in iOS 12.
The end-use time basically allows you to set limitations in the use you make of the device, at the level of how long you are connected to the screen, how long you use social networks, and so on.
They also added parental control so that if the child has a device, you can tell them that they can't be on social networks for more than an hour or that they can't use the device for more than X amount of time.
And within this functionality, they added restrictions.
So, within the use time, by activating the switch, what it allows you to do is configure what things you want to be active within the settings menu.
So, for example, if I tell it that it doesn't allow me to change the code, it wouldn't allow me to change the code within the settings menu.
I'm going to set it to not allow.
We recommend, of course, not to allow changes to the code or changes to the account.
Why?
Because this is like a double authentication factor.
In order for me to be able to change my access code or a change in the account, I need to enter this other second code.
So, we are going to put, for example, this, not allow.
And well, this is the principle.
The idea would be that.
Let's go.
There are a number of options.
We would define the code, sorry, just to show it quickly.
Raúl, that's it.
So, now, when I access the settings menu, we are going to block it.
Okay?
If I try to access the security menu.
Well, in fact, I don't have it anymore.
Because as I have disabled the ability to change the code, as you can see, it doesn't appear.
So, if someone took my device away and managed to steal my access code, as I would have done with you, you would be sure that you cannot register a fingerprint or change the code because the menu will not be available.
So, we find it a very interesting security option that, for some reason, Apple does not have it documented in this way.
For families and others who may be watching us via streaming or who see the presentation later, we certainly recommend that parents configure this.
Because for parents, not only for the children, but in general, because you lend the phone to the child who cannot change the user account, he or his friends.
The little ones don't usually do it, but the older ones do much more complicated things.
And here I think that...
I would also like to comment on one thing.
We wanted to focus a little more on the lock screen, but in order not to focus only on that, it is quite important that you control that you do not have the notifications active on the lock screen.
And not only for privacy reasons.
It is very typical that everyone has the notifications active and you see quickly with your phone, without having to unlock it, what messages are coming to you.
On the one hand, it can be a commitment to privacy, but on the other hand, don't think it's just that.
Recently, we have violated a device that was protected, even with what we call an MDM,
a fairly important business management system, because the notifications were active on the lock screen and they also enabled an option that Android leaves enabled by default, which is to connect to Wi-Fi networks, that is, it shows you the availability of open Wi-Fi networks.
So, combining those two elements, it showed you the notification on the lock screen.
Oh, here is an open Wi-Fi network.
And the quick actions menu is to connect.
So, from the lock screen, on a device that was ultra-secured, we were able to connect to our own Wi-Fi network, which we had, of course, defined, and start launching MDM attacks.
So, even though the device was super-blocked, from the point of view of internal configuration, something as stupid as leaving the notifications, the active content on the lock screen, allowed us to violate it and build a good story.
I'll finish with that.
With this, we can tell you more things.
Now, if you are interested, we will tell you more.
Basically, this also happens a lot when you are going to pay and someone is putting their PIN on the card, on a dataphone that has no earplugs, and you are looking at the code and you say, no, no, I don't want to open it.
So, with this, we want to make it clear to you the methodology of a hacker, which is basically what Monica did before.
Observe, analyze, act, and with that, get the data you need.
And, well, hackers don't sleep much because they are also all day researching new things and technologies and so on.
And they leave their devices unlocked because they have fallen asleep.
How can you protect yourself from this attack, that someone sees you?
What comes to your mind?
There is a fairly traditional option that works well.
Apart from covering the screen a little bit, it is turning the sweater a little bit and basically putting the access code inside the sweater.
If the wool is fat, it is going to be difficult for you to access it.
Well, can we do a...
No?
We pass?
Well, it was also a little bit to test you on the part of what you think is more interesting or safer, a pin, a pattern, a password.
We leave you some statistics, basically.
A pin is four digits, there are 10,000 combinations.
If there are six, there are a million, basically by combination.
An alphanumeric password, numbers, letters, and so on, capital letters, lowercase letters and numbers, we go to billions.
