Well, can you hear me well?
Yes?
Well, let me introduce myself.
My name is Luis Jurado.
On Twitter, my friends know me as extremindiez.
I am a member and partner and founder of the Perseus and RCA Abogados office.
I am from Seville, I think you can tell by my accent.
Something like that.
And now I am living in Coruña.
Well, after knowing my personal journey, I will explain it to you.
The title of Damn Internet Hippie is, as I think some people think, Well, I don't want to be repetitive with the topic of cyber.
I will avoid it as much as possible, so you don't have to drink a lot.
And well, first of all, I want to thank all of you for being here today, a Saturday at 6 p.m., and for the delay.
Secondly, I want to thank the CyberCamp organization, which has allowed me to enjoy this moment with you, and also the 1984 POSCA, of which I find here some of its representatives.
Well, what am I not going to talk about?
Well, I am not going to talk about how bad hackers are, I am not going to talk about politics, I am not going to talk about conspiracies, and I am not going to talk about business solutions of Cancamusera or Vendehumos.
I have not come here to sell any type of product.
What is Cancamusa for me?
Well , Big Data, Startups, Communities, I don't know, Hacker Cards, and that kind of thing, which we are tired of hearing.
It is another kind of talk.
What am I going to talk about?
Well, I am going to talk about the new criminal code, the new criminal prosecution law, the Civil Security Law, just a little bit, because it is an administrative law, and about situations that I have been encountering throughout my day-to-day life and the problems that arise with it.
Well, what you are seeing there is a statistic facilitated by the General Prosecutor's Office of the State, where you can observe, in this case, how telematic crimes, or cyber crimes, as they call them, in 2014, rose to more than 80% increase.
The most remarkable is the scam, then the revelation of secrets, damage and sabotage, threat and coercion, and the issue of child pornography.
Well, and what is this?
Well, basically, this is what the legislator thinks about the crimes of the Internet.
I mean, what is fashionable right now?
The Internet.
And what is old since 1995?
The criminal code.
Well, we are going to update the criminal code and we also update everything that is related to the Internet.
You see?
A bad adaptation.
And now I'm going to move on to explain some of its points that catch my attention of the many that it has.
There are some crimes that can be committed by the Internet, such as crimes against freedom, threats, crimes such as cyberbullying, stalking, bullying.
It looks good, doesn't it?
Okay.
The issue of sexual assault, pornography, crime against the administration of justice, intellectual property, public order, terrorism on the Internet, dissemination and humiliation of victims.
All of this, also linked to crime against the public treasury, freedom of conscience, related to the market and apology for serious crimes.
There are many crimes that affect, or that can occur or be committed through the Internet.
But I'm not going to focus today on that type of crime, which are many and I would give at least two more talks, right?
I would like to thank first of all, because they are very serious crimes, the GDT, the group of telematic crimes, the program developed in the schools of agent-tutor, of awareness for the kids, the one carried out by Angel Ucho with his program of For a safer network,
to the telematic crime brigade of the technological unit of the national police, judges and prosecutors, who watch for the safety, especially of the weakest people, such as minors and others.
After that, my talk, the one I'm going to focus on, are going to be those three parts.
On the one hand, the issue of hacking and the crimes that are connected to it, the issue of hacktivism and the issue of e-crime, right?
Frauds and frauds.
And, well, starting with the first part, I go to the next one, and I, chatting with my colleagues, who in the vast majority are computer security specialists, some hackers, others not, other auditors, in short, of all sorts, they usually say to me, hey,
this tool I use is legal?
I mean, can I smear my colleague in a good way?
Or can I launch a Metasploit?
Or can I put the Trojan on my girlfriend?
Because I don't know if...
Anyway.
Well, hey, am I committing some kind of crime?
And, well, if you have seen this...
Some of you may have heard this initial screen of Metasploit.
What kind of crime can I commit, for example, if I don't have the authorization from the person I'm auditing?
