Ekoparty 2026: Embrace the Chaos

I’ve been reading El lado del mal, the Spanish-language blog of Chema Alonso, for more than ten years. At this Ekoparty I finally met him in person: I came home with a photo, a hug and his autograph on my badge.

But the Eko, as everyone calls it, was much more than that moment. The 22nd edition of Ekoparty ran October 7–9 at the Buenos Aires Convention Center, under a motto that ended up describing the agenda pretty well: embrace the chaos. There were 250+ activities, hundreds of speakers and dozens of villages, community-run spaces that each focus on one topic. This post is my summary of what was discussed, what surprised me and what I’m taking home to study.

Surveillance-camera cosplay, right under the motto. Photo: Flor Fernández, from Dark News.

How to tackle 250+ activities

You don’t get through an agenda like this; you pick from it. Before going, I did what I’d do with any data problem. Using Hacker Tracker, I built one card per talk and clustered them by topic to see where the conference’s real weight was.

AI won by a mile: about a third of the activities touched it in some way. Next came hardware and IoT, social engineering, secure development, threat intelligence and bug bounty. Further back were industrial security, identity and cloud, quantum computing, risk management, detection and response, and fraud.

I also checked which rooms would be recorded. The rule wrote itself: if it isn’t recorded, watch it live; if it is, catch it later on YouTube (with a few exceptions I wanted to see in person). That left me time for the villages and for talking with the people giving the talks.

The Lado B desk: the Eko’s own live stream on Twitch and YouTube, with interviews and backstage.

The Maintrack: where the strongest work was

The Maintrack is the main stage, and almost all of the most important research went through it. It was opened by Leo Pigñer, CEO and one of the Eko’s founders. From there, for three days, came a parade of first-hand findings with names attached: someone found something real and showed the whole chain, from the first bug to the impact.

Chema Alonso: hacking in the age of AI

Chema’s talk was the day-two keynote, and the room was packed. I watched it live, phone in hand to take photos and record a few bits. He has already uploaded the full talk to YouTube and written about it on his blog, both in Spanish. It was called Hacking in the age of AI after Mythos, Fable, Sol and Astra, after some of the most recent models, and it builds on his book Hacking IA, published by 0xWord.

He started at the very beginning, with Alan Turing asking in 1950 whether machines can think, to underline how new everything else is. Agents, skills and MCP (Model Context Protocol, the standard an agent uses to connect to external tools) are months old or, at most, a couple of years. And they’ve already changed the internet: according to Cloudflare Radar, bot traffic is now almost on par with human traffic. Chema works at Cloudflare these days.

The first half was about models as the target. LLMs (large language models) ship with built-in weaknesses:

• they can be poisoned with a small amount of manipulated training data;
• they hallucinate;
• they leak what they learned;
• they obey instructions they find along the way.

That last one is prompt injection, and Chema compared it to what SQL injection was for the web for almost twenty years. He said attackers are already registering the package names, MCP servers and domains that models invent when they hallucinate, so that the next person who copies the code downloads malware.

Then came the demos. First he took a chat assistant built for an online store, which in theory only answers questions about its products, and talked it into writing arbitrary code. The next step in the cybercrime world is to package that trick as an API and sell it. Then came a role-play jailbreak: framed as fiction, the model ended up drafting a plan against one of the Eko’s founders.

The part that stuck with me most was fragmented attacks. Inspired by an Asimov novel in which no robot knows the full plan, he showed how to split a dangerous task across several agents. In the demo, five agents end up poisoning a person while each one believes it’s serving water. None of them sees the plan. The only way to detect it is to watch what all the agents do at once, with history. They built a monitor that catches it with five agents or with a hundred; with thousands, according to Chema, there’s no answer yet.

The second half was AI on the attacker’s side. The new models chain vulnerabilities and write exploits from a single request, even analyzing binaries without source code. He said that at Cloudflare, when they tested these models against their own platform, the volume of findings was such that they had to build agents just to triage them. I heard that same idea again in other rooms, as I’ll get to below.

Near the end he put up the LLM ATT&CK Navigator from Anthropic’s red team, which he had reviewed on his blog: the offensive techniques of 832 accounts Anthropic banned for abuse, laid out on the MITRE ATT&CK matrix. There’s hardly a phase of an attack left without some use of AI.

