Press archive

On Cruce de Cables, alongside Rafa López, I explain that bot farms are places with hundreds of thousands of devices, usually phones, hired to inflate likes and comments and game social media algorithms, or to generate fake visits to a company's ads so it spends money with nobody actually seeing them. I recall that when Twitch started removing them, around a third of many streamers' traffic vanished, and I warn that in politics this viralised content pulls you into a confirmation spiral that gradually changes how you see the world. Anyone with a few euros can buy interactions on the regular web, even choosing the country, and more tailored services on the dark web or Telegram, although real psychological warfare is carried out by states with their own teams.

Disinformation and digital risk →

Rafa, the Cibercapitan, and I took to the CCN-CERT's STIC conference, the centre under Spain's CNI, a talk on hacktivism and psychological operations in cyberspace. We showed the real conversations we held with four pro-Russian groups, among them NoName057(16), which I link to this year's attacks on Vitrasa and the councils of Vigo and Lugo. I stress an uncomfortable idea: these aren't four kids at home, they're highly organised, resilient people who live for this out of conviction, and they attack Spain for its support of NATO.

Geopolitical risk and hacktivism →

Artificial intelligence is here to stay and will make a great deal of work easier, but with the speed at which it has entered our lives many people haven't gauged the risks. I'm an advocate of using it while being aware of the dangers of its misuse, starting with watching who we hand our data to. And I warn that cybercriminals already use it to automate attacks, sharpen scams in any language and build deepfakes that impersonate identities.

AI and cybersecurity for executives →

Groups that on paper detest each other, pro-Russian hacktivists, jihadists and those aligned with China or Iran, set aside their differences and coordinate under a single banner to strike the West. In this report, tied to the National Cryptologic Centre's conference, I explain why that alliance works: each one believes it's doing the right thing and they're all united by a common goal. They range from denial-of-service attacks to the theft and sale of company and industrial data to the highest bidder.

Geopolitical risk and cybersecurity →

In this interview I go over what drives me after more than two decades in this field: as I often say, some people simply don't want to watch the world burn. I argue that cybersecurity is an inherent part of the business, that sooner or later we'll all be vulnerable to an attack and that there's no longer any separation between digital life and physical life. And I stand up for hacker culture, community and privacy, because privacy is essential to being free.

Who I am →

In this interview at the CTV Forum in A Coruna I make a point I never tire of repeating: security is not an expense, it is part of the design of any project from day one. I also warn that Spain has let the artificial intelligence and cybersecurity train pass, and risks missing the quantum one too. And I recall a figure that still stings, the British company that lost twenty-four million euros to a fraud using synthetic voice and image.

Cybersecurity for boards and management committees →

In this Espejo Público report on the black market for medical records, within just a few minutes I reached an advert selling data recently stolen from a hospital in Dubai. When I'm asked what a patient can do to prevent that theft, the answer is a hard one: unfortunately, nothing. The guarantor of that data is whoever holds it, hospitals, clinics and health systems, and as end users we depend on what they do with our information.

Data protection in critical sectors →

AI plays on both sides: it drives up the sophistication of attacks, but it also lets us defend ourselves better. I show it with a real case, the fake video in which Marta Ortega offered a supposed miracle investment opportunity, and I explain that today it's enough to run the link through a detector to see it's almost certainly fake. On the defensive side, a computer receives thousands of attacks a day and without AI it would be impossible to review them one by one; with it we extract patterns and tell the real from the false positive.

AI and cybersecurity for executives →

In The Wild Project's summer special I go live into the deep web and the dark web with Jordi Wild. First I explain the difference between the surface, deep and dark web, how Tor chains three encrypted nodes, like linking three buses where the last driver doesn't know where you came from, and why it's worth booting from a USB stick with Tails, which runs in memory and encrypts whatever you save. I show that Tor also hosts perfectly legal sites, such as the BBC or ProPublica, which serve people living under censorship, and I criticise the mass blocking of Cloudflare IPs that LaLiga imposes in Spain during matches.

Hacking and outreach →

I was part of a commission of twenty experts that reviewed and strengthened the City of Malaga's Cybersecurity Strategy, alongside people from Madrid's Cybersecurity Centre, the State Digital Administration Agency and the Bank of Spain. What I liked most is that Malaga doesn't stop at the technical, it also works on the social and awareness side. I hope more cities take on this kind of initiative and don't limit themselves to following the national and regional ones.

Cybersecurity strategy →

Twenty-five years after the 'I love you' virus, which spread by email to millions of computers in May 2000, I recall on laSexta that IT security was then in its infancy and in many countries was not even regulated by law. Today the picture is very different: cybercrime now moves more money than drug trafficking and arms trafficking combined.

Cybersecurity risk →

After Monday's great blackout, on Cruce de Cables I explain that technically anything connected can be hacked, and I recall the attack that took down Ukraine's power system in 2022 and the 2010 attack on Iranian nuclear plants, while urging care with attributions. A kid at home could do it with the right knowledge, but states seeking to destabilise a country are usually behind these attacks, and the worrying scenario would be a surgical attack triggering a cascading failure; the first signs would show within 24 hours if logs exist. I warn that SMEs working with large companies can serve as a gateway, that NIS2 will bring many more sectors under obligation, and that a real attack would have lasted longer, perhaps even as a distraction while pursuing another goal.

Critical infrastructure and risk →

On the great blackout of 28 April I stayed cautious: I lean more towards a technical fault than a cyberattack, among other reasons because industrial networks have no direct internet access. I rule out that groups like Dark Storm or NoName, which claimed it on social media, had that capability, because their thing is denial of service, not bringing down a power grid. And I add a thought: if a government wanted to destabilise a country with a blackout, it wouldn't do it on a Monday, but on a weekend, when the technicians are off.

