Thank you very much, Sere, for your presentation.
First of all, I am delighted to be here today.
It is a pleasure to be in my home.
In this event, I would like to thank CyberCamp, Tatiana, and all the organizers of CyberCamp for making it possible for me to be here today.
Although now I live a little far away, in the United States.
I have been living there for four years, but the rest of my life I have spent here.
So, when I was called there before the summer to say if I could be interested in coming here to give a talk, I did not take long to say yes, of course.
My name is Ismael Valenzuela, as you have heard.
You can follow me on Twitter.
I try to be quite active there, so you can also use it during the presentation.
And, well, I have been dedicating myself to this for almost 20 years.
In this same city, not far from here, I started to set up a company together with other people, of whom we will talk a little later, so that all the talent here in Malaga is known.
And over the years, they have been working on many things that may sound familiar to us, but we do not know where they come from.
We are going to give a little bit of voice and echo to all this.
And I started this in 2001, and since then I have been practically dedicated to security.
Now I work for McAfee.
I have been working with them for more than six years, the last four in the United States.
And basically what I want to tell you a little bit today is not only my experience, but through the experience that I have been able to have during these years, to tell you some of the things that have worked for me.
And I hope that for many of you who are perhaps interested in starting in security, or maybe you are already doing some little things that can help you to restart your career, or see some other perspective, some other things that you can do.
One of the first things I want to tell you is what meaning I want to give to this word hacker.
Because you have seen, the name of the paper is how to hack your career in security.
And the truth is that the connotation that the word hacker has today is a little...
It is very different from what it originally had.
When we talk about hacker, it seems like it is understood as a person, a criminal, practically.
It is what we use to define someone who enters another computer, another system, a company, to which it has no authorization, and that, well, steals those data and uses it for illegal purposes.
But really, the original definition of hacker was very different.
Very different.
I recently had the opportunity to attend a conference with Walter Isaacson, who wrote a series of quite interesting books.
He is a well-known journalist in the United States for having written the biography of Steve Jobs.
And in this book, Innovators, he talks about the people who have really created this industry, computing, microchips, computers, Internet, people like Tim Berners-Lee, people like, for example, Bill Gates, John Von Neumann or Ada Lovelace.
And he explains how these people, originally, were hackers.
But not hackers in the sense of entering other computers illegally, but hackers in the sense of doing things that seemed impossible.
Really ingenious people.
The word hacker really comes from a group of what we would call today freaks or geeks, who belonged to a club of electric train models in the Massachusetts Institute, at MIT, next to Boston.
And in the 1940s, this club that was dedicated to making train models, and they were seeing all these little things, there were a number of people who were basically only concerned that the trains looked good and that everything was very nice to be able to boast about all this.
And there were people who were more interested in seeing what was happening just below that model.
What do you think was happening just below?
The cables, the switches, all the electrical part.
There were no circuits as we know them today then, but all the part of how those trains worked.
All that curiosity is part of the hacker philosophy.
Knowing how things work, disassembling them, reassembling them.
And they called what was a hack, a trick, something ingenious.
Something you could do that maybe wasn't elegant, but made an object that wasn't designed with that purpose work in a different way.
Sometimes even jokes related to this.
For example, a person that I've had the pleasure to work with in the last years, with people who worked with her in the 1940s, Grace Hopper, they called her Amazing Grace, or the Incredible Grace.
She is known for being the first person who invented compilers.
For those of you who are studying programming and use a compiler, think about it, the first person who invented compilers.
Grace Hopper.
A mathematician.
In the 1940s she worked with Harvard University.
And you could say that she really reflected the original hacker spirit.
Look, at just 7 years old, she went around her house disassembling the clocks she had at home.
Do you know why she disassembled the clocks?
To see how they worked.
She wanted to know how those little hands worked, what was the mechanism, to be able to disassemble them, to reassemble them.
Her mother says that when she had already disassembled 9 clocks, she told her daughter, no, no, stop, stop, I'll explain to you how this works.
And one of the things she usually said was that, she said that one of the things that damaged society the most, and we can see it here, is to think that things have always been done the same way.
And that when something has always been done the same way and it works, don't touch it.
Have you ever heard that?
If something works, don't touch it.
She said that this is one of the things that damages society the most, in the sense that we have to try new ways of doing things.
That's where innovation comes from, creativity.
Not to be satisfied with how something has always been done throughout life.
And one of the things she says here, and one of her most famous phrases, was that to realize this and force herself to think in a different way, she had a clock on the wall whose hands went in the opposite direction.
To be able to realize and think, reflect on this.
Part of the hacker spirit, and part of what led her to be known as a bit of a rebel, was because she always went against the established.
At 34, she joined the US Navy, weighing 7 kilos less than the minimum established, for anyone who joined the Navy.
Really an interesting person.
And if you have the opportunity to read this book, Innovators, it's quite interesting too.