And that is where the difference is.
And in a pattern, there are also different combinations.
For you to get an idea, a more or less six-point pattern would be more robust than a four-digit pin.
It is a little bit because you get that idea in robustness of 10,000 versus 26,000.
We would be there comparing those technologies.
It does not make sense to spend more time on the subject of passwords.
What do you think about this one?
Do you want to see other methods to get the password?
I think it is interesting.
Are you interested in the subject of the password or should we change the subject?
Do you like to see more options?
I think it is something we all use on a daily basis, in the access code, and it can be interesting.
We are going to show you and here you have to guess how it was obtained.
Then we will give you the references of these videos and so on.
It is how the following code of this victim was obtained.
So, I put it here and so you see it.
Basically, it is the supposed attacker who is going to try to obtain the code of a victim.
We are without audio, but I will tell you.
Basically, what it means is that I'm going to enter the store, I'm going to buy a product and there will potentially be another victim user who is buying in the store, paying with his credit card and I'm going to try to get his PIN.
So, this is the victim, this girl, you see that she is paying on the dataphone as we usually do, and the attacker, you see that he is with the Coca-Cola behind and look closely because he is going to launch the attack.
Let's see if you see how he got the PIN.
There he already has the victim's PIN.
He already got it.
How did he do it?
Let's stop there.
How did he do it?
Of course, he is recording with the camera, right?
But the victim has already left.
Notice that in time, he was not recording when the victim was entering the PIN, right?
It was a bit like you said before, you recorded the screen, right?
It is a very common technique nowadays.
No, no.
Normally, the dataphones have NFC for contactless payment, right?
They have wireless technologies of short range, but of course, look at what would happen with the technology if I could go and read the text of the previous user, right?
There we would have a serious security problem.
More ideas?
The heat.
Look, he has a mobile with a camera that is recording the PIN, the keyboard of the dataphone.
It is a thermal camera that I can adapt to the iPhone in this case.
For a cost, I think it appeared 200 dollars or something like that.
It is a thermal camera.
It detects temperatures.
So, if someone has been sitting on the sofa, I detect that someone has been there a moment ago, right?
Logically, the thermal temperature the temperature on the sofa is dissipating over time.
So, if the person gets up, he still has a lot of temperature, after a while, that temperature is decreasing over time until it dissipates, right?
And the whole environment has the same temperature.
That happens on a lot of surfaces, depending on the material, where that thermal footprint is.
So, of course, what happens in a PINpad, especially in a dataphone, especially those that are made of plastic?
Well, look at the thermal camera.
And the interesting thing about this, as you can see, is that in which order the numbers have been pressed.
Of course, and the last one, which is 5, is the one that has more heat.
And now we have an advantage against the wear of the door buttons, right?
Where there were several possible combinations.
Here, the order is quite wedged.
We are going to cut it here, because you see what the idea is, right?
So, depending on which surfaces retain less heat, a metal keyboard dissipates the heat and therefore is less vulnerable.
How can you protect yourself against this technique?
I, since, let's say, I saw this type of attack years ago, well, go ahead.
Let's see, you could wear gloves.
In summer it's a bit complicated.
But, indeed, they don't transfer the heat.
One option is...
But you are already thinking with the hacker mentality, which is what we want, right?
How do I not transfer heat to the keyboard?
Well, I put something in between, it's an option.
What is another option?
Because I refuse to wear gloves in summer.
It's back there.
What?
Well, exactly.
I could press with a...
as we had before in the PDAs, a pencil, which is made of another material and does not transfer any heat.
What happens if I bend with the stick?
It's a bit complicated too.
Yes, it's the same, the cashier or the cashier kill you, right?
Because he says, what are you doing here generating queues in the supermarket?
But it's an option.
I wait a little longer for the heat to dissipate.
But I can do the opposite, look.
What can I do?
Of course, generate a lot of heat.
Generate noise.
And that's what I usually do.
I'm going to pay with my card, and what I do is that I touch all the buttons and now guess which one it is, okay?