Cyber-risk oversight →

When half the peninsula went dark, many rushed to talk of a cyberattack. In this piece I put the brakes on: if it really had been an attack, we'd know where it came from, with the diplomatic consequences that drags along. I go over the real precedents, like the blackouts caused in Ukraine with malware such as BlackEnergy or Industroyer, but I remind everyone that a technical fault is still the most common explanation.

Cyber-risk oversight from the board →

On La Hora de La 1, the day after Spain's blackout, I explain that not enough time had passed to know what happened and that we had to follow the technical channels. I describe how an intrusion into an industrial system is investigated: the affected company's teams, helped by law enforcement in advanced cases, contain the attack, clean the network and restore it through public-private collaboration. I warn that attributing an attack is always complex and that many people take advantage of the confusion, and I recall precedents such as the 2010 attack on nuclear facilities and the 2016 attack on Ukraine's power companies.

Critical infrastructure and cyber risk →

I explain for Newtral what tabnabbing is, that phishing technique which changes the content of a tab you've left open in the background in order to impersonate a website and steal your credentials. Behind it is a piece of JavaScript that rewrites the page while you're not looking. On mobile it's less likely to happen, because of how browsers manage battery, and the best defence is to keep your software updated and always check the website where you're about to enter your data.

I'm collaborating with the European AI Office on drafting the first code of best practices for general-purpose AI, alongside a thousand experts, companies and member states. I take part online from Vigo in the risk and cybersecurity groups, because I want the technology being born to be secure and for no one, governments included, to be able to manipulate its results. I don't draft the text, but I contribute ideas and debate to the people in the working groups.

AI regulation (the AI Act) →

Following the arrest of the man who hired a hitman on the Dark Web to disfigure a woman in Pontevedra with acid, I explain on COPE Pontevedra the difference between the Deep Web and the Dark Web. The Deep Web is everything that doesn't show up in search engines, such as password-protected pages or databases, and it makes up most of the internet; the Dark Web is easy to reach with Tor Browser. But I warn that half the people there are criminals and the other half are police hunting them, and that the hitman advert is often a police bait waiting for the gullible to fall into the trap.

Hacking and cybercrime →

The Hellcat group, which appeared in late 2024, got into Telefonica's internal ticketing system using compromised employee credentials and made off with some 2.3 GB of data. In this analysis I offer a reading worth keeping in mind: an incident like this hits mainly on the inside, the company's own operations, more than its customers.

Can deleted messages be recovered from a phone? In this article I explain it without the smoke. Carriers keep the metadata of calls and texts for about twelve months, but not their content; the rest is the domain of the digital forensics expert, with tools like Cellebrite and cloud backups. And I add a key nuance: within a couple of days you can tell what can be extracted from a phone, though it's often a matter of hours.

In the interview with O Economista, the magazine of the A Coruña Association of Economists, I argue that companies and users turn to professionals when it is too late and the damage is already done, and I warn that many firms fall under the obligations of the NIS2 Directive without knowing it, exposed to cyberattacks and to hefty fines. I discuss the CrowdStrike IT outage as proof of our dependence on the supply chain and ask whether Europe is technologically sovereign. I also explain how NASA sent a friend and me a letter of thanks for finding a flaw on its website through its public programme, and I present cursodeciberseguridad.com, the training community I am building for non-technical staff.

Cybersecurity for executives →

After Roja Directa was ordered to pay 31.6 million euros to Mediapro for streaming LaLiga matches from the 2014-2015 season, I explain in ABC why football piracy is so profitable: it's a multimillion business at zero cost, because maintaining and hosting a website is trivial when you get millions of visits on the day of a Clásico or a final. I also point out that Russia is the pirates' favourite destination, as it has no jurisdictional agreements with Spain and taking a website down there is far harder.

Digital risk and geopolitics →

At this Quincemil Tech Meeting I drop a figure that tends to throw people: if cybercrime were a country, it would be the world's eighth-largest economy by GDP, far above the drug trade. I explain how ransomware has become an affiliate business that recruits even people with no technical knowledge, and why buying expensive tools without staff to run them is useless. The point I want to land is simple: investing in protection always works out cheaper than recovering from an attack.

Investing before the incident →

With Sandra Estok I go over how I started at eight or nine, programming in BASIC, moving on to BBSs and FidoNet by modem and, in the late 90s, to the chat rooms where I met people passionate about security. To me a hacker is someone who looks for a use of things other than the recommended one, and it's a title others have to give you, you can't award it to yourself; even back then we warned companies and public bodies about flaws and published which ones had behaved well, what we now call bug bounty. I also talk about my work as an evaluator of European innovation projects and in an expert group on AI in connected products, and I warn: AI won't take your job, a person who knows how to use it will.

My path as a hacker →

With Martin Vigo I helped put together DanaCON Solidario, an online cybersecurity congress to raise donations for those affected by the Valencia floods. We brought together forty-eight speakers from Spain and Latin America across two twelve-hour days, with the donations going straight to Caritas, World Central Kitchen or the Food Bank. It wasn't the first: earlier we ran CoronaCON against covid, which raised forty thousand euros. Ours is a sector that pulls together.

My track record →

In this debate with Marlon Molina we go over the real state of cybersecurity without mincing words, beyond the purely technical. We talk about geopolitics, digital sovereignty and why regulatory compliance has become a critical piece of the defence. An analysis meant for those who have to make decisions, not only for whoever is sitting at the console.

Digital sovereignty and compliance →

I comment on the case of a man from Vigo investigated over a cyberscam with some three hundred victims across Spain, who opened online accounts with other people's data to move and invest the money without leaving a trace. I recall that for years now cybercrime has moved more money than the drug trade, so scams like this aren't done by people who are bored. My usual recommendations: proper passwords and a password manager, two-factor authentication and antivirus on every device, the phone included.