But the truth is that this romantic definition, in a way, of hacker, is not the one we have today, right?
Today the definition of hacker is something else.
We think like this.
Something that creates a bit of both fascination and at the same time a bit of fear, of thinking that there are terrorist acts behind this, some governments with not very good intentions, industrial espionage, the well-known ransomware, perhaps some of which we have had to suffer in our computer systems,
military groups, criminals, the famous APT's, or Persistent, Advanced Threats, all kinds of things that perhaps we are starting to hear more and more in the news.
We live in a very interesting time, in which there are journalists dedicated exclusively to cybersecurity.
Here we have, for example, the blog of the famous Brian Krebs in the United States, who is always sharing news about criminal groups, advanced attacks, etc.
Now, for example, since the last few years, it is common in the news every day.
I live in the United States and it is impossible to turn on the news without them talking about something related to the elections, something related to governments that are interested in modifying the election results or this issue of hacking in Russia against the United States.
It is something that covers the covers of the newspapers that open on television.
Something that years ago was totally unthinkable, and now it is part of our day-to-day.
And on the other hand, as the Secretary of State and the President of INCIBE have said, the fact that there is more and more need for security professionals.
And the fact that you are here today and that this room is full and that the whole event is full during these four days only confirms that this is important.
And that many people are interested in entering the world of cybersecurity.
Look, these statistics say that by 2019, 1.5 million professionals will be needed above the supply there is.
There will be a deficit of 1.5 million professionals.
So, if you are interested in security, in working in this field, you will not be short of work in the coming years, no doubt.
There are other statistics that say that by 2021, there will be a double deficit of 3 million.
Of people who will need professionals in this field of cybersecurity.
So, well, for many years, many people have asked me, hey, how did you start in security?
I want to share some of these little things and, above all, give some recommendations.
I don't like to say advice.
Because in the end, everyone has to take their own path.
But yes, at least some things that have helped me, that over the years I have reflected and thought, well, look, what I did that didn't matter, now I realize that it was beneficial.
And I hope it can also help you.
Really, one of the things that is also happening is that there is so much demand on the part of, not only public entities, but commercial entities, that happens in cases like this.
I don't know if you can see it, this is a tweet where a company from California, in San Jose, is asking for a developer in Hadoop, which is a big data technology, and it says that they need someone with more than 9 years of experience.
Do you hear this kind of posts?
Many of the young people in the audience, you want to start working somewhere and they ask for more than 10 years of experience, 15 years of experience.
Well, don't despair.
In many cases, like this one, employers or recruiters don't know what they're talking about.
As you can see, Hadoop is a technology that is 6 years old.
It came out 6 years ago.
There is no one with more than 9 years of experience in this technology.
And this is also part of what is happening now.
There is a new field where everyone is coming and we have to train not only professionals, but also companies, recruiters, so they can know what this is all about.
So, during the next few minutes, I'm going to talk about some tricks, some hacks.
And if there is something I want you to remember from this lecture, is to think like a hacker.
But a hacker, like the people I have defined before.
Like someone who can make possible what may seem impossible to you today and think about what things you can do to forge that path.
The first of all, and it has a lot to do with the hacker philosophy, is to be curious.
Be curious about things.
And I can tell you that, for example, when my first PC, I had it when I was 13 or 14 years old, my father bought, I will never forget, an Olivetti PCS 286.
And I remember that it had 1 MB of RAM and 40 MB of hard disk.
Today we laugh about this, right?
40 MB of hard disk.
I remember that I had a friend at that time, when I was starting at the institute, who told me, 40 MB of hard disk, Ismael, you are not going to fill that in your life.
Today you laugh, right?
Because we would probably exploit that hard disk with only the assembly in an email, right?
Probably this presentation weighs more than 40 MB.
But nevertheless, at that time, it was like, wow, tremendous, right?
And I remember starting to take the disks I had, 2, I think it was 5, MS-DOS 5, I didn't even have Windows, I started playing with BASIC, I started writing my first programs, which today we would call Artificial Intelligence, right?
Because I asked him my name, the little programmer asked me my name, and he repeated it to me.
Hello, Ismael.
A super basic thing, but for me it was like, wow, I'm making the computer speak, the computer speaks, right?
But just out of curiosity, I started to take the manuals, to investigate, to read.
One day Windows 3.1 came out, 3.11, with the diskettes, diskettes that you started to install on the computer.
For many young people here this is like, well, what are you talking about, right?
And where you had to rush to buy a mouse, because we didn't have a mouse to be able to use Windows.
Those were the years in which little by little you were connecting to the Internet, with that modem that made a lot of noise, you connected and started to enter the chats, the IRC, right?
Today young people use Slack, and all this kind of much more modern things.
But where you started to...
I started to look for information about how protocols work on the Internet, how this kind of things work.
This is also the curiosity of the hacker, right?