Okay?
Well, which is quite interesting, well, look, one of them could be perfectly the one that describes the criminal type of 197 complemented with 201 of the criminal code, right?
Crimes against privacy, the image itself, the viability of the home.
In this case, they record you, for example, with the web camera, in some of its modalities, either the sound, the image, or that they steal some information from you, or that they introduce into your computer some information, well, it would be typified in this type of 197.
And, well, and now I say, and what do you want to protect?
What does a lawyer say?
What is the protected legal good?
The protected legal good, in this case, would be the secrets and the individual intimacy that every person has the right to.
And it is recorded in article 18 of the Spanish Constitution.
And then, there are two budgets that must be fulfilled of this 197.1.
First of all, that there is no consent.
That is why it is very important if you are making a security audit, that there is a consent.
That is to say, if your boss of the computer security company sends you to audit the web security or the security of a company and you do not have a written consent, well, the truth is that you are a little bit sold.
Ok?
That is why it is very important that there is a consent to be possible by writing in some kind of contract where that will is manifested .
And the second that is needed for this typification would be the complaint by the aggrieved person.
That is to say, if that boy who is believed to be the victim of an attack about his intimacy what he has to do is to file a complaint.
The police, the prosecutor cannot enter directly even if they have knowledge of those facts.
Ok?
That is what says the 201 of the current criminal code with the reform.
Other types of crimes that can also be produced by internet would be the freaking.
Some of you know that, well, the new computers, the new routers of certain companies know orange well, the same have some kind of failure and who knows, the same can be used as VoIP without the neighbor knowing it.
Or, for example, if some type of VoIP in some type of server, well, the same you set up a premium SMS service.
Things that happen in the day-to-day, right?
Examples there at random.
Then also the issue of wire-driving, right?
That of taking the Wi-Fi to the neighbor.
Applications that you have in Android that have cost you a little more work nowadays are very easy in most cases to do.
What happens is that, well, in this case, the vast majority of the people who have Internet have a flat rate .
Therefore , you would have to spend many months stealing the Wi-Fi to the neighbor in order to exceed the 400 euros that are required to go from crime , as it is now , to a crime , right ?
So , that is collected in the 255 , the 256 , but it barely used , right?
And what I am putting here was in a forum of a well -known Internet website, in which a user gets some doubts and puts the one o'clock in the morning, right?
And he says that at one o 'clock in the there is a server from a company that of work and they have connected it to a botnet , right?
Typical .
He sends the commands by IRC from the CIC .
This has happened, it has triggered in a DOS , right ?
It has taken
it and put it bots , where he is seeing everything , right?
After that great idea of that administrator, well, a phenomenon , he takes and says that , right?
And he continues not only doing this kind of actions , but he says that he wants to do two business to break the ice.
Typical, right?
Hey, you have a botnet, let's put another botnet in another place with my company, the normal thing .
And then we a DOS
and we
make the to break the ice other place with my company path to Ok?
That's the first thing to do.
The second thing is not to get into any kind of DRC channel to continue investigating.
Why?
Because there is a thing called traceability.
Obviously, that will leave a log record.
And who will be the first person investigated in case a judicial investigation is opened by the Telematic Crimes Group?
Well, obviously, the administrator who was inside, ok?
And he can get into a big mess, because then it will be very difficult to clarify, ok?
That's about it.
Then, we continue.
Hey, and what do I do?
I mean, apart from telling my boss that they are setting up a bomb in our servers, can I report it to the police or am I going to get into a mess?
Well, yes, the answer is yes.
I mean, you can report it to the police.
And how does it have to be done?
Well, it has to be done as follows, ok?
Depending on the seriousness.
I mean, if you understand that it is such a serious thing, imagine that your servers have been infected, but it is not with a normal bomb, it is with a bomb that distributes child pornography.
I think it is a little heavier than normal, ok?
