The truth is that it impacts me to be here and with this presentation even more.
But it impacts me more that you are, or I am, enjoying, at least if we are lucky, and more in Santander, to have services that many of us consider basic.
The light, the water, the gas... What if one day all that goes poof and disappears?
How many days, hours, would it take for us to get into tension, fear, fear, to see altercations?
Well, these are scenarios that many movies, even series, have portrayed, but that in a bad day could become reality.
And in Spain, how do we do it?
Let's see it.
What do we consider critical infrastructure?
In fact, to this day it is not exactly established.
Because yes, we take into account, for example, water purification systems.
It is vital.
We take into account energy systems.
We always put as an example a nuclear power plant, I don't know, because it impacts the towers more.
Or we also have systems like defense.
Defense, which can have components that can be managed by similar control systems, but we also have other systems, such as telecommunications, TV channels, radio, and all kinds of networks.
Infrastructures that allow us to communicate between different regions.
For example, to get to Santander, I took two trains, one from Valencia to Madrid and one from Madrid to Santander.
Could I have taken other alternatives?
Yes, but I took that one.
We also have control systems, for example, traffic, roads.
But let's not forget that companies, the private sector, also have their own needs.
And they need, for example, a refrigerator full of refrigerators to be at the right temperature, so that all the food they store there is kept fresh and healthy.
This is also an industrial control system.
Can a supermarket be considered a critical infrastructure?
No.
But it uses very similar systems.
What you see here is a random panel.
It is what an operator would see to control one of these industrial control systems.
There they reflect values, the state of several pressure pumps, etc.
And it is something that a human, like us, can interpret.
That is why these systems are called HMI, Human Machine Interface.
We also have to take into account that all this information comes from somewhere.
In fact, it is processed by systems known as RTUs, which are responsible for managing all the information that comes from the different sensors and probes in order to translate it to our language, so that we can understand it.
That is, what the machines do is translate it to an interface so that we, as operators, can understand it.
And in the end, these sensors can be connected from an industrial oven to a system of machines, centrifuges, washing machines, whatever you want, up to a reactor in a nuclear power plant.
In the end, these are data that these sensors collect from all this machinery.
And we have to manage them properly, either automatically or manually.
It is up to each one to choose.
As the speaker said before, there is a search engine.
He has called it the search engine of hackers.
I call it the search engine of machines.
It is called Shodan, and it is like Google, for those of you who don't know it, that allows you to search for devices on the Internet.
All kinds, from computers to industrial control systems, and you can find funny things, like this one, which says Nuclear Engineering.
It seems funny.
Or directly systems exposed on the Internet, which don't have any security system, not even a tiny password, to which you can access, see, and in the worst case, get to control.
And that is a problem.
Because there was a moment when someone decided, these systems are very good, but I want to control them remotely.
From my house, if possible.
Is it necessary?
Maybe not strictly, but it is more comfortable.
And that is when the serious problems started.
There you have only a representation of a few, of the last years.
I am only going to focus on the ones you see marked.
Why?
Because at some point, each one of these incidents was a milestone in the field of industrial security.
Since 1982, although that event must be taken with certain precautions, because it was a cold war event, until what we are seeing in 2017, many things have happened.
Some have been made public, others not.
Of some we have a lot of information, of others we don't even know they exist.
Or we will know it in a while.
Let's focus on the one that marked a milestone and caused many people to start talking about security problems in industrial control systems.
We are talking about Stuxnet.
In the summer of 2010, security compresses and threat monitoring systems began to be detected in Iran.
Something very focused in this place, Natanz, which is the core of the Iranian nuclear program.
What was happening there?
Well, those who are younger may not remember, but at that time, and still today, the problem was that the Iranian government wanted to produce nuclear fuel supposedly for its power plants.
They are right.
But other countries did not see it with good eyes and thought that this nuclear fuel could be used, for example, for weapons.
What was done?
Well, to begin with, information was collected and it was discovered that in that uranium processing plant they were using PLCs of a well-known brand, such as Siemens, which could be attacked.
In short, those systems, together with the uranium centrifuges, if a malfunction is caused, we have that at that time the president had a problem.
That was the summary.
Now, going a little more in detail.
How was the attack made?
This site that you have just seen was not a site that you could easily access, nor did it have a connection so that any operator could watch football games.
No, no, it was well guarded.
In fact, in order to attack the systems, an external attack was not used through the network.
What was used were USB devices.
What was done was to locate which scientists, operators and staff were working on that plant and had access to the systems that the attackers wanted to affect, and they planted USBs, infected USBs, so that they could take them inside the plant and from there they could carry out their work.
How?
Well, so far, I still consider this threat as the most advanced because five vulnerabilities were used, and four of them were from scratch.