Chema Alonso on the Maintrack stage, with Anthropic’s LLM ATT&CK Navigator behind him.

AI on the attacker’s side

Chema’s wasn’t the only Maintrack talk on the subject:

• Prompt Critical: AI-driven Weaponization of a UniFi OS RCE Chain. Jon Williams of Bishop Fox took over a Ubiquiti UniFi OS console live (the box that runs an office network along with its cameras and door locks) with one unauthenticated web request. The access also survived the official patch. The most interesting part was the method: the reversing wasn’t done by hand. Williams assembled commercial AI tools into a vuln research setup, had it drive the work end to end, from the raw firmware dump to a working exploit, and then walked through where the AI delivered and where it fell short.
• Dead.Letter y el exploit writing moderno (“Dead.Letter and modern exploit writing”). Andrés Luksenberg of XBOW reconstructed Dead.Letter (CVE-2026-45185), a pre-auth RCE in Exim. The week between the report and the public disclosure was a race: an agent trying to write the exploit on its own and, in parallel, Luksenberg with an LLM as copilot. Back then the conclusion seemed settled: the model speeds up code review and solves whatever looks like a CTF, but a real exploit still needs debugging and human judgment. Three months later the picture had already changed, and the talk put both moments side by side: which parts of exploit writing models now handle, and where they still fail.
• PleaseFix: Cómo navegadores con agentes de IA están deshaciendo décadas de ingeniería de seguridad (“how agentic AI browsers are undoing decades of security engineering”). Inbar Raz argued that, to let agents browse, the industry is deliberately tearing down mitigations that took years to build: agentic browsers that sidestep the same-origin policy, talk to localhost or touch the file system. For Raz these aren’t bugs but design decisions, which is why XSS, sandbox escapes and drive-by attacks are back. PleaseFix is an evolution of ClickFix that fools the agent instead of the person, with 0-click chains: it’s enough for the agent to pass through a social network or read a booby-trapped calendar invite. The chain ended in account takeover, mail and file exfiltration, persistence in the agent’s memory and RCE on the target machine.
• Patriot Bait: How One Man and an AI Agent Ran a Five-Year Influence Operation and a Six-Minute Botnet. Lucas Silva followed “bandcampro”, a lone, Russian-speaking actor with little technical skill who kept five years of MAGA- and QAnon-themed fraud going on top of a jailbroken Gemini, from a Telegram channel with 17,000 subscribers. The evidence is unusual: the actor’s exposed working environment, chats and more than 200 Gemini CLI session logs. The strongest moment: writing only in Russian, the actor asked the agent to migrate a live botnet, with machines inside a dental clinic, and in about six minutes the whole C2 (the command-and-control infrastructure) had been reduced to three text files of under 5 KB. Two trivial guardrail bypasses were enough.

Lucas Silva during Patriot Bait.