What happens when you change a bit in the header of a protocol?
What happens when that package goes through the network?
What happens in the memory of a computer system?
For me all this was a new world, and I was very interested, very curious, in knowing all this kind of things.
I don't know if anyone remembers, for those of us who are a few more years old, at that time, to see or find the network of this kind of manual.
Carolyn Mayle.
Does anyone know her?
I was the only weird guy then who came across this.
In the United States she was very well known, and in fact she has a reputation of being a woman, let's say, quite controversial, because she was involved in certain kinds of things.
But this kind of guides were called mostly harmless hacking guides.
And it was because they weren't really hacking guides, they were guides that helped you understand how protocols worked, how the internet worked.
For example, at that time you started having email and you had your basic email client where you downloaded it.
Well, reading these guides, I learned that I could connect with a telnet to port 25 of an email system, to the server where I could read my email with a terminal, simply by typing with a command line.
It seemed fascinating to me.
Of course, it has nothing to do with what is hacking today, but that curiosity led me to learn how the internet worked, to learn how these protocols worked.
All this is still available on the internet.
Obviously this presentation will be available when I finish and you will be able, if you are interested, to read this kind of things, which, although they are old, in the sense that they are from 1995, 1996, but they explain a little bit of the history.
As you can see there, connecting by telnet to port 25, reading your email, explaining how the ports work, etc.
And it was more or less at this time when I also started to learn a little more about an operating system called Linux.
Being at the university, here in Malaga, a group of people was formed who started teaching for free after the classes, how Linux worked, which was an operating system that I found fascinating.
After years using Windows now, having started with MS-DOS, the command line, it seemed to me that it was all very boring, using a mouse for everything.
It made everything too simple and I liked to learn how things worked at the lowest level.
And Linux allowed me to do that.
It allowed me to put into practice many of the things I was learning with these manuals.
So, from there, I started to get together with this group of people.
At the same time, I decided to make my father a web page that he was going to learn.
Actually, he probably already knows, he didn't need it at that time, but I offered him to make a web page so that I could learn how to do this kind of things.
I remember buying my first HTML book and starting to learn PHP, ASP, databases.
Things that were not exactly the same that I was learning at the faculty in the first years, but that made me curious and that I wanted to learn.
One day, entering the faculty, one morning, I was already in the third year of technical engineering.
I saw a poster.
Nowadays, I would have liked to have had a picture of that.
But, basically, it said something like this.
If you understand this, we will hire you.
In a column next to the entrance of the faculty.
And it was basically PHP code, ASP code, that came from a database.
And, well, I had already had a little idea of all this.
I knew what this was about.
And I remember that I was with my partner and I said, ah, yes, this is a query, a database and such.
And my partner told me, hey, well , fill out your CV.
Ah, I'm studying now.
No, I don't think so.
No, I didn't even think about it.
Or yes, maybe I thought about it and I thought about it.
During that day, I was thinking, hey, and yes, and yes, I send my CV.
So, that afternoon, when I got home, I did my first CV.
Imagine what kind of CV, as I had no experience.
But, at least, I could tell the little things that I knew or that I was learning, that I was practicing.
I sent it and I didn't give it much importance.
I went with some friends to do something else and I got home that afternoon and I remember my mother told me, hey, you have been called from a place called G2 and they want to talk to you.
Ah, well, interesting.
Here, nearby, in the center of Malaga.
I went there the next day, or on Monday, it seems it was.
And, well, I started working there in the middle of the day.
So, in the morning I was studying.
No, the other way around.
In the morning I was working, in the afternoon I was studying.
I finished my studies and, at the same time, I started practicing and learning a lot of things that, well, at that time were fascinating and today I also realize that all this helped me a lot for what I did later.
I'm glad to see some people here in the audience who worked with me at that time.
And we started in a project called topfootball.com which was, basically, now we can't think, we all know Facebook, we know these things, but much before this, in the year 99, five years before Facebook came out, here in Malaga, a digital platform of collaboration was being made with forums where people could register,
create their profile, exchange information and it was really fascinating.
And I started working here programming in ColdFusion and, after this, they asked me to take care of the servers that we had on the Internet.
Servers that, well, where we were going to put the web server, the applications server, the databases...
Obviously, we had to put security because there would be people who would be interested in being able to download these servers, we had to protect these data, so everything I was learning on my own now turned out to be quite useful and it gave me the opportunity to be able to experiment and to be able to practice all these things.
Well, something interesting and it was that being also in the university, there was a group of people that I will talk about a little later.
A group called HackUMA, Hack Universidad de Málaga.
And it is not what it may seem to you, it was not a group created to hack the university, but it was a group created to share information about computer security.
We are talking about the year 96, 97, year 98.
And, within this group of people, I met some of them, some of them were my colleagues at the faculty.
Then, obviously, to this day, very good friends here in Málaga.