I have pressed four to put the pin, but then I touch the rest, I generate noise, heat, and then with that I prevent you from knowing which one it is.
Sometimes they look at you badly.
Yes, they look at me like, what is this guy doing, touching everything?
But they haven't stolen the pin from the card yet.
But we are doing well, okay.
So, that's the idea, that you open your mind to defense and attack alternatives.
And above all, when you leave this workshop, which is something we insist on a lot, you already measure the world in a different way.
I mean, probably there are things that we have been telling here that you would never have thought of, because maybe you had never approached certain problems outside of what this is meant for, but you don't know how to think and how else it could be used.
So the hacker mentality is I know that many other things can be done that are not those for which the device is designed, so I'm going to know the device well to know better than anyone how they can violate it and protect it.
Okay, so we don't steal a lot of time, maybe we do the exercise or we leave it as an exercise for home.
Let them try it.
What do you think?
Or we do a small part, right?
Well, okay.
Since they are very scattered, it will be a bit complicated.
The idea here was to assume that now your device is blocked.
We'll leave you there for a minute, we don't want to waste so much time.
Your device is blocked, you have an access code.
What could a third party do if they get physical access to the device, even for a moment?
So, with this, what we like to do, and it's your turn, if you have come with acquaintances of some confidence, because I wouldn't lend my mobile to anyone here, is to leave your mobile for a minute between you.
If you come in pairs, you exchange it.
If you come in three, you rotate.
If you are even, you exchange it two to two.
If you are odd, you make a circle and you exchange it.
So, look at the blocking screen of the other user and see what things can be interesting for an attacker.
If you have come alone and so on, do self-criticism.
Look at your own screen, analyze it and see what things are there.
Go on.
The camera.
This is super interesting.
Besides, I get angry.
If I get upset, you calm me down.
Because we have been with Android and with iOS for 10 years, each of us, and Apple and Google have not yet removed this functionality.
And I really do not understand it.
We are almost in 2020.
Please, gentlemen of Google and Apple, if you see us streaming, is it so hard to go to the device settings and put an option that says if I want to have or not the camera on the lock screen without having to enter the access code?
Okay, let's think about it.
What could we do with the camera?
Here I would have to start thinking.
Many times this hacker idea is used by us as professionals.
We do audits, intrusion tests and so on, with the offensive part, to show a company the risk it runs, for example, with certain vulnerabilities in technology.
So, here you have to start thinking maliciously.
It is not about doing anything illegal, because you are doing it with the company's authorization, but I have to show that there is a security risk here.
So, start thinking maliciously and think what we could do with the camera.
Of course, can I access the existing photos?
No, fortunately, I cannot.
Tell me, tell me what it depends on.
Okay, I give you the nuance and you correct me if I am wrong, okay?
What is it?
Yes, from a long time ago, old Androids and so on.
Normally, what happens today is if I access your device, I go to the camera, I cannot access the previous photos.
But if I start taking photos and videos now, I can access them.
But they are the ones I have taken from that moment.
That is the usual.
It is true that with so many versions of Android models and so on, and facing the past, you can expect anything.
You say, well, I cannot access what exists in the device, but what can I do?
Scan one?
Exactly.
Right now, the cameras are already very smart and, one, they let you scan Wi-Fi QRs and they connect you to the Wi-Fi network.
I mean, I connect you to a malicious Wi-Fi network by scanning a QR.
I can scan QRs with URLs embedded so that it tries to start the navigation to that malicious web address.
More things.
Something even simpler, even though they do not manage QRs.
There you should see it.
In each case, if I take a picture, do I have another functionality that allows me to share it or send it by another method?
By a multimedia message, WhatsApp or Telegram, some messaging service or Dropbox type and cloud storage services?
Normally, Matizo, the sharing function you can start it from the lock screen, but you need to enter the access method before you can formalize the sharing.
But yes, indeed, the sharing option is available to launch it.
Something that hackers don't like if you are doing things in style, but that could be done to annoy.
No, but at the level of the camera, I mean.
They are denial of service.
