Hey, hey, hey everybody. I just wanted to take a second here to announce this section We're gonna be talking about today abusing smart cities in the dark age of modern mobility This is an especially interesting topic for me as I live in a city that is still stuck in the dark ages in Texas I also want you to be aware of the fact that we've got full Mateo redundancy in this presentation We're not one but two of them in case one of them breaks. So I'm gonna turn it over to them So thank you everyone for coming and thank you for your time We are going to steal you just one hour. So Okay I'm a tail Mateo the one Mateo Mateo the caro. I work as In the security field as a CTO of a small company in Italy and we do offensive physical security That's my Twitter. And if you want to just give feedback at the end of the talk I'd be happy to reply to that. There's me. I'm Mateo Kallura and I got a bachelor just two weeks ago and I'm still a student studying now in the field of nanotechnologies Fricities, so if you want my Twitter as well, you'll find here my personal information and Starting from May We are with opposing force member of securing smart cities, which is a non-profit organization which helps Decision-maker to consider also security issues when implementing new solutions and I will give the speech to my friend that will start illustrating what we did Okay, so that's the agenda for today We start giving a little overview about what a smart cities is then we focus on a transportation system smart transportation system and What we want to do is like introduce a methodology for assess those kind of systems and Doing so we also have three different case studies one for each Infrastructure in a smart transportation system and we are we apply our method to these to these case studies And then we see what's up next So let's start with the what is a smart cities So as much cities is usually composed by several critical infrastructure as for example You know energy management surveillance systems Water management transportation system and waste management. So for a city to because Mars usually those Infrastructures have to be connected in some way. They can be connected to some central system or connected to each other to communicate and You know better manage the resources In this presentation, we are going to focus on Transportation system. So Let's focus on smart transportation system and a smart transportation system itself is divided in the several infrastructure and We may have Strafi control. We may have a smart parking system. We may have a street lighting smart street lighting systems and public transportation system. So it's Pretty complicated to work in this kind of environment because we have multiple layers Multiple infrastructure each one communicate with the others in unknown protocols. So What we are doing is trying to define a method to assess the system to better to easily do it doing so because That's what we do for jobs. So we have to know Do it as quickly as possible and the best way we can So let's see quickly. How's our smart transportation system is usually composed? We have two methods Yeah, sorry two different kind of systems the first one in which every element so for example Traffic system traffic control system smart lighting control smart parking and transportation Communicates with some central system each central system them communicate to a more central system and that central system Aggregate the data from all the other systems and communicate information usually useful information to the citizen Like we watch it. What is the best road to go to work? Where is the more? What is the left traffic today and so on? And another kind of system is where each of the Macro system Communicates directly to the user and sometimes also directly to each other. So there is no need of a more central control system Usually the the central point of a smart city is always the citizen. So all the infrastructure are Four to be helpful to the citizen Okay, let's go even more in details. So smart transportation system We have private transport shared transport and public transport with the private transport to we mean like a smart parking With the public transport we mean metro bus tram trains You call it and with shared transport. We mean the new Transportation economy like bike sharing car sharing etc. I drink a lot. So sorry for these interruptions okay, that's one of the method one of the Architecture used to assess the system. So we try to Reduce every infrastructure to this schema in which we have an edge domain and inside the edge domain there is the edge device that take data from the physical world and Send this road data to a cloud domain. The cloud domain is like the brain of our system and you know analyze the data and Send command back to the to device or send information to the client domain Which can be like mobile application for the citizen and etc So the communication usually is always bilateral. So the edge devices can both Send send send data and receive commands so they can act properly about the data They are sending so for example if there is no traffic the traffic light is always green Okay That's our first that's a little bit introduction now Let's go to our first case study a smart parking meter system We will show some vulnerabilities about that. Okay, that's the device and let's make a little bit of introduction about how the device work so the device is both by the user at some shop and Then the device can be recharged so you can store credit on the device and you can do it Both online From your home. So you connect the device to your computer a register on the website of the of the of the company And then using your credit card or PayPal or whatever you can charge credit on the device that can be used later Or you can do the same procedure at some come at some shops So you go to the shops you gave the device you pay in cash in the and the guy can charge your can charge your device Also once the device has some credit you can park your car and then turn on the device You then have to select the proper location because this device is available for more than 40 cities in Italy Actually, I didn't I shouldn't say Italy. Okay in more than 40 cities worldwide and It's growing so You have to select the correct cities because each city has different fair zone So and once that you select the city you have to select the proper fair zone and activate the device For for that for now on every minute Every second sorry the device automatically calculate the fee you are paying and reduce that amount from your from your credit So actually the benefit for the user is that the user doesn't have to bring like coins and cash to pay the park The parking and he just get he just pay for the exact time is is parking and not for like half an hour or one hour over So these are some of the interfaces we found on the device So there is a display port which is for showing some information We will see later. There is the USB port which is used to connect the device through the so-called gateway Which is our computer that connects the device to the cloud system and then we have our our MCU And all those interfaces that have some vulnerabilities. We will show them in a few. I just need to drink again at Defcon there is a I'll say the first time you speak at Defcon. They usually bring you shots of alcohol. They didn't do that It's easier. I don't know why Yeah anyway The first analysis we did on the on the device was a firmware analysis In which we found that there are no integrity checks The the firmware can be easily obtained in two different methods We can intercept the communication between the gateway So our PC and the back end system during an OTA update So we can intercept the firmware or we can extract the firmware directly from the MCU In both cases Unpacking the the firmware was easy and no integrity checks were present. No encryption in the firmware were present No discussion and no authenticity is also authenticity checks is present during the firmware upgrade analysis So the result is that attacker can upload a malicious firmware for example removing the Reducing of the credits part so you can turn on the device device acts as It always being but at the end of the at the end of the at the end of the day You have always the same credit on the device as I said before there is some the bug interface Sorry, there is some debugging interfaces present on the on the device We use the JTAG port and the SWD port to extract for example the firmware There are also other debug traces for all the components So for each component present on the device you can actually and intercept the data exchange it and in inject other data So let's try to reconduce our our device to the schema. I show you before So for the edge domain we have the parking meter Which is connected via USB to our gateway and the cloud domain The cloud appliance is used for like remote charging the device to create invoice based on Where you park and how time you out of your park for example for expensive for the company etc and do OTA updates so The cloud domain then communicates to our client application, which is gave to the inspectors The inspector can use the application to check if you are paying the correct fee for your staying if you are paying corrected Another thing the inspector can usually the inspector check if you are paying correctly just by looking at the