And, one of them, in a forum, said one day, there is a vulnerability that we have found in a public administration here in Málaga.
Look, take a look at this.
And again, curiosity, right?
You get curious and you start looking.
And really, the problem that there was on the surface was not that someone had hacked this server that was hosted, that was in a company here in the technological park, where, well, the administrator had made a mistake and had indexed a series of data that did not belong to this local,
public administration here in Málaga, and where one could enter the web page of this administration and do a series of searches and data of other servers that were also there, of other websites, some of them with, let's say, dubious reputation.
Let's leave it there.
And, well, taking a look at all that, precisely because I knew about internet protection, because I myself was in charge of protecting these servers, well, I found that they had in the port 1433 exposed internet.
Does anyone know what is usually in this port?
SQL.
Exactly, the databases, right?
And internet was totally exposed, something that usually is not something that should be done.
That's why they put firewalls.
And in this case, well, I thought, this doesn't look very good.
Really, the problem was much bigger.
The problem came from, if anyone remembers managing this type of database at that time, you will remember that when you installed SQL Server 2000 and versions at that time, it asked you for a password for the administrator , for the SSA, System Administrator.
The problem was that that password was optional.
As you can see in the message, it was recommended to enter a password that wasn't blank.
Nowadays, it would be something unthinkable, right?
A lot of people on the Internet had these servers exposed, without any protection, where anyone could connect to the server with SSA without password.
Obviously, the problem was much bigger, much more serious than just this public administration , because the rest of the servers were exposed.
To sum up, basically, this led to a lot of commotion at that time, in the press, in different places.
Immediately, when I discovered this, I contacted the people who had the responsibility of these servers.
It could be solved, immediately by cutting the access to this port of the internet, and it could be solved.
But at the same time, the one who was the delegate of the G2 where he worked with Top Football, Alfredo Grisoli, approached me and offered me the opportunity to offer this type of services, or we would call it Red Teaming or Hacking Ethic or Penetration Testing,
whatever, this type of advice for companies who wanted to protect themselves.
They wanted to know their exposure to these threats.
And we are talking about the end of 2000, the beginning of 2001, when there were very few companies in this country doing this type of things.
Very few.
We all know each other still today in this sector, but it was really something pioneering that we didn't realize time .
But today, looking back almost 20 years ago, we reflect on this and see that we were among the first to do these things.
Based on this, what can I recommend?
I have always been doing this.
You can see a picture of my house.
In the basement of my house, I always have a laboratory .
I always have something.
A small machine .
In this time , it's much easier to do this.
We have the cloud.
In this case, it's a small Intel NUC, a small PC, like a big book , where you can run virtual machines.
My suggestion is to create your own laboratory .
Find a machine that is kind of old, that you have there, maybe you can't play video games, but that you can use to build a small laboratory .
Install the VMware ESX , which is a free version , the ESX I, which is a free version that you can install at home , on any PC, and where you can create your own network.
My suggestion is to install these things from scratch.
My challenge for you today is to install Linux from scratch, compile, download from the sources, compile the applications yourself.
It will be painful.
Nothing will work immediately, probably.
You will have to spend time doing this, but by doing this you are learning how things work.
Think of the hacker philosophy, disassembling, knowing how things work from scratch, because that is fundamental.
Create a small Windows domain , you can download free images from Microsoft , which you can use for a period of time , and you can create what would be the most similar thing to a company network .
And now that you have installed it, try to secure it.
Try to secure it with the guides you can find on the internet, those workstations, Linux, Windows.
And once you have done this, try to learn how to these systems, and now see what evidence is left behind, to better understand what are the needs that the organizations have out there.
And if there is something that surprises you, you say, ah, I didn't know this, celebrate it, you are learning, and these are things that can help you in the future .
It is not only what you learn, but the process of how you learn these kinds of things is very, very, very important.
Something that I also see these days is that, obviously, young people want to be a hacker, want to learn how hack, want to learn all these things, and that is very good.
But sometimes we forget about history and where we come from.
And I think that learning about history doesn't mean you have to learn how to handle ENIAC, as you can see here.
But there are things that are very interesting.
I recommended you a book before, the book about innovators.
You have to read this book as well.
Cliff Stoll was a physicist who worked for the Berkeley Laboratory , the University of Berkeley in California.
And in 1986 , he wasn't a very good physicist, so they sent him to the computer lab because they said , well, he knows a little about Unix so let's send him there to see if he can leave us alone and work with computers.
The computer scientists, when this guy came to the basement to work with computers, said, well, this guy is not very good but we think he is
a good
scientist is This is going to be charged to your department, this amount of money, for having used the server.
It was charged, it was charged for time.
Time that you used those servers.
Well, when checking the accounting of this system, he realized that 70 cents were missing.
Those accounts did not match.
Someone had used the computer system and did not have an associated account in the laboratory.