Hardware that wasn’t meant to be opened

• It’s a me! DOOM! A Homebrew Entry Point for LEGO Super Mario. Kevin Aguilar (cabr4) found the first known way to run custom native code on a LEGO Super Mario. Under the plastic there’s a Cortex-M4 and 80 KB of RAM driving a color display, an optical sensor and an accelerometer. It talks BLE (Bluetooth Low Energy) and takes GATT writes with no pairing and no bonding, so anyone in range can write to it. The bug lives in a GATT characteristic the community has known about for years: its write callback copies whatever it gets without checking the length. From that single overflow, Aguilar built arbitrary read and write primitives over SRAM, jumped into custom code and took over the screen, just enough to run DOOM. All without opening the toy, without SWD, without touching flash and without breaking the bootloader’s ECDSA signature check.
• Root From Kilometers Away: Ubiquiti AirMax RCE. Federico Kirschbaum, another of the Eko’s founders, and Gaston Aznarez went after AirMax, Ubiquiti’s proprietary wireless mode for long-distance links: wireless ISPs rely on it, and it also turns up on battlefronts. They reversed the protocol, AirOS and the kernel modules that implement it, on a 17-year-old Linux. AirMax data rides in 802.11 Information Elements; they look encrypted, but they aren’t. The result is two critical CVEs (CVE-2026-21638 and CVE-2026-21639): kernel-level remote code execution, over the air and without authentication. You don’t need to be on the network; line of sight is enough. They affect seven device families, more than 50 models on sale, going back to the very first AirMax. Ubiquiti’s bug bounty rated it “Adjacent”, even though it’s exploitable from kilometers away. The research comes from Faraday, which also released an open source tool to detect and locate AirMax networks, and which organized the wardriving I describe below.
• Hacking the KIA Real Time Operative System. Danilo Erazo presented the third part of a research series on the head unit (the infotainment unit) of Erazo’s own KIA. In 2025, Erazo had found a flaw in the proprietary RTOS boot process that allows injecting arbitrary PNGs: enough to deface the screen and, with a custom tool that automates the chain, to pivot from the infected firmware into a shell on the driver’s phone. This year the RTOS reversing went deeper, and when vulnerabilities were published in libpng, Erazo confirmed that one of them also affects KIA’s implementation, and many other embedded systems too. The boot flaw is precisely what makes it possible to deliver the malicious PNG. It has already been reported to KIA.
• Breaking the Warehouse: From Bluetooth Devices to Operational Control. Haidar Kabibo and Sergey Sidorov mapped the ways into an automated warehouse and showed three paths in. The first, an RCE (CVE-2026-4272) in Bluetooth barcode scanners that compromises the host they connect to with no user interaction. The second, a kiosk-mode escape on the workers’ Android terminals. The third, an attack on thermal printers that lets an unauthenticated attacker onto the internal network. Chained together, they lead from a peripheral nobody watches to the WMS (Warehouse Management System) and the critical processes.
• Nobody puts baby in a corner. Sammy Azdoufal was reverse engineering the cloud behind a popular line of baby monitors and home cameras and found that a single MQTT subscription with a wildcard returned live messages from every device on the platform, about 1.1 million cameras. The stream included motion alerts carrying image URLs, home floor plans, P2P credentials and audio events. MQTT is the go-to publish/subscribe protocol in IoT, and one wildcard the broker should never have accepted was enough to read it all.
• Hardware in the loop: reverseando el link de un headset de VR (“reversing a VR headset’s link”). Matias Soler spent two years on the wireless link between a virtual reality headset and its controller: a proprietary 2.4 GHz protocol combining TDMA, frequency hopping, ECDH pairing and session encryption, with closed firmware on both ends and no debugger. The setup was pure hardware: six custom-programmed nRF52 boards (one plays the controller, another camps on a fixed channel, two chase the hopping, one measures timing down to the nanosecond and the last one injects frames), the original controller opened up and wired to its test points, and the firmware pulled out through glitching. In the demo, the headset accepted Soler’s board as if it were the original controller, with a serial number, a firmware version and a battery that didn’t exist. A ten-month dead end was cleared in two days with LLMs and the hardware in the loop, but the conclusion is the one I found most useful: without something to check against, the model talks itself into things. It filled Soler’s Ghidra project database with assumptions that were later re-read as facts; one of them, a formula for the hopping, sat in the notes for a year and was wrong. Soler summed it up in one line (my translation): “No model solders, transmits, or wires up more radios for you.”

Lockstep, from Danilo Erazo’s other talk, at the Car Hacking Village, on voltage glitching (dipping a chip’s power for an instant so it skips or corrupts an instruction) in automotive microcontrollers. A second core repeats the main core’s work a few cycles behind, so a single glitch can’t fool both the same way: any mismatch raises a fault.