That is, there was no patch to solve them, and until then, many of them were even unknown.
Vulnerabilities were used, for example, that allowed the execution of code only by visualizing, not by opening, but by visualizing files.
Vulnerabilities were used that allowed to move through an internal network taking advantage of security holes.
And all this from a single or several USBs.
In the end, what they wanted was to point to the PLCs of Siemens, to get to know which systems were controlling them or to be able to interact with them and to pose a threat to them that would do things like what we are going to see now.
How did they really know which systems were being used?
Well, the curious thing is that the propaganda of the regime, the propaganda of the Iranian regime itself, helped a lot in knowing it.
These photos are taken from reports and public exhibitions that the Iranian government made at that time, from a visit of President Ahmadinejad to the Central.
In the red dots you can see which centrifuges were inoperative, at the time of the visit, taken from a photo.
You can also see details of the control panels, enlarged from photographs where the operator was working.
And you can also see details like, for example, the pressure exhaust valves that those uranium centrifuges had, to know the exact model and guess who or what was controlling them.
From there, they just had to make a map, see which systems could be vulnerable and attack them.
What happened?
It was a very ingenious attack.
What was pursued was that the data provided by the centrifuges to the operator who was there with the interface, were apparently normal, when in reality neither the centrifuges were spinning at the speed they should to produce the uranium, nor the uranium that was produced was useful for anything.
It didn't serve as a nuclear fuel to produce energy, nor did it serve as an armament.
In short, what was achieved?
It was achieved that over several months, even years, the Iranian nuclear program was quite affected, producing a delay, and it is calculated, and this is an approximation, because no one has counted them one by one, but it is calculated by reports and other observations that almost a thousand centrifuges were useless.
That means a considerable delay.
To this day, the Iranian government has recovered a lot from that blow and we are again seeing how some consider it a threat and so on.
Who was behind it?
Officially, nothing has been said.
Officially.
But there is no need to be very smart to investigate, to pull some strings, seeing that Israel doesn't like that Iranian program, and the Americans don't like it either, to see that there may be some very interesting interests.
Let's advance a little in time.
We are going to 2014.
We no longer have Iran as the protagonist.
Now we are going to another region, very beautiful, but lately it is immersed in a conflict with a big enemy.
I am talking about Ukraine.
What happens there?
Well, in Ukraine, many operators of power plants or plants only intended for any type of critical infrastructure receive emails, like us, every day.
But they are a little peculiar emails.
They are emails like this one, from the Minister of Industrial Policy of Ukraine, someone important, so people usually have a tendency to open it, especially if they have a zip file, and inside that zip file there is something camouflaged as a document,
but in reality it is an executable.
A technique like this, used for decades, serves to attack someone inside a critical infrastructure that has control over one of these industrial systems.
Not only once, but several times.
In fact, when they realized, a few months later, that it was no longer so easy to simply put the executable inside a zip file, they used another strategy.
In this case, in 2014, Ukraine was already immersed in some dime and direte with Russia, in a specific area, the one in the east of the country, and obviously everything related to war, to the army, dissidents, rebels, etc.
was of great interest.
What did the attackers do?
They camouflaged a supposed report of generals and commanders of the dissident side, that was in favor of Russia, they camouflaged it inside a PowerPoint presentation, there was information about those commanders, supposedly, and this is what the operative saw.
What he didn't see was what was happening behind.
And behind, they were loading two files that were embedded inside that document.
Two files that were hidden in a location, even some of them were passing through a .gif, but it was actually an executable.
What was that file doing?
That file was downloading one of the first variants of what we know today as Black Energy.
This malware was basically looking to open a backdoor in these systems so that, remotely, an attacker could do with them whatever he wanted.
From that moment on, all the alarms went off and the criminals, the attackers, whoever was behind, started to improve the techniques a little.
They stopped using this type of malware inclusion taking advantage of the PowerPoint and moved on to something very traditional like including the malware inside the macros of an Excel document, also making them go through as official documents.
There you have an example.
Like this one, many more came.
What they also did was to destroy, at least logically, the part of the hard disk that they were interested in.
That is, when they had finished their attack, they had entered and done what they wanted to do, they left the hard disk unusable.
This is a problem, not only for the operator, but also if you want to do a forensic analysis because if you want to know what happened there, the hard disk is a very important piece to know which files have been downloaded, which have been executed during the entire infection process.
You also have the possibility to see how they were also looking for certain types of files.
If they didn't want to download the whole hard disk, they were looking for the extensions, they were eliminating them and making the subsequent investigation difficult.
Not only were they satisfied with that, but also they made a second way to get control of these systems.
As you saw that the issue of macros sometimes worked and sometimes didn't, the solution was to trojanize a legitimate application.