No one had been charged for this time.
Of course, if you think about it, it's 70 cents.
It's ridiculous, right?
Who would, for example, do something like this?
He, because of his hacker mentality, started to investigate, out of curiosity.
What's going on here?
And I thought, well, this is not a big problem, but this way I entertain myself and also learn how the computer system works.
I'm not going to tell you the whole story, but I will tell you that after a year, all this story that started with
a small lack of 70 cents in the system resulted in the arrest of a guy named Markus Heiss, in Germany, who was remotely logging, unauthorized, hacking, let's say, these servers in the Berkeley laboratory.
From there, the rest of the ARPANET, which was what was available at that time, it was not the Internet, it was simply a network that connected to certain universities in the US, together with the government, and from there to the MILNET, the Military Net,
the US military network, the Defense Department, from where this criminal was stealing sensitive data from military projects, selling it to the KGB, the Russian espionage service, for cocaine and money.
We are talking about 1986.
It does not sound much like the stories we see today, or that we think of today, about APT and that kind of thing.
They are not new.
They are not new, only that today we know much more about this.
But this started a long time ago.
Of course, if you read this book, you may not be able to learn much about the tools they used, because there were no intruder detectors, there was no artificial intelligence, and this kind of thing that we have today, but we had the same thing.
Attackers, defenders, people behind this kind of thing, because there is always a human being on the other side.
So, the strategies, the tactics, even, have not changed much.
This guy used something that we use today, and we talk about honeypots, honey jars.
This kind of idea was used by him, he created a secret military project, which was false, and he left it in this computer system to make the attacker, who was looking for this kind of secrets, once he discovered his motivation, go there, try to download this file,
and since it was a very large file, it took him a lot of time, enough time so that, together with the police service in the US, the FBI, the police service in Europe, they could trace this connection to the building, to the apartment where this criminal was connecting and stealing these secrets.
So, it's not about tools, it's about your way of thinking.
And this guy, for me, is also an example of this.
So, get to know the story.
The story can teach you a lot.
The story teaches you the basics.
And, look, I get a little tired of the subject, honestly, when there are a lot of people who have been doing this for years, and they try to give the impression that what we do is super, super difficult.
As they say in the US, rocket science.
This is not science about missiles, or quantum physics, or anything so complex.
It's not.
You just need to know the basics.
A colleague, he's an instructor at the Institute of Science, well known in the field of penetration testing, hacking ethics, he likes to mention this.
He says that the secret of information is not more than simply applying the basics of security, but in an inspired way.
First, you have to know the basics, and second, know how to apply them.
Because that's what comes with experience.
But precisely because we often don't have the experience, because no one has given us the opportunity to have it in a job, it's so important to have your own laboratory at home, and to experiment with all these kinds of things.
How can you learn the basics?
I like to leave practical things.
There is a list of books, you can find it there in this URL.
As I say, these slides, the presentation will be available after this talk.
But there you can see a huge list, quite large.
There you have books to read for the rest of your life.
You won't have to read them all.
But they are classified as advanced books, basic books, by topics, by categories.
If you are more interested, maybe start learning networks, or start learning operating systems.
Of course, at the university, and I have to mention the University of Malaga, Javier López is here, who was my professor, and who, for many years, has been doing a fantastic job in the shadows, teaching people who, at that time, thought, wow, TCP and IP,
this is unfathomable.
I really realized, after all these years, these are the basics.
If you don't know this, if you don't know these protocols, the headings of the protocols, how they work, it will be very difficult for you to do things that you want to learn much later, that you want to do, in terms of hacking.
In the end, everything happens through the network.
It is important to know how the network works, how the operating systems work, Linux, Windows.
These are the basics.
Analysis methodology.
Look, today, the industry is spending, in general, in security, a lot of money.
A lot, a lot of money.
And the hottest thing right now, the hottest thing is SOC, Security Operations Centers.
The idea of having a security organization where people are monitoring everything that is happening in the day-to-day, defending you from attackers, generating enough evidence, responding to incidents, doing forensics, doing intelligence.
And this is like, ah, I want to do this, the guys leaving the university, I want to do intelligence.
Well, this, once again, requires knowing the basics, but also knowing how to think strategically.
And it is much more than bits and bytes.
It is knowing how this impacts the business, knowing what goes beyond all the technological part.
There, in this part, in this list of books, you can also find references in that sense, and that in recent years I have realized that it is very important to be trained in knowing how to generate hypotheses.
Something that, perhaps, I would not have thought when I started with this topic.
When you have a problem that you have to analyze, how do you keep your mind open?
Think like a hacker.
Keep your mind open.
What am I seeing?
Have I seen it before?
And that you have seen it before does not mean that it is the same as you have seen it before.
What other things can there be?
Hypothesis generation, questions that support hypothesis or not.
There is a very interesting method that is available and that you can study, I recommend it.