Data, payments and identity

• ¡Atrápalos Ya! How To Capture 3.5 Billion WhatsApp Accounts. Gabriel Gegenhuber, Max Günther and Philipp Frenzel, from SBA Research and the University of Vienna, reverse engineered WhatsApp’s contact discovery API, the one that tells you which of your contacts use the app, and turned it into a global enumerator. Out of roughly 63 billion possible numbers they turned up over 3.5 billion active accounts, from a single machine and a single IP. Besides the number, they collected profile pictures, public keys, device data, timestamps and the “about” text, and from that they spotted reused cryptographic keys and signs of scam operations. Argentina alone has more than 40 million accounts, 88% of them on Android. Message encryption stayed intact; the lesson is that metadata, at this scale, is sensitive data too. Meta has already fixed it.
• Every ride you take - Hacking a City’s Public Transportation. Ignacio Navarro read code and chained weak access controls and internal design flaws until taking over the central mobility systems of Córdoba, which more than 1.5 million people use every day: buses and taxis, DVRs, transit cards, rider data, live vehicle tracking and admin panels.
• Contactless Under Attack: PIN Bypass, EMV and Apple Pay. Davi Mikael walked through NFC and EMV, the chip card standard, and the research that pulled off high-value payments without a PIN by tampering with protocol data. The talk also showed wallets in Express Transit mode that pay without unlocking the phone or asking for any other authentication.
• The Glass Perimeter - Systematic Bypasses in Biometric Frameworks and the Rise of Synthetic Identity. Dan Borgogno, also from Faraday, and Javier Bernardo, from Strike, instrumented the environment around biometric frameworks and showed how liveness detection falls apart under attacks that range from the camera lens to hijacking the capture at kernel level. It isn’t an isolated bug: it’s a trust model that leaves the business logic exposed.

Dan Borgogno and Javier Bernardo during The Glass Perimeter. Technique 5 on the screen: writing raw frames straight into the camera’s image buffers, so the SDK takes them as if they came from the lens.

Windows, firmware and protection schemes

• MSIX’d Up: Weaponizing the Modern Windows App Packaging Ecosystem. Nick Powers went after the packaging ecosystem behind modern Windows apps (MSIX, UWP, WinRT, AppContainers and package identity), which has been on by default for over a decade and which almost nobody has looked at from the offensive side. Powers showed one technique per stage of the attack. For initial access, protocol handlers and little-known package formats that slip past detections. For post-exploitation, operating inside AppContainer isolation below EDR thresholds. For lateral movement, WMI providers and DCOM objects from the installation services. And for escalation, SYSTEM from a standard user through a logic flaw in the deployment service, still under coordinated disclosure with Microsoft. None of it needs third-party software and all of it works against patched systems. The talk came with red team tooling and detection guidance.
• VU#226679: rompiendo contraseñas UEFI mediante WinRE (“breaking UEFI passwords through WinRE”). Beatriz Fresno Naumova found that WinRE, the Windows Recovery Environment, changes the BootNext NVRAM variable without authentication, so the firmware boots from an external device even when a UEFI password is set. The firmware’s own boot menu does ask for it; WinRE gets in through a gap in the specification. Fresno Naumova reproduced it on an HP ZBook Firefly 14 G11. The six months of disclosure were almost as interesting as the bug: HP blamed the ecosystem, Microsoft rated it Moderate without issuing a CVE and GIGABYTE replied that it was by design.
• Reversing el DRM de Netflix: anatomía de Widevine L1 en Windows (“reversing Netflix’s DRM: anatomy of Widevine L1 on Windows”). Jeremy Erazo opened up widevinecdm.dll, Google’s closed library that decrypts 4K content in Chrome and Edge. The talk mapped its dispatch model, with 19 methods spread across three concentric vtables and MBA obfuscation sitting where you wouldn’t think to look, and found something counterintuitive: when the video is hardware-decoded, Decrypt and DecryptAndDecodeFrame, which look like the obvious place to intercept frames, never even get called. Ninety seconds of 4K HDR without a single invocation.
• Zero-Knowledge cracking of a 1983 Apple II Hardware Copy Protection. Inbar Raz, who cracked hundreds of PC protections as a teenager, ran into a historic 1983 Hebrew-language program for the Apple IIe protected with a dongle, without knowing anything about the platform. The talk was the process itself: learning the architecture on the fly until finding the protection and breaking it.

