Articles & Publications

I walk through the 11 October cyberattack on hundreds of French supermarkets: attackers remotely switched on the fridges' automatic defrost by exploiting a flaw known since 2023, with no ransom and no data stolen. I explain why Spain is already on the list, from NoName057(16) to the ransomware that halted Damm, Hero and the Port of Vigo, and the 189 petrol stations whose tank valves were exposed online, as reported by ASPERTIC in 2018. An attack doesn't need to black out a country; being surgical is enough to erode trust, and NIS2 also reaches the suppliers of essential entities even though Spain has yet to transpose it.

Read the full article →

A guide to AI cybersecurity for senior management, from OdiseIA's cAIre project with support from Google.org, which I co-authored. It approaches AI security from a corporate governance angle: the secure life cycle of AI systems, AI-specific threats such as data poisoning and model inversion, defences (guardrails, LLM firewalls and red teaming) and AI literacy. For boards, it helps set the acceptable risk threshold and includes a checklist of critical assets.

For many, September is the start of the year, and cybersecurity is still unfinished business, all the more so with Spain's Cybersecurity Coordination and Governance Act about to be published. I suggest three ways to catch up: my Cybersecurity Course for Executives, jargon-free and with a year of free advice, the in-person Nebrija Master's led by Enrique Cervantes, and the online EIP Master's led by Sergio Padilla.

Read the full article →

After covering pro-Russian groups such as NoName057(16) on my channel, I tell another side of hacktivism: someone receives a phishing email impersonating Correos, finds the scammer's own webshell on the hacked site and renames index.php so victims no longer reach the card-stealing form, without deleting anything. However good it looks, hacking back is not legal, and there are lawful ways to help, from OSINT to find missing people to reporting paedophiles.

Read the full article →

In my El Español column I start with an ordinary day on which you get to work and can't access anything: no email, no customers, no accounts. I point out that NIS2 proposes fines of 10 million euros or 2% of turnover, for executives too, and that pro-Russian groups such as NoName057(16) have long been attacking public bodies and companies in Galicia, while Z Pentest Alliance disrupts factories and water plants. A war 4,000 kilometres away can leave us without a business.

Read the full article →

A study by the Deepfake Observatory of ISMS Forum's Artificial Intelligence Group, which I co-authored with Daniel Fernández, Diana Molero and Miguel Ángel Pérez. We analyse ten real cases of video, audio, generated images and real-time face swaps, from the attempted scam on WPP and the impersonation of Princess Leonor to the fraud against an Arup employee, and review detection techniques and tools and the life cycle of a deepfake.

I play the grinch a little in my El Español column: online fraud will remain the second most reported crime, with fake job offers on WhatsApp, crypto schemes on Instagram and texts impersonating banks, even fake charities after the DANA floods. My resolutions for the year: common sense, distrust anything that sounds odd, call INCIBE's 017 helpline when in doubt, and pay only through secure platforms such as prepaid virtual cards.

Read the full article →

91% of cybersecurity leaders suffer moderate or high stress and almost 20% turn to alcohol or medication to cope, according to the Life Inside the Perimeter report. On World Mental Health Day I talk about distress and how misused technology feeds anxiety, jealousy and addiction, and I recommend the conversation I had on my channel with psychologist Bárbara Diez.

Read the full article →

After the 2024 elections, Maduro spoke of a massive hack on the CNE's transmission system. I go through the history of Venezuelan e-voting, from Indra to Smartmatic, ExClé and the CANTV network, and explain that what the Attorney General describes is a denial of service that slowed the sending of tally sheets, which does not make one candidate's votes disappear. To me it is easier for whoever controls the machines, the network and the servers to cheat.

Read the full article →

I respond to criticism of remote work from Sam Altman, Elon Musk and José Elías with the Stanford research, which finds a 10% productivity drop in fully remote work but none in hybrid, and the University of Pittsburgh study on return-to-office mandates. I believe we are missing the chance to adapt, and that giving workers freedom would ease rural depopulation, rents, pollution and work-life balance.

Read the full article →

NSO Group's Pegasus is not the only one: before it came FinFisher and HackingTeam, and today Cy4gate, Nexa, Intellexa and Cytrox sell spying cyberweapons, as the Predator Files showed. I explain the use of zero-day vulnerabilities, which Mandiant saw grow by 50% in 2022, and remind readers that espionage also comes through our data and advertising, from Cambridge Analytica to AdInt.

Read the full article →

While Sora fascinates us, criminals swindled a multinational out of 24 million euros with a deepfake video call. I review the fake adverts with Marta Ortega or Antonio Resines that forced Spain's CNMV to issue a warning, sextortion with fake nudes such as the Almendralejo case, and propaganda, from the fake Biden robocall to the video of Zelensky surrendering. Against all this: projects like IVERES, reporting and critical thinking.

Read the full article →

Generative AI use in companies is up 43%, but 15% of users paste information into it and 6% admit it was sensitive. Samsung leaked semiconductor data to ChatGPT, and Apple and major banks have restricted it. I explain what OpenAI says about using your data, why I prefer to host these services in-house, and the flaws listed in the OWASP Top 10 for LLMs.

Read the full article →

In European Public Mosaic, the journal of the Public Administration School of Catalonia, I reclaim the word hacker from its sensationalist use. I trace its origins, from MIT's Tech Model Railroad Club and the PDP-1 to ARPANET, Wozniak, the Morris worm and Mitnick, and Spanish groups such as !Hispahack and La Vieja Guardia. I argue that hackers are the first line of defence against exponentially growing cybercrime and that public-private collaboration is more necessary than ever.

My background as a hacker →

An academic paper I co-authored with María J. Santofimia, Félix J. Villanueva, Egor Litvinov, Ilia Viksnin and Juan C. López in Procedia Computer Science (vol. 192, KES 2021). We analyse the cybersecurity of smart homes and services for active and healthy ageing: their users may be vulnerable through lack of digital literacy or cognitive impairment, and they are deployed in the most private sphere, the home. There were no specific studies, standards or guidelines for manufacturers, and the paper sets out the issues that need special attention.