display of the device But there is also an NFC interface That they use that the inspector can use to access memory of the on the device So we did an communication security analysis and the result where that there is no data validation between the edge device and the cloud domain So we can both modify the data send from the cloud to the device and to the from the device to the cloud and Moreover, the all the trust in the if you are paying or not is in the device itself So the inspector can actually check only if you are paying by looking the device or accessing the memory on the device You cannot check if you are paying correctly using the cloud that the cloud data Because the device it's not it's not updating its status in real time So as I said, there is no increase and I integrity check no encryption not in TCT checks So this is a sample request we intercepted and from that you can see I don't know if you can see but it's There is some parameters which are very useful and this is a configuration file So every time you connect your device to the to the gateway The the cloud appliance and the new configuration files for updating like fee zones, etc if there are any new cities and We can modify that configuration file Okay, so reversing the the firmware analyzing the communication and using some Debug interface to understand better the data. We finally found what is the formula used by the device to calculate the fee That's the formula. So we have the price per time unit then we have the fair frequency because in some cities you You may have To pay every half an hour and not an hour So it's another parameter then we have the time the seconds laps from when you turn on the device And then you divide every all this for one hour because usually it's one hour And then we have to add the minimum fee because in some park in some parking you have to pay at least One hour of parking even if you stay just for like ten minutes so As I said before when you turn on the device the display show you the price you are paying and The time you turn on the device. So those two parameters has actually displayed. So even if we modified the The configuration files so we can for example if we put at zero the price per time unit That zero is displayed it is displayed by the device so the inspector can actually see you are you are committing a fraud So that's not good The minimum fee in all the cities At the moment is usually set to zero. So we don't have to care about that So what's the only parameter we have to change to set the multiplication to zero because that's what we want If we set the multiplication to zero then our fee is zero so If you can change the frame the fair frequency to zero all the key all the formula is then zero so we don't pay anything even if the Correct configuration files is displayed because price per time units We just set the the correct one and it's the second we don't modify that The fair frequency is not displayed so we can change it easily to zero from the configuration files So we intercept the configuration file Change the the value to zero and then the old formula becomes zero. So that's why we call our formula our cento gral and Using this vulnerability this vulnerability is pretty easy to To exploit we actually wrote a little script that can allow you to like do everything automatically So you can just plug the device to the computer and like I don't know maybe three or four seconds Your device is like every city present in Italy or not Actually, you pay zero for parking Moreover we also develop a firmware which in which the the fee payment is removed So we displayed the correct Information, but we don't remove the credits from the memory So multiple vulnerabilities allow you to actually not pay for parking. That's a good thing, right? Okay, I'll now leave my award to my colleague, which we'll talk about the next two case study Okay Yeah, a little spoiler, but We will go on speaking now about shared transport shared transportation systems and in particular we will speak about bike sharing Well Our case of study was divided into three steps Essentially, the first step is the one in which you go to the station where all the bikes are located and You unlock yours The second step is the funniest you ride the bike and the third one is when you lock it again and You walk away. So let's go step by step From the first one the first one So the picture shows that the ways to unlock your bike are essentially two the first one is say more physical you need an NFC card and the NFC card Will be checked Here we will see how Will be checked and will unlock the bike the other way to unlock is by using a mobile application on our mobile device so the station is Speaking with the cloud or the back end that authorizes the unlocking of the bike Let's see more in detail. This is one of the stations and as you can see on the top. There is a NFC breeder for the for the card and As I said before there are those two Accessible methods in order to unlock the bike. Let's focus on the first one. So the mobile application so at first we with a compile the app and We found that there is no obfuscation on the code and so that Helped us a lot in order to understand how the whole procedure works but moreover One of the critical points is that there are the vendor credentials are coded and obviously we obfuscated them here because we don't want to say the name of any company here and The critical point is that with those credentials you are allowed to create new users Charge some credits on those users activate the users and Unlock a bike in real time wherever it is. So it is quite dangerous. I mean and moreover There are some API's here and that are vulnerable to a SQL injection and of course for Legal reasons we did not make any attempt to exploit them. So I will skip this part and There is a private Q&A session later Let's move to the card analysis. Okay, I Hope you don't recognize the city but It's okay, let's go on it's in Italy, but he said before and that's not a second The second mistake, okay, it's a ultralight NFC card. So we all know that ultralight does not have any Encrypted Data on it. Well, the protocol is not It's not encrypting the data inside so each one can read it easily and there is no authentication while Reading the card so If I can get one of those card I can easily read with my smartphone or another reader and The only identification a parameter in it unique Unique Identification parameter is the UID which identifies one and only one user So that is the sensible all the sensible information relies in the UID to unlock the bike and If you look close to that card Just look inside that rectangle. I don't know if you see That's number. Please raise raise your hand if you guess what that number is Please do Yes, you're right. It is the UID but in reversed way. So Don't know who who decided to put in that place the UID. Well, of course, it is simple to read it by a reader, but They ease you this procedure Let's go further and analyze the the other steps Well, there is a physical issue we found in the stations because the only way the station Is able to understand if the bike is properly locked or is inserted is by a sensor inside that little piece of metal you see in the Yeah, in the hole and If you slightly remove the bike as soon as you unlocked But just a few centimeters If the distance is short the sensor will not well the station is not going to understand that the bike has been removed And so after a minute or 30 seconds, I don't remember the unlocking process goes in timeout and The station locks again the bike. The point is that The bike has slightly been unlocked. So the lock is not locking actually the bike and and you can extract the bike and station will feel as if the bike has not been unlocked and The point is that the central system can detect this issue in two ways The first one is that you you leave the bike in another station. So the central system will see okay I have the bike number one two three in station one and at the same time in station two so there is something wrong and The other critical point is if there is another bike that is going to be Left in in that station the central system will Understand that there are two bikes in the same location. So it is actually a problem and That's all for the shared transportation systems and what about the public transportation systems we defined two Different architectures the first one we called the offline system because each of the bus metro or tram, however they They are speaking with a back-end and the back-end is Unilaterally speaking with the UID blacklist or a database which is recording all the possible Tickets that are run out or banned don't know and The other architecture is we called online system because the difference is that the UID blacklist can interact With the stamping machines that are located on the bus metro or whatever So let's start with the first architecture. We spot out two main vulnerabilities the first one is called lock attack and Actually, it's quite easy to be understood because the the sector where the rides are located that is the OTP one Can be made read-only if we set one beat in the lock bites to one so it's quite easy hack, let's say and No rides will be removed when you stamp your ticket because it is read-only so Essentially, it's quite easy also to be fixed this vulnerability but it will work essentially well it was working and