Crypto, threat intel and disclosure

• A Practical Approach to Post-Quantum Readiness at Scale! Sheila Berta, CTO of Atomiq Lab, took on a basic question almost nobody measures: how much real-world TLS infrastructure already negotiates post-quantum cryptography. To answer it, the team extended the ZMap ecosystem. They added the hybrid X25519MLKEM768 group to zcrypto, which pairs classic X25519 with ML-KEM, plus the ability to send several key shares in TLS 1.3, and enabled it in zgrab2, falling back to X25519 when the server doesn’t support it. With that they scanned Argentina’s exposed TLS infrastructure, sector by sector, and closed with how to build your own assessment and migration process, including the hardest part: legacy and OT environments.
• LATAM-as-a-Service: How Latin American cybercrime industrialized Everything-as-a-Service. Anton Dolgalev of Group-IB dissected six operations that either sell services in the region or target it: marketplaces for compromised access, a Nuitka-compiled Python framework that fetches its C2 from a paste site, a phishing platform with a fourteen-state WebSocket protocol to steal sessions and bypass MFA, an Android RAT, a commercial RAT with nineteen persistence mechanisms, and a vishing module with an LLM, a synthetic voice and thirty SIP channels in parallel. In Classiscam, which spins up phishing pages from Telegram bots, Argentina carries as much weight as Chile. The best part was the methodology: attribution came from forensic analysis of code and repositories (shared build chains, backdoors, leaked tokens) where clustering by infrastructure fell short, and the talk closed with five behavior-based hunting hypotheses that survive domain rotation.
• Un Palantir para gobernarlos a todos (“one Palantir to rule them all”). Valentina Costa Gazcón used Palantir as an excuse for an experiment: take real data on natural disasters, climate and global risk, look at it through the eyes of different countries, and make explicit the rules by which the same event is a threat to one and noise to another. Whoever builds the model defines what the system can see and what it can conclude.
• HTTP2Crash and the Cicada Problem. Houston Hunt started with the mechanism. A client, with no authentication, advertises a SETTINGS_INITIAL_WINDOW_SIZE of zero and then asks for big resources on lots of streams. The server processes them but can’t send the responses, which pile up in memory, and when the connection closes, freeing them all at once spikes CPU and I/O until the service falls over. There are no malformed frames: RFC 9113 allows it. It’s already up to five CVEs. The second part was the critique. While the team was coordinating through VINCE, CERT/CC’s coordination platform, someone published a similar AI-found bug, with a PoC a few days later, and took the spotlight. For Hunt, coordinated disclosure doesn’t have a process problem but an incentive problem: it punishes whoever plays by the rules.

Anton Dolgalev during LATAM-as-a-Service. BraZetsu, the Nuitka-compiled framework, went from 10 to 27 functions in five versions between February and May, and its latest tracked build still had 0 detections out of 72 on VirusTotal after it was discovered.

Read together, almost all of these talks say the same thing in different ways: security through obscurity lasts until someone sits down to look. A proprietary protocol like AirMax, a toy without an SDK or an obfuscated DLL isn’t a defense. It’s a postponement.

AI agents as the target

What showed up in the Maintrack as research was discussed in the villages as an everyday problem. The topic kept coming back at the AI Resilience Hub, OWASP, Red Team Space, Blue Space and Cloud Security Space. The underlying shift: the question is no longer just what a model can do, but what happens to an agent that reads text it doesn’t control and acts with real permissions.

• Valentín Torassa Colombero spoke at several villages. In Prompt injection en agentes con tools: permisos, aislamiento y auditoría (“prompt injection in agents with tools: permissions, isolation and auditing”), the same injection ran live against agents configured in different ways: the damage depends on each tool’s permissions, isolation and auditing. In Dónde se rompe OAuth cuando el que llama es un agente (“where OAuth breaks when the caller is an agent”), at OWASP, the focus was the confused deputy: an agent with more access than the person who handed it the task is the cleanest privilege escalation in the system, and it needs no exploit and no CVE. The proposal is a fixed order for every agent action: normalize it first, then apply a default-deny policy, have a human approve anything sensitive and write to an append-only log at the end. And if any of those steps fails, deny.
• Christian Urcuqui focused on breaking agents and MCP servers in When Agents Trust Too Much: Breaking AI Agents and MCP. At Red Team Space, Urcuqui also presented Building Orion, a framework that combines LLM agents, adversarial ML techniques and the MITRE ATLAS catalog to attack models and turn those attacks into defenses.
• David Soto, in MCP y el problema que nadie está viendo: supply chain attacks en el ecosistema de herramientas IA (“MCP and the problem nobody is seeing: supply chain attacks in the AI tooling ecosystem”), showed that an MCP server carries the same supply chain risks as an npm or PyPI package, with one uncomfortable difference: the malicious code isn’t run by your runtime but by the model itself. The talk brought a working proof of concept, three variants of the attack, indicators of compromise and rules to detect it.
• Mario Lobo presented AImaru C2: La Nueva Era del Living off the Land (“the new era of living off the land”), a C2 that combines LLMs with MCP. It takes orders in natural language, writes obfuscated PowerShell on the fly, rewrites its payloads around legitimate binaries, ships modules to get past AMSI and walks the operator through the kill chain, technique by technique from MITRE ATT&CK. It’s the logic of a LOLBin taken to another scale: the attacker brings no malware, uses what’s already installed, and now also asks the model to decide how.
• Juan David Alvarez Builes and Javier Díaz took the problem to detection in Cuando la orquestación ataca: detección comportamental en flotas de agentes IA (“when orchestration attacks: behavioral detection in AI agent fleets”). Today’s controls, like per-action authorization or content filtering, are stateless: they look at each request on its own and answer ALLOW or DENY. The blind spot is attacks where every action is legitimate and what gives the compromise away is the pattern. For example, an agent that performs 412 reads in a single session, all of them authorized; five agents going after the same resource inside the same five-minute window; or permissions that creep up little by little over a month. The answer is a behavioral baseline per agent and per fleet.