On the podcast Cuidado con las macros ocultas, recorded at the Universitat Jaume I in Castellón, I look back on how I started in IT security, when that professional role did not even exist, and I say you learn far more from failure, such as the company I set up around 2000 and had to close. I argue that cybersecurity is business in itself, that a good scare is usually what unlocks investment in companies, and that SMEs gain nothing from buying an all-in-one AI solution from an unscrupulous salesperson but need a plan suited to their needs; it was for them that I launched cursodeciberseguridad.com. Propaganda and polarisation worry me more than the security of systems, with the Cambridge Analytica case, and I explain how the bug bounty programmes work through which I have helped Google, Facebook, Twitter and the US Department of Defense.

Career and bug bounty →

I analyse for ABC how Mossad could have sabotaged Hezbollah's pagers to make them explode all at once. It had to be a lightning-fast operation: either they were pre-modified at the factory or done in a hurry, with a tracking code, because a shipment sitting still for long would have raised suspicion. I compare it to our storm emergency alerts, a first message so everyone takes the pager out of their pocket and a second one for the detonation. It was very well planned.

On the first edition of Cruce de Cables, on Spain's RNE, I talk about the letter of recognition NASA sent us for detecting a security flaw on its website through its bug bounty programme, and I explain that other programmes pay according to the severity of the flaw: in Spain there are people who live exclusively from this and some who have already passed a million euros. I argue that it is better to pay someone who collaborates with you than to let a criminal ransom your data or sell it on the dark web, and I recommend bug bounty to newcomers as a way to prove experience. I also explain that the word hacker was born at MIT's model railroad club and that, as good practice, industrial systems should be kept separate from the IT world.

Bug bounty and ethical hacking →

This piece tells the story of the friendly challenge I set my colleague Roberto Fernández, Darkandroider: to see who could find a flaw in NASA's systems first. Within a few days we each found one almost at the same time; mine was on the website of a NASA research centre and could have allowed its users' credentials to be stolen to access other websites and systems. We both received the letter of recognition NASA sends to those who responsibly report vulnerabilities through its disclosure policy (VDP).

Hacking and bug bounty →

It all started with some friendly rivalry with my colleague Roberto Fernández, whom I know from the bug bounty world: who would be first to find a flaw on NASA's website. Two weeks later we had both done it, a vulnerability that allowed NASA employees' credentials to be stolen and access gained to private systems and information, so a technical draw, and the agency recognised us with a letter. On my wall, instead of diplomas, hang the acknowledgements from Google, Facebook, Twitter and the US Department of Defense, plus the Dutch government's T-shirt, and I encourage young people to get into bug bounty to gain experience and build their CV.

Ethical hacking and bug bounty →

A colleague and I challenged each other to see who would find a flaw on NASA's website first, and we ended up tied: we both managed it at almost the same time and the agency sent each of us a thank-you letter from its headquarters in Washington. The one I found could have allowed users' credentials to be stolen, and it wasn't easy at all, because NASA has things very well secured. That's the beauty of bounty programmes: you open the door to a thousand eyes watching over your organisation's security.

My track record and recognitions →

On the same CrowdStrike incident I explain why it was so hard to fix: many machines had to be repaired by hand, and if you have five you do it, but imagine someone with two or three thousand. On top of that they broke a basic rule of the trade, never push anything to production on a Friday. It's another reminder that in Europe we depend too much on outside players and that we ought to develop some digital sovereignty, with our own services.

The global IT outage of July 2024 wasn't Microsoft's, it was a CrowdStrike error while updating its product, and it took down almost all our clients, even Microsoft's cloud. I take the chance to insist on our technological dependence: we live at the mercy of US antivirus and US cloud, they press a button and we're left with no access even if the data is in Europe. CrowdStrike is a cutting-edge company, but the fault was theirs, not a change in Windows.

Digital sovereignty and tech dependence →

I reviewed the technical documentation of the Digital Wallet the government wanted to use to control minors' access to pornography, and I dismantled the claim that it was anonymous: the moment you contact its server they identify you by the public key, and there's an ID field and the device's IP. If the government wants to, it will be able to know who uses the app. Besides, it's not much use, because it only affects Spanish sites and there are ways around it; parental controls would be a better solution.

I link the wave of attacks on Iberdrola, Telefonica, Santander and the DGT to geopolitics: lately we've been on bad terms with some countries, and Russia and Israel are among the biggest cybersecurity powers. The Santander case was a supply-chain attack, through a third party. I insist that organisations still see cybersecurity as an expense when it's an investment, and that behind this there are no hooded kids, but mafias out for money.

Cyber-risk and geopolitics →

In this report on the future of cybersecurity I bring the ethical-hacking view: we hackers are the good guys, cybercriminals the bad. I foresee more cybercrime for money and more scams with AI and deepfakes, and I recount the RootedCon demo in which my voice sounded like a CEO's in real time. I repeat two ideas that obsess me: since 2017 cybercrime has moved more than the drug trade, and we're dangerously dependent on foreign technology, because in a global conflict one button strips us of those services.

The future of cyber-risk →

Faced with the surge in cyberscams in Galicia I sum up the defence in two words: distrust and verify, or put another way, what you wouldn't do in the street don't do online. I warn that the bad guys already use AI too to clone voices and images in fake videos and fraudulent ads, and that we're working on apps to detect those forgeries, though they have all the time and money in the world. Strong passwords, different for each site, and two-factor authentication.

Google.org selected three of us from OdiseIA in Vigo for its Digital Futures Project fund, and I got to lead a group exploring how AI affects companies' cybersecurity. The goal is to create an easy-to-understand best-practices guide that helps them defend themselves better against attacks. I do it out of vocation, not for money, because the bad guys are about to have far more tools at their disposal.

