Hacker versus cracker. The conflict between white hats and black hats. Although society usually associates the hacker with a criminal, this perception is wrong. In reality, the hacker An ethical cybersecurity expert, known as a white hat, is dedicated to identifying flaws in systems altruistically or in exchange for rewards offered by companies, with the goal of improving cybersecurity. Thus, the hackers Ethical people are what have helped the development of the internet. While the cracker, or black hat, seeks to compromise systems for malicious purposes, such as attacking, threatening, and extorting.
“"The crackers "They have become a major threat," he says. Knight Pine, director of CryptULL: cryptology group and the Cybersecurity Chairs at the University of La Laguna, sponsored by the National Cybersecurity Institute (Incibe) and Binter. He also points out that black hat cybercriminals no longer act solely for money, but also have other motivations, such as cyberterrorism. In this regard, Caballero states: “We need hackers to protect ourselves from the crackers”.
The researcher points out that, currently, crackers They carry out numerous attacks on ransomware, These attacks involve encrypting the victim's system—whether it's a media outlet, a hospital, or a government agency—and then demanding a ransom in exchange for the decryption key, supposedly to restore access. Petya, an example of this, was a malware of type ransomware launched in 2016 that affected public infrastructure.
“Normally, attacks by ransomware ”Powerful ransomware uses encryption with current standards, which is very difficult to break, so system recovery is virtually impossible unless the key is provided,” Caballero explains. He also warns against paying the ransom, as doing so makes the victim an ideal target for further attacks.
Cybersecurity threats
Each year, the Open Web Application Security Project (OWASP) compiles a list of the top 10 cybersecurity threats. Caballero notes that in 2024, the top three are access control issues, cryptographic flaws, and malicious code injection attacks. Common problems, such as poor application design and the use of outdated components, are also included. Furthermore, Carlos Trincado, A researcher in the area of Criminal Law at the University of La Laguna indicates that, in general, there are problems linked to massive data leaks, denial-of-service attacks, and ransomware.
The first case was recorded in 1988 malware On the internet—then known as ARPANET—the Morris worm affected the 10% port of machines connected to the network. Following this incident, the Association for Computing Machinery (ACM) established November 30 as International Computer Security Day to raise awareness about the importance of protecting data in the digital world and being vigilant against potential threats.
The biggest problem is human error. “We are the weakest link,” says Caballero. “In cryptography—the discipline that studies and develops techniques to secure information—we can design perfect algorithms, but when it comes to implementation, it is humans who execute them and can make mistakes,” he points out. The most common human errors are related to the creation and repeated use of weak passwords across all platforms, and attacks by phishing, the outdatedness of software and the misuse of computer tools.
The director of CryptULL is annoyed by social engineering attacks like the phishing, These scams aim to manipulate users into revealing confidential information. Currently, it's very common for individuals to receive phone calls requesting personal data. "It really angers me that people fall for these traps, because there's no way to defend themselves against such widespread ignorance." Cybercriminals are even using more advanced social engineering techniques. According to Trincado, the number of cases using generative artificial intelligence tools to commit cyber fraud is increasing. One example is a specific method where artificial intelligence modulates the voice of a company's CEO to impersonate them and instruct an employee to make a bank transfer.
Women, more vulnerable
Within the digital ecosystem, women are more vulnerable. “Unfortunately, the digital environment is part of our world,” Caballero points out. Thus, if the physical world is sexist, so is the digital one. Women suffer two types of cyberviolence: cyberbullying through misogynistic attacks and sexual harassment related to the dissemination of images. In this regard, Caballero notes that the best way for women to protect themselves is through training in gender equality and the use of digital media. “It has been shown that women are at greater risk of having their systems infiltrated,” she states. For this reason, in Spain, Incibe is working to bring more women into the world of cybersecurity, a field in which they are very few. “We are victims, and we must become our own defenders,” she declares.
Currently, the technology of machine learning Machine learning is widely used in cybersecurity, both for launching attacks and defending against them. In addition to detecting known attacks, it can identify new threats through learning processes. Its main advantage lies in its ability to handle large volumes of data. “It feeds on an enormous amount of information, from which it identifies patterns to draw conclusions and improve its learning,” explains Caballero.
On the other hand, the blockchain Blockchain is another important technology in the field of cybersecurity. Its main use is for smart contracts. However, Caballero indicates that its use has declined. The researcher highlights the advantages of this technology, such as its equitable distribution and its solid cryptographic foundation, which guarantee the integrity of the stored information.
Quantum computing
“A few years ago I participated in a TED Talk ”In which I treated quantum computing as a joke,“ Caballero admits. ”I eat my words,“ he confesses. Quantum computers are already a reality: ”They are much more efficient and powerful than our traditional computers, which are now obsolete.” Although quantum computing has applications in different fields, its impact is most notable in the area of cybersecurity, particularly related to cryptography.
“As soon as we have quantum computers with sufficient power, it will be possible to break all the cryptographic systems we currently use to browse the internet, communicate via mobile phone, or carry out banking transactions,” Caballero warns. Traditional computing cryptographic systems are based on complex mathematical problems, such as elliptic logarithms or the factorization of large prime numbers: “For a conventional computer, separating the product of two large prime numbers is very difficult,” he explains.
