Brief introduction and Ekoparty talk!
This year I’m going to speak at ekoparty and that is special. Not only because it’s the most important security conference in South America, but also due to its meaning to me. Surely you visit our page and see that alertot is a product, then I’m going to introduce myself to let you know the people behind it.
I started in computer security at 2003 (I was 16), young for some people but a bit late for what I remember “la belle epoque” of computer security in Chile with lots of groups publishing ezines (CDLR, 350cc, CDT, EST, k3t, etc). I had the luck of being part of a great team (Pinguinux, infinite gratitude to core and chicox) when Google didn’t have the solution to most of my questions.
University times
First years I learnt by myself in the practical way. In 2005 I started with the wargames at PullThePlug (now OverTheWire), a bit lost in this world of binary exploitation without people around to ask for guidance. Then I started to realize that the community and its knowledge was at other level in near countries like Argentina and Brazil. I understood that to be good at this, I couldn’t set as point of comparison Chile, but the world.
In 2006 I was talking with my friend Simon Norambuena about the status of research in USA (he was a MIT fan) and the idea of SPECT Research was born. We wanted to do private research at a high technical level (in computer security and electronics), but eventually we didn’t develope the project. In 2009 I retook the project and started it as a consultancy firm.
During University times I strove a lot to put computer security on the table. In example, for Encuentro Linux 2009 at UTFSM, Tomas Hernandez and I proposed a CTF and we had a long discussion with a professor about what was going to generate in terms of reputation.
Moreover, there wasn’t any guidance in computer security at University. I did a research on Linux rootkits and the professor asked me if it could be on Windows platforms because he didn’t use Linux. For my thesis I did a research to score security attacks using ModSecurity and let you prioritize which vulnerabilities to patch, based on if the attack had some degree of successful. The first thesis professor told me that he didn’t understand very well what I did (some days before I did the final presentation) and the other one I think didn’t read it.
If you are a student interested in security and need some guidance, don’t hesitate to contact me.
Post-University times
In 2011 and 2012 I won the challenges at 8dot8 (a CTF and a Malware Analysis Challenge by ESET), then after getting my degree I started my work on SPECT. Soon I realized that you needed commercial staff to be able to get clients and eventually I joined Scrapinghub as a Software Engineer. I’ve worked for 5 great years with them, I learnt a lot from very skilled software developers and also trained my hacker mindset when some website was not so easy to scrape (to be clear, we didn’t attack the server, just bypass some network/security mitigations and Javascript reversing).
As an island in the middle of the sea, in 2013 I taught a course on web security at UTFSM to more than 60 undergrad students. Then I continued working as usual.
In October 2016 I took a sabbatical period for 5 months. That year ekoparty was in late October and I attended alone, my first big conference, I was excited. I discovered that the local CTF was running and played, and I got the second place as a solo-team between teams of 4+ people (look at the big difference with always ruling team amn3s1a).
I wasn’t prepared, Guillermo (our CFO) helped me to run some programs in Windows because I didn’t have any virtual machine in my laptop. Therefore it was a strong signal, I wanted to do a shift in my career and turn to computer security and even better if I could combine computer security and software development, my other passion.
I had worked 5 years remotely and liked it because that allowed me to travel around the world. According to my searches, it wasn’t easy to get a remote position as security researcher back in the days because of citizenship requirements, then I would have to invent some way to mix both interests.
Starting October 2016 the idea of alertot hit my head and the outcome of this CTF gave me the confidence to pursue my dream. Because of my CTF participation, in November I was contacted to do a penetration testing (I hadn’t done before) in a company in Chile for 3 days. In the end, it lasted one full month because of the good results. More confidence.
I returned to work part-time and after three months I left to dedicate myself full-time to alertot. Few days after leaving we got accepted in StartupChile Seed program, some people was believing in us.
Ekoparty
Now you know why this conference is special to me. This year I got accepted to talk about my last research about PHP Object Injection and how to make it work nowadays. I hope to meet the expectations and to see you there!