A legitimate application like DropBeer, for example, to connect via SSH.
What did they do?
They planted a trojanized version so that people could download it, including these central operators, and what they said was what they were listening to and they left a default password that is embedded in the code so that an attacker from the outside could access that machine that was compromised.
In an ingenious way, also using a tool that several system administrators in the area recommend and use, and that also allowed an attacker to have a second gateway apart from the initial infection vector.
The conclusion?
In these two dates, especially the first one, on December 23, 2015, there was a blackout that affected, according to calculations, between 300 and 500 thousand people in an area in Ukraine.
Now imagine the situation.
December 23 in Ukraine.
If those of you who are here think that you are cold, now move to that moment.
Not cold, the following.
And without light, without possibility of heating apart from the traditional gas or firewood or coal even, and without possibility of using any electronic device.
Of course, that means a considerable attack.
It is no longer a circumstantial blackout.
You are affecting a fairly important area of a region that is also in conflict with a neighbor.
Obviously, all the alarms went off.
And people began to launch theories that it could have been, if it had been a technical failure, if it had been an attack.
The media exaggerated.
What happened?
Obviously, we saw that although Black Energy had not been the fundamental component of the attack, it had been used by the criminals both to access and to eliminate any trace of the attack.
I mean, it had been used in conjunction with other tools.
And if you want to see how an operator felt at that time, I have brought you a video where you can see perfectly
how the attackers managed to take control.
Do you see the cursor there?
It looks like something normal, but the operator is not touching anything.
It is someone from outside.
And in this particular machine there was no problem because it was not connected to any critical system.
But in others it was.
And that affects the operation of the plant.
You hear the comments of the operators saying, but are you doing it?
And they say, no, no, this is from outside.
And what are they trying to do?
They are using electronic switches to cut the energy.
Now you see how they say, but are you doing it?
And they say, not in this one because we have no access to any of these switches.
But if they wanted to do it in others, they would be doing it.
And in fact they are saying, yes, they are telling me that in other sectors of the plant it is happening.
A remote management of these systems.
You see that the operator is not touching anything and it is done with something as simple as a rear door that they have managed to close .
Confirmed, there were three plants.
If there were more, we do not know.
But at least three fell.
After this incident, obviously, it caught a lot of attention.
We are talking about January of last year, 2016.
And they began to investigate where this type of threat could come from, who was behind it, what were their motives and how they had achieved it.
So, of course, that caught a lot of attention.
It makes many experts around the world
and from there, an investigation is carried out to determine where this malware may have come from , who may have developed it and why.
Of course, to the criminals, to the attackers, it was not very funny and what they did was to evolve.
They took what they had already done and began to change it.
They continued to use propagation techniques that had gone very well for them, such as the issue of macros, but they began to add new functionalities, this that you see here is an evolution of what we have seen, the kill disk, but instead of deleting,
what it did was to encrypt.
It was a usual ransomware.
Why?
Maybe it was a way to say that we are a group of criminals, of those who only want to make money.
And so they got rid of all the persecution that existed at that level.
But it did not help them much because this type of malware can be analyzed and when we analyzed it, we saw that the similarities were many.
Not only because of the attack vector, but because they shared functions, they continued to use the same methods and the only thing they had done was to make up the code a little to hide it.
But they had reused many functions of what they had already done in recent years.
In fact, it was funny because we saw how they even began to attack systems that until then had remained a little immune or quite far away from the usual ransomware attacks, such as Linux servers.
And they did their own tricks by infecting Linux servers.
They even planted you here, as you can see on this screen, in the group, in the boot, the message where it said that your wonderful server had been infected, that all the files were encrypted and that if you wanted to recover it, you had to pay a certain amount.
They also made their versions for Windows.
Below you can see how they sent the message.
In addition, with very high expectations, although at that time it was 10,000 dollars, as we are today, asking for 222 bitcoins in 2016, at the beginning of 2016, was already a fairly respectable amount.
Obviously, no one, as far as I know, paid.
But hey, they did their tricks.
Why?
Was it simply a bad level of distraction?
Did they want to change the opportunity they had made instead of attacking industrial systems to earn money directly?
Or was there something else behind it?
It was materialized.
And it was materialized this year, not long ago, at the end of June.
Maybe it will sound familiar to you.
A Petya, NotPetya, XPetya, Discoder, whatever you call it.
In the end, it was a malware based on one that also appeared last year and had no apparent relationship with this year, which encrypted your files and sent you the typical message.
In addition, it was done in an ingenious way, copying what I had seen in Petya from last year.
It was doing a process of hard disk revision and, from there, it proceeded to encrypt the files and send you this message.
Problem.
Problem number one.
The files were irrecoverable.