the second one we are talking about is the time attack and This is nicer because you don't have to make any any modifications to the lock set lock sector and to the OTP so you leave essentially all the rides as they were and you find the place where the timestamp of the last validate Last validated ticket is stored. So the only The only task is to reverse To reverse the timestamp and find the initial time when They start counting the minutes so as soon as we reversed those data for example here we we put a rectangle a red rectangle around the That area and we found the initial date was something around 2005 First January Yeah, don't don't say it and we found that and so that way we are able to forge our our own timestamp and validate our ticket without touching the rides because the ticket is valid for some minutes 90 minutes or whatever and so you you will have always a valid ticket and What about the online systems? This those kind of systems are not vulnerable to the previous but are vulnerable to the replay attack well offline systems are also vulnerable to replay attack but I will explain now and by replay attack you have a lot of possibilities and will be a serious problem because If you use some emulators or clone tickets the one from China for example There are no rules. They act like Miffere ultra light, but they are not or other Miffere maybe classic et cetera, but they are not following the standard rules and the protocols They are completely erasable and changeable So you are allowed to change the uid forge new uids with a valid structure because you have a you can clone your ticket with a Valid structure, even if it is encrypted you change the uid and then you can stamp it and bypass any software encryption because the the validating machine makes everything by itself and Moreover, you can also use the same ticket to you clone it on your clone one you increase one ride and you stamp the clone one and then you come back to the Previews ticket the original one copying all the data sectors and whatever you have so it will be perfectly Indistinguishable from the previous one and it is valid and The problem is that the implementation of a white list would be a problem in our systems because the white list must be must be updated on all the stamping machine in real time Think about if you go to buy a new ticket from a shop that ticket must be usable immediately As soon as you buy you buy it so the implementation of a white list is a serious problem and it will mean well you will need to Build a completely new infrastructure if you already deployed one to implement such a thing So it will be a very very difficult task As regards future works. What's next? well, we studied This is the picture we show we see before and We spoke about energy management surveillance systems water management. So let's start with the smart cities surveillance and those kind of cameras Can be used for? Well, they have multiple uses one of those uses can be for policemen to charge people may be going with their car in restricted areas for example limited traffic areas and they can snap a picture of your of your plate and Sending you a fine for entering that but how the how is the connection made between those cameras and the main back end well we still have to understand how and Then we have something on water management maybe there are some counters that are revealing how much water each one of us is using and Applying a charge for each a cube meter of water I don't know if you use here those kind of units of measurements, but The amount of water unit. Yeah imperial is different from metric, but I hope it is clear the same way and So those kind of systems have to be interconnected between a central infrastructure that Evaluates the right fee to be charged at each user But what about for example the smart city lighting system? and this way we are going to illustrate for example how the lighting for a Street, maybe or some buildings how to Save money in turning on or off lights when when it is not necessary, so What is the? What is the algorithm a central system can use to turn on or off those kind of lights that it will be a central point for future works and finally the smart traffic light system and some new technologies about making the green light last longer if the the road is quite crowded and maybe Preventing from turning it red if there is no car in the crossing road And but if those systems are interconnected and badly, let's say say badly and the connection is not secure. Maybe Elintation at user can turn red often and Well the green on and the green on the other side could be a mess There was a paper published by CISO Cerudo about traffic system. You can check about that. Yes Securing the smart yeah, securing smart cities.  We can test all all those infrastructure But our final challenge will be hacking a whole city. Yeah, so As you saw we have like material for for you or for death cone Good. Well, you can see us in the next year probably Sure, and if you have some yeah, I suggest you would recommend some cities to be hacked. Yeah We are to sponsor us. We are You just need to play the flight a five-star hotel and then we can work something out. No problem You forgot the suite. Yeah, five stars sweet enough. I started the last story One each we don't share Okay, just to be clear. Yeah. Yeah, sure. Okay, so I think there is like something like 1500 people now here Any question? Don't be shy. Come on. It's written. Don't be shy. It's a Q&A session. Okay Do we have a microphone for how does it work? Yeah goons? We need a microphone. I think my is here. Oh, okay. You have to come here You have to do the work. Oh on a replay attack rather than copying it to another device Couldn't you just copy it make a gold image and then after you've used it replay that back onto the original device? Yeah, you you can do that. But the problem is when you have the blacklist Sometimes your ticket can can be put on the blacklist because it actually behaved now not correct way So what we did is to inject new you ID? So the system doesn't recognize if the every time you stamp the ticket you put a new ID so that this new ID has not Previous behavior so they don't ban it other question. Just stand up and go to the microphone. We have like Yes, yes, so we won't go anyway, please ask you have to stay inside close the doors Okay, thank you have a question It's for you not for us Thank you Singapore is having a real big surge with a smart nation one of the things that they're doing is they're having a big push for In the name of elder care monitoring in the home Are you seeing that in Europe? No, at least not in Italy. Well, we are from Italy now. Maybe you haven't said understood that but not in Italy We think it's an interesting thing because we actually never thought about that but We are going to present the same research in Singapore next month at GSEC Yeah, this month two weeks at the end of the month in GSEC So maybe there's some like interesting point to speak about can you tweet where you're doing this information because I live In Singapore, I like to attend Okay, you can come later and give you the link. Yeah, whatever Yeah, yeah, but something very weird happened. Yeah, we charged us like 10 times what what what we owe? Oh, yeah, so there must be something more in that formula Reversing the firmware. There is some like very strange things like some weird vulnerabilities in which you can like overflow the whole system and crush it But yes, we tried so in Chicago We have a different bike share system with a different lock at the front of the bike, which I believe I'm not sure if this hack will work or not on it So I'm wondering if you've looked into other hacks for bike share that aren't reliant on the locking mechanism And then also our bikes have GPS. So have you figured out how to if you wanted to literally steal the bike? How do you overcome the GPS? So you have a GPS on the bike the bike. Okay, there was a talk I think last year the blackhead or death convolved both probably about spoofing GPS data with the SDR so you can actually bring your SDR and now in a backpack with a battery and Like spoofing the data and meanwhile stealing stealing the bike legally It's a principle we are trying also to apply it to car sharing because they check your mileage and where are you going and they charge money for that. So it's interesting thing Do I go anyone else? three minutes maybe four Or five Okay, thank you very much for coming. Thank you for your hour. Yeah, thanks. We really appreciate Also, thanks for all our sponsors Yeah, that's it