And what could we do?
Of course, how?
A video?
I put a video to record, I leave it recording until the memory is full.
What happens when the memory is full?
Well, we will see how the operating system responds.
But to put this in context, if I know that the director of a company is going to have a call at 12 o'clock because he is doing a purchase at the level of acquisition of another company, of millions, at the business level, and I can leave his phone recording a video so that it is saturated,
it restarts and the memory is filled and it does not receive the call that I was expecting from the business to make this purchase, the impact is brutal.
Because the camera is there and I can record a video.
Put it in another context.
Photos.
What happens if I take the phone of an employee, I take a photo of some confidential documents that he should not have on his mobile device and now I filter a snippet of I think the employee is competent, filtering confidential documents because I think he has photos on his device.
A forensic analysis is done on his device and photos of the confidential documents appear.
We have a serious problem.
These are the kind of threats that normally seem light and they are not.
Ok.
Anything else besides the camera?
Have you seen the lock screen?
What can you do?
Sorry?
Yes.
All the functionalities, right?
It is an Android call of what you are telling me.
Ok.
By default, both Android and IOS have active in the case of IOS, what is called the control center.
In the lock screen.
And in Android it is called the quick settings menu.
So, what happens?
From the lock screen...
From the lock screen, anyone who has access to my screen already has access to...
Simply by sliding down I activate the Wi-Fi or deactivate the Wi-Fi, the data interface, Bluetooth, put the device in airplane mode.
So, what risks does that have?
Have you ever locked your mobile and had to use the remote location capabilities?
Yes.
So, what does it mean if an attacker can disable the data connection?
It is taking away that functionality.
So, very important.
The quick settings menu, in Android you have to customize it so that it does not show us those icons on the lock screen.
It is more uncomfortable.
Yes, because when you want to activate or deactivate the Wi-Fi, you have to go in.
But I say the same thing.
You don't leave the car open so you don't have to take out the key when you want to get in it.
So , keep in mind that the mobile device is much more important than anything else.
So, even if we have to sacrifice usability, we are going to make sure that we are protected.
In iOS, the same thing happens.
The control center...
Yes, here I have it enabled.
In this case, it is the place from top to bottom.
It is from bottom to top, but look, by default, all the options.
In fact, in iOS 13, if we make a long press, another menu appears and here it lets us manipulate AirDrop, the Bluetooth issue and so on.
So, do you know how to configure it so that this is not the case?
Has anyone ever played with it?
Yes?
Come on.
Yes.
Typically, in Android, even in previous versions, you had to activate the development options and it was a little more complicated.
But in the latest versions, it is as easy as hitting the pen and that's it.
This one that appears here.
The one you see here.
It asks for the code logically and with that you can edit.
But as Monica emphasizes, here I can add or remove icons and functionality, as you said, but as we said before with the camera, this has been until very recent versions.
If I remember correctly, it was between Android 7 and 8 when it was possible more or less to start customizing this.
It was possible before, but as I said, you had to enable the development options, which was a hidden menu that was not accessible for the user at the normal configuration level.
And in iOS we have the same problem with the control center, right?
Yes, you have seen that I have enabled it.
I didn't have this one.
It was in Touch ID and code.
We put the code and this one had it protected and below, a little below, there is the control center.
So, what do we recommend?
Disable both the control center part of the lock screen and the notification center, so that we don't get sensitive notifications.
And from the point of view of the control center, there is also an option that is within the settings of the control center.
Yes , sorry.
I touched it just here for a second.
Yes, here.
It allows you to customize controls.
And put and remove them.
The problem with them is that there are some that you cannot remove, even if you want to.
There are some that are by default.
So, what we recommend is to completely remove the control center from the lock screen.
Above all, all those who use biometrics, it costs you 0.
I think that is the critical point.
Until a while ago, when there was no biometrics, the ability to quickly make actions on my mobile phone without having to insert that super secure and secret password that we were using, well, I didn't want to do it.
I wanted to be able to act quickly.
With biometrics, there are no excuses.