It is called ACH.
Analysis of Competing Hypothesis.
ACH.
If you go to my website, you will see references to how to learn this.
It is a document from the CIA that explains how to analyze a situation, how to do a security investigation.
A general investigation that can be applied to security investigations.
These are fascinating things that have more to do with psychology, with how our brain works, with how to analyze complex situations.
And this is what you will really find when you are doing this type of work defending the organization, the network of an organization.
Beyond this, one of my recommendations is to learn at least two programming languages.
Learn, at least, Bash in Linux, PowerShell in Windows and everything else.
PowerShell is now everywhere.
And even, as I say, it is already in the toasters, because everything is connecting to the Internet.
Microsoft is using PowerShell to be able to handle absolutely everything.
These are languages that you like more or less.
They are used a lot today.
And, above all, with the movement of the cloud, everyone, whether you like it or not, is going towards the cloud.
There you can handle all this with scripting languages.
And, really, it is something very important.
As the roles change also in this sector, it is important that we learn programming languages, that we learn how to handle automation, orchestration, because every time we have a lot more data, analysis methodology, big data, machine learning, all this kind of things that every time are going to be more and more important in the new times that are coming.
It is also very important to learn the business language.
This was one of the main things I learned working with both Alfredo Garisoli at G2 and, later, in the group NovaSoft with Francisco Barrionuevo.
And it is that, sometimes, we are technical.
We like to mess up, we like to disassemble things, to speak in this language, which is a language that we have developed.
But, as Cliff Stoll realized, this is a master lecture he gave last year at a SANS event in the United States, he said something like, when I had discovered this failure of 70 cents, this that did not fit these numbers, I went to the FBI, I went to all this kind of people,
I found that there was an account that had been created in the system that no one had claimed.
And I went to the FBI and I told them, hey, we have a hacker in the network, we have a guy who is connecting from we do not know where, we need help, we have to trace it.
And the FBI asked him, okay, how much money have you stolen?
70 cents.
Imagine the laugh that came to the agent, a 20-year-old boy told him, when you have stolen an important amount of money, please, do not count it again.
Then he realized, reflecting on all this, that the important thing is actually to tell a story.
Not only the bits, the bytes, or the logs.
No, it's telling a story.
Why is this interesting to someone?
What is the story behind it?
And that's really what is important for us today.
I learned this over the years.
There are some press notes that I have been able to recover.
There you can see someone who today also has a lot of influence in everything that is done in Malaga and in the world.
Sergio de los Santos, the Director of the Laboratory of Telephone Research here in Spain, or worldwide.
He is here in Malaga.
He was my fellow student, the first person who helped me in G2 Security.
And we learned all these things together.
How to speak the business language, why someone would care about what we are doing.
Back then, we wanted to sell penetration testing.
Many people did not understand why we had to do that.
Today, it is different.
There are regulations that require you to do this kind of thing regularly.
But back then, no.
In 2001, 2002, there was none of this.
Some companies did it proactively.
But ask yourself, who would pay for this?
I may be interested, but who else is interested?
What is behind this?
Marketing or sales are very important.
It may sound like I am not interested, I am a technical person.
But even if you are not interested, or you do not have your own company, or you do not work for a company, each one of us has our own brand.
And this always goes with you.
One of the things we lack is the power, at a local level, to show all the talent here in Malaga.
We need better marketing.
The power behind many security projects, tools that are well known all over the world.
There are very good people here or in other places in Spain.
It is important that you use this.
And this is a story I like to tell.
Back in 2001, I received a call after many years, or months, trying to sell our services.
And from Malaga, where there was no awareness, there were big companies that wanted to buy our services.
We went to Madrid, to Barcelona, trying to get subcontracted.
And one day I received a call from a big public administration in this country.
They told me, Ismael, we need your services, we want to hire you because we are being attacked by the Chinese government.
This was my first professional job after setting up the company.
We have a very cool website, very cool brochures, and they call us and tell us this.
And I thought, wow, this could be my first job and my last job.
I thought it was way above what I could do back then.
The thing is, we had to send a report in three days to show what we had discovered.
To sum it up, I spent the whole weekend without sleeping, scanning those networks, trying to find out what these attackers had managed to discover in that network, how they had entered, and it turned out that I found a machine after a lot of scanning,
a lot of analysis.
One day, something appeared that had not been seen before.
It was a machine that perhaps was not connected all the time, but at that moment it did connect.
And I could find, it was the DMZ, the perimeter network of the organization, and I found a page similar to this one.
It was not this one, but similar to this one.
This had nothing to do with a particular government hacking, but it was the worm that was called Code Red.
It has a very interesting story, I don't have time to tell it, but basically it was a Chinese fighter plane that was shot down by the American government in a territory where there were no such regulations.
At the end, the Chinese government took retaliation and created this type of worm that infected solar machines, and these solar machines scanned and infected internet servers.