Mr. District Attorney, starring David Bryan. Mr. District Attorney, champion of the people, defender of truth, guardian of our fundamental rights to life, liberty and the pursuit of happiness. And it shall be my duty as District Attorney not only to prosecute to the limit of the law all persons accused of crimes perpetrated within this county but to defend with equal vigor the rights and privileges of all its citizens. This is David Bryan. In a moment we'll bring you another case from the files of Mr. District Attorney. But first the word from our sponsor. Here is our star, David Bryan as Paul Garrett, Mr. District Attorney. A District Attorney knows that murder can strike any place in his county at any time. This case started on a rainy afternoon on an almost deserted highway west of the city. A man is sitting in a stalled car. His face brightens as a tow truck pulls off the road beside him. Painted on the door of the truck of the words, Joe's Garage. Hello! Oh, you having trouble? Yeah, wires got so coming through that low spot back there. She chugged and spluttered away and then conked out on me. Oh, I guess we can get you started again. Get the squirt gun ready. You want the tarp too? Yeah, the tarp over it so the rain can't beat in while we're working. I'll give you a hand. You just stay there and keep dry, mister. We'll have her perking in a minute. I'm sure grateful to you. What are you going to do? Squirt a little carbon tetrachloride on the ignition wires. Better release your hood. Oh, oh, yeah. Okay, Rusty. Lift her up. Fellas, sure you know what you're doing. What do you mean? Well, I can't see how you can get them wires dry by squirting them wetter. That's a mechanic's trick. Squirt them with carbon tet. Carbon tet cuts through the water and runs it off and the carbon tet evaporates. And there you go. Dry wires. Well, it's okay with me if you say so. Don't worry. When it rains like this, I do more business along the highway than I do at the shop. Wires are all spray, Joe. Okay. Try it now? No, no, you give it a second to dry out good. A couple of drops of water ran down my neck. It's only a mile up the road to Wally's cafe. We'll stop and warm up after this fellow gets moving. Good. I think I'll stop up there myself. I've been sitting here for more than an hour. Only other car that came through barreled right past. Where are you bound for? Just back to town. I'm a real estate agent. Just closed a sale on a piece of property up at Hilldale. Hey, that thing ought to be ready to go now, huh, Joe? Yeah. You can try starting it now. Oh, good. Here's hoping. Watch the puddles. You'll be okay. I sure wish there was some way of thanking you, fellas. Well, that won't be hard to do. The charge is 15 bucks. $15? We don't stand out in the rain for fun, mister. You were stuck, weren't you? Yeah, I was stuck, but $15 seems like a lot of money for three minutes' worth. Now, look, I've got a nice warm garage where the prices are regular, but working out here is a little bit different. Charge is 15 bucks. I haven't got $15. What are you, a wise guy?  Five bucks is all I have on me that's my own. The real estate money belongs to somebody else. Well, then you can borrow it until you get home. I think I'm not going to report this to the sheriff's office. If you report it any place you want, you just pay me. Except for the five, all the money I've got's in hundreds. You got change? You being funny. I'm telling you, it's all hundred dollar bills. That's the way I was. You want your money? I'll meet you at that cafe you mentioned and get change. Wally wouldn't have changed for a hundred in that crummy joint. The change ain't the problem, Joe. The problem is whether or not this guy's really got a hundred bucks to begin with. Yeah, that's right. Let's see the color of your money, mister. You're not seeing anything. I've decided to go to the sheriff's office first before I pay you. You think we're going to stand here in the rain and argue with you? It's a conversation, Joe. You've got hands and he's got pockets. He has it all right. Must be close to a thousand bucks. He comes too. We can fix it so he won't. He's going to sign a complaint against us anyhow. That wise guy wears your nerve. Got as much nerve as you got. All right, then grab his feet and let's take him into the bushes. Yes, money, Arrington. You should have taken those boots and carpet offered you. Yeah, I'm all right. Hell, here's the body. I thought you should see it. He thought it was moving at the time. You checked the body for identification? Mm-hmm. Licensed description fits. Names William McShane. He was a realtor. What are you looking at? What's left of those footprints around the body? Oh, lab says they have puddled up too much to help. Brain washed the edges away. He was carried in here by two men. All walked in with one. No, Arrington. He was carried. If he walked, there'd have been some mud on the soles of his shoes, especially at the joining of the heel. His feet never touched the ground after he left the pavement. The ignition keys to his car were lying right there beside him. Good thing the state troop investigated when he found the car abandoned this morning. Any sign of a weapon around? Must have been one. Well, this had the way it is. Well, the lab boys figured it was a large rock they found over there. Some indications of blood on it. It was almost washed clean by the rain, though. They didn't want to leave it here, so they wrapped it up and took it in for examination. It doesn't sound like it'll help much. Some of the blood might have held, but the prints won't. Now, let's get back to the car. All right. There it is. Just the way the trooper found it. Door on the driver's side open. Seat and steering wheel soaked with rain. Well, he might have gotten out to fix something. Tires are all OK. Well, if he did, he finished it before he was killed because the car runs. I checked it. He stopped for something. Pull the hood release. Let's have a look at the motor. There's no sign of any fresh tool marks. Wires haven't been taped any place. No, but look. What? Son of a thin white film on the wires. Distributor and coil connections, too. I want the lab to check that. Morgan's still here with the mobile unit. He'll be able to work better indoors. Haven't told the car to the nearest garage. What was the name of that cafe we passed? About a mile up the road. You mean where the trooper met us? Wallies. Good. When Morgan finishes, he can radio his findings into the office and Miss Miller can relay him to us at the cafe by phone. Meanwhile, you and I can get some breakfast. All right. What do you have, gents? How about hair man, chief? Sounds good. Not to me, I'm out. You settled for bacon? Yeah, sure, sure. OK with you, chief? Fine. Excuse me, sir. Never mind. I'll take it. We're expecting a call here. Hello? Hello. Is there a Mr. Garrett or Mr. Harrington there, please? This is Harrington, Miss Miller. Oh, I just called to tell you that Morgan is taking the car to a place in Hooperville about two miles closer in, Joe's garage. OK. We may be in there before he's through. The medical examiner's report just came in, too. He says McShane was killed sometime yesterday afternoon. Oh, that's a long time. OK, Miss Miller, I'll tell the chief. Thanks. Bye. Bye. Anything? Yeah. Medical examiner says McShane's been dead since yesterday afternoon. Not long. So he says. That car was standing on the highway for a long time then. I think somebody would have stopped, seen the door open and that downpour. Yeah, you know how people are sometimes. Everybody's in a hurry. Yeah. How about the car? Morgan is talking at the Hooperville. Two miles. Place called Joe's garage. Here you are, gents. Say, I hear you mentioned Joe's garage. Huh? Oh, yeah. You going in there for anything? Possibly. Why? Uh, mind and do me a favor if you do. Sure. What? Ask Joe to bring out a fan belt for my pickup next time he passes this way, huh? Fan belt. All right. I just swank on no ham. I couldn't make a trip in for supplies this morning. Tried to get him on a phone a couple of times yesterday, but I didn't get no answer. Well, Ray might have kept him busy. Yeah, I guess so. I just miss flagging him down on the road yesterday afternoon. I saw him coming around the curb. I expect him to stop, but he didn't. Just went barreling by in his tow truck. Yesterday afternoon, you saying? Yeah, about four o'clock headed for his garage. Huh? I should have run out and signaled him. I shouldn't have nothing else to do. Dawn Rainer, but I didn't shove three blue plates across this corner all day. Big breakfast trade this morning, though. Excuse me while I get on a dish. Yeah, sure, sure. That garage tow truck must have compared to the spot where McShane's car was found, chief. Yes. Ordinary drivers might have passed the car with a door open like that. It seems to me that a mechanic would stop, though. Doesn't it, to you? Especially in that rain. Yeah. Of course, maybe the car wasn't there yet. Medical examiner couldn't fit the exact time of death. But he'd been there too long before he got to it. Well, if the garage man didn't see the car, it'll be some help anyhow. Well, no McShane was killed after four o'clock. Yeah. I was wondering... Could that be Miss Miller again so soon? You want to get that? Yes. I'll take it. Hello? Mr. Garrett? Yes, Miss Miller. Mr. Garrett, we located McShane's wife. She just came into the office. I think you'd better come in and talk to her. Do you know anything? McShane sold a piece of real estate yesterday. He called her after he closed the deal. He was carrying $1,200 cash and $100 bills. We'll be right in. I have to skip breakfast now, Harriigan, and get back to the office. McShane's wife is there. Oh, does she give any line on a motive? $1,200 he was carrying. Here's your money, Wally. Oh, but you didn't eat nothing. What's wrong with it? Well, just a rush business call. We'll see you next time around. Well, hey, you'll remember about that fan belt, won't you? You better try reaching the garage on the phone again. We're not stopping there after all. Well, thanks, anyhow. Hurry back. You know what it sounds like to me, Chief? What? Somebody who knew he had that money followed him and forced him off the road. Yes. That's the way it's beginning to look to me, too. This is David Bryan. Before we continue with Mr. District Attorney in the case of the murderous Good Samaritans, here is an important message from our sponsor. Calling us Paul Garrett. Mr. District Attorney.  