With biometrics, we are going to make the change.
One thing...
How do you have...
We are going to do a...
We are going to ask you a question about...
We are going to skip for a little time and things that we wanted to tell you.
We are going to move on to some things.
This is all we have seen on the lock screen.
Quick adjustments, control center, camera and others.
And some things that I told you, Monica, before.
Look at the screen.
We also talked about the part of disabling biometrics.
And well, we leave you as an exercise to protect you.
What is the objective?
To dedicate a little time to the adjustments and see what things I could remove to make more robust the access to my device.
That's the idea.
In fact, there are other vulnerabilities that have arisen.
We don't want to get too involved.
All the resources we have there will be available to me at the end of the presentation.
Now we see at the end the link.
Yes, where they are.
Does anyone know what this is?
Yes?
Cabled.
Very good.
In Stockholm, indeed.
And this is how they physically cabled the lines of the houses.
From a tower that practically covered the sky of Stockholm with the thousands and thousands of cables that went to each house.
Of course, this is unthinkable with wireless technologies.
The wireless technologies that we normally don't use are WiFi and Bluetooth.
Can you check if you have WiFi and Bluetooth enabled?
Please.
On your devices.
I mean, if you go to...
Well, normally, right?
How do you get to Android and iOS?
It's easy.
You go to settings.
There is usually a network option, communications in the case of Android, WiFi or Bluetooth, and you can put it.
We start with Bluetooth and then WiFi.
So, if you go through Bluetooth, you have it enabled, you can discover other devices.
In Bluetooth, how is it?
Tell us.
What do you see?
You go to settings.
Did you have Bluetooth enabled?
Some did, others didn't.
Nowadays, with the idea of smart watches and this kind of thing, it is more common to have Bluetooth enabled.
If you go to settings and so on, what happened when you entered?
Javi has an MI5, right?
And there is also a Redmi in the room.
What's going on?
Who is Javi?
The one with the MI5.
What happens is that you can launch with a USB device, from, for example, Linux or Kali Linux.
Note that the USB device is this.
Yes, this red device has a cost of 30 euros, with external antennas and a lot of range.
And in this case, because it is red, but if it were black, it would have gone unnoticed.
Yes, what it allows you is to make Bluetooth scans when the devices are visible.
And this is something quite curious, because nowadays, both Android and iOS, just by entering the Bluetooth screen, it starts to become visible.
So that you discover others, but others discover you.
And with that, there are already enough attacks, because we already have the addresses, we can enter these devices, see all the details and so on.
In this case, we do not have much Bluetooth activity, so we have seen a couple of devices.
How about Wi-Fi?
Do you have Wi-Fi enabled?
My question would be, why do you go with Wi-Fi enabled for life?
In this case, because maybe you are using a Wi-Fi network here, right?
But what happens when you leave the building?
Do you always turn off Wi-Fi?
Do you always remember when leaving the office?
Of course, the problem is that it is very difficult.
And what has happened with Wi-Fi?
Well, the following has happened.
While we were having the talk, we can perhaps say that the AU, which I imagine will be Laura, has an MI9, or someone has connected to Laura's MI9, or that there are people from the university because they connect to Eduroam, or maybe the Castillo 5G sounds familiar to you,
or other things, or Direct Guion, or Yolanda's iPhone, which is also here, or has been.
Yolanda's iPhone, Yolanda has recently joined, because she wasn't here before.
Yolanda's iPhone is very active, by the way.
Yolanda, be careful to see what's going on.
Ok, the Viestar A758 network may sound familiar to you, because it belongs to someone at home or to a relative.
NFB may also sound familiar to you.
Yes, ValeCorp, ValeCorp, Spencat, as possible Wi-Fi networks.
There have been some interesting ones before.
Logically, Wi-Fi and CyberCamp.
I'll show you some interesting ones here.
The OhMyWeb, OhMyWeb External, the Blue Web.
Sometimes here you find two things that it's better not to find.
What happens with all this?
Basically, your devices, there's another one here, ValeCorp, maybe it's a corporate Wi-Fi from a company.