As much as you paid the ransom, the encrypted system that was implemented was not good and could not recover them.
Second, they provided you an email address for something that fell quickly, so there was no possibility to contact them to try to recover those files.
And third, the affection, if you look at the map, was mainly in Ukraine.
The rest of the country, tangentially.
There were companies that fell because they were based in Ukraine and, above all, a very important thing, they used the same program
that was implemented in Ukraine.
And, finally, there were companies
because they were based in Ukraine they used the same program a very important thing , they used the same program
is the program me.doc.
It is a program used in a massive way by almost all companies, no matter the size, in Ukraine.
If we do a little bit of memory, Petya appeared at the end of June, just before the return to Ukraine.
And what program most people are using to prepare the return to Ukraine?
This one.
How did the attackers
know that this was in Ukraine?
Well , they used the update servers of this application.
What you see here is an official FTP of this application that was committed by the attackers.
And what they did was upload a malicious update, specifically the first file that is there, and that was uploaded on May 31, 2017.
We downloaded it, installed it and it kept working.
And in fact, it was quick because we had to prepare the annual income declaration reports .
This, moreover, was not the first time they did it.
They tried it a month before.
In the timeline we have of this investigation, in May, they had tried to propagate a ransomware,
and now they were going for all of them.
They had managed to install this update in many companies in Ukraine and they had the perfect date to cause a brutal chaos.
And they did it.
You just have to see images of that day in Ukraine.
Even international companies like Maesk, who had headquarters there, saw how their systems
worked .
Very few.
To see the difference, on the left you have the trojanized version of this app, and on the right the clean version.
You see there are differences and that is what was included by the attackers.
It is a very smart vector to use because from the world of security we are always advising you and they took advantage of this advice to commit a third party of trust, like this app, to use it to enter thousands of companies from a region that they were interested in.
It is a problem because this is not going to be the last time we see it.
In fact, there have been not so serious cases, but it is possible that in the future we see
a utility that we use in our day-to-day life and that someone commits to their servers to infect us.
We have seen it, for example, in the case of ransomware for Mac, where several applications have been committed and for a few hours they have been serving trojanized versions that the criminals used to encrypt the content of our systems.
And we are going to move
to an industrial system.
Why?
Apart from my colleague Anton Cherepanov from SET, there was also an application of a very important company in the issue of security of industrial systems, which is the company Dragos, and we collaborated with them because we obtained the first samples at the beginning of the year and we analyzed together how it could affect an industrial system.
It is something as simple as one or several operators connect to a command and control center that they control and that is usually located inside the rector.
They manage to infect a single machine or several of a company or a factory or an electrical plant and that machine is in charge of giving and receiving orders to the industrial control systems, or whatever.
If those orders are not expected or are not sent directly, then, for example, an electrical company stops producing electricity and that is where the problem comes from.
The difference with respect to previous attacks is that, on the one hand, they do not seek to infect the industrial system itself, they do not seek to infect the PLCs of a specific brand,
and , on the other hand, they do not seek to infect with a rear door, even if they use it and remotely control it with the mouse, which, on video, looks good, but, technically, is quite lame.
What is their scheme?
Here is a summary of what they achieve.
First, they manage to install a rear door,
an e-mail, and another one, which they install using a trojanized version of the notepad, the notepad of all life.
Why?
Because if the main version is discovered , they always have a secondary that they can use to attack that company.
They also install additional remote control tools, and what they seek is to schedule an attack
to do what they proposed using a launcher and a wiper to eliminate it.
The important change is in how they execute their actions.
As I said, they do not seek to infect neither the industrial control systems nor the PLCs, nor, at least apparently, remote control remotely.
What they do is inject orders that are legitimate, as if they were given by an operator as usual, and that the system interprets
protocols that are widespread in the industrial world, mainly the first two.
These two protocols allow, on the one hand, a more ancient one, allows communication through serial port with these industrial control systems.
What the attackers seek is, on the one hand, to see that the legitimate process used to communicate with these systems is being executed,
through several ports to avoid legitimate communications because they are already occupying all communication ports.
They make a service delegation and they are the only authorized to talk to the industrial control system.
This is the part of protocol 101, which is the oldest.
Then there is a more modern one, which is 104, which adds a TCP and IP layer.
That is, they allow to send command orders through a network with TCP and IP configuration.
It is a more concrete protocol.
It even allows to look for a file where registers are stored, where configurations are given, and that allows to determine routes from which to download those orders.
Also, this protocol has a problem.
It is that, through serial port communication, it would have to be, again, locally, through protocol 104 or using the Internet, it can be done remotely.
In fact, what they did, many times, was not to attack a specific system.