Then it has to be put, with common sense, you give part to your boss, in the case that you have a boss, and if not, you directly communicate it to that link that the police has on their page, right?
www .policia.es.collabora.php And if you think that it can be framed within some kind of conduct, less harmful to the interests of other people or your own, well, what you would have to do is a complaint to the Spanish Data Protection Agency, ok?
In virtue of the Organic Data Protection Law and the SSI-0, ok?
As the link was very long, I have cut it like this, so that everyone can find it.
You put Google, you put complaint to the SSI-0, I think that everyone can find it, so that we do not get lost.
Well, that would be the first part of the talk.
The second part, I would like to start it with a quote from Henry Turot, ok?
That says the following, right?
You are already seeing, The law never made men bad or a bit more just, and in the spirit of respect for it, even those of good disposition, it becomes a daily agent of injustice.
And I think that is something that everyone who is dedicated to computer security may have felt at some point in their life.
This is what we are living today, ok?
Freedom always has to control security, but it is happening that we are getting too scared.
And that fear, in the end, will end up devouring us and controlling all aspects of our vital limits, and our privacy, ok?
What do I personally understand about activism?
What is my concept?
Well, activism on the Internet is basically to spread causes, ok?
To make claims and organize demonstrations.
Everything that comes out of there and involves a harmful behavior for another type of person, well, I understand that it could be classified as terrorism.
Not any type of demonstration, but something quite serious, like what we are seeing right now with ISIS, etc.
Well, as a result of that, activism, this year, the Organic Law 4-2015 was enacted, ok?
Protection of security, also known as the Mordaza Law by the vast majority, right?
And what I am going to give are three strokes, because this is not criminal law, which is what I do.
This is not within the penal code, it is an administrative rule.
The infractions are classified, you see the fines, which is what we always care about, ok?
First of all, very serious ones, ok?
From €30,001 to €600,000.
Serious ones, from €601,000 to €30,000.
And mild ones, from €100,000 to €600,000.
In the case that affects us, related to what can be committed on the Internet, it would be within the serious ones.
There is a specific section that says, well, that.
The use of unauthorized images or personal data related to the forces and security forces of the State or its relatives, or that put at risk the success of an operation.
Example, what we saw the other day, if you are watching the news, with the kittens they put in Brussels, right?
That people were first taking pictures where the raids against the jihadists were taking place.
Well, in this case, simply by uploading the photo that this raid or this police investigation is taking place on the street, we would be fulfilling, we would be within the type that I am mentioning right now, right?
It must be made clear that this administrative norm of the law on citizenship, the Mordaza law, acts in a subsidiary way, that is, first the criminal norm must be fulfilled, and if the criminal norm is not fulfilled, then we go to the procedure here regulated,
right?
Well, what does that mean?
Well, it means that if I, for example, am in a demonstration, and I get into a fight with a policeman because I am very strong, well, apart from the sticks I can take and the dungeon, etc., etc., well, if they see that they cannot catch me for the issue of,
I don't know, public order violation and so on, well, in this case they would apply this norm to me.
Many times they apply a pecuniary sanction to you, well, it can be much more painful and it makes you reflect much more on your attitudes, right?
Well, moving on to this, other types of crimes that are usually committed when actions are carried out within activism are crimes against honor, slander and injury, the typical tweet that says I shit on your father, etc., etc., of the politician in turn.
Or when, for example, they hook up to avoid being located to other types of routers that are not the ones that are headlines, right?
Crime of damage, for example, when it is dosed or when information is deleted from servers or computers that have committed the activists.
Others that usually happen too, revelation of company secrets through the Internet, crimes against national defense, ultra-Spanish, and the crime against the crown, which lately is also quite fashionable, right?
Finally, well, we move on to the issue of fraud, the scam, right?
The frauds, right?
In this case, it is regulated from 248 to 251 and 269.
And I'm going to give you a series of common characteristics that I understand exist in all of them, right?
First of all, transnationality.