Basically, all we've done is take a Wi-Fi interface with its antenna, an adapter, connect it, start capturing the traffic of your devices that are eager to connect to the Wi-Fi networks they know.
This is known as the PNL, the Preferred Network List, the list of preferred networks that your device has been storing since the first day you started using it in all the networks you have been connecting.
And from time to time, it searches those networks.
And that also has many implications, because an attacker who may want to know where you frequent, especially for people who may have children, can know where you go, if you connect to a network of an institute, and get a lot of information, even triangular,
because nowadays there are Wi-Fi network maps that can be consulted.
So, you can know if you've been in a place you shouldn't have been.
So, all that information, without you being aware, your device is revealing it for the mere fact of leaving home with the Wi-Fi active and entering a range where it can be captured.
Does anyone know how to avoid this?
Apart from turning off the Wi-Fi interface.
If you are not interested in knowing if you have been in a specific Wi-Fi network, how can you do it?
Do you do it regularly?
Do you delete the Wi-Fi network when...
No, right?
Deleting it is also killing flies.
Deleting it from a conference...
Imagine, here you have...
CyberCamp 2019.
When CyberCamp ends tomorrow or Saturday, I can delete it because the event is over.
And we take the opportunity to say that you must delete it.
Sure, but the Wi-Fi network from the office, from home, etc.
I don't want to be deleting it and adding it frequently.
This, as Mónica said, I give you an example of the many we have seen involved.
I remember a case where we did an intrusion test and we followed a directive and we located where Rotterdam lived, in Holland, a company with authorization, logically, in an auditorium, based on that.
Based on the fact that it had a very unique network name that we could search in these public maps and it was identified in a specific geographic point of the planet.
That is the interesting thing.
Before, Marime was also here with her iPhone, which was very active at the beginning and then it disappeared.
Envex too.
The idea of this is, on the one hand, never configure the Wi-Fi networks as hidden because that necessarily makes your devices have to be searched and uncovered.
Don't configure the networks as hidden.
The level of security that a hidden Wi-Fi network gives you is minimal and exposes mobile devices.
And then, let's remember to delete all those that we can not have to connect to them again.
Especially because a risk is when an attacker puts a Wi-Fi network that can emulate the one you have previously connected.
In this case, you are absolutely right.
We don't have time.
We are just opening our eyes, being careful that your device is creating these networks.
But what happens if I take it and the network that it puts there, Envex, raises an access point and I call it Envex?
Because the device that was looking for it says, if the Wi-Fi network that I was looking for is here , I'm going to connect.
And from there we launch attacks, even if the network has a password, to try to obtain an exchange of plots with the device that allows us to get the password.
If the network is open, end of the game.
The device has already connected and shares the network with the attacker.
And once that happens, for people who are less technical, what can be done is the attack of Man in the Middle, which is basically you are in the middle and you can manipulate the traffic between the device that generates it and the device to which it goes.
Okay?
We don't want to steal much more time, so what we are going to do is close some conclusions, right?
Basically, to sum up, we have seen the wireless part, the remote management part that Moni mentioned before, and we had some extras here, like Comodin, to tell you things.
Especially those of you who are younger, who have not known things that some of us have seen, be aware of what we have in the mobile device today.
For the elderly, this is where this will satisfy you.
Remember all those extras we had, like VHS, cassettes, and microphone recorders, and even the more traditional GPS , speakers, watches, compasses, radios, etc., that all that is already in the mobile device.
In your digital life.
This could be worse.
I still do not understand if it is so essential to have the smart fridge in the fridge, so that when you are in the supermarket, you can connect to it remotely and it will tell you that you have two eggs left to buy a dozen.
But it is already in the market, so people buy it and this type of device is often used.
Do you know what this is?
A Raspberry, a Raspberry Pi.
And why do we bring it here?
Because you probably have it at home, right?
Some of you play with them.
Be careful, because NASA got it for having a Raspberry Pi that was lost there.
They did not have an inventory and did not know it was there.