What they were looking for was all the systems of the network through two processes, one called RANGE NATURAL SHIFT, and what they were looking for was to see how many of those processes were active and turn them off one by one, automatically.
Instead of going with the mouse and saying, click, out, click, out, it is, look for all these industrial control systems that are monitoring, one by one, automatically, without me having to do anything.
And when you finish, you delete and leave.
It is something much more advanced.
The problem is that this is not only for power plants.
These protocols are working in industrial control systems in companies and critical infrastructure services or not, from all over the world.
And they are established standards and I doubt that they will change in the short or medium term.
So, the impact of this attack can be brutal if it is used
to turn off the switches, the electronic switches, so that this company stops working, or stops providing the service, or stops providing electricity, or whatever that infrastructure does.
But in a much more elegant way, much more automated and above all, it leaves less trace when investigating it.
Ah, there was a bonus, by the way.
Since they are there, they took advantage of a service denial attack against Siemens systems, called C-Protect, and there is a vulnerability that is already corrected, many people need to apply it, and that simply sending a UDP package with these characteristics caused the system to stop working.
These systems are responsible for the security of communications between the operator and the critical systems, so that they stop working is a pretty big problem.
They didn't need it, but since they were there, they did it.
And until now, more or less, we have talked about attacks that are carried out through the Internet or networks that we are used to use in our day-to-day life.
But this type of attack uses many other vectors.
You don't need to connect to a computer, to the Internet, or use Shodan to look for those vulnerable machines
or those systems that are now controlling cities, or as you have here in Santander, a smart city.
If you didn't know, Santander is one of the Spanish and European smart cities.
There is a website where you can see the status of the sensors, temperature, garbage trucks, buses, or as citizens,
the city council.
In fact, I recommend you to look for a talk by a good friend, Juanito, called Hacking a city like Santander.
He gave it here two years ago and he gave practical examples, nothing really dangerous, just people leaving a message, but he showed that those systems could also be hacked.
There are many examples.
The typical traffic signal,
even a little funny.
What is not so funny is that you can modify emergency systems, such as the police, ambulances, systems that should work well when needed, and that you can modify using SDR to make it work as it should.
Carlos García said it very well in his talk.
Do you have 30 euros?
He demonstrated how with desire, knowledge and the necessary material, not so expensive, you can use any of these systems that control traffic lights, emergency communication systems, etc.
He put the components.
That, buying well, in good places, according to Aliexpress, for less than 30 euros you can build it.
You have to have knowledge
and it is less worrying that they have not taken the right measures so that this does not happen on a larger scale.
We also have another case.
The case of Dallas in May.
What you are hearing are the emergency sirens for situations such as hurricanes, earthquakes, floods, etc.
If I remember correctly, this sounded like a Saturday, a Sunday, I don't know, a weekend,
that sounds like a siren to you.
It is also quite noisy.
But of course, what caused this?
Was it someone who pressed the button when he should not?
Apparently not.
No operator recognized having given that order.
Was there an emergency?
Everything seems quiet.
What happened then?
Well, radio-frequency attacks were used to cause the operation of these alarms.
And in fact, this is just an example of what can be done.
There are many more possibilities that are not being considered in terms of security and that radio-frequency attacks can affect.
It is not necessary, as I say, to connect to the Internet to attack a system.
There are other communication protocols that work just as well and that are vulnerable because no one has considered
what we have done as a serious mistake for many years.
To trust security for darkness.
To think that since no one knows how this works, apparently we are calm and we are safe.
And that is not the case.
Today it is relatively easy to obtain crucial information on how systems work in critical infrastructures or in infrastructures of any kind.
And that, any son of a neighbor
can think of names like Ruben Santamarta.
He is a crack at discovering vulnerabilities both in communication systems and in critical infrastructures.
And now comes the question.
After seeing all this, are we as bad as they say?
Are the media telling the truth or are they exaggerating?
Besides, where do they get this information from?
Because when they tell me that Spain is the third country in the world with more cyberattacks, I say, ok, who says that?
Well, there is a report...
Ok, which are the first two?
United States, England...
Oh yes?
Where is France?
And Germany?
And Russia?
Here it is happening a bit like the Spanish flu during the First World War.
There are countries that are not giving us this data, so it does not appear in the list and we go up the ladder.
In the Spanish flu during the First World War, Spain did not participate in the conflict
and hundreds of thousands of people died because of the Spanish flu.
What happened?
As Spain did provide data about those deaths, and other countries that were in conflict did not provide them so as not to give information to the enemy, it was called the Spanish flu.
Not because there were more deaths, but because it was one of the few countries that provided data and where the figures were substantial.
Here the same thing happens.
There are many countries that are not providing data because they are not interested
It is not that they have only increased, but we are able to detect them more efficiently.
