Press archive

On Cruce de Cables, alongside Rafa López, I explain that bot farms are places with hundreds of thousands of devices, usually phones, hired to inflate likes and comments and game social media algorithms, or to generate fake visits to a company's ads so it spends money with nobody actually seeing them. I recall that when Twitch started removing them, around a third of many streamers' traffic vanished, and I warn that in politics this viralised content pulls you into a confirmation spiral that gradually changes how you see the world. Anyone with a few euros can buy interactions on the regular web, even choosing the country, and more tailored services on the dark web or Telegram, although real psychological warfare is carried out by states with their own teams.

Disinformation and digital risk →

After Monday's great blackout, on Cruce de Cables I explain that technically anything connected can be hacked, and I recall the attack that took down Ukraine's power system in 2022 and the 2010 attack on Iranian nuclear plants, while urging care with attributions. A kid at home could do it with the right knowledge, but states seeking to destabilise a country are usually behind these attacks, and the worrying scenario would be a surgical attack triggering a cascading failure; the first signs would show within 24 hours if logs exist. I warn that SMEs working with large companies can serve as a gateway, that NIS2 will bring many more sectors under obligation, and that a real attack would have lasted longer, perhaps even as a distraction while pursuing another goal.

Critical infrastructure and risk →

Following the arrest of the man who hired a hitman on the Dark Web to disfigure a woman in Pontevedra with acid, I explain on COPE Pontevedra the difference between the Deep Web and the Dark Web. The Deep Web is everything that doesn't show up in search engines, such as password-protected pages or databases, and it makes up most of the internet; the Dark Web is easy to reach with Tor Browser. But I warn that half the people there are criminals and the other half are police hunting them, and that the hitman advert is often a police bait waiting for the gullible to fall into the trap.

Hacking and cybercrime →

With Sandra Estok I go over how I started at eight or nine, programming in BASIC, moving on to BBSs and FidoNet by modem and, in the late 90s, to the chat rooms where I met people passionate about security. To me a hacker is someone who looks for a use of things other than the recommended one, and it's a title others have to give you, you can't award it to yourself; even back then we warned companies and public bodies about flaws and published which ones had behaved well, what we now call bug bounty. I also talk about my work as an evaluator of European innovation projects and in an expert group on AI in connected products, and I warn: AI won't take your job, a person who knows how to use it will.

My path as a hacker →

On the podcast Cuidado con las macros ocultas, recorded at the Universitat Jaume I in Castellón, I look back on how I started in IT security, when that professional role did not even exist, and I say you learn far more from failure, such as the company I set up around 2000 and had to close. I argue that cybersecurity is business in itself, that a good scare is usually what unlocks investment in companies, and that SMEs gain nothing from buying an all-in-one AI solution from an unscrupulous salesperson but need a plan suited to their needs; it was for them that I launched cursodeciberseguridad.com. Propaganda and polarisation worry me more than the security of systems, with the Cambridge Analytica case, and I explain how the bug bounty programmes work through which I have helped Google, Facebook, Twitter and the US Department of Defense.

Career and bug bounty →

On the first edition of Cruce de Cables, on Spain's RNE, I talk about the letter of recognition NASA sent us for detecting a security flaw on its website through its bug bounty programme, and I explain that other programmes pay according to the severity of the flaw: in Spain there are people who live exclusively from this and some who have already passed a million euros. I argue that it is better to pay someone who collaborates with you than to let a criminal ransom your data or sell it on the dark web, and I recommend bug bounty to newcomers as a way to prove experience. I also explain that the word hacker was born at MIT's model railroad club and that, as good practice, industrial systems should be kept separate from the IT world.

Bug bounty and ethical hacking →

On COPE's La Tarde I discuss the case of Antonio Galindo, a small business owner whose email was accessed by a hacker who changed his supplier's bank account number within a legitimate thread, costing him more than 100,000 euros across two transfers. I warn that we make absurd mistakes as users, such as using the same password for everything, and that this fraud is routine, an everyday occurrence. My advice: switch on two-factor authentication and always check by phone that the account number is correct.

Fraud and business risk →

On COPE's La Tarde I analyse the cyberattack on Barcelona's Hospital Clínic: these groups encrypt the data, first exfiltrate it to their cloud and, if no one pays, publish part of it to cause reputational damage. Paying gives them fuel, because these aren't kids at home, they're mafias that earn more than from drug trafficking. RansomHouse is being pointed to, although attribution is difficult, and I recall that two months earlier the group Killmilk threatened European hospitals over NATO's support for Ukraine. I find it strange, because attacking hospitals usually goes against their own code of ethics.

Ransomware and geopolitical risk →

On Mediodía COPE, following the hack of Spain's General Council of the Judiciary and its Punto Neutro Judicial network, I explain that the figure of 40,000 attacks a day in Spain does not mean they all succeed or that we are weaker, but that we see and detect them more. I point out that preventing these attacks is complex and requires people who handle the technology and keep watch. And I explain why 70% of victims are SMEs: for budget reasons they leave security until last and lack awareness, when their very survival tomorrow depends on it.

Cybersecurity risk in business →

On Tech Tok I discuss the finding that the in-app browsers of apps such as Instagram, Facebook and TikTok can record what we do: Meta is no charity, it lives off our data and our behaviour, and we accept that when we sign up to its terms. I explain that, although WhatsApp encrypts conversations end to end, what interests them is the metadata: they know that you and I talk, when and at what times, and that information is far more powerful. My advice: copy the link and open it in the browser we always use.

Privacy and personal data →

On COPE's 'La Tarde' I explain the other side of the QR codes that became widespread with the pandemic: they aren't that secure, because anyone can generate one on a website with whatever URL they like and stick it over the original. If that happens at a bank's door, whoever scans it can end up on a fake site resembling the official one and hand over their details, although banks' authentication stops many attacks. We fall like flies, but common sense and a decent app that tells you which website it will take you to are almost always enough.

Hacking and online scams →

In the middle of the COVID-19 crisis, Daniel Puente and I launched the solidarity initiative Cybersecurity Leads against COVID-19, which nearly 200 professionals joined to give free advice to companies, especially those without a specialist department, through a LinkedIn group. On Radio Nacional we explain the questions we receive, from hoaxes about videoconferencing software to phishing campaigns exploiting the pandemic, such as fake 500-euro Red Cross cheques. And we share the keys to working from home securely: VPN, care when opening systems to the internet, user awareness and, above all, common sense before clicking a link.

Cybersecurity for SMEs →