And they left this message that we have seen behind.
Hacked by Chinese.
But it really was a worm that took advantage of a vulnerability in the Internet Information Server and left this message behind.
Something that seemed impossible at that time, it was not so complex.
But what it required was patience, it required to have an idea of what other things were happening in the world at that time, and one of them was this worm.
And one of the things I learned at that time and that helped me a lot to understand what business is, was that I had the opportunity to do the Penetration Test, the audit or the advice, but in the end, all this hacking, attacking, now we call it Red Teaming,
is useless if one does not do the part of how to improve the company, how to improve the security of the company.
This part, which is the Blue Teaming, this is a terminology that is used a lot in the military language in the United States, Red Teaming, the people who attack, Blue Teaming, the people who defend.
One of the things I learned over the years is that you do not have to be neither Red nor Blue, Blue or Red, now it is called Purple Teaming, which is the purple combination of the two colors.
What does this mean?
The important thing is not to be very good attacking or defending, the important thing is what you get with this.
How do you improve the security of the company?
This is what matters in the end, to the people who are paying, to the people who are maintaining the business.
I have had the opportunity to work in the United States for the hospital group in New York City with 27 public hospitals.
The important thing is not that you get to do a pentesting and become a domain manager or that you find a piece of malware or that you have done a reverse engineering or a fascinating malware analysis.
No, the important thing is what you do with all this.
The important thing for a hospital network is to provide health services for emergencies to the citizens.
The health of the people.
Your job is to support that so that you can maintain the security of that network and minimize the impact that a terrorist attack or a virus attack or a ransomware attack could have on the services that the organization provides.
But it is also important, as a hacker, to think what is important for the organization that pays you, that hires you and that wants your services.
In the end, it is all this.
Risk management.
About your personal brand.
Basically, as I said before, it will always accompany you.
So be careful how you use the networks.
We have had cases in which we have wanted to hire a very good technical person very, very, very good and then when the organization went and looked at his social networks he saw that, well, he was a person a little controversial in his comments.
I would even say something else too.
And in the end, that made the organization say no, no, we do not want to hire this type of person.
Although she was technically very good.
And many of these things can stay there in the network, as you know, for many years.
So take care of your brand.
It is important, as I said, share, put things in github that people can see.
When you send a resume somewhere, people will google your name.
They will search in google your name.
What have you published?
What do you have out there?
And it does not have to be that you have given a talk or a very important conference.
It can be a piece of code, but something I can see and say, ah, well, look, it's true.
You know a little bit of Python, you know a little bit of PowerShell.
You have the attitude of sharing.
You have the attitude of learning.
That's good, of collaborating.
People will look for this kind of thing.
And that brings me to the next hack.
The next suggestion.
Write, share, collaborate.
We started doing this many years ago in G2.
One of the first things we said is we are going to make a security bulletin.
We want people to subscribe.
We want people to learn about security.
But behind this there was a trick.
Not only did we want people to learn about security.
We want to learn ourselves.
Why?
Because when you write, when you write about something, what happens?
It forces you to think, right?
It forces you to analyze.
How are you going to explain it?
How would you explain this, which is complex, to a non-technical audience?
How would you explain it to your parents, to your siblings?
It forces you to use illustrations, to analyze the problem, to summarize it.
All these things make you learn it much better.
And when you explain it to someone, or you have to put it into practice, you will learn it, much more than just reading something.
So start your own blog.
Even if you don't have readers at first.
It doesn't matter.
Do it for yourself.
To start learning, analyzing this kind of thing.
Write about what you want to learn.
Look, years ago we started doing this.
And you will recognize some of these names.
Sergio de los Santos.
This is an article from 2002 or 2003.
If you go to the Wayback Machine on the Internet, you can find web pages from many years ago.
These pages are not online anymore.
But the Wayback Machine is like a a robot on the Internet that takes pictures of those pages for many years and keeps them there.
Andrés Méndez.
Another one of my friends who also started working with me at GeoSecurity, years ago, writing articles about this kind of things.
And even before starting with us, there was already a presence on the Internet, Hakuma, here in Malaga.
A series of people who were dedicated to writing articles, that you could collaborate.
Look at the purpose.
It was the original spirit of the hacker.
To learn, to collaborate, to teach others.
And many of these things were published in a magazine called Arroba.
And there are still some manuals that were published for years.
But I know what you are thinking.
Many of you may think I really don't have anything that matters to people.
There are much better people than me.
Look, this has a name.
It's called the impostor syndrome.
And it happens to all of us.
It happened to me before coming here today, thinking, maybe what I have to tell you is not so interesting.
Every time I have to make a presentation, it happens to all of us.
Why?
Because we think this is our case.
This is what I know, this is what everyone else knows.
It's not like that.
This is your perception.
Reality is more like this.