Maybe two years ago we did not have the mechanisms or devices to detect those attacks.
Which means, we are so bad, we can go live in a cave, we forget everything, the end of the world is near, or how things are.
We have to take into account several factors.
To begin with, many of the examples we have mentioned
have been produced to infrastructures that are either poorly configured for their security or are connecting when they should not.
I have had the opportunity to visit critical infrastructures in Spain, for example, a nuclear power plant, and I was very calm knowing that all devices that act in an emergency situation are mechanical.
There is no external connection.
There is no system that controls them by turning off or on electronic switches.
You have to go to an operator who knows how to do it.
Maybe they could affect the surveillance system, the cameras, the movement of a turret, etc.
But nothing else.
Well, what it has to do with having systems from 40 years ago in places like this.
That is why we are safe.
But at a global level, what is there?
It is true that there are some trusted sources, like IBM,
but yes, I think they are the two things.
On the other hand, we see, according to IBM, that the five countries that receive more attacks are, with a lot of difference, the United States, the country that supposedly has more systems of industrial control implanted, and then, a long way away, China and Israel,
and then Pakistan and Canada.
And Spain?
In fact, in the official lists in the ranking of the top 20, we do not even appear.
So, on the one hand, we are safe, but on the other hand, you say, then, those news that we have seen before, where do they come from?
Well, I told you, they come from studies that are biased because not all the information is there.
Going back to the report that Kaspersky's colleagues told us , there are countries
where the biggest problem is that there is a seasonality.
And in this case, the attackers also take holidays.
In other cases, no.
But here, yes.
If you look, December, and then January, boom, down.
The rush, the parties, those things.
Then it goes up, up, up, and then it goes down again in June, and if you look there, you see that from July it goes up again.
And you say, what a mess.
They also take advantage of the holidays to either prepare new attacks or go directly to the party.
And we also have to take into account that in Spain, for a few years now, we have mechanisms, such as the ones provided by CNPIC, the National Center for Protection of Critical Structures, and that adopts measures that are good on paper, then we would have to do more work in the field,
that is, applying them, but it is good that we have these measures that have been implemented since 2013.
Not only that, but yesterday, when I was preparing the presentation, I saw that INCIBE, as you are going to see now, is preparing something new.
And that is where I go now, in the solutions.
Does all this have a solution, any arrangement?
Well, there are several scenarios.
On the one hand, there is the option that I have told you
that what you have to do is develop safer technology.
The other one, which is the one that, unfortunately, most sectors are adapting, is, I don't see, I don't hear, I don't feel anything, this is not happening to me, until you discover that you have entered the kitchen and you have the problem inside your house.
That is the main problem that we are seeing and that is appearing in the media.
Then there is another one that appears to us and that we learn a lot later.
That is when you do UF, which we have got rid of, what are solutions, are things like this one.
Yesterday's news.
And it is that Incibe has bet to launch a tool distribution that supposedly will help to raise the level of cybersecurity.
Very good.
It is a good development, it is a good initiative.
Now we need that to reach companies, to reach the critical sectors that really have to apply it and, above all, apply it.
Because if not, we haven't done anything.
We have developed these tools but if we don't follow that through an update process, if we don't stop thinking like we did 10 or 15 years ago and think like it is time now to face the attacks that we are seeing today, then it would have been useless.
How can it be imposed in some way?
Well, the hardest part would be legally.
You have to meet some requirements and some systems and security mechanisms that until now had not been contemplated.
And yes, many of these critical infrastructures meet the requirements at the level of physical security but the logical part is that either they leave it abandoned or the person in charge of administering it is not given the necessary resources not even the training to be able to fulfill it.
So, that on the one hand.
And the other one.
Pay attention to those people who are dedicating their time and knowledge to discover these vulnerabilities because they know a lot about this.
And if they are not paid attention and not only that but many times they are accused of something they have not done that is, you can attack me and I am warning you of what can happen then we will have a problem.
Because many people get desperate when they want to report an incident that they know is affecting a critical infrastructure such as a garbage dump they try to contact the company that manages it and one of two.
Either they do not pay attention or directly
Against this, what can we do?
Well, if any of you or you know someone who has information of this kind there are mechanisms to communicate it.
One of them is through the State Security Forces such as the Department of Technological Crimes of the Civil Guard or the National Police Technological Investigation Unit or through the many various CERs we have in various autonomous communities in Spain or directly the main one.
If someone wants to keep his privacy let him talk to a lawyer and say that he has discovered this the lawyer will contact whoever he has to and will keep the confidentiality of his client.
But what we cannot do is to criminalize precisely those researchers who are betting to make safer systems discovering security holes to be patched not to stay there all their lives and be exploited by attackers.
If we don't do this the problem is that the bad guys will eat us as they have been doing so far.