My track record →

At the 3rd Spanish Economic Forum 'La Galicia que viene', in conversation with Pablo Grandío, editor of Quincemil, I advised companies to invest in cybersecurity specialists: it has always been a problem, but it never used to matter, and the risk has grown because everything is now digitised. I explained that behind online scams there are mafias that study their victims before attacking, in public administration even through tender documents, and that they recruit disgruntled employees as accomplices. I gave practical advice, such as never signing up anywhere with your corporate account or reusing passwords, and warned about deepfakes used in Teams meetings to impersonate the boss, voice included.

Cybersecurity for executives →

On Café & Pizza I go over my career: I was born in Paris, came to Spain aged 8 and started out programming text adventures in BASIC, moved through BBSs and Infovía, installed my first Slackware Linux in 1995 and gave my first talk in 2002. I recount my time in Madrid at a 100% Linux consultancy, the 2008 crisis that led me to become a driving instructor in Porto and how I ended up in management as head of security, as well as evaluating projects for the European Commission and sitting on an expert subgroup on AI and cybersecurity. I make the case for bug bounty as the extra mile after the annual pentest, warn that a CTF is harder than the real world and urge Europe to stop buying firewalls from the United States and Israel to gain technological sovereignty.

My career →

At RootedCON 2024, Daniel Fernández of Telefónica Tech and I showed live how easy it is to clone an executive's voice with AI. We effortlessly obtained the phone number of Juan Antonio Calles, CEO of Zerolynx, gathered his voice, which is plentiful because CEOs do lots of podcasts and talks, and used it to try to deceive his own company; although they had been warned, some fell for it. At the end, members of the audience recorded their own voices and heard them instantly reproduced in Calles's voice, using freely available tools such as Whisper.

AI fraud and deepfakes for executives →

In this interview I tell how I started at fourteen tinkering with Infovia and a chat room called Axis, when it was trivial to get into the PC of anyone connected by modem. I make the case that a hacker is not a criminal and that much of the technology we use, the internet included, exists thanks to hackers, and that won't change. I also recall a figure I repeat a lot: six out of ten SMEs that suffer a cyberattack end up shutting their doors.

How I see cybersecurity →

Telegram has become a bazaar where drugs, pirated football, pornography and even the coordination of attacks on companies and media all live side by side. In this report I sum it up bluntly: it's no exaggeration to say Telegram is the new deep web. And I point out where the real danger lies for the ordinary user, in the files you download loaded with malware.

With Daniel Fernandez I demonstrated at RootedCon how easy it is to clone an executive's voice with AI for the CEO scam. I gave the talk while a machine swapped my voice in real time for that of a well-known CEO, with a gaming laptop worth about fourteen hundred euros and free software. I warn that generative AI multiplies fraud, from phishing in perfect Spanish to the twenty-four-million-euro con a British company suffered, and that, while regulating is good, the bad guys will stay one step ahead.

Deepfakes and CEO fraud →

Here I argue that having a good cybersecurity posture isn't a luxury, it's what lets a company grow and keep fighting in the market. I recall a figure that should keep any executive up at night: six out of ten SMEs that suffer a cyberattack end up closing. And I warn against those selling magic solutions, because real security is about accompanying the company, not palming off a generic product on it.

Cybersecurity as a competitive edge →

In this Informativos Telecinco piece on the facial-recognition boarding that Vueling is rolling out at airports such as Barcelona and Madrid, I explain how biometrics works: the algorithms look for the features that set your face apart, so your face becomes like your ID card, because there's no other one like it. And I point out that in Spain we're lucky to have the Spanish Data Protection Agency, which ensures personal data isn't misused.

Privacy and biometric data →

I comment on the cyberattack against the Cangas town council, which began with a fake email to a civil servant and turned out to be ransomware, LockBit 3.0, that knocked out half the municipal staff and blocked the payroll. I suspect the same gang that shortly before had stolen data from the Galician operator R, and I point out there may be more councils in Pontevedra affected. LockBit is one of the most prolific groups in the world.

On COPE's La Tarde I discuss the case of Antonio Galindo, a small business owner whose email was accessed by a hacker who changed his supplier's bank account number within a legitimate thread, costing him more than 100,000 euros across two transfers. I warn that we make absurd mistakes as users, such as using the same password for everything, and that this fraud is routine, an everyday occurrence. My advice: switch on two-factor authentication and always check by phone that the account number is correct.

Fraud and business risk →

In this interview with CSO, held at the Cybersecurity Forum organised by Foundry and IDC, I look back on more than 20 years in cybersecurity, since the days when it was just a handful of geeks, and I defend the term hacker against its use as a synonym for cybercriminal. I argue that propaganda changes how citizens behave and that it is very important to be closer to the truth than to a tweet. I call for more collaboration with Incibe and CCN-CERT, homegrown European technology and more resources for law enforcement, I criticise Europe for over-regulating (the United States develops, China implements and we regulate) and I explain my work as an independent expert for the European Commission on the Innovation Council and the AI subgroup on connected products.

Geopolitical risk and cybersecurity →

Being spied on by our own side is no comfort: many platforms have some kind of back door for US government agencies, and we Europeans are in the hands of third parties. With TikTok the problem is China, where it's assumed the government accesses information whenever it wants, and storing the data in the EU doesn't fix it, because China can place an agent anywhere. I also warn about our dependence on clouds that aren't European: if in a global conflict the United States switches them off, our data comes to nothing. And one piece of advice: a mobile phone is not a toy, anything that's free turns you into the product.

Digital sovereignty and geopolitical risk →

On COPE's La Tarde I analyse the cyberattack on Barcelona's Hospital Clínic: these groups encrypt the data, first exfiltrate it to their cloud and, if no one pays, publish part of it to cause reputational damage. Paying gives them fuel, because these aren't kids at home, they're mafias that earn more than from drug trafficking. RansomHouse is being pointed to, although attribution is difficult, and I recall that two months earlier the group Killmilk threatened European hospitals over NATO's support for Ukraine. I find it strange, because attacking hospitals usually goes against their own code of ethics.