That is, the criminal, in this case a criminal, which is the only difference, there are no cybercriminals, for the criminal code there are only criminals, he can perfectly be in Russia, he can be in China, he can be in North Korea, wherever in Malaysia,
and he can have his servers there and be carrying out an attack against Spanish companies or against Spanish users.
It can happen in many parts of the world.
Then, the physical distance, what I was saying, it is not necessary that they are here.
Thirdly, there would be ubiquity.
What does this mean?
Well, basically that the same attack can be happening in Malaysia, in Russia, in France, in Spain, at the same time.
That is what the Internet allows.
And finally, these networks of crime are usually managed by organized crime groups that earn a lot, a lot of money.
Much more than with the issue of drug trafficking, much more than with the issue of trafficking of whites or trafficking of people and weapons, right?
Well, what would be regulated in this case?
Well, and what is protected?
Well, in this case, the patrimony and the ability to dispose of it.
That is, if you are robbed of your bank account, with which you have protected 30,000 euros, well, it probably won't be funny at all.
And these are some of the techniques used by cybercriminals.
The issue of phishing, well-known, okay?
In which a page is imitated.
To supplant, the identity of the page is supplanted, more or less, one with more art, another with less art.
Then, another type of scam that occurs is the issue of pharming.
The DNS addresses are changed.
The user thinks he is, for example, introducing himself on Facebook.
He is not doing it, he redirects himself, introduces the data, stores it, redirects you and sends you to the real address so that it is not noticed.
Lastly, the issue occurs more and more through compromised VoIP centralities.
The sending of smithing, of fake SMS, where you are encouraged to enter your data within a malicious link to control your terminal and then access your data and then sell it or simply access them, right?
Another type of scam, which usually has a lot of art, as we usually say there in Seville, are the Nigerian scams.
This type of scam, although they seem obvious to the vast majority of people, must be taken into account that they have a rather curious logical sense.
That is, 95% of the population would not click on a link that says you have touched an iPad and that you have touched it, that without less than five minutes you do not pick it up and you are going to lose it.
The vast majority have two fingers in front and do not click on the link.
But there are other people, that 5%, who say, Wow, how good, I have logged in and I have just touched an iPad.
Well, I'm going to see how I can get it.
I'm going to put all my data.
I do not understand that kind of people, but hey, there are.
And they usually have this kind of premise, right?
It would normally say that we are heirs of a rich and generous deceased.
Someone offers us a substantial business with which we can get a good cut.
Then they ask us to move a certain amount of capital from one country to another, right?
Not only are there Nigerian scams, but also the issue of online purchases.
On Facebook, until very recently, they were on the subject of Zara's vouchers.
I do not know if you have seen it.
You could, well, perfectly.
There were 50 Zara vouchers, and if you signed up, you would probably get one.
Or there was a lot of 100 iPads.
100 iPads that, by customs, could not be sold in Spain, but they had retained it.
And obviously, if you sign up, you could access one of them at an irresistible price.
Sentimental scams.
A Russian from Spain contacts you because you are a really sexy guy.
She is a girl who lives in Siberia, with few resources, she is very good, but she has no resources.
And then she asks you, in a fairly simple English or Spanish, not to say anything else, that you pay her the trip and her beauty treatments to come to visit you.
The usual.
Then you, as a good paga fanta, well, you take and pay her the money, the Russian disappears, and the Russian's boyfriend too.
Then there are the charity schemes.
Now, Christmas is very typical.
And the fake job offers, which, to be honest, bother me a lot, because they play with people's illusions and with the need of this crisis that we are suffering.
This is often found, many times, also related to...
You provide for the profile the copy of the DNA.
What happens?
Once you give the DNA a number of accounts, they can do things, they can give you a raise in companies in your name, and they can play with withdrawing or withdrawing money in an illegitimate way, and you may have gotten into a fairly serious problem.