Germán Borda, from OWASP, pointed out that in a prompt, data and instructions arrive mixed together. Almost everything else follows from that. Daniel Dieser, from the AI Resilience Hub, took the drama out of Skynet-style scenarios and brought it down to something concrete: review what permissions each agent has and isolate the environment it acts in.

If I had to turn all of this into controls, the list would be short, and not that different from the usual one:

• Everything the model reads is untrusted input, whether it comes from a website, a document or another tool’s response.
• Each tool gets the least privilege it needs, not whatever is convenient to give it.
• Third-party tools get vetted like any other dependency: where they come from, what they do and whether they’ve changed.
• Every tool call gets logged, because what isn’t audited can’t be detected.

None of these is enough on its own. It’s defense in depth applied to something that makes its own decisions.

The bottleneck moved

The consequence of AI finding and exploiting flaws showed up, with numbers, at the Bug Bounty Argentina village. In Bug Bounty at AI Speed from Both Sides of The Counter, Alan Levy spoke from the hunter’s side and Andrés Riancho from the company’s. Riancho ran Vercel’s one-million-dollar challenge and built a triage agent to work through the more than 1,300 reports that came in over two weeks. Only 73 turned out to be relevant; most were duplicates. Levy’s takeaway: finding flaws is no longer the problem; now the problem is separating the noise from what matters.

Alan Levy and Andrés Riancho at the Bug Bounty Argentina village.

Darío Rivas Quero took the same question to scale with El colapso del CVE (“the collapse of the CVE”): what happens to triage, and to an already overwhelmed NVD, when finding vulnerabilities becomes a prompt. Andrea Brosio showed the other extreme in N-days Weaponizer with a Multi-Agent AI Pipeline: a pipeline of agents that takes a CVE and runs the whole cycle unattended, from researching the flaw and standing up a vulnerable lab to picking the gadget chain, building the payload and delivering it. It ran live against CVE-2024-54676, a deserialization RCE in Apache OpenMeetings that had no public PoC. And Chema told the same story from inside Cloudflare.

As someone moving toward risk management, this was the most important news of the Eko for me: the expensive part of the work shifted from finding to prioritizing, fixing and explaining.

Latin America, on its own terms

Something I really valued is that the region didn’t show up as a copy of what happens elsewhere, but with its own cases, numbers and regulations.