Ransomware and geopolitical risk →

I took part as a guest in the Decembro Maker Talks digital-culture gatherings, on the Ourense campus, within the provincial council's Emprende Makers project. The programme brought together cybersecurity, the internet of things, robotics, 3D printing and video games, with speakers from the sector and the presentation of the Talento Maker awards.

With Jordi Wild I go back over my beginnings: I programmed text adventures in BASIC, connected to BBSs and FidoNet by modem and, with Infovía, reached IRC, where at 15 or 16 I joined Hispahack as its youngest member. I tell how the group changed the front page of congreso.es after Trillo's famous «manda huevos» remark, and how it all ended in the Hispahack case, which saw logs begin to be accepted as court evidence and in which nobody was convicted. And I explain with simple examples flaws such as SQL injection or uploading a PHP file disguised as a CV, which still exist because in the rush security gets left for later, and later never comes.

My path as a hacker →

On Mediodía COPE, following the hack of Spain's General Council of the Judiciary and its Punto Neutro Judicial network, I explain that the figure of 40,000 attacks a day in Spain does not mean they all succeed or that we are weaker, but that we see and detect them more. I point out that preventing these attacks is complex and requires people who handle the technology and keep watch. And I explain why 70% of victims are SMEs: for budget reasons they leave security until last and lack awareness, when their very survival tomorrow depends on it.

Cybersecurity risk in business →

On TVG's A Revista I start with a clarification: those who attack companies are not hackers but cybercriminals, mafias that also traffic weapons or drugs, and cybercrime already makes more money than drug trafficking. I mention the intrusion at Spain's General Council of the Judiciary and one at a clinical system in Catalonia, explain the fake boss scam demanding an urgent, secret transfer, and recount how a Tesla employee was offered a million dollars to plug a USB stick into its network. To protect themselves, companies must first look inward and have a head of cybersecurity, a role I doubt even 10 or 15 people hold in Galicia, and if they lack the maturity to have one in house, turn to Galicia's cybersecurity SMEs.

Cybersecurity for businesses →

I received the Pericia Tecnologica award for communicator of the year in Cybersecurity, presented by the PETEC association at the National Police Academy in Avila. It's recognition of twenty years spreading the word, training and organising events like ViCON. It happened to mark two decades since my first talk on Linux and security, so it was a path that led somewhere.

My track record and recognitions →

On Tech Tok I discuss the finding that the in-app browsers of apps such as Instagram, Facebook and TikTok can record what we do: Meta is no charity, it lives off our data and our behaviour, and we accept that when we sign up to its terms. I explain that, although WhatsApp encrypts conversations end to end, what interests them is the metadata: they know that you and I talk, when and at what times, and that information is far more powerful. My advice: copy the link and open it in the browser we always use.

Privacy and personal data →

I took part in the closing of the first edition of the University of Vigo's industrial cybersecurity specialist course, a one-of-a-kind programme in Galicia that sold out its places with working industry professionals. Siemens described that first cohort's job prospects as strong.

On how threats will evolve, I think there'll be a specialisation by sector to reach more customers: the malware of the future will target industries, governments and political parties, to get more return on the effort. I also expect a rise in supply-chain attacks, driven by economic interests according to what the market demands.

On Radio Galega's Galicia por diante I explain what Pegasus is: spyware from an Israeli company, NSO Group, sold to states and police forces, which in its newest versions gets into a phone with no interaction from the user, for instance just by receiving a video on WhatsApp, and gives access to the microphone, camera, documents and location. It relies on exploits only they know about, which is why my advice is to always keep the system and apps up to date, and anyone with suspicions can check using Amnesty International's toolkit, which investigated the case with Citizen Lab. I give figures such as 500,000 euros to sign up for the service and another 650,000 for ten attempts, I recall Hacking Team, whose client list published by WikiLeaks included Spain's CNI, and I repeat that we have been in a kind of cyber cold war for years.

Geopolitical risk and cyber espionage →

On COPE's 'La Tarde' I explain the other side of the QR codes that became widespread with the pandemic: they aren't that secure, because anyone can generate one on a website with whatever URL they like and stick it over the original. If that happens at a bank's door, whoever scans it can end up on a fake site resembling the official one and hand over their details, although banks' authentication stops many attacks. We fall like flies, but common sense and a decent app that tells you which website it will take you to are almost always enough.

Hacking and online scams →

In the middle of the panic over Russian cyberattacks following the invasion of Ukraine, I call for calm against the alarmism: many of those measures have been advised for years. I warn that not all the mafias are in Russia, there are some in Spain too, and that they range from the petty scammer to the organised super-mafia. I sum it up with an image: burglars don't go for the house with the most alarms, but the least protected one, and the mafias are after cash, so they attack the least protected system.

I explain that for some time now we've been living a cyber cold war with Russia and China at the front, and that attacks on the media have grown, because if you control the information you've won half the war. I warn that utilities and banks will suffer more attacks as essential services, and that many gangs are backed by governments. Against that, common sense: antivirus, two-factor, VirusTotal and keeping everything updated, because 100% security doesn't exist, but you can put up obstacles.

On the cyberwar in Ukraine I play down the drama: there have always been cyberattacks, I don't see any special surge against ordinary citizens. In Galicia, with Amtega, civil servants are fairly secure and a lot is being done, like the Galician cybersecurity hub, though resources are short. I warn that NATO should be careful, because attributing an attack to a country is hard, with plenty of false flags and murky interests in play.