His wife gave us our first indication of a motive. $1,200 in cash that the dead man had been carrying. We questioned her further at my office. Uh, how did you know your husband was carrying the money, Mrs. McShane? He... He'd telephoned me from upstate after he made the save. Wasn't a cash transaction a little bit unusual? No. Not with the Athens sisters. Mrs. McShane, did your husband have anything else of value on him? Anything of his own, I mean. I don't think so. Jewelry of any kind. Oh, wristwatch. That's all. There was no watch on the body, Chief. Do you know what make it was, Mrs. McShane? No, I just know he had one. That's all. He wore it all the time. I never gave it no special notice. Well, could you describe it? Gold, leather strap. I don't know. All men's watches look the same to me. Well, would you know it if you saw it again? I don't think so. I don't know. May I go now? Yes. Thank you for coming in. Yeah, let me get the door for you. Oh, Miss Miller, hi. I didn't mean to close the door on your face. It's all right. I knew she was upset. I didn't want to come in until you'd finished with her. What is it? Morgan just called about McShane's car, that film on the ignition wires. Well, what was it? He said carbon tetrachloride residue. You have any ideas how it got on there? Yes, sir. He said the car must have been stalled with wet wires and the carbon tet was sprayed on to dry them off. Where would he get carbon tetrachloride on a highway? Was there any in the car? Did he carry a fire extinguisher or anything like that? He said somebody must have helped McShane spray the wires, somebody who had the equipment like a mechanic. Uh, Chief, that guy at the roadside cafe, Wall-E, he said that... I know. The tow truck from Joe's garage. Go to the teletype room. Get out that query to the Athens sisters on the serial numbers of those bills. And then meet me down at the motor pool in the basement. We're going to visit a guy named Joe. Is that all you got to do, Rusty? Throw playing cards into a hat? What would you like me to do? Well, give me a hand with this fender. No thanks. I'm no grease monkey. I only work for you when it's raining. A sweet guy. A real sweet guy. When it comes to taking the gravy. So what? Well, I think it's a good idea to keep working. That's what. So who's stopping you? You. Hey, here's another customer. Work yourself to death. Which one of you is Joe? Me. What can I do for you? The county lab brought a car in here this morning. Oh, yeah. That's it over in the corner. Grace Dan. I know. My name is Paul Garrett. I'm the district attorney. Sometime late yesterday afternoon during the rain, that car was parked off the road about a mile past Wally's Cafe out on State Highway 27. It was stalled with wet ignition wires. Somebody fixed it with tetrachloride spray. Wally said he saw your tow truck pass out that way at about four o'clock. Yeah. Yeah, I guess he did. Did you see that car on the highway yesterday? Well, I can't say for sure. Maybe. I guess you're going to be busy for a while. Joe, I'll call you later. Sure. Sure, Rusty.  Oh, if you don't mind, I'd like you to wait just a second, please. Sure. I don't work here, though. Uh, just wait. You keep saying maybe about that car, Joe. How about making it yes or no? Well, I... I did stop for Grace Dan out on 27. Yeah, yeah. I guess it might have been that one. Lots of Grace Dan's around, though. Not yesterday, the one. Then you did get that car started. Yeah. Was the driver all right when you left him? Well, yeah. He was all right. Uh, you still want me to wait? Oh, uh, I almost forgot about you. No, I was just wondering if you might have been with Joe when he fixed McShane's car. Oh, no. I'm hardly ever around here. He just happened to stop by today. I see. Well, thank you. You're welcome. So long. Oh, uh, by the way, I think my watch has stopped. What time do you got? 20 past two. Thanks. Yeah, that's a good looking watch. Keeps pretty good time. Yeah. Yeah, right on the dot. Looks like you've had it for a long time. Uh, yeah, yeah. Quite a while. You must have gained a lot of weight since you bought it. Huh? I don't get you. The strap is getting too small for your wrist. A badly worn mark on the leather band there where you used to hook it through the fourth hole. You're wearing it hooked through the second hole now. So long. Yeah, uh, be seen around, Joe. Well, Harrington, I guess we might as well get back to the office. That devil, were you talking... I have a million cards I signaled you to get. Yeah, I had a tough time figuring what you wanted for a minute, though. All I could get was a few of them while they were talking to you. They're in my pocket. I don't touch them any more than you have to until we get them to the lab. But what's the idea? Well, those cards are greasy. They'll be covered with clear prints. Joe's and that other fellas who just happened to stop by. I want to know if either or both of them have records. Ah, now I get it. And that wristwatch business. Well, that wasn't his watch. And from the size of him, I figured that his wrist would be just about two notches bigger than McShane's. I want McShane's car moved to the police lab. Prints on the playing cards were good. They're running the codes through the machines now to see if we can match them. Car in yet? Yep. Morgan's got it down the garage in the basement. No, here comes Miss Miller. She has a couple of identification cards, all right? Here they are, Mr. Garrick. Both men have done time all right. Good muck shots, too. Robert, Rusty, Allison, and Joe Faller there. Good. Get these down to Morgan in the basement garage right away. See if he's getting anything like these from under the hood rim of McShane's car. Especially Rusty, Allison's prints. Yes, sir. Oh, Chief, what about the serial numbers on the currency? Here. The athletes and sisters had a complete list. Much to my surprise. Has that gone out yet? To every bank and store in the city and all the transportation companies in case anybody decides to run. Let's go up to the office and wait for Morgan's report. I wanted that stuff to go down right away. Well, I didn't have to go down. Morgan was coming up when I reached the elevator. He found what you wanted. Rusty, Allison's prints on McShane's car? Yes, sir. Right where you told him to look. The rim of the motor hood. Well, that does it, Chief. Yes. What time is it? Uh, it's only, uh, 4.35. Why? I just wanted to be sure he'd get to Joe's garage before he closes. Tonight we'll close him for good. Place looks like a shutdown, Chief.  Locked all right. Only 5 after 5. The service truck is gone. He wouldn't make a run on that. Yeah, wait a minute. Sign on the door there, written in pencil. Out on service call in emergency phone Elmwood 4677. I've seen that number before, earlier today. And so have you. Huh? When? When we answered the phone calls from Miss Miller at Wally's cafe. Hey, that was the Elmwood exchange. And Wally wanted a new fan, Belchrist Pickup. Come on. I hope he's still there. I hope more than that. I hope Rusty is with him. Now this Titan generator, and she's fixed. Why don't you keep things where you can get at him? Oh, never mind. I'll get it myself. Okay, okay, get it. Just don't look to me for free labor. Drop dead. Say, you two ain't in some kind of trouble, are you? What makes you ask that? Whoa. It's just the way you're acting, that's all. Two fellas here this morning wanted to know all about you passing on a highway yesterday during the rain.    What was that? You heard me.  Well, you keep hearing all you want. But if you ever tell anybody, especially the two guys that were here this morning... Why? Because that a guy was killed up the highway? Oh, Joey. This guy needs a little lesson. I wouldn't do that if I were you, Rusty. What? What? Interesting conversation you boys were having. I thought you weren't with Joe when he came by here yesterday, Rusty. I wasn't. Then how did your fingerprints get out of the hood of McShane's car? Get something, Joe! I got you! I got you! You all right, chief? Just dizzy. I had to fire. He'd have split your skull open. He's dead. I had nothing to do with this. We know you didn't, Wally.  You're going to pin this on me, aren't you? You killed him and now it's all on me. Look how he'd get a break. It was his idea. Oh, sure. It's always the dead man's idea. He can't contradict you.  What do I do to me? Can't you wait a minute? Can't you answer that one for yourself? Huh? Yes. What did you do to McShane? This is David Bryan again. I hope you've enjoyed this case from the file of Mr. District Attorney. I'll be back in just a moment after this message from our sponsor. Here's the star of Mr. District Attorney, David Bryan, with a word about the program you have just heard. With Robert Rusty Allison dead, Joe Faladea made a complete statement and agreed to enter a plea of guilty to a charge of murder in the second degree. He was sentenced to prison for the rest of his natural life. And now this is David Bryan inviting you to join us when we present our next case based on the facts of crime from the file of Mr. District Attorney. Mr. District Attorney was originated by Phillips H. Lord.