• Fabio Marenghi, in El manual de Lazarus llega a Brasil: Mikedor y OfDor contra el ecosistema financiero latinoamericano (“the Lazarus playbook comes to Brazil: Mikedor and OfDor against the Latin American financial ecosystem”), tracked a group that applied the Lazarus playbook against Brazilian banking, with Pix, Brazil’s instant payment system, in the role SWIFT used to play. In early 2026, a large international bank lost more than $18 million, split within minutes across dozens of mule accounts and moved into crypto. Starting from a single domain, the investigation led to Mikedor: shell scripts, Go backdoors for Windows and Linux (x64 and ARM) and a scanner that uses AI to decide what to steal first.
• Diego Ritunnano, in Sin armas ni rencores - Encadenando vulnerabilidades en un homebanking (“no weapons, no grudges: chaining vulnerabilities in an online bank”), attacked CyberFinance Bank, a deliberately vulnerable online banking app, live. The chain went from an IDOR to an OTP bypass and JWT attacks, until an account was drained. The point: a low-impact finding can be the first link of a critical one.
• Facundo Lisotto, in Resultados de tesis - A7724 y su impacto en el ecosistema financiero (“thesis results: A7724 and its impact on the financial ecosystem”), presented a UTN (Universidad Tecnológica Nacional) thesis on Communication A 7724 from the BCRA, Argentina’s central bank, which sets the minimum requirements for managing technology and information security risk. The thesis built its own instrument to measure how mature cyber incident recovery controls are in the financial sector, and compared it with frameworks like NIST’s.
• Juan Martinez Blanco and Juan Urbano Stordeur, in Bypassing KYC SDKs in the AI Era, found the same mistake in KYC (know your customer) integrations from different vendors: the server took the biometric package generated by the SDK on the phone as a guarantee that the capture came from the app. Instead of fighting each protection (SSL pinning, anti-root, anti-Frida), they reconstructed how that package is assembled and reproduced it outside the app, fed with images downloaded from the internet or generated with AI. The impact runs from fraudulent onboarding to account takeover through account recovery.

Together with The Glass Perimeter and the deepfakes discussed at the Cyber Finance space, the message is clear: when fraud rests on synthetic identities, the perimeter stops being the network and becomes the person.

OT and quantum, down to earth

OT (operational technology) means the systems that control physical processes: plants, power grids, robots, warehouses. What I liked here was less noise and more plant floor. The Secure OT Village, co-founded by Habib Gramondi, brought talks on ISA/IEC 62443, the family of industrial cybersecurity standards, and on the IRAM standards (IRAM is Argentina’s standards body) that adopt it locally. It also put together an explanation of how a process is controlled, aimed at those of us coming from IT. Florencia Rao ran the workshop Root > ROS: hackeando un robot (“hacking a robot”): with limited SSH access to a simulated warehouse robot running Linux and ROS (Robot Operating System), you had to do recon, escalate privileges and abuse insecure APIs until reaching the control layer. And to make it tangible, the village built a scale model of Buenos Aires’ northern corridor with electrical substations running on real hardware.

Quantum also had a space of its own, with two faces. One is the threat to today’s encryption, which Sheila Berta’s research showed. The other is quantum as a tool. In Quantum Gadgets: Finding Optimal ROP Chains on Real Quantum Computer Hardware, Carlos Benitez framed building a ROP chain as what it is underneath: a combinatorial optimization problem, choosing and ordering gadgets that satisfy register constraints inside a huge search space. The gadgets were extracted and filtered, the constraints encoded as an objective function and the optimization run on real IBM quantum hardware, noise and all, compared against classical methods, all the way to root.

Outside the talk rooms

Hacking since 2001: one of the backdrops around the venue.

A good part of the Eko happens in the villages, a format the conference borrows from DEF CON. Some of the ones that caught my attention most:

• MeshArg, the Argentine Meshtastic community, showed text messaging without internet, using LoRa radio nodes that build their own mesh network. There are already about 200 permanent nodes around Greater Buenos Aires. This year’s electronic Eko Badge, in fact, ran its own build of Meshtastic.
• The Cybercirujas (roughly, “cyber scavengers”), the collective fighting planned obsolescence, brought a replica of the Altair 8800, a 286 PC with an amber monitor and DOOM running on an old card payment terminal. It was the Eko’s second DOOM, after the LEGO Mario. They also set up a hardware olla popular, a community potluck where people swap components instead of food.
• P2P, this year’s new space, organized by Gala Cacchione, brought together electronics, repair and art, with talks on the demoscene, BBSes and free software.
• The Physical Security Village had lockpicking practice every day. Bill Graydon gave Intro to Lockpicking, focused on the lever locks that are so common in Argentina, and Karen Ng gave Bypass 101 and Bypass 102: how a door gets opened without touching the lock (exit hardware, access control, under-the-door attacks, latch slipping) and how to fix each one.