I comment on the cyber dimension of Russia's invasion of Ukraine, the first hybrid war between countries. I confirm that the Russians were launching denial-of-service attacks against Ukrainian entities and that this was spilling over onto its banking too. Even before the tanks arrived, dormant trojans had already been triggered in Ukrainian servers.

I explain how to escape the phishing and smishing that impersonate your bank: behind it there aren't two bored guys at home, but well-organised mafias playing cat and mouse. My rule is simple, if you're not expecting any delivery, that email isn't for you; and faced with any alert, always go to the official website instead of clicking the link, checking that the domain has nothing to do with the real company. Different passwords, updated software and, when in doubt, Incibe's 017 helpline.

In this interview after Ciber.gal I argue that a hacker is always a good thing: a curious mind that wants to understand how things work, and whoever uses that knowledge to do harm is a cybercriminal, not a hacker. I warn that companies aren't prepared and still treat cybersecurity as an expense when it's an investment, because this isn't only about buying expensive technology, it's about processes and people. In Galicia we don't even reach a dozen people dedicated to this.

How I see cybersecurity →

On TVG's Bos Días I talk about Ciber.gal, the cybersecurity gathering held on 10 and 11 November at the Cidade da Cultura in Santiago, aimed at businesses, public administration and citizens. I argue that the awareness companies already promote has to become everyday cyber hygiene: don't reuse passwords, because when one service's passwords leak the crooks try them everywhere, rely on tools that generate long passwords, and switch on two-factor authentication. And above all, common sense: many scams are the old ones, like the classic confidence trick, brought into the digital world with cryptocurrencies that promise to make you a millionaire; when in doubt, ask your trusted IT person.

Cybersecurity outreach →

On the malware of the future I insist on specialisation by sector to reach more customers, with attacks aimed at industries, governments and parties to get more return on the effort. I also foresee more supply-chain attacks, geared to serving economic interests according to what the market demands.

In this interview I start from an uncomfortable asymmetry: attackers are ahead because they have money, highly skilled people and do only this, while the defender has to protect every front at once and it's enough for one to fail. I give examples like Colonial, which didn't even have a head of cybersecurity, and I compare the European framework, with the NIS directive setting mandatory minimums, against a US model that leaves critical infrastructure in private hands. And I call for more investment in the state's forces to move from reacting to anticipating.

Cyber-risk, NIS2 and compliance in the boardroom →

On Radio Galega's Galicia por diante fin de semana, following DarkSide's cyberattack on the major pipeline on the US east coast, for which a ransom of almost five million dollars was paid, I explain that those behind it are not hackers but mafias coming from human trafficking or drug dealing, and how data ransom has evolved: first encrypting, then threatening to publish and now extorting customers and suppliers. I explain that targeted attackers have their own market research department, go after the companies with the highest turnover, profile their employees and, if they cannot get in, jump across from suppliers, and I recommend a password used only for work and two-factor authentication. I argue that we have been in a kind of cyber cold war for some years, with Russia, China, the United States and North Korea constantly attacking each other, and that Spain is targeted to destabilise it with fake news and attacks on ministries.

Geopolitical risk and ransomware →

I regret that companies aren't prepared for a cyberattack, as we saw at the SEPE or in Castellon, and that it's still seen as a purely technical problem when losing your data ends up on the bottom line. I describe cybercrime as one more arm of organised crime, which already turns over more than the drug trade and even has call centres to handle ransoms. And I warn that the virtual world is more dangerous than the real one precisely because we drop our guard; the hacking of Jeff Bezos's phone ended in the most expensive divorce in history.

Cybersecurity as an investment →

In this interview I describe myself as someone who has spent twenty years in technology entirely out of vocation. I tell of my beginnings in the BBS scene, the demoscene and Infovia, and my collaboration with the European Commission evaluating projects and in a group on the risks of consumer products with AI. Of a CISO's day-to-day I highlight the human side, guiding people towards safer practices, and I drop an idea I stand by: identity is the new perimeter.

Who I am →

Progress is like a tsunami: you can stay on the sand and let it drag you under, or grab a board and try to surf it. With that metaphor I open this interview, in which I insist that a hacker is not a cybercriminal, because ethics lie in the person and not in the technology. I also criticise companies looking for a jack-of-all-trades techie when what they need is a specialist, just as with a broken arm you go to the trauma surgeon and not the GP.

How I see cybersecurity →

In December, the Catalan government became the first Spanish public administration to open a bug bounty, and I was one of the fifteen researchers invited to prod its systems. I tell how it went on the inside, with five flaws validated by Catalonia-CERT, and I call for what's fair: that these initiatives be paid as they should be and not end in a t-shirt and a certificate.

My track record and recognitions →

The Catalan government asked for my help to set up the first bug bounty of a public administration in Spain: recruiting a team of fifteen bounty hunters and letting them look for flaws in its network. We found five vulnerabilities, which its technicians fixed under the supervision of Catalonia-CERT. I helped them find the people and define how to report the flaws to the agency; a pioneering project in the country.

My track record and recognitions →

Reporting flaws to the big tech firms started for me as a hobby over Christmas 2019, to keep from getting rusty on the technical side. In this interview I explain how bug bounty works, from reconnaissance of domains to stumbling on a misconfigured server that left a well-known company's source code in plain view. And I make clear that, although some people pull in more than a hundred thousand euros a year, I prefer to keep it as a side pursuit so as not to end up resenting it.

My track record and recognitions →

I was a mentor for the Civil Guard's National Cyber League, a contest in which some two thousand teams of young people defend a company under attack in a simulated environment. My job was to guide the teams that qualified for the final. There's plenty of talent in Galicia: in the first edition the Galician contestants took home scholarships, internships and prizes, no finalist left empty-handed.