So be careful, do not facilitate the DNA so easily, only when you believe that the company is serious, and above all, that it has a physical support to which you can go in case of some kind of problem.
I, to finish this part, I have made a picture in which...
What am I going to do?
Who is more likely to get away with it?
In legal trafficking, in economic trafficking, right?
Well, the companies, because they have...
They can be in any part of the world, they can have different headquarters, they have a lot of money, the vast majority, they have a lot of staff, and yes, they act within legal norms.
Then there are the criminal groups, which have exactly the same thing, but they do not enter within the legality, so they are not governed.
Then the governments, then the justice administration, and finally, the forces and security forces.
Who is more likely to get away with it?
Well, I think that, in principle, the companies, the companies adapt their...
or adjust their tax movements to pay as little as possible.
We already see that renowned companies pay taxes in tax havens and make special agreements to pay as little as possible, while the ordinary citizen cannot go to those types of mechanisms, right?
Then the issue of criminal groups, evidently, is out of the law and they also access this type of premium services, right?
Well, the governments comply with the law and, in the end, there is the justice administration with little resource and staff and the forces and security forces of the state.
Moving on to the issue of the project of organic law, which is no longer a project, but an organic law of criminal trial.
It is made up of different legal texts and, in this case, it fully affects the profession of computer security expert or auditor, right?
Well, I think that what has been tried to do...
I think it is the first paper that I put with a little color...
The precops, right?
I mean, they try to turn the police into predicting the future before the crime occurs.
This is what is being tried with this new regulation of the criminal trial law, right?
And I am only going to touch certain aspects, very specific, that catch my attention of this criminal trial law and I am going to name them, right?
First of all, right?
This would be the famous police trojan that everyone knows and that has been debated within the computer community, right?
Remote records on computer equipment.
588-610-A The judge can authorize the installation of a remote software, that is, a trojan, without knowing the title of it, right?
And it says in its section E.
The crimes committed...
Well, let me explain.
What I have put below, that is, the trojan can be introduced, the remote software, without knowing the title, right?
to investigate a crime that is believed to be committed by the person investigated, right?
When can that investigation and that installation be carried out by the police, right?
At the judge's discretion.
Well, when crimes have been committed through computer instruments or any other information technology.
That is, to this day, in our profession, practically everything affects us, right?
So, that you think you are being investigated because you are using some kind of strange behavior via WhatsApp or Telegram, well, the police can investigate you.
That they think you are trafficking drugs via Skype with your colleagues in Azerbaijan, well, the same thing is investigating the police and they have installed a trojan.
Currently, since the regulation is very novel, I have no evidence, no client has reached me yet, telling me that they have installed the trojan.
They will arrive.
If God wants, they will arrive.
And then, of course, this raises a question for me, right?
Once they have installed the trojan, then how do you know that they will delete it?
It is a question that I pose there in a crazy way.
And, well, to what limitation does it have?
What data do they take?
Hey, because the same thing you have a folder of the holidays of 2007 when you were in Punta Cana and, hey, the same thing does not go into criminal investigation.
Okay?
Well, that's what I point out there.
Then the subject.
The subject of the SEC-TSB, okay?
This refers to the subject of the police, the translation of the criminal type is as follows.
The police, the civil guard, the person in charge of that investigation, okay?
It will force service providers to reveal any information they have of you.
That is, if you, for example, have a page hosted with the typical WordPress or Joomla, that some of you do not use it there, but hey, someone who has it installed, and that hosting, that VPS, that server, the owner has it hosted in Spain, okay?
It can be, let's say, I do not know how to explain it, it can be forced a little bit to collaborate, okay?
It is instructed to collaborate, okay?
Because if not, it leads to a crime, okay?
Then there is a duty on the part of the service providers to collaborate with the justice administration.
What does this mean?
Well, if your service provider has your passwords, it has to be facilitated to the police so that they look at you and review you well, okay?
But there is a point within this SEC-TSB, okay?
That says the following.
