Happy to announce Arthur Jantz who's gonna give another Talk in in the web track. I think we can say about rootkits in web applications where he's gonna tell us about cross-site scripting I believe so The stage is yours. Thank you So thank you everyone for coming. I'll just do a short introduction My name is Arthur Jantz and I work at Google and Google is doing a lot of really serious security research and some Not really all that serious research some sort of wacky stuff And if you're sort of wondering what the wacky stuff might be, I guess you'll get to see So I was thinking of this talk as a sort of short light-hearted overview of some of the issues that are relevant to Exploiting web vulnerabilities on web clients. So so the first thing to get out of the way is I know that the talk has rootkits in its title, but it's actually not about rootkits at all so if you're You know if you're used to the idea of of rootkits as this thing on the client side that lets you hide Processes and and do and enable malware to avoid detection It's not going to be about that But it'll be about something that's that you know apparently is a little different, but but there are many similarities. So what I'm talking about is Attacks on web application clients that are due to various kinds of script injection and obviously the most often discovered attack is cross-site scripting and So I'll do I'll do a quick introduction to those attacks and how they work very quick and Then I'll talk a little bit about the interesting stuff Hopefully for you, which is what happens after a script injection attack actually is successful So after we have a cross-site scripting victim What can be done and what are the the problems for web application authors? related to that and obviously For it to be a complete Security conference presentation. We have to introduce a new buzzword. There's there's no other way so the buzzword for today is resident XSS and You know, it's it's sort of tongue-in-cheek, right? I don't think anyone should should go off and start using it after I describe it But it's something that will help us sort of be on the same page about the Particular kind of attack and and then I'll talk a little bit about how What the difficulties are with cleaning up users who have suffered from from this attack So I mentioned before that this talk isn't really about rootkits because For in traditional software and client-side software The way you sort of have malware Running on users machines is that first you find a code execution vector, you know, so you find a bug or you You entice a user to to click on your executable and and fold them that way If you actually find a vulnerability you have to bypass ASLR and that and stuff like that And after you get to that point you do the things As malware you do the things that that I classified loosely as a rootkit and you know We can talk about semantics later if anyone wants to so the stuff like inserting a backdoor to maintain Access to the machine for an attacker and hiding the presence of attackers processes on the machine Let's call that rootkit functionality and after you have that after you have the way to execute code and a Way to hide your presence and maintain access then you can do various kinds of evil things And we've all seen malware and what it does. So this is sort of the traditional way Malware has worked and it didn't it never really applied to web apps, right because web apps are sort of different but and the sort of idea that I want to impart on you is that web applications have evolved in the last Five or ten years to the point where we can have similar things to rootkits Running within web applications for a particular user so and and I'll I'll talk I'll talk more about that So Unless you've been living under a rock for the last Nine or ten years, you know what XSS is but I'll just go over it very quickly XSS is cross-site scripting. It's when a web application allows External users to submit queries that will execute some code Supplied by the attacker in a victims browser. So for example, if the victim.net domain is not careful about sanitizing Or escaping actually the User input the script in the supplied in the URL parameter will be treated as a markup in the user's browser And it will execute in the context of the victim domain So the reason for that is that the web application doesn't escape the HTML meta characters and Which leads to the vulnerability attacker scripts get to run there's no way for the browser to distinguish attacker supplied scripts in this case from legitimate scripts on that website so Whatever code the attacker Gives to the victim of this attack will be run in the scope of the victim user's authenticated session and the attacker will be able to execute XML HTTP requests back to the same server and basically impersonate the user it's it's code execution sort of for the web and Whenever people see information about XSS for the first time They they see two two things that that are my sort of pet peeve Because that's not really how it works So the first thing you learn about XSS is that you you find the vulnerability you send a link to some user And they click on it and then you know you can run your code But that that isn't really how it works because you would have to have your entire payload in the URL It doesn't there are many other cross-site scripting attacks that that wouldn't work this way The user would see some kind of weird URL with scripts, but you know that if you send it to them via email the The link might be broken up on onto several lines Just basically it wouldn't really work and the second thing is the way you exploit cross-site scripting it isn't to Just send the cookie a deauthentication cookie back to the attacker because the One of the first things that that we learn about cross-site scripting is that it has access to all the cookies Within the victim's browser So you can just get the browser to send the attacker the session cookie and the attacker can from their own machine Send all the requests that are necessary to to impersonate the user So I'm sure a lot of you know why isn't it how how this works. What's the problem with with the second thing? So browsers don't really allow this and the reason for this is that document cookie So there's this attribute set on cookies Called HTTP only which all web apps that know what they're doing are setting on Authentication cookies and which means that JavaScript doesn't have access to authentication cookies So you can't really steal a cookie this way There are some vulnerabilities that might let you do that, but really that's not how how you would exploit it So how you could exploit cross-site scripting is to to get a user to to visit this page with a cute kitten So obviously there is nothing to let us know that there that there might be a cross-site scripting exploit there But there could be invisible