Okay, welcome to my talk, COVID-19-84, Propaganda and Surveillance During a Pandemic. Before we start, I would like to make a brief introduction both to this talk and to myself. My name is Mauro Eldridge, I work as a cyber security architect. I'm the founder of DC-5411 Argentina, and I was a speaker for DEF from Las Vegas, DEF in Siberia, Routes in Brazil, Ragonjar, Colombia, Boscon, Iran and Texas Cyber Summit, among other conferences. I'm a returning speaker to this billage, I spoke here on DEF CON 26. And this talk is about explaining the political situation of surveillance and propaganda in Argentina. Although, it is also compatible with the same situation in other countries and regions. This will be explained from a hacker's point of view using a hacker's toolbox, which in my case includes social engineering and open source intelligence, and there's even some application reverse engineering at the end. This talk will be divided into two chapters. The first propaganda about the Argentine pro-government propaganda apparatus and social networks, seen from the inside. We will see the process from the scratch, from the infiltration of a sock puppet account into the apparatus to its internal operation. The second part is surveillance. We will dissect the Quiddarcovid 19 mobile application, which is now mandatory by law in order to circulate. So if you want to leave your home, if you want to step away from your doorstep, you have to have this application installed on your phone. And we will dissect this application, uncovering many privacy abuses, bad practices, and lots of material worth of appearing on Reddit, especially on programming horror or subreddit. Just a brief disclaimer, every item disclosed here is publicly available through OSINT. On my George's rediction, it is totally legal to reverse and join any application or any software. And I wasn't involved in any illegal activity directly or indirectly. So that being said, let's start with our first chapter, propaganda. So what is propaganda, you might ask? Propaganda is a communication that is primarily focused on influencing an audience and furthering an agenda, which might not be objective or might not be real at all. And that may be presenting facts selectively. You might have heard the term alternative facts recently in media. Well, it's probably related to this kind of behavior. Online agents of propaganda are called trolls. They massively comment on social networks, supporting a certain government in this case or a certain movement. It may not always be a government, but a political movement. They try to establish their own debates and trends. For instance, in my country, it's pretty popular to see trendings like thanks, President Fernandez, or we support you, President Fernandez. There also may be found diverting the focus from opposition debates. For example, every time an opposition part tries to open a thread or tries to communicate something, you might find the trolls leaving spam comments, fancams, or any other material that, when exposed repeatedly, could turn this thread into something really difficult to follow for legit users or for interested users. So it may turn the conversation into something unbearable. They also work by establishing negative trends against the opposition, and they are usually grouped into troll farms, where they work together in an organized manner, surprisingly. How do you recognize a troll? Okay. First, it's pretty simple because lots of default configurations on their profile are present. For example, they don't have a picture, a profile picture. They use a fake one or a stock one.  That's pretty common, pretty normal on Twitter, actually, because that's the default username that Twitter gives you and allows you to change later. They share common terms and phrases that have their own languages, surprisingly. They agree on a common version to answer debates. For example, the president's offshore accounts are a media operation. So they are basically saying that everyone else is lying and they are not. And they obviously work in swarm behavior. They never come alone.  Many governments are credited with having online propaganda apparatus and agents. For example, Russia, with the collapse set on the trolls of Algino, China and the 57th Party, North Korea with the United Front Department, Venezuela with the Armada Bolivariana de Trolls, which barely translated to English its Bolivarian Army of Trolls, and also Argentina with the Cibercast or Tropacá, which translated from Spanish as K-Troop or Cyborg-K, which is not actually a K-pop supporting fandom. It's valid in the clarification. This global advance on propaganda apparatus around the world is such that there are social networks with firm positions towards them. For example, Counter-Social is against it. And countries with the highest propaganda incidents are absolutely valid, blocked entirely by their IP block. Some of them are listed here. And there are other social media sites, for example this one in my country, that supports the propaganda behavior. FacePopular.net was an Argentine social network against establishment and imperialism. And it's a firm supporter of the Peronist Party. It was a place where only its militants participated and it was backed, supported, by the Ministry of Culture. At the first sight you might obviously see that this is a bad rip-off of Facebook. And it even allows you to register with Facebook. This project is now default and it's no longer active. But it was heavily used by users from Argentina and Venezuela some years ago. Throws and censorship. The goal of a troll is not only to spread messages, but to prevent the opposition from doing so. Lots of groups participate in massively reporting the digit that posts or accounts from the opposition in order to take them down. They are actively abusing an automatic mechanism for reporting. So if a lot of users report someone, it must be true. And this automatic behavior takes down the post or the account without any real intervention. Argentina, it's an ideal terrain for these surveillance experiments since many times the government have tried to control social networks to no avail. For example, Peronist legislators proposing that the users who comment on websites identify themselves with their national identification number, which is like the social security number for US residents. Or a senator from the same party proposing a public and democratic regulation of social networks. Or the cyber patrol protocol imposed this year, which basically ended up with a lot of people being detained for tweeting or for expressing themselves on social media. You know, there are a lot of projects and already installed measures to control social networks. But what about the trolls? The trolls continue working together and growing. So this is where we start after this introduction. Tracking trolls. The Argentine apparatus has the particularity of being made up of real users, as well as trolls and bots, as you can see when exploring their hashtags. Rumors indicated that many users received invitations to join this apparatus. My goal was to get that invitation. You know, it's like a golden ticket to the chocolate factory. So after a month of silent observation, I created a sock puppet account mimicking the behavior of these users. And it was configured using these settings. Profile photo, President Fernandez, and Vice President Fernandez together. The cover photo was Vice President Fernandez giving a speech at Belles Stadium. And who was I following? The President and some ministers, along with a few real pro-government accounts. What about the description and tweets? Both I made them imitating the specific languages and symbolism used by these users. How? Well, using Twitter API to monitor the hashtags and extracts the most repeated words. You might find them here as a word cloud. Most of these are pejorative terms to refer to opponents like Bolsonaro and Piranha, instead of Sebastián Piner at the Chilean president. So, after learning how they speak, now that we speak the same languages, it was a matter of time before getting the invitation. This sock puppet raised 100 or so followers in a few hours. I have my original Twitter account since 2015 and I think I have less than 300 users, just for comparing. Most of these were trolls, but a few real users too. So, I started retweeting official accounts and these real users and tweeting with their same hashtags. For instance, map should be in jail, our ex president for the opposition. And after only three days, I received my invitation, this golden ticket, from a user we'll call DC. On the left you can see the original conversation in Spanish and I translated it the best I could to English. Hey buddy, we are making Twitter groups to install hashtags. Wanna join? Hey buddy, sure, what am I supposed to do? Well, basically you have to treat the hashtags that we send to the group. After agreeing this, I was sent to the group number 300 and some of soldiers of the National Project, containing 50 people. One of the messages shared there was this. Guys, Ariel Garbarz is asking us to use La Reta is responsible. La Reta is the mayor of one side of Syria and a member of the opposition. Now you may ask, who is Ariel Garbarz by the way? No clue so far. But in fact, both of these hashtags that made the top five in my country, one of them being pescado, potrido, La Reta is responsible, are fabricated trends proposed on propaganda groups. You may find the source on getdaytrends.com. Just for confirmation, I went to trending earlier and I found that this information was right. And these trendings lasted for at least 12 hours, which gives us a little help toxic artist propaganda interventions. Another message on this group is, hey guys, with Ariel Garbarz, we formed a group where he's the administrator and tells us what to publish and at what time. So we can get our trend to always be on first place. Another user replies, it's like you say, we used to do the same long ago with the K Youth, a new group. You have to set a day and a time, it's the best. Again, who is Ariel Garbarz? Okay, remember DC, the original member who invited me here? Well, 10 days later, another account from him tried to recruit me again. So he has probably forgot about my account. Hey buddy, we're making Twitter groups to install hashtags. Wanna join? And I say, hey buddy, sure, go ahead. I was added once again to another soldiers of the national project, 300 and something. Now by accident, I was a member of two