This will cost money yes, it will cost a lot of money but the losses it will cause that this is not solved that this insecurity we have today continues to operate as it is operating that the criminals can camp and provoke attacks as we have seen without basically any impediment and we are not talking about inconveniences like,
for example, staying without heating on December 23 in Ukraine but much worse things that records are lost that critical systems fail or, for example, hospital issues, etc.
This is something that we must all pressure so that the necessary resources are invested not only at the national level but at the global level because in the end we are often interconnected and maybe the energy we are consuming does not come from Spain we have to take that into account too so if you have doubts,
questions, questions I have dedicated some time because it is a rather peculiar topic I know that many of you have caught it again others not in the streaming channel I am sure that there will be people very trained on this topic so if you want to ask something no one eats me look wait,
wait the microphone
Hi Hi I really liked your presentation Thank you and regarding the last thing you said that we need to look for solutions from professionals the current Spanish government does not think so I mean right now they have released a news that is reserve Volunteers for the homeland.
What do you think about this?
If professionals are needed to tackle this problem, which is tremendous, how is the Spanish government doing?
Well, in this news, we have to be specific, because what has been said is not entirely true.
What they are looking for is cyber-reservists.
Here there are people who are much more capable to talk about this issue than me.
I suggest you look for Enrique Ávila, who knows a lot about this.
And what they are looking for is people who are in a reserve that already exists today.
You can be an army reservist, for example, if you are a doctor, and give classes or lend your knowledge for X weeks a year.
And what they are looking for is that.
What happens is that the way of expression was not the most appropriate.
When you are a normal reservist, you are not charging.
They pay you when you go to lend the service.
I understand that what they wanted to say was that you, as a cyber-reservist, were not going to be paid, except when you were operational.
What really worries me is not the issue of pay or not, the platotrism of some, the platotrism of others, etc.
What worries me is who is going to manage, who has the necessary skills to be a cyber-reservist, what kind of information is going to be handled in that cyber-reserve, and if someone can launch attacks is taking care that he was acting in favor of the interests of the nation.
That is what really worries me.
The issue of money, yes, it is important, above all, that people who can contribute their knowledge and their skills are rewarded in an adequate way, not by paying a misery as is happening in many companies today.
For example, they tell me that this company lacks talent.
No, no, it does not lack.
What happens is that we export it.
We export it because the companies here do not pay what is deserved of all that talent that we are generating.
And people have to look for habits outside.
And that is a problem, because the people who are trained here are very good.
You just have to see the national and international congresses and see how the Spanish speakers are always among the best rated.
And that is for a reason.
Now, with the lack of talent or lack of training, we could have a debate, and that also affects the issue of the cyber-reserve.
Who can be there?
Anyone.
You have to pass an exam first, they have to give you the hacker's card, how is the thing?
This is a debate that gives you a lot.
But I give my point of view, that these people first have to be trained, that they have to define very well what can and cannot be done, and second, obviously, when they are acting, these people have to make a living.
I do not know if I have answered you.
Well, to be valued.
To be valued, correctly.
The government still does not value these people, who are cyber-professionals, who have invested hours and hours and hours, and do not see their reward.
Fuck .
And sorry for the...
No, yes, you are right.
The problem is that someone has to communicate that those hours, that research, that knowledge does not appear out of nowhere.
It is not free.
There are people who have dedicated half their lives to train in that way, and if they are willing to make it available, in case of an emergency, but they also expect that the government, or whoever is managing if it is the Cyber Defense Command, or whoever,
just like a professional military man, I have a few military friends, they charge to defend Spain, you too.
That is important.
The problem is how it has been communicated.
And this does not come from now, it comes from months ago, when they appeared.
These are the hackers who are going to defend Spain.
Among them I have many friends and acquaintances, but it was not the best way to promote it.
It even generated debates in several groups and several people, even in Twitter, in a public way.
It is such a complex issue that ambiguity does not have to be used.
But that is how things are done.
That is how things are done.
And that is a problem that comes from not only this issue, but many others.
More questions, doubts, questions?
Here.
Going back a little bit to the beginning of the presentation.
How can a person or a group of people install a malware inside an application update to make an income statement?
I do not understand.
How can a group of people inside an application of a company install a malware?
That company does not control it?
You just answered it.
Really, the only thing they had was to access the update server, which was a public FTP.
You could access it.
The only thing is that it had security measures that were broken.
Once they were inside, they modified the application so that it had an additional file that was not in the original.
Specifically, a PHP file that routed code.
Once that, as the updates are configured by the majority of the users of the application so that they are automatic, they download it.
And that has happened not only in this case, but in many others.
They were not looking for this type of attack, but others that were more direct.