They will only be able to declare against, okay?
The obligation to declare the people who have a relationship, in this case, your husband or your wife, okay?
And then those who are within 416.2, in virtue of the professional secret.
That is, if I am a lawyer, and I also own a company of an ISP or a hosting, and you are my clients, well, I, as your defense lawyer, could never give the passwords to the police, okay?
Because the professional secret is above and protects you, okay?
It's a pretty, pretty good thing.
That's why you have to have a lawyer who always defends you and defends your specific interests.
And then you will say, well, how long does this measure last, right?
Well, at first, a month, okay?
These are not phone calls, these are not phone calls or correspondence.
And it can be extended another three months when it is done in an argumented way by the judge.
Some briconsejos, as you would say of bricomania.
First, anonymize.
Anonymizing does not mean installing Tor.
Tor, you know, has a lot of holes, okay?
If you want to do something that is not within...
Well, if you want to protect yourself, okay?
We are not going to say to do something illegal, because obviously that is not.
If you want to protect yourself, well, first you have to have some minimum security measures.
Then you have to encrypt, okay?
Do not leave things unclear.
Do not put the post-it on top of the screen with the 1, 2, 3, 4, 5, 6.
Then, last but not least, trust your lawyer.
If you have any kind of situation in which you feel violated, well, you have to talk to him, who is the only person you can trust, okay?
Another point that calls me are the undercover precops.
What does this mean?
Well, this is something that the legislator has introduced, very American, okay?
We are tired of seeing series in which the policeman puts on a dirty jacket, he paints his face, he looks like a junkie, and he is already an undercover policeman, right?
Who traffics with drugs in Miami, right?
Well, in this case, the figure of the undercover agent, who tries to imitate, in my opinion, the American legislator, says the following.
When can the figure of the undercover agent be used?
Well, when there is organized crime, and what is understood by jurisprudence as organized crime, would be three or more people who permanently commit criminal acts, okay?
That is what jurisprudence says.
Then, for the undercover agent to act, a judge has to designate him.
That is, the chief of police cannot come and can say, hey kid, the last one who has arrived, put on that dirty jacket and go to the street to kick the streets or get into the computer, and now you are an undercover policeman.
It cannot be.
If the measure has to be taken urgently, it would have to be the prosecutor who authorized it and then gave account to the judge so that he had constancy.
It must be with a founded resolution.
The judge must give a founded resolution and that there is a need for that investigation.
Not in all cases this assumption is fulfilled.
And for how long?
Well, for six months and then it can be another six months.
Okay ?
It must always be proportionally and without causing the crime.
That is, what the police cannot do is upload, for example, pedophilic files at the most serious level inside your computer and then incriminate you.
Okay?
That cannot be done because it is against the most fundamental rights as people.
I do not believe that the forces of the State Security Service do it because they are well aware that this type of situation occurs.
It is difficult for me because I know several of them within the units of the groups of telematic crimes and they do it in an incredible way.
Then, to finish, what are the problems that I understand these telematic crimes have of which I have been commenting.
First of all, the globality.
Secondly, the simultaneity.
Thirdly, the anonymization.
The traceability of the money.
That is, I, who am the owner of a botnet in Russia, how do I make the money get lost from your account that you live in Albacete to my account that is in the Cayman Islands?
How to avoid it?
Well, there are different ways.
Bitcoin payment, MoneyGram, PaySafeCard, everything that can be used so that the person who has been the victim and the final recipient of that amount of property money or the final recipient of that botnet in this case.
And also, another thing that I currently see in Spain in particular, which is what I have been referring to during the whole presentation, the criminal processing tools that we currently have at a global level, at a state level, are outdated and useless.
Or they are of little use.
For example, the begging commissions.
That is, if I, for example, insult another person on Twitter, Twitter is based in the United States.
And then the police, if they want to locate me, what they have to do is request a begging commission.
