where you were and September 11
2001 the day of the fateful attack on
the twin towers but almost certainly
would bring us two you were on 12
May 2017 because maybe for
you were not such an important day
although it was agreed and from this
global cyber attack that has not stopped
of talking to each other since then I do not feel
that has occupied the covers in the middle
generalist the news in all the
world
well let’s see what happened
May 12 , 2017
start running on social networks
twitter groups the telegraph lists of
mail first media echo
telephone a multinational like
I do not have many friends
those like chema alonso that is a
big and other hackers working there
Send all your employees to turn them off
team go home basically and warn
to another partner
through a message on the internet and
from the public address services not
like movies like this robot has
seen my dog bo
well this happens to a lot of people
many companies would have some left
more there was more than one that we are going to
your joy does not call the woman or
we would arrive at the beach that is something
before but the normal thing was happening
that day was that this happened, the
panic was not happening a company
as a multinational telephone company
this caliber that also provides service
of safety of its employees that turn off
the teams that are leaving let’s leave
to work and let everyone know
by loudspeaker
well we started to find out
start now
as I say the groups that have lists
of emails that we collaborate with
means like me right away we call medium
to do that has happened and first thing
What is this?
a ranch on the web this is a term that
many of you now will have to
incorporate into our vocabulary the
year since May 12, 2007 but
a term that does not come ringing ago
years for the term ransomware not but
the word crypto what torrent what
some sure that has suffered this knows
to someone who has suffered this type of
virus malware ambitious program that
hijacked your team’s information
and asks for a bailout in exchange
that’s why it’s called ransom in English
terrazzo good this is what first
we knew in an attack of this kind a
ranch on web
start to spend a little talk about
other organizations the ibex 35 has
affected some false rumors others
Certain then in the afternoon we will talk
involvement of the health service
British also infected
many other entities throughout the
world fedex motivations like nissan cds
and a virus that is spreading
spreading all over the world is not a
madness from day to day we go to heart attack
I as I say particularly many many
media communication interventions
these are the media around the world
echoing the news
that day it was crazy it was like
take him when the office burst 10
of the night trying to attend to all
the means that call us asking
What has happened
what is this the web ranch why and
why an organization like
telephone other organizations so
leading edge may have been the victim of
this is not this is the big question
at the end of the summary the executive summary
and
we talk about a threat of a virus that
has affected more than 230 thousand computers in
all the world
150 countries and how why and what
the difference with other attacks like
I say for many years some
you have heard about Christ
what this type of malware but with the
difference that was happening no
this is the big question that all the
world was good when I started to
began to investigate more strikes in
reverse engineering of this the people that
is dedicated to this was discovered many
things did not discover the famous kill
switch you will have read it in the
newspapers
that young German who got
disarticulate make the infection
stop by registering a domain in
Internet
a domain that checked the virus
when checked check if the domain
it existed already existed it stopped well what
more things were discovered and even it
discovered that the malware is wrong
fact
imagine huntsman web that has problems
in the code in the code design
has managed to put in check half
I do not like the world because it’s badly done
because if any of you is
infected and I wanted to pay the ransom for
get the information in return
the problem was that the malware is not the
They also did not have the
identifier to be able to identify
customers in this case do not
extorted people could not
return your information
but why this is good the
program made use of a very one way
famous an exploit that has become
fashion that is called eternal to blog about
he read in newspapers
you have heard talk let’s see a little
what is this not
first because they pass the attacks take me
and they put the talk that you have seen
before it talks about three types attack
the attacks that are aimed at
get economic profit
it’s first motivation
cybercriminals the economic profit the
money there are other attacks on activists
activist activists who use the
network to manifest and to achieve
impact and notoriety
now we will talk about some of them and
other attacks aimed at control at
power
the attacks that governments make
intelligence agencies agencies
espionage
it sounds true is good venezuela
many things about how to
they produce attacks in magic and
methodology
You think hackers are really magicians
that there is a mysticism component
associated this really is not like that there’s
a failure is worth a vulnerability that is
start from our world a mistake a
human error
there is an operating system that has a
patch without installing a program there
what is wrong and what can be done
take advantage to insert code there is a
user who has a password
1 2 3 4 5 6 and a user who leaves the
security question with the name of
your dog and everyone knows what there is
a service that is without a password
wifi network open a dream that is
install something that does not have to be
install or that pricked you do not have to
to click is how it goes and what they do
the bad ones and exploit this vulnerability
and the programs that are used to
exploit the vulnerabilities in what
it’s called as exploits well in this
world happens that when a researcher of
security
discover a vulnerability and make a
exploit discovered the program exploit
that exploits be a reality can do
several things you can report to
maker
for example microsoft do not take it then
from 20 thousand dollars 10,000 dollars
even a shirt depends on the
severity the vulnerability can
save for yourself you do not know if
is exploiting it power
in the vulnerability market or
anomalous and what happens with this is that