Wardriving: hunting for AirMax

Wardriving is an Eko tradition: surveying the city’s wireless networks from a moving vehicle and logging each one with its location. Some editions were done on a boat; this year the call talked about the “tren hacker de la alegría” (the “happy hacker train”), which had little train about it: it was a bus. The 2026 challenge had a clear theme because Faraday built it around its own research: an antenna went to whoever found the most AirMax networks. For first-timers there was a prior workshop run by Matias Baghdassarian, and the call asked people to bring an antenna, a Raspberry Pi or a Flipper.

The “happy hacker train” that took the wardriving out into the city.

The technique is simpler than it looks, and it’s very well explained in the wardriving workshop from the Eko’s 2025 Summer Workshops (in Spanish):

• It’s passive. No traffic gets captured and no network gets touched: you only log what each access point announces on its own in its beacons (SSID, BSSID, channel, encryption and signal strength). Kismet has a mode built for exactly this, --override wardrive, which stops saving packets and keeps only the access points.
• Hardware matters. You need an adapter that supports monitor mode (Alfa cards are the classic pick, and it’s worth checking the chipset before buying), antennas suited to the band, directional for precision or omnidirectional for coverage, and a GPS, which can be a USB receiver read through gpsd or a phone forwarding NMEA. A practical warning: never power the adapter without the antenna attached, because you can burn out the radio.
• One radio listens to one channel at a time. That’s why you do channel hopping, switching channels every few seconds, or split the channels across several adapters. Hence the appeal of multi-radio gear like a WiFi Pineapple.
• The output is a map. Kismet exports to the format used by WiGLE, the crowdsourced database of geolocated networks, and an Android phone with the WiGLE app is enough to take part.

That workshop also showed what all this is good for. In the Eko’s Buenos Aires surveys, WEP went from almost a third of all networks in 2012 to practically gone by 2021. Not because people got informed, but because ISPs gradually replaced the routers.

What made this year different was the target. An AirMax device is still 802.11 and sends beacons like any access point, but its proprietary protocol travels in Information Elements inside those same frames, the ones Faraday’s talk showed look encrypted and aren’t. Faraday also released an open source tool to recognize and locate these networks. So the wardriving and the talk were two halves of the same research: one explained the flaw, and the other took to the streets to count how many exposed devices you can see from a bus.

Some of the wardriving crew, on stage.

Competitions and careers

Besides the wardriving, there were several competitions:

• a social engineering CTF, where all you could use was a phone and your powers of persuasion;
• a 23-hour CTF organized by the Brazilian community Hack in Cariri;
• a live hacking event against Banco Galicia, run with YesWeHack.

Players at the Hack in Cariri CTF.

Another table at the same CTF: terminals on every screen.

For those of us building a career, there were the Hack the Talent Zone and the EKOJOBS Speed Interviews: seven-minute interviews with companies and sponsors, every day at lunchtime.

The organizers had their moments too. Leo Pigñer announced that the 2027 Miami edition will be held together with HackMiami. The lifetime achievement award went to Julio Ardita, one of the historic names in Argentine hacking. And in the closing words, Federico Kirschbaum remembered Andrés Blanco, an Argentine hacker and Wi-Fi researcher who had died the month before.

If you want another take, Juan Brodersen’s coverage in Dark News (in Spanish) does a great job of telling what happened each day.

A photo, a hug and an autograph

Back to Chema: reading him for years is like having a teacher who has never seen your face. This time I got to meet him in person. I came home with a photo, a hug and his autograph on my badge, and I’ll remember them fondly. It’s a small detail next to everything above, but it’s the one that puts a face on all the rest.

My badge, signed by Chema.

What I’m taking home

Three ideas that are useful to me beyond this Eko:

1. AI’s attack surface is the usual one, in a different shape. It’s excess permissions, dependencies nobody verifies and untrusted input. The controls aren’t new either: least privilege, isolation and auditing. What’s new is applying them to something that decides on its own.
2. Finding vulnerabilities got cheaper; deciding what to do with them didn’t. The value is moving toward triage, prioritization and communicating risk, which is exactly where I want to work.
3. The community is half the conference. Recorded talks can be watched later. What doesn’t get recorded are the villages, the CTFs and the hallway conversations. Going with a plan helps, as long as the plan leaves room for people.

Now comes the long part: watching the recordings, sorting through my notes and turning some of these talks into something I can test with my own hands.