It seems that due to a problem of credentials, that is why it has come to us, but basically this is the idea.
In June 2019 it was published, and it looks good, right?
That someone entered NASA's ACHORRO propulsion laboratory.
There must be interesting things, right?
The attack came in April 2018.
In other words, with this type of attack what happens is that the attacker gets in, nobody finds out, he is there for 10 months and starts taking out files.
He took out files from missions to Mars and jumped to other networks, as I am told in this name, and I say, this network must be the deep space network.
The Deep Space Network.
And you say, there they must have the information of those galactic elements, black holes and such, of the most interesting.
Well, an institution like NASA, how could they get in there?
It is not the first time.
There was a certain Jonathan James who hacked NASA and the Pentagon years ago, but he ended up in jail, right?
And there is a well-known cyber-scammer in Spain that you can look for the news, who has brought the forces and security forces of the State from Quebradero for several years until they have hunted him down.
Objective with all this, a hacker is not a criminal, so you do not end up in jail.
The idea is that you can play with the technology, test the technology, see how it works, violate it and so on, without doing anything illegal, with authorization, with your own technology, etc.
So that is the important thing.
And although we should not say it, if there are children listening, the only difference between a computer criminal and a normal criminal is that probably the computer criminal, when he gets out of jail, will be rich because he will be hired by many technology companies to secure his systems.
But you do not end up in jail.
You do not end up in jail.
Recommendations to finish.
We must know the technology from a very young age.
And do not do the abstruse.
I do not know it and I do not want to know how they can attack me and so on.
It is an important part of our life.
Let's know it, let's protect ourselves.
That is the idea.
And let's consume it with responsibility.
The idea here is that you will end up watching government campaigns about protecting your devices at home and so on.
There are cases that isolate your devices from radio frequency communications, GPS, mobile technologies, 2, 3, 4, 5G, Wi-Fi, Bluetooth, so that there are no modifications.
There are USB condoms, that is, they basically isolate the data connection and only give you electricity.
This is important when you need to charge the battery and you click on any USB you find there.
You do not know if behind the USB there is only current or there is a computer that can make data communications.
And in some countries, they are ahead of us, because in the Eastern countries, children come with Wi-Fi and everything, so be careful with that part.
You do not have to be paranoid either, and put on the aluminum hat, so that my brainwaves are not intercepted.
The idea is to learn about technology and get to know it.
References, we have left you this link, which is basically bit.do hacker for a day, with underlined, there you have more references, music related to a safer network, references to guides.
I imagine you all have WhatsApp, unfortunately, so you have guides to protect WhatsApp too, right?
How do I verify if a contact is who says to be, how do I put a second authentication factor, right?
You have all those guides there, we leave you some references.
Thank you very much for having attended, both those of you who are streaming and those of you who have come locally, and we hope you have benefited from the workshop.
Thank you very much.
Any questions?
Thank you.
Questions, comments, doubts you may have, now is the time too.
Yes.
I found that one.
Good, good, good.
Has anyone thought of it?
Yes.
There we are.
Very good, very good.
You can make three very thin and elongated lines so that all the points can cross slightly and solve it.
Could it be solved easier now that you have already opened your mind with this?
Yes.
Exactly.
That is the idea we wanted that at the mental level you open your mind.
What happens if I make a line with a very thick marker and with a single line I cross all the points?
No one has put restrictions for me.
There was no limitation in the statement.
Exactly.
Phenomenal.
Keep researching technology, thinking in a lateral way.
And we encourage you, if any of you are interested, we are collaborating with the organization of the cyber camp hackathon.
They are exhibiting very interesting projects.
People who are developing open source projects.
Tomorrow is the final.
They are going to make their presentations in this one.
From 12 to 3.
And very cool things are coming out.
So if you are going to walk around here, we encourage you to stop by and see what people are doing who already have a lot of experience and above all want to contribute to the community.
Thank you very much.
More questions?
No ?
Very good to remind you of the points.
Perfect.
Thank you very much.
See you later.
Bye.