a vulnerability that is not known to
manufactures nation we heeding
our world a 0-day exploit all
that everyone thought about this a
exploit zero day like all this
organization is being violated
it really was not an example and only he
but to an exploit that was not known that
It happened in March of 2017
a month ago and microsoft got a
patch to be an ability that already
famous that more 17 and 10 days very very
famous and a month later there is a group
activist as i said machado brokers
that he had also heard a lot
sure they said they had
plundered to the want everything to be
they started doing an auction to put
for sale all the most tools
well be April 2017 assumes freed
a lot of tools released the
exploitation framework that uses the
people be it’s called football and what
let’s see now and between them a
exploit that is called eternal to the blue and
another one called the pulsar
what is it that the bad guys used to
achieve that time there was a patch
there was a patch to protect this
Mining in March 2017
what’s wrong now curiously
big organizations like cds
as a common telephone and sanz as the
móttola rail service
organizations is more difficult than
they update all their equipment that we are going to
an SME a user an organization
small because they are organizations where
corporate services are provided
platform computers for a lot of
applications and any change you have to
do it in a planned way and
coordinated for this is something that at
better to many it sounds weird but it’s
as well as they go is not why I celebrate
impact that occurs a kind of
cocktail of things that this bug had
this good face that put in check to
half the world and he taught us that all this
it can happen that happens that are exploits
that he pulled out he already managed to have the
agency had it a long time
microsoft published the patch in March
but how long can the
energy using your example and to
enter our computers to
access our information
let’s see now how these work
exploits we’re not going to see a clear and
let’s see a demonstration of how
that ‘s what it has, and what is it
that does well
this is the victim machine you see it with
this ip
the 1 134 105 this is the machine of the
bad the attacking machine when I do
well this is the famous football a lot the
risk exploitation of the need
this we are here loading you see
are the tools the church that already
achieved that it is public and that we are going to
use to violate the computer the
ip address the law so they see that
There is no trap or cardboard
wolverine 19 834 105 the ip address of
this machine 43 we tell you not to
we say that if we say yes
yus eternal blue the famous
vulnerability of which the whole world
is talking now that if it ‘s for
defect well what happens with the others
do not go well as long as the
there are running may fail moment of
maximum tension if you see take place there
complete july bad have light axis
we are inside not for the moment here has not
past nothing
Wolverine nothing now let’s use another
which is called double pushbutton which is the
another to inject code that we’re going
to do we have exploits a vulnerability
that had that machine the machine
victim and we will inject a vélez
for a library with malicious code
to get control of the
computer
then we say that yes we say that
yes again yes it’s worth x86 is vélez
I have already prepared because if it
we make more every day
I do not have time just the mangueta in
this process and we will give you vouchers
access access access foot
here you can not see anything has happened and in
this other third attacking machine says
initial here to james do not activate well
agence interart is the connection of the
machine
Copy right let’s see if we are inside
if now we are going to inject another code
with the the cob that a code that
use to access the code
who injects the victim tomorrow what
what we are going to do is inject a faithful
with what allows you to activate a
very famous Trojan uses a more world
sure he is going to get imprisoned in eta
exploded then put prisoner here
waiting
does not make bay too crazy and now what
I am
once I’m inside the machine
next to this and warning
what allows me to have more access
comfortable and to have a Trojan inside
The machine las playas de valencia
You can use to create or to
control the machine do what
it wants is here is
we are inside that puts the
interpreter we are inside machines
and info here you do not see anything nothing happens
I ‘ll put you here or the team
barcelona nothing I go here I put
screenshot ebay I have a screenshot
here x open days that is true
six screens or you have to maximize a
little of that out there
olate that barcelona is not seen so that
you see that there is no trap or cardboard
I’m inside the machine you can
do a lot of things of mine list the
process upload files pulsations of
keyboard or open up I’m going to migrate
right now I can get the hashed from the
machine
that is to say the passwords faults that are
Call as windom store passwords
in the four banners but also
fixed he could get it out of memory
if I am I am the user of this
machine for example jack and locke and me
record imagined a long time ago I did not
I registered here today with the
password once they put same
well more things we’re going to look at
process the scene and a half and this
Sometimes it works sometimes you do not know what
here there is no magic good if it leaves me
the calculator that is what we like to
the hackers now the calculator
this calculating law
going back to what we are talking about already
I have very little left to finish this
to continue happening to create us the first
of the attacks that has been going on
a lot of time what happens that many
people on foot the great social mass does not
they knew impact that attacks can
have someone may have been
using all the tools to
monitor our conversations
for a very long time and it’s not going to be
the first nor the last
so fasten the belts the
reflection that I wanted to do is this
they do not want to control the world who
has the power because in this case of the
organizations that have the potential
to have these explosives and they are worth
those who can access to have all
these resources do not
the question we have to do and
was going to be the first one is going to be the last
we are ready, all of us are
aware
we have to be aware that they are
susceptible to being violated in some
occasion and that this has not done more than
start
thank you very much
to
”
Be First to Comment