For example, cases of ransomware, spyware, etc.
Configuration failure by the company that developed this software when monitoring who can access and how can access and what can it introduce in the updates and a revision failure when downloading this malicious update for not checking it, for example,
with a checksum, seeing that the hash coincided with the one they wanted to launch.
So there is a chain of errors that if it had not been there, it would not have happened.
Good morning.
First, I want to thank you for explaining everything clearly.
You have explained it in a way that everyone can understand.
First, a reflection on what you have said and then a question.
The reflection is that in most of the cases you have raised, I see that there are problems that people do not use the computer for what it is, that it lacks training to use it, and almost all vulnerabilities are related to some of that.
That is the reflection.
The question is, the Internet of Things is giving me a lot of fear that it starts to raise things related to these, because we are seeing light bulbs that are controlled from the Internet, coffee makers that are controlled from the Internet.
I don't think all these elements have a prepared security and I wanted to know your opinion about this.
Yes, unfortunately you are right.
Most Internet of Things devices, especially those intended for daily consumption by any of us, do not have security among their priorities.
Why?
Because that delays their development and they want to launch their product before the competition.
And it can be cheaper.
We have already seen cases, to bore you, in fact I have talks about the Internet of Things and one in particular about cars, and we see that it does not go anywhere and in fact the problem is that we have more and more devices of this type connected.
And that allows a criminal or several to access them and we have cases like last year with the Bonded Mirai where several thousands of these devices were used to launch attacks on primary Internet systems such as DNS, causing crashes in services such as Spotify,
Twitter, Playstation Network, etc.
for several hours.
That multiplied by the number of devices there are and that are vulnerable can cause serious, serious, serious problems.
Now also, we as consumers have the power to say hey, I do not like this product because it is not safe, I do not buy it.
Apart from trying to promote a regularization that at the European level is already at least being designed.
Another thing that is fulfilled.
Well, first of all, thank you for having prepared the whole presentation that surely takes a lot of time and work behind and ask you I, as I am a teenager, I am still learning and to get to where you are I have a long way to go.
Do not put me up yet because above me there are many more who know much more.
And I wanted to ask you if at the level of working cybersecurity, if you recommend it to us teenagers as a job option in the future, as it will have a lot of momentum.
And my second question would also be if what training courses should we follow to acquire knowledge of cybersecurity.
The subject of cybersecurity as a career in the future is not in the future, it is in the present.
People need it.
And as I said in Spain, the problem is that many people choose to leave because many companies do not pay what they should.
Then, yes, it is a career that I recommend that if you are interested in the subject you have to like it because this is something that you have to learn every day.
It is not that I study this and that's it.
In fact, the regular training that there is today focuses on giving you some basic pillars, some foundations, both in the university career and in higher modules of FP.
They give you some very general basics so that from there you decide.
Then you can specialize doing master's, doing courses, certifications, but here is something that is vital and important.
Practice.
Just to study?
No.
You have to be curious.
You have to want to find out how all the systems work that you want to see later if there is any security.
You have to, above all, read, learn.
Do something that you are doing today, attending this conference.
Let's see if Edu is still here.
Are you here?
Where has he gone?
Well, this is my colleague Edu who is a professor of FP at an institute in Cordoba and he promotes that among his students.
He even holds cybersecurity olympiads.
There you have the opportunity that we did not have many at your age.
Even people older than me who had to look for the chestnuts in a very difficult way.
You have a lot of tutorials, documentation, practices.
Even here at CyberCamp you have the option to test your skills.
And there are even companies that are looking for this talent to hire them in the future.
Take advantage of all the resources you have to feel restless, look, be part of a community , contribute your own research.
It is not something that is difficult today.
Now yes, if I tell you an important advice .
Do not cross or at least try to avoid crossing that line that separates the hacker from the criminal.
A hacker is not a criminal.
A hacker is a researcher looking for holes to solve.
The one who crosses the line and uses those holes for his own benefit, that is a criminal .
I know it is difficult because many can do it and that is something that is difficult to control but it is important.
Take advantage of the resources you have.
Study something that can be related to higher modules in computer science or careers and masters.
That is very good, it will give you some foundations.
But practice and self-learning is vital in this profession.
And...
the last question.
They have been telling us that we need practice.
But how can we take the theory that we learn in books or guides or whatever, we take it on paper?
No, it is very easy.
How to take this theory to practice?
Well, right now there are a lot of instruments that allow you to practice in your own home.
Generating scenarios of vulnerabilities where there are systems that can be compromised, etc.
Then, if you want, I can tell you, but there are a lot and many of them free, of virtual machines, tests, capture of flags that you can use to put
your knowledge to the test.
And today that costs little and nothing.
And this man here can help you to get it.
Thank you very much.