propaganda groups. There was a six digit difference between each group ID, for example, 301 and 307. Each group can have up to 50 users, 49 if you do not take into account administrator. So 49 users multiplied by six new groups almost 300 new users in 10 days. This is how fast can these apparatus grow without almost no any effort. Currently, according to the last group ID I managed to find, there are at least about 350 propaganda groups on Twitter alone. This give us a total of 17,150 users. I imagine all these people try to picture all these people tweeting five or six times a day. They can make any trend they want. Well, also this doesn't ends here. A WhatsApp group is shared with both groups I belong to and of course hashtags are shared there too. This group is CT7. There are seven groups of around 256 users. If we take into account 255 users, we are not taking into account administration, multiplied by these seven groups, there are almost 2000 new users here that may be repeated. And adding them all together, we have almost 20,000 users. Again, there may be repeated users. This doesn't ends here. This group had members from the USA, Spain, the United Arab Emirates and even Germany. So upon joining, the administrator started sending hashtags. In this case, at half past seven, we come out with $Witter. That administrator, as you may see in the message, on the leading message, is Ariel Garbaros. And that name now definitely rings a bell for you, right? So, okay, let's try to answer who is Ariel Garbaros. He's the CEO of Protection Digital, which is Digital Protection, a company which was favored with many contracts by the federal justice and various Argentine governments. He was benefitted with two direct, several state infrastructure projects. He was appointed computer attorney general for the 17 and 19 elections. And he's the leader of the propaganda, paratus on social networks. The Lord of the Trolls, we might say. The source of this is the newspaper Perfel, where he answered an interview. Here is a video of Ariel Garbaros instructing the trolls live. But it is in Spanish. And for time reasons, I'm not going to show it here, but it will be shared on the GitHub repository, along with the slides. Obviously, since in Argentina we speak Spanish, the video is in Spanish. This was leaked on Twitter by a user. So the final diagram of the trolls, or a simplified one, is here. Ariel Garbaros acts as a leader, sends the trending topics to be installed to its coordinators, the coordinators of each group, which then share this objective to robot Twitter groups and WhatsApp groups, which then are executed by the trolls. So is this illegal? In Twitter platform, it is against the terms of service. The Twitter safety team actively tracks and takes down state-linked propaganda groups. In our country, well, it is not. In fact, it looks suspiciously endorsed, like the Facebook ripoff social media I showed you some slides ago. What tools did you use for this chapter? Trendy and Alia, Trends24in, Boutometer, Get Day Trends, the Twitter API, the Twitter Ruby Gem, and my own tool, which is also in the repository, Venator.lua, for recognizing both or troll-like behavior. So what is the propaganda apparatus up to right now? Generating hashtags supporting the use of the government application to monitor the coronavirus outbreak. You know, the Quidarkovid-19 application, which leads us to the next part, surveillance, or dissecting the Argov coronavirus application. So this is the tracking application proposed by the Argentine Ministry of Modernization. It is mandatory by law to circulate. So if you want to leave your home, you want to step outside your front door, you need to have this application installed. The current version is 331, but here we analyzed 102, 307, and 33, using the most common tools available for Android, the compiling and reverse engine. At first glance, I noticed a lot of broken functions, and reviewing the code, I found many dyslexic errors. Like, for example, the sabilidad instead of desabilitar, which in English means disabled. Bonotas instead of botones, barons. And this problem is repeated regardless of the decompiler using. Númer instead of número, number. Masculio instead of masculino, male. Auto-evaluate coin instead of auto-evaluation, which is a critical feature of this application, the auto-evaluation module. And after digging a little bit further, I found a new Roligrid only token is closer, which is not a vulnerability per se, what will become handy later. Insecuration structure creation, vulnerable to injection or manipulation, instead of using the Java-provided functions to build JSON. A reference to a long-dead product, Google Bluth. Lots of insecure and unsanitized executable calls. Really, a lot of them. And some even could lead to SQL injection. The application communicates with foreign servers, which is by our national law or local law, it's not allowed. These servers are not pretty much safe for storing medical data or well, anything. This is the map of the application. All of these assets inherit the qualification of C, so it's not secure at all. A lot of missing security features. And privacy is also at risk. Of a total score of 100, this application received a 61 score. There are many right operations that record PII about the device, which are in base 54. Whenever you decode them, you get that this application is trying to keep track of the device ID, the build of the own application, and the device manufacturer. Obviously, since this is an emulated device, the application was not able to extract any valid information at all. From the very first version, the possibility of permanently tracking the user was considered. As you might see, permiso de ubicación means access, location, permission, and todo el tiempo means all the time. The application has farset updates that try to run as start-up. For example, show farset update dialog, and device start-up or on boot. Also, this location tracker attempts to listen for boot events. The app tracks and asks for medical history. For example, cancer, diabetes, pregnancy, cardiac hepatic renal respiratory diseases, and all this data is stored abroad. Auto-evaluations are not stored at client-side, but rather sent to the server. The user's location, along with his or her DNA, a national document ID number, are sent to a remote server. Again, this identification number is like the social security number of U.S. residents. If the user's evaluation returns that he or she is infected, the tracking service is activated in the background. Also, by default, the app allows backup mode, which may send private medical information to Google. Now, it's unreliable for an application to diagnose a disease, but it's less reliable for an app to say, okay, you're not contagious, bro. We are during a pandemic, but, hey, you're not contagious. You are safe to go. Nosus contagioso means in English you're not contagious, so the app has an option or feature for that. Now, remember the last time you Google your symptoms of something for anything you have. I had a slight fever, my ankle hurts, I have a headache. What is the first result that Google answered you? You know, it's probably not something good at all, or not accurate at all. Again, for example, in this snippet of code, it tries to determine if the user is not infected or not contagious. Again, you might have to see a professional, not an application. And this is not the first time we do something like this on the Argentine government. We were featured a lot of times on programming horror on Reddit for this kind of things. For example, this was the application that the Argentine government forces people to download when they land on Argentina to control coronavirus infections. As you can see, it's really long if it might give you a little sample of how we work here. Now, on the first version, the 102 that I have reversed, I found this string all across the code base, all across. So, who is Sergio C? We want to disclose its full name. Who is Sergio? A possible author, a project lead. After some Google queries are landed on his personal site. He has worked on a lot of government apps before, including transport, local government, national government, healthcare, and even now, the government's main application, Mi Argentina, which is my Argentina. So, following the email he provided on his site, I found out that he was licking a good couple of times. So, this might even rise the attacks on face for this kind of application. Now, what is everybody else doing? What are all our neighbors doing? All of them are dropping centralized solutions or centralized contact tracing. But, we insist on keeping this model, on pushing forward this model. And so, to close this chapter, this application was launched without publishing an audit report or penetration test. And it isn't EVA EVA compliant, not at all. This is especially serious knowing that it handles medical information and sends it to servers abroad. Now, ask yourself, please, what will happen if you develop an application of this poor quality for your company? Let's jump to the conclusions and questions and answers. I thought it might seem obvious for us who are techies, geeks, hackers or whatever, always inform yourself through professional, neutral and verified sources. They are not easy to get and again, it may seem obvious to us, but not to the rest of the world out there. And so, if you have a problem or a phrase is trending, does not mean that it is real or automatically represents the thinking of the majority, right? Every day, somewhere and at all times there are groups of people and machines designed to install biased thoughts and debates in society. Surveillance and monitoring of citizens created systematic abuses against freedom of expression, especially in digital media and obviously, especially in Argentina. You have seen some examples in this talk. Investing thousands in technology and applications after neglecting the earth infrastructure is not the solution. An expensive app does not replace a doctor at all. You can get in touch with me, the Atolegram or GitHub share and the video that I didn't have the time to play and feel free to follow me on Twitter at Mauro Eldridge as you may see, I have a few followers since I'm not into trolls, actually. I really hope you enjoyed this talk and if you had any questions I'm glad to help you and to answer. So, please feel free to drop in and ask whatever you like. Thanks for watching this and I hope to see you again next year.