A begging commission means that it gives priority to a judge from here, sends it to the United States, the United States answers it and sends it to the appropriate company.
The appropriate company says no, that it lacks some data or that it simply does not understand it as a crime, that it does not provide the data, returns the information, and all that has been more than a year and a bit.
Okay?
So, it is a little agile mechanism and, evidently, there is a certain amount of high crime that is impugned by this lack of international process mechanisms.
And, in the end, what we thought, that these policemen, these robocops, that they intended to give us the new criminal regulation, in Spain, well, it is useless, and, in the end, they are like toy guns.
And nothing else.
Thank you all very much for listening to me and here I am to answer whatever you want.
Hello.
First of all, thank you for the talk.
And my question is the following.
How does the Spanish legislation contemplate hacktivism when it comes to combating terrorism, as it has happened now with Anonymous and Daesh?
Well, look, the Spanish legislation understands that those who have to fight terrorism on the Internet have to be the forces and security forces of the State.
That is, this morning I gave a presentation to the Joint Cyber Defense Command for activities that are related to the military field and, on the other hand, the Instituto del INCIBE, also the Guardia Civil, are they, with their special units, who fight.
That is, today there is no legal mechanism of communication between the good person who wants to collaborate and provide information about what he has knowledge in the Internet forums, reads the chat, reads the forum, reads Twitter, whatever, reporting.
Why?
Because, in the end, the user who participates in those actions of hacktivism is going to end up farting.
My recommendation is if you see that there is a need to communicate it because it is a very serious act, you communicate it directly to the Guardia Civil, to the Telematic Crimes Group, to the Guardia Civil, who have a very fast response and, most likely,
they will help you to overcome that situation that you think can put in danger the rest of human lives of the civilian population.
Thank you very much.
You're welcome.
You can ask.
Nobody is going to eat me.
Hi, how are you?
Hi.
In the end, I wasn't very clear when you said those of us who have tools like Scaneo, like Metasploit...
Yes.
I wasn't very clear what can happen or what we have to notify or what we have to do, how we can protect ourselves, etc., etc.
You can have the tools.
Okay?
What you can't do is audit the neighbor's security without his consent.
You can't do that.
You can't audit random pages, Tumtum, or modify, for example, the prices of the websites to make it a little cheaper.
You apply the Brad Friday, right?
You can't do that kind of thing in quotation marks, right?
So, of course, the company hires you to audit the security, to put it in writing, and then audits it within the terms that were established in that merchant contract.
If he doesn't give you permission, then, probably, if the company has the right proofs and follows the right procedure, then, he gives it to you if you haven't anonymized properly and you get involved in a rather curious mess , either from 197.1 or 264,
if you have installed, for example, a ransomware in a good way.
Okay?
Very good.
Up.
Oh, sorry.
Very good.
Like the locksmiths, they do have a professional card to be able to...
Yes , if you can talk to me a little bit.
There, louder.
Okay.
Like the locksmiths, they do have a professional card to be able to have their own picks.
The IT people don't have a professional card to be able to use the tools that are inside the ethical hacking, the forensic analysis, etc.
So, many times, when we collaborate with the police, they can ask us for things that are, let's say, what we have to use, the tools we have to use are outside the law.
How can we not get into trouble or how can we protect ourselves from that?
Even the same tenancy of, for example, an investigation against counterfeit notes, the same tenancy of a counterfeit note that you have to put in your certificate is already a crime, you are already committing a crime.
Then you have to delete it, supposedly, when you deliver it, I understand, okay?
But, of course, when the trial comes out, you also have to have the certificate that you have delivered to read it and then declare it, the same tenancy of that certificate, I insist, goes back to another crime.
How can we professionals act not on the basis of the law but with the law to help it?
Let's see, what I was saying before with the colleague who has also asked the question in the same direction, how can we collaborate with the police without being stopped, right?
Because we have gone a little beyond our curiosity.
What I understand with my friends who have computer expertise is the following.
