Articles & Publications

I walk through the 11 October cyberattack on hundreds of French supermarkets: attackers remotely switched on the fridges' automatic defrost by exploiting a flaw known since 2023, with no ransom and no data stolen. I explain why Spain is already on the list, from NoName057(16) to the ransomware that halted Damm, Hero and the Port of Vigo, and the 189 petrol stations whose tank valves were exposed online, as reported by ASPERTIC in 2018. An attack doesn't need to black out a country; being surgical is enough to erode trust, and NIS2 also reaches the suppliers of essential entities even though Spain has yet to transpose it.

Read the full article →

For many, September is the start of the year, and cybersecurity is still unfinished business, all the more so with Spain's Cybersecurity Coordination and Governance Act about to be published. I suggest three ways to catch up: my Cybersecurity Course for Executives, jargon-free and with a year of free advice, the in-person Nebrija Master's led by Enrique Cervantes, and the online EIP Master's led by Sergio Padilla.

Read the full article →

After covering pro-Russian groups such as NoName057(16) on my channel, I tell another side of hacktivism: someone receives a phishing email impersonating Correos, finds the scammer's own webshell on the hacked site and renames index.php so victims no longer reach the card-stealing form, without deleting anything. However good it looks, hacking back is not legal, and there are lawful ways to help, from OSINT to find missing people to reporting paedophiles.

Read the full article →

91% of cybersecurity leaders suffer moderate or high stress and almost 20% turn to alcohol or medication to cope, according to the Life Inside the Perimeter report. On World Mental Health Day I talk about distress and how misused technology feeds anxiety, jealousy and addiction, and I recommend the conversation I had on my channel with psychologist Bárbara Diez.

Read the full article →

After the 2024 elections, Maduro spoke of a massive hack on the CNE's transmission system. I go through the history of Venezuelan e-voting, from Indra to Smartmatic, ExClé and the CANTV network, and explain that what the Attorney General describes is a denial of service that slowed the sending of tally sheets, which does not make one candidate's votes disappear. To me it is easier for whoever controls the machines, the network and the servers to cheat.

Read the full article →

I respond to criticism of remote work from Sam Altman, Elon Musk and José Elías with the Stanford research, which finds a 10% productivity drop in fully remote work but none in hybrid, and the University of Pittsburgh study on return-to-office mandates. I believe we are missing the chance to adapt, and that giving workers freedom would ease rural depopulation, rents, pollution and work-life balance.

Read the full article →

NSO Group's Pegasus is not the only one: before it came FinFisher and HackingTeam, and today Cy4gate, Nexa, Intellexa and Cytrox sell spying cyberweapons, as the Predator Files showed. I explain the use of zero-day vulnerabilities, which Mandiant saw grow by 50% in 2022, and remind readers that espionage also comes through our data and advertising, from Cambridge Analytica to AdInt.

Read the full article →

While Sora fascinates us, criminals swindled a multinational out of 24 million euros with a deepfake video call. I review the fake adverts with Marta Ortega or Antonio Resines that forced Spain's CNMV to issue a warning, sextortion with fake nudes such as the Almendralejo case, and propaganda, from the fake Biden robocall to the video of Zelensky surrendering. Against all this: projects like IVERES, reporting and critical thinking.

Read the full article →

Generative AI use in companies is up 43%, but 15% of users paste information into it and 6% admit it was sensitive. Samsung leaked semiconductor data to ChatGPT, and Apple and major banks have restricted it. I explain what OpenAI says about using your data, why I prefer to host these services in-house, and the flaws listed in the OWASP Top 10 for LLMs.

Read the full article →