Thank you. Our next speaker is Naro Ao. Naro is from Nagaland, India. She's a woman living with HIV and a drug user. She started in the field of HIV and drugs in May 2005, engaging in outreach activities with both drug users and community of people living with HIV in her hometown. She also worked with APN plus in the capacity of women coordinator. She has represented women who use drugs from Asia in various national and regional platform, highlighting the specific issues faced by women who use drugs in Asia and advocated for these issues to be addressed. Currently, she sits in the executive board of UNPUT, the Asian Network of People Who Use Drugs. Naro. Thank you, Michelle, for the introduction. Good morning, everyone. I would like to start with some of the achievements made by people who use drugs in this movement. The involvement of people who use drugs in advocacy and implementation has not resulted in many positive change in many areas related to harm reduction. Example, distribution of needle and syringe is acceptable today because of the involvement of us in the advocacy. Another example is, it's from India, which I wanted to highlight, community has first initiated Nalaxon in harm reduction program without any external support because it saved lives. So there was no funding, but the peers, we know that we have to save our friends' life and that's how it initiated among the peers and this was used as an evidence for advocacy and now government of India is providing Nalaxon in all the government hospitals, which is a great achievement and this is this is achieved because of the involvement of drug users in the advocacy and programming and similarly, there are other very good examples from across the country's globally of issues being able to address by people who use drugs, although there is a lot needs to be done, but still something has been achieved because of the involvement. Evidence has also shown that community-led or peer-led intervention has resulted in many best practices and innovative ways. It is effective because it involves trust and we solve our problem out of the box, thinking out of the box. The journey of drug users movement started at a very grassroots level. If you study a drug user's life, the journey started at a very grassroots level at the implementation as a peer educator mostly or an outreach worker and slowly made it to a higher level, I mean, involving in policy dialogues and all. And in this journey, in this journey we left, we've missed the women, a population, which is the women who use drugs. If you look into the leadership role that people who use drugs are playing in Asian context, how many women activists we have in Asia? Who are drug users? It's almost 20 years and it's almost nil. And why is harm reduction program not gender-sensitive and why hasn't it been not addressed still now? It's because of lack of involvement. So, yes, there has been achievement because of the involvement of people who use drugs, but in one area, a big hall has been left out. And so, beginning with that, I want to share some challenges faced by women who use drugs in our region. Number one is many people say that it's hidden or not, it's hidden and invisible. No, we are visible. We are not hidden. The only thing is we are invisible to others, to people. When harm reduction implementation started, implementation of harm reduction program started, it is for the people who use drugs. And maybe the women were left behind because of number one, the double stigma. It is not easy to come out as a drug user. I'm a drug user and for me it was very difficult. Coming out in public and saying that I am HIV positive was much, much easier for me than saying I'm a drug user. So in that situation, unless there are certain things that certain services or activities which can attract women who use drugs besides just needle and syringe, providing needle and syringe or condoms or referral services for OISD and other treatment, there is nothing and that's why what is the use of coming out. I don't want to come out. I just want to be secure in my own place. So it's not about hidden or invisible. We are very much there. It's just that it's time we need to be, we are there so it's time people need to see us. As I said, harm reduction services were provided to all people who use drugs, irrespective of genders, young or all. But in the process, in the process a lot of capacities have been built of people who use drugs. And in that area of capacity building, women who use drugs were overlooked. They were never there. And they were overlooked in terms of implementation, at the implementation level in terms of representation, in terms of taking leadership role. And that is why today, even after almost 20 years of HIV and drug use movement in our region, our region still lack women specific or gender specific program in harm reduction. Our involvement was not given importance and that is why women in leadership role as an activist or an advocate is almost nil in our region. Programs are designed to find things from research and experts. And from research and expert brings this to the designing level. And since the women who use drugs were not involved at the designing level, maybe that is one reason why we don't have services that we need in the existing harm reduction program. But very lately the involvement of women who use drugs is felt and platform is many areas. But again when it comes to investment, nobody wants to invest in us. Number one example is how many women from Asia are here in this harm reduction conference when this conference, international conference is happening here in Asia. We have women activists in the countries where why aren't they there here? I mean in this conference. I don't know why donors or investors or whoever, I don't know why, what is the reason behind not wanting to invest in us. But that is one. I was actually expecting a lot of women at least from this part of the world because it's happening here. But it's very sad to see that it's very, very, very few. This shouldn't be happening. It should be more than this but that's one example. I was once told that number of women who use drugs is very less as compared to men. So designing a program just for a few numbers is not cost effective. Seriously. I believe we are all in this movement in order to save lives and creating an environment where human rights of people who use drugs are respected. So women who use drugs are not human because we are not human because we are few in numbers compared to men. Whether it is one or thousands or millions, it is about human lives not about numbers. So I appeal to everyone here that please open your eyes because we are very much alive and present among you. Start recognizing the issues that we bring and invest on us too. Otherwise tomorrow no matter how many good things you have done, how many positive things you have been able to make, I mean you have been able to contribute, you will still question your own accountability in this movement by leaving us behind. If you leave us behind you will question your own accountability. And also I agree with Rajiv that it is never too late to start. At least for us women who use drugs. So we as women who use drugs will be expecting a lot of positive things to bring after this conference which can definitely be a camp changer in this movement. Thank you. Thank you very much Narrow message, very clear. Questions and comments from the audience? Please. Can you pass the microphone here? Hi. I worked with a lot of women when I was working in Luton back in London. Sorry my name is Mags, I'm the coordinator for EuroInput. And one of the things I found amongst the women from the Asian populations was the dreadful stigma that they had to live with and the fear in coming out as a woman, as an Asian woman who was using drugs. And one of the innovative ideas that we came up with in order to be able to attract the women to our service was putting on health days. And we would for example advertise the fact that we would be having a sexual health and family planning day. And behind that we would actually be having sessions that were linked to sexual abuse or other types of abuse which might be some of the underlying reasons why the women were using drugs in the first place and then we'd be able to sign post them on for further support etc etc. Because we found that in order for us to be able to provide interventions we had to do it in secret of their husbands and their communities. So I just wanted to share that with you really just for ideas for the future and good luck with it. Thank you for the SS. It's true as an Asian woman coming out as a drug user. It's not easy. It's seriously not easy. I grew up with five brothers and I have more male friends than female friends. And my peers my drug using peers are all my cousin brothers. We are all we are 12 of us who use we are only four of us alive now. So because I am a women I'm a girl those days when it was time for me to go for treatment. I mean when I was caught by my parents they said if you were a boy we would have sent you for treatment. So I never got treatment. So that is the scenario. My cousins were sent for treatment not me because I am a girl. And it's not acceptable. It's not acceptable that your daughter your sister is doing drugs. Sorry. It's not. So coming out as a drug user as I said it was very easy for me to compare to coming out as a drug user. But it was very easy for me to come out as a woman as a woman living with HIV. It was very easy. Now it is because of stigma. Again another thing is it's also because of the motivation the peer support that we get in the PL HIV field HIV field. We get lots of counseling. We give we get lots of motivation. I mean we are we are motivated. We are mentored. We are provided counseling. I mean we are sent we are being sent for exposures. I mean we have been invested in the HIV sector not the harm reduction sector. I'm not talking about harm reduction sector but I am today because who I am I'm able to I'm here today speaking because of the investment made by my by my friends. I mean those in HIV field. So if if the same level of commitment the same level of investment the same level of support. Beyond the women who use drugs it stigma can be you know it can be overcome. It's just about positive positive thing. I mean it's just about positive way of life. It has to but then this has to be shared which is not done. It's just about OK we need we have to draw your blood. It's it's Sentinel surveillance time this time. They are after us only when it's about it when it's time for testing for HIV mostly. So I I seriously believe that if if women who use drugs are being kind of supported or mentored or invested as people living with HIV women living I believe that a lot of women will come out a lot. Thank you. There's one question here. Right there. Thank you. I'm Asian woman. I'm from Nepal. I'm working as an advocate. So I really like your presentation not only related to drug even in the court room even in the court if there are women even if they are arrested for a simple theft like there will be the crowd in the courtroom. And if we talk about murder there will be like hundreds of people and normally like I look even the cases of the drug users and all. So if any girl or woman is arrested they all the time cover their face with this all and the first request would be please don't call any of my relative of my friends. So that's true. So I know these these all are the problems in most of our Asian countries. So what you suggest how to work how to deal with them how to deal with these issues how to deal with their parents how to convince them how to convince court how to convince police how to convince prison officials how to convince themselves how to make people understand. So what like what can we do together because it's the common problem of all I think almost all the Asian countries. What can we do together. We have to start I think we have to start from the basic from the scratch to address the issues of women who use drugs. I can't say this but then we have to start from the beginning that is start by counseling peer counseling so that the women drug users are motivated. They become they become more empowered. Yeah. Yes I think I think that is the I mean that is the starting starting point that we cannot just go and do advocacy for for issues of women who use drugs just like that. We have to develop we have to build the capacity of the women who use drugs for them to come out and present their issues. So and in order to do that like I said their capacities have to be built and build their capacities. We need support. And I believe that we will get support and that is the best. I mean that is the basis. We have to start from the scratch. Thank you. That's that's what I was going to say and that was part of the reason why we would have these sessions in in in secret. Because the whole motivation behind that was to empower the women develop their self confidence and their self efficacy so that as a group they would then feel empowered to take ownership and to actually speak out. And that's where you have to begin with the women but you can only do that by giving them the skills in the first place. And we could only give them the skills by putting on these open days or these sexual health days or whatever you wanted to call them so that the men in the community would quite happily allow their wives to attend these sessions because they didn't realize that really behind closed doors we were addressing other things which were related to drug use. OK. Thank you so much out of respect for time for the other speakers. We're going to move on.