They are curious in themselves.
So, you want to go a little further.
What happens?
When you want to go a little further and they have not given you the authorization, you can see yourself in a problem.
It is what the law tells you .
I can not give you other answers, okay?
Do you want to venture?
You venture.
Do you want to do it?
You do it.
Can it be exposed?
Yes.
Okay?
Everything is, also, many times, nowadays, as there is not a specific regulation and as there is not a path marked by the law of collaboration, there is not a hacker carnet where it is proposed, for example, in another type, well, some of you will know other types of communities where this is talked about.
There are representatives who want to create the hacker carnet so that the one who is authorized, etc., etc., can collaborate.
I understand that the one who has computer skills will not agree with that position because, obviously, it is quite limiting and it will exclude.
There is a sector of those who are dedicated to computer skills that will be excluded if it does not have that hacker carnet, right?
What happens?
When you have knowledge of a criminal act, you put it in the knowledge of the law.
What you cannot do, or I understand that it would be a little wrong, is, if you have committed a criminal act, you put it in the knowledge of the law because , well, you are messing around a little, logically, logically.
And that, within putting it in the forensic analysis, providing it, I do not know how far you want to go into the branch and such, I would indicate it, what I would do would be, in that expertise, I would indicate the milestones where that line of investigation could go ,
provide it to the Civil Guard and that they or the National Police with their brigade of telematic crimes, investigate the case and deepen that for that they are.
I think that with that answer I answer in a way, it is not the answer that I understand that you want that I give you, but in which I must give you according to my experience.
Yes.
Here.
Apart from that I could get you in trouble if you have here your Kali with your things and...
No, no, you can have it.
No, no, you have it, but if you dare to put quotes in the web to make you black friday...
Of course, he has the syndrome of the quotes.
Hey , they said that...
they said, it is read out there, I have heard that also if you do a simple video tutorial saying how to blow Wordpress with any tool and someone comes and sees your simple video tutorial and blows Wordpress or something.
right ?
I understand?
Yes, an educational video, simple, beautiful, with colors.
Ok.
In a virtual machine, your own?
Of course, but if someone comes and blows Wordpress, I don't know...
That is your property?
No, no, another one.
Someone sees your video, blows group and says, no, but I did it with this video.
I think they could also make fun of you because you showed it to them.
No , no, not in this case.
I understand that no.
I understand that my opinion is my personal.
There will be other colleagues who discredit the same and there will be other people who are much more understood than me and say that it can be typifiable, it can be frameable.
So, I understand that no, like, anyway, I can teach how to shoot in a shooting field with a video tutorial how to shoot the pigeon, but not for that, because I teach how to aim with the sight with a Beretta, well, you use a machine gun and learning that system you start shooting by people.
It is a very abrupt example, but I think in a way you could make an analogy and obviously I don't think it fits.
Ok?
Ok.
Hello, good afternoon.
Look, I wanted to ask you, I can audit the security of my website, of my domain, taking into account that this is in a hosting provider and that in turn I am also detecting vulnerabilities that are part of the hosting service itself , which is an American company,
etc.
Ok, if you, for example, you are auditing your own website, you can do it perfectly locally.
What you could not do, for example, is that the admin comes dosing, for example, Amazon services, because you have it hosted there, or OVH, because you have the domain of Hostinger or of any of the other hosting providers that are usually used in the day-to-day.
If the audit goes a little beyond your hands, the same thing happens to the admin who is a little confused and has realized that there is a traceability between your IP.
I understand that, well, I understand that few people will audit a system with their own IP of their home so that they come to look for it.
But, well, if you do it, it goes out of their hands and starts this, there will be a log that links the attack that that service provider has suffered with you.
And if that admin wants WhatsApp and the owner of the company can look for it, they can look for it.
Do you want to audit your own website?
You can do it, you can install it locally and you do it, ok?
I think it is the most reasonable thing , ok?
Well, thank you all very much.