My track record →

In the middle of the COVID-19 crisis, Daniel Puente and I launched the solidarity initiative Cybersecurity Leads against COVID-19, which nearly 200 professionals joined to give free advice to companies, especially those without a specialist department, through a LinkedIn group. On Radio Nacional we explain the questions we receive, from hoaxes about videoconferencing software to phishing campaigns exploiting the pandemic, such as fake 500-euro Red Cross cheques. And we share the keys to working from home securely: VPN, care when opening systems to the internet, user awareness and, above all, common sense before clicking a link.

Cybersecurity for SMEs →

On CEO fraud, that fake email asking you to change the account where payments are made, the solution I give is common sense: when something involves money, whoever it comes from, confirm it by another channel. If they ask you to change an account, pick up the phone number you already know for that person and ask whether it was really them. Around then we had formed the SpInquisitors bounty-hunter group and were preparing a bug bounty workshop for RootedCON.

In this report on those tasked with watching over cyberspace I argue that European citizens need to be given tools. The NIS Directive has pushed countries to create their strategies, but there's much still to apply for the public. I miss a mechanism for any European to report flaws in the administration, along the lines of the whistleblower directive, and I call for a citizen-facing, publicly accessible CSIRT.

Compliance and the NIS directive →

On what age to give a child a phone, I'm in favour of them getting to know technology early, because we can't deny it and they need to keep up; a phone is a tool that connects to places, not the reincarnation of evil. That said, don't give a child your own phone with your personal and work data, because a child is very easy to trick into clicking where they shouldn't. I'm not one for banning, but for getting informed and giving them tools, leaning for example on Incibe's guides for parents.

Being a hacker, more than a job, is a way of being: curiosity to know how and why things work and to make them do what they weren't meant to. The reality is a long way from the Hollywood stereotype. I warn that there are many more incidents and ransom payments than come to light, I champion the role of women in hacking and, on Snowden and Assange, I clarify that they are hacktivists.

Who I am →

I comment on why it's so hard to investigate online scams in Vigo: many criminals operate from peripheral countries that cooperate little, and that slows the investigations. And I warn that the bad guys will move into the world of video games, one of the highest-earning industries, posing as others or using PayPal accounts maliciously.

ElevenPaths, Telefonica's cybersecurity unit, chose nine of us as ambassadors to spread security awareness online. I warn of a trend that's already real: today it's easier to be harmed online than in the street. On our phones we carry data we wouldn't want getting out, so beware of apps and public Wi-Fi, because you don't know who's on the other side.

My track record →

The University of Vigo signed several of us hackers to teach courses and the new inter-university Master's in Cybersecurity, and to debate how to shield Industry 4.0 factories. With Belen Perez, with whom I organise the Hack & Beers in Vigo, I taught a course on cybersecurity in smart factories.

The Dutch government thanked me for reporting a vulnerability with a letter and, tongue in cheek, a black t-shirt that read "I hacked the Dutch government and all I got was this lousy t-shirt." It's not the only recognition: I appear in the US Department of Defense's HackerOne, in Philips's Hall of Honors and in the EU CERT's Hall of Fame. For me bug bounty is a hobby, a way of not getting technically rusty.

My track record and recognitions →

In a report on how gangs use encryption apps I explain the ins and outs: handing your privacy to a third party, be it Telegram, Signal or WhatsApp, means trusting they'll handle your communications securely. I recall that with public-key cryptography, among other techniques, anyone can build their own practically unbreakable communication system. As a hacker, I stay sceptical and don't rule out weak points that allow leaks.

With Belen Perez we organised an edition of Vigo's Hack & Beers devoted to giving women visibility, with five Galician experts giving the talks. We wanted to showcase the talent we have to export, in a relaxed setting where people learn and connect. With the new European data protection rules I warned that big companies face fines that can hit their revenue, and that some, like Facebook, will have to up their game.

I signed the report that alerted the EU to cybersecurity flaws in a hundred and eighty-nine Spanish petrol stations with connected devices: in almost all of them an intruder could run hundreds of commands from the internet and even change the pump prices. Professionals have known about the problem since 2015, it costs next to nothing to fix and the impact of an attack could be serious, but almost no one has bothered. Awareness is needed.

Industrial cybersecurity and OT →

I recall my meeting with Kevin Mitnick, of whom I still keep the photo: he's a legend. I champion the people from the groups I grew up with, like Hispahack, Els Apostols or La Vieja Guardia, and the European pioneers of the Chaos Computer Club, who still organise some of the best events on the continent. Fifteen years after that photo, I'm still running the Hack & Beers in Vigo every quarter.

Who I am →

Before the students of a telecoms Master's in Vigo I argued that a hacker is not a criminal and recommended going into the security of the Internet of Things, because right now shipping the product comes first and security waits, and this technology is going to change everything. I warned that there are already televisions that spy through microphone and camera, and even toys with flaws that let someone speak to a child through them. I'm active and ready to help: I want to give back to the community what it gave me.

The second Hack & Beers of Galicia brought together around thirty security experts in Vigo, with talks such as Dave Ryan's on pentesting. I think the audience took away some interesting tricks on discovering that there are tools online to keep an acceptable level of security without paying the prices of the big consultancies, automating penetration tests to save money.

I took part as a speaker at Santiago's Librecon, the biggest international free-technology gathering, with three hundred and fifty experts and two hundred companies, talking about the challenges of Industry 4.0 alongside names like Yaiza Rubio and Pilar Vila.

An edition of Vigo's Hack & Beers brought together between thirty and forty ethical hackers and Galician experts, with one clear conclusion: an awareness campaign is needed so that ordinary people take more measures. The audience included business owners, teachers, students and researchers. I insist on a practical idea: if you hire an outside firm for pentesting they charge you a fortune, but with the available tools you can do it yourself and save.