Each of us has a different experience.
Each of us can tell something different.
So, don't be afraid.
Put it out there, share it.
And when you share it, people will come and ask you, how interesting, how good.
I myself had this experience years ago, when I was in New York hospitals.
After doing this type of incident response for many years in the Middle East, in other countries.
I got there and I had to do this job myself, basically.
As a consultant, it's very easy, because you come and do a consultancy, and then you leave the problem to those who have to do the operations on a daily basis.
But I had to do this now, as the client had to do it.
Managing a network of more than 60,000 IT teams in the whole city.
And one of the things I realized was that I needed a series of tools to do this remote machine analysis, incident response, forensic, from the problem I had then.
I made a little program in Python, which I put in GitHub.
I asked my boss, hey, what do you think if I share this?
Of course, Ismael.
This is what we like to do.
It's part of our philosophy.
You have to share with people.
Because no one ever invents anything from scratch.
If you've done something, it's because you've learned from someone else, because you're inspiring someone else.
So I put it on the internet and suddenly people from all over the world started calling me, sending me emails that they were using it, that it was super interesting, that it could be improved.
Hey, have you thought about doing this?
Have you thought about doing something else?
One day they called me to give a talk at SANS, at an event, a summit there in New Orleans, where I explained it.
They called me in Black Hat.
I had the opportunity to present it for up to two years.
I was presenting it in Black Hat in Arsenal, in the United States, in Las Vegas in 2016, in 2018.
A project that, honestly, when I created it, I was like, nothing.
It took me two days to do it.
But people found it useful.
Many of the things you can do today, the same.
Maybe you don't give it any importance.
You've made a little script that solves a very simple problem.
Share it and put your name there.
Because that same problem is probably being solved by another person.
In France, in Brazil, in Argentina, or in India or Australia.
And when you put it there, people will see it and it can give you the opportunity to do other interesting things.
So start doing these things now.
Here at CyberCamp you have a very good opportunity to start sharing, to talk to the people around you and to present your projects.
Briefly, something very important.
Do you speak English?
Good?
Here in Spain we like it a lot.
What level of English do you have in your CV?
Medium or high?
I'm going to tell you my frustration, because it seems very silly, but we've had the opportunity to hire people here in Spain, working from home, earning salaries that are three or four times what you would earn doing any other type of work.
And we haven't been able to hire them, because they knew how to read English.
They understood English, but they couldn't speak it in a telephone conversation.
Something as simple as this.
And it's a shame that you invest so much in your studies, in learning, and that for something so, so simple, because it's not so complex either, you can't take advantage of this.
I'll leave you with a few suggestions of how you can do it.
It's not complex at all.
But finally, I'd like to say something that is part of hacker philosophy is to think in terms of graphs, not lists, for those of you studying computer science.
Attackers think in terms of graphs.
If this technique doesn't work for me, I try this one.
If I don't, I try this one.
If I don't, I try the other one.
And if I don't, I keep trying.
Many times, as defenders, we lose against attackers because we think in terms of lists.
If I see A, then I do B, C, D.
If I see B, I do D, E.
But what if you see X?
And you don't have a manual that tells you what to do.
Learn to think in terms of graphs.
So the important thing is not what I told you here today about what you have to do.
I'm not going to tell you what you have to do.
The most practical part of this is try it, share it, do things we've said here, but find your own way.
The important thing is not having a role, having a title.
The important thing is what you do along the way.
The process.
The people you're going to work with.
The people you're going to learn from.
What you can contribute to others and what these other people you're going to work with will contribute to you.
Nobody gets anything alone.
So don't be afraid to do things that fail, that don't work.
It's part of that learning process.
And that's going to help you a lot.
And lastly, be balanced.
In this job, this is like the universe.
It's infinite and expands.
You're never going to finish.
You're never going to finish your job.
There are people who go into depression.
There are even suicide cases.
Because you can easily get lost.
Even working from home, you can lose your balance.
And dedicate yourself exclusively to this.
And in the end, that's not good.
You need a balance.
You need...
This is something that, over the years, thanks to my wife, my wife has taught me to balance all these things.
Here you have a model of some of the things that are important in life.
This is going to make you a better professional.
It's going to make you a better person, a better professional.
And in the end, you're going to be much more successful in your job.
Lastly, I was saying before that this has been a very special event for me.
So I wanted to thank everyone.
And especially my family, my parents who are here today.
For the first time in a talk with me.
And because, well, basically, thanks to them, I've been able to learn to have an open mind and to be able to learn all the basic things, the principles that are much more important than anything else you can learn in this career.
Thank you very much.
Thank you, Encibio, again.
If you want, I think we don't have time for questions.
Or do we?
One question.
We have time for one question.
Nobody will dare to ask any question.
It's okay.
I'll be here all day.
If you want to chat with me, feel free to do so.
And thank you very much for your attention.