However, for a quantum computer, these problems are much easier to solve. For this reason, it will be necessary to replace all current cryptographic algorithms. Caballero points out that the technology company IBM Research is leading the development in this field: “They have promised that, in a few years, there will be a quantum computer capable of breaking all current cryptography.”.
In fact, outgoing US President Joe Biden, during his term, issued an executive order mandating that all government agencies replace their cryptographic algorithms within 18 months, a measure taken urgently in response to the rapid advancement of this technology. For its part, Europe also published a series of recommendations urging countries to update their algorithms to adapt them to quantum computers. Indeed, according to Caballero, the National Institute of Standards and Technology (NIST) recently published an announcement revealing that all current cryptography will be obsolete by 2030 and prohibited after 2035.
Post-quantum cryptography
Thus, mathematics and computer engineering have worked together to develop post-quantum cryptography, resistant to quantum computers. This new cryptography must be based on mathematical problems different from those used in traditional systems. Caballero explains that, in one of her books, the first on cryptography in Spanish, she introduced the McEliece scheme, which is based on codes. However, this scheme has two drawbacks: it requires very large keys and its calculation is slow. The researcher has a more recent publication in which she proposes a modification of the McEliece scheme with shorter keys. The code system was proposed as a possible standard for post-quantum cryptography, but ultimately, lattice-based systems have been chosen.
However, lattice-based cryptography is very difficult to understand. For this reason, the CryptULL group has developed educational tools to bring this knowledge into classrooms at schools and universities. “We have used tools from software ”They use tools like GeoGebra to introduce lattice theory and Scratch to teach programming and introduce quantum computing,” he explains. They have also designed a card game related to quantum computing.
All of these science outreach tools have been presented at international conferences and published in high-impact scientific journals. Caballero admits that staff from IBM Research and NIST have expressed interest in some of them. Furthermore, the director of CryptULL notes that they have implemented these activities in classrooms and analyzed how much students have learned with these tools, obtaining promising results.
Legal shield
The role of law in the field of cybersecurity is fundamental. Trincado, a researcher in the area of Criminal Law, points out that most crimes involve damage to and disruption of computer systems, regulated in Articles 264 and 264 bis of the Criminal Code. On the other hand, unauthorized access to confidential data contained in computer systems encompasses a range of offenses scattered throughout the document, including the crime of discovering and revealing secrets, improper access to personal data stored in computer files, crimes related to trade secrets, and offenses related to national security.
“The issue is that many of these crimes go unreported, a term that refers to the high frequency of certain offenses whose true incidence is not reflected in official statistics,” he explains. This occurs because it is very difficult to identify and prosecute cybercriminals. Thus, reported crimes often go unpunished, and the perpetrators do not receive their respective sentences. “In contrast, other crimes, such as scams or online fraud, result in a higher number of convictions, since it is easier to identify those responsible,” Trincado explains.
Regarding crimes against access to confidential data in computer systems, society tends to imagine the perpetrators as crackers in a dark room in front of a computer screen with a few lights. However, court statistics reveal that a large proportion of cases involve company employees or public officials accessing files from computers that probably don't even start up.
“This happens because government agencies exercise very strict control over who accesses computer systems and how,” explains Trincado. “In the public sector, there are numerous court rulings convicting officials for improperly accessing medical records and police files, among other things,” he adds. From a legal standpoint, the key point is that it is not only necessary to establish security measures against external threats, but internal ones must also be considered.
And how can the law adapt to the frenetic pace of the digital world? “Access to confidential data is possible both in computer systems and in physical files or storage facilities,” he states. Thus, the interpretation of these crimes can generally be subsumed under existing ones. However, some actions, such as the non-consensual dissemination of intimate images—sextingThese crimes have had to be incorporated into the Penal Code due to their increasing frequency in the digital world. Regarding jurisprudence, it is true that some judges, especially the more purist ones, may lack specific training in new technologies, which influences how they interpret certain terms. However, this does not imply poor administration of justice: “Judges rely on reports from experts and specialists, as is the case in other technical disciplines,” explains Trincado.
Regulating AI
The problem with artificial intelligence lies in its definition, as neither technology nor computer science experts can agree. From a legal standpoint, this presents an obstacle, since laws require precise definitions. “Using a very broad definition can create problems in the application of the law,” he states. In June 2024, the European Union (EU) approved a regulation governing artificial intelligence. Regarding this, the researcher maintains: “A consensus was reached which, although generally correct in its definition, still presents the problem of remaining too open and ambiguous.”.
Although there is little doubt that advanced systems like Chat GPT can be considered artificial intelligence, the definition proposed by the EU could encompass these systems as well as others. software more traditional. “The EU has tried to avoid this by introducing some modifications, but experts continue to question it,” he says.
Trincado himself still has doubts about how to clearly differentiate between an artificial intelligence system and a software traditional interpretations stem from the proposed definition. “A broad interpretation could unnecessarily regulate systems that do not present the risks associated with artificial intelligence,” he states. But the opposite could also occur: “A definition that is too narrow could exclude systems that pose the very problems the regulation seeks to prevent.” Thus, a broad definition could hinder technological innovation, as systems would have to comply with the obligations established in the regulation, which would have economic and temporal consequences.
(This report is an initiative framed within the InvestigaULL Commemorations Calendar, a scientific dissemination project promoted by the University of La Laguna).
Scientific Culture and Innovation Unit (Cienci@ULL)
Spanish 
English 
French