The EU added me to the expert list of the Enisa agency to help devise legal strategies, assess risks and stop cyberattacks like WannaCry. I tell how as a teenager I found holes in company websites and warned them, and how I drove around Vigo with a laptop checking how vulnerable the Wi-Fi networks were. Much of the work would be remote, evaluating and collaborating depending on the group you're assigned to.

My track record and recognitions →

I foresee the classic threats continuing, ransomware and phishing, but growing more specialised with AI and Big Data exploitation, and used too by state-backed groups for cyberwar. I warn about the old software still running in critical systems: old flaws will be found and used for mass attacks. And about Industry 4.0, where we're heading towards them infecting what we produce to spread malware to customers, with connected devices as the target for a global zombie network.

In this interview I tell how at seventeen I uncovered holes in banking websites to warn them, and that I'd just passed an online MIT course on cybersecurity. I explain ethical hacking: intrusion attempts with an attacker's mindset but with permission and at a fair price. On whether the good hacker exists, I answer that a hacker is someone with a passion, and passion is neither good nor bad, it's a matter of ethics; the era of the romantic hacker who broke barriers just for the challenge is now history.

How I see cybersecurity →

I recall when a friend and I drove around Vigo with a laptop to map the city's cybersecurity and found how many homes hadn't set a password on their Wi-Fi. I warn that, although almost everyone has some antivirus, very few renew their passwords, have a firewall or use an account with limited privileges. With Industry 4.0, what we've seen so far could look like child's play if a factory is suddenly paralysed by a ransom attack.

I'm back from a cryptography congress with one thousand seven hundred experts organised by the National Cryptography Centre, where advanced persistent threats and cyberespionage were discussed: 2017 promises to be lively. For online shopping I recommend methods like PayPal and always going straight to the official store. Because beyond the money they scam from you, the problem is who you hand your name, address and card to: they could steal your identity or hijack your machine. Always check the domain and the padlock of secure encrypted payment.

I warn that companies in Vigo are suffering ransomware, which encrypts the office drives and demands a ransom in bitcoin to return the files. Over the past year I've noticed this kind of attack coming into fashion, and although no company wants to admit whether it paid, I know of some that had incidents. Criminals use bitcoin precisely to complicate everything and throw off the trail.

An early profile of my beginnings as an entrepreneur, when a partner and I set up Fernandes Soluciones, specialising in systems security and in helping companies protect themselves from espionage and attacks while, at the same time, selling themselves better. They described us as ethical hackers, those people of healthy curiosity who try every lock to see whether it's properly shut.

A personal profile of my beginnings: they tell how my first contact with a computer came around the time of my first communion and that, while others went to watch Celta, I was watching the screen. Even then we advised companies on security, though most only worried when something serious happened to them.

I analyse the incident on the website of Spain's EU presidency, where Mr. Bean's face appeared instead of Zapatero's. I clarify that no one attacked the servers and it wasn't a montage: it was a cross-site scripting flaw, a hole that lets content from another website be shown through the search box, without getting into the server. The real risk of these things isn't the server, it's tricking the user into entering data thinking they're on the official page, as in phishing.

I explain how zombie computers are created, controlled by criminals with viruses that arrive via websites, emails or downloads: they can get in even from a USB stick and you're at their mercy without knowing it, with your data and your connection in the hands of the network's owner. I recall that in 2007 a legion of zombies attacked the thirteen DNS root servers, the heart of the internet; had they all gone down, it would have been chaos until it was fixed.

In a report on the risks of sharing files over P2P I insist that security depends on the user and on what they share. I confess I don't even use eMule, revolutionary technology though it is, and I see a future for it in communication between people, voice over IP and video calls. The minimum precaution: check carefully what you're handling, because some people hide illegal content or a virus under an innocent title.

On the risks of P2P networks I hold that their security depends entirely on the user and on what they share. I predict a good future for this technology, not only for films but also for books, voice over IP and video calls, but I remind everyone that all technology depends on the use you give it. The minimum precaution is to check what you download before opening it, because some people hide a porn film or a virus under a Disney title.

In this report on the cybervillains of the future I tell, already turned adviser, that sneaking into your neighbour's Wi-Fi to steal their connection is an everyday thing. If you cross Vigo on any given night you can find more than three hundred networks belonging to companies and individuals, almost all of them vulnerable. And the worst part is that the victim will only notice their connection running slower, without suspecting that someone is controlling their machine.

In the reactions to the acquittal of the hacker QuickBasic, who broke into the websites of the Tax Agency and the PP party, I made clear that to us he wasn't a hacker: he used a program within reach of any amateur. He was lucky to be let off, though no one can take away the scare of facing prison. I think he did it for notoriety, to show off how good he was and land a job and fame, not out of the drive to learn that moves a real hacker.

I analyse the leak of part of the source code of Windows NT and 2000. In that code, downloaded by thousands of internet users, you can see the programming of the desktop or the network core, and I think it will cause new security flaws, though I stress it wasn't Microsoft's fault. After studying it closely, everything points to the leak coming from a US company, not a government or a university.

I was part of the honorary committee of Tecnoatlantico, Vigo's first forum for computing and new technologies, which brought together a thousand enthusiasts over four days in Cotogrande, with professional forums, workshops and internet gurus like Albert Gabas, of the Chaos Computer Club.

One of my first steps, at twenty, in the Vigo group Unluck Net Research, which ran security audits on big websites and exposed flaws others couldn't see. Ours was an intellectual challenge: when we found a flaw we reported it to the company to fix, and only if they ignored us did we alert the auditors. We never touched customer data; we did R&D, not gratuitous damage.

Who I am →

One of my first appearances, at nineteen and still in secondary school, when I ran the Vigo branch of the Babysoft group, devoted to bespoke programming, IT security and server hosting, alongside Daniel Fernandez. It all began with a contact made online that ended in a trip to Mallorca.