frames that do the same thing basically create an iFrame or some other or a frame To the victim page that the user never sees another way to to exploit XSS is to just visit any popular Internet site My claim is that if you visit this page you might actually fall victim to cross-site scripting on In some web application that you're currently logged into Does anyone have any ideas? Why that might be? Ads exactly yes, so if you're an attacker you can just pay an ad network to distribute your flash file or Snip it of HTML to be loaded in a frame And it will be shown on on various popular Websites, so there have there has actually been research on showing malicious ads to users or researchers have used this technique to Sort of demonstrate evil distributing evil payloads to users. So so this is another way that that you could execute XSS So what would happen is that? You as a user you visit an attacker's page There's a hidden frame somewhere there with the cross-site scripting payload and the exploit Runs in the context of of the target domain and does something malicious So the malicious things could be it could initiate a bank transfer if you're logged into your banking application It could transfer money to the attacker. It could set up an email filter for your web mail service that would Forward all your incoming emails to the attacker and it could do a bunch of evil things Another way is if there is a persistent cross-site scripting bug Which is a way for other users to? Embed code on a page that you normally see in the web application Once you fall victim to that you can there have been many cases of cross-site scripting worms Because of persistent cross-site scripting, but in both cases and we don't need to get into details about that but in both cases The exploit is doing something malicious, but there is a problem from the attacker's point of view a Problem with exploiting this so once you find a bug and you start exploiting it and you have to take So there are two things you have to do first of all, you know that if you are If a user visits your page with a picture of acute kitten They won't be on that page for very long And you could there are some ways in which you can try and to get them to stay on that page, but but in general What you would do as an attacker is you would execute your evil code right away as soon as possible So, you know, you just set up your evil email filter or make the bank transfer and that's it And the second problem and the problem associated with that is that the vulnerable web application Immediately sees when users start getting exploited via this technique that there might be Maybe a thousand users or ten thousand users if we're talking about mass exploitation That Executed some action within a very short period of time. So the web application will know immediately That there is something going on that there's usually monitoring So as an attacker you have to expect that that someone will be on to you in, you know, maybe minutes maybe maybe a few hours and That way you you burn your Your exploit and and you can't use it again because it supposedly it'll be fixed So I talked about cross-site scripting a little bit, but it's not really the only way in which you can inject evil scripts on to Important domains of applications that that internet users use So cross-site scripting is one of them. There's also universal cross-site scripting, which is when a browser or or browser plug-in Has a bug that that affects all web pages So it's not necessarily that you as the web application author have have done something wrong It's you know, it's it's possible that there is a Bug in a plug-in that the user has installed on their machine and to quote Dan from from yesterday it's always fricking Java and It really is because Very recently there have been examples of universal cross-site scripting in in the Java plug-in that's still very widely installed Then there are ways to get the user to Put something Put a bit of JavaScript in their URL bar and when you hit enter it actually executes the code that you put in there So Facebook has suffered from this attack quite a bit because people were unknowingly pasting snippets of JavaScript into their URL bar and when you execute it it actually runs in the context of Facebook without any fault of the web application provider They didn't do anything wrong, but the users didn't really know what they were doing. It's the same way malware gets distributed when you send someone an evil attachment from people just don't know any better and There are some more sophisticated attack attacks related to the abusing the URL bar And then there are there are yet other ways of injecting your evil scripts onto onto target Victim domains. So for example if the if the web application is trusting external Providers for their JavaScript for example for example the omg awesome JavaScript bunnies calm totally trustworthy Page, right? I mean there's what why would we ever worry about their security? But you know, maybe they're they're not all that awesome Even though they might be bunnies So you know they can be compromised and suddenly the resource that your web application is loading is is backdoored in some way and can execute Some evil code of the attackers choosing and it can also happen to your domain So if you have a big domain that hosts many applications, it might also host static files that are uploaded by say Marketing people that that have no I is anyone here from a marketing person All right so so you have clueless marketing people that you know might might have access to a particular Directory on your domain and what if you know they use the same password on You know all their web accounts and it the password gets compromised someone someone logs into Their account uploads a file.  So about half of the people are using the wireless network and about and the other half are too lazy to raise their hands, right? So yeah, everyone is using the wireless network here So when you connect to an untrusted wireless network, you you're at the mercy of the provider and other people who might Be able to control that network, especially especially wireless, but but not only so what can happen is that you after? browsing the internet from a network like that you will continue to use a browser with with evil cash so cashed resources that were Injected there by the evil network by doing say DNS spoofing or just man in the middle on HTTP traffic And those resources can be very long-lived. So if you you can have for example a JavaScript snippet that is used on many applications such as Maybe SWF object or one of those popular JavaScript libraries When you visit When when you browse the web from an untrusted network It will be Backdoored which and by that I mean it might still contain the same functionality that you're expecting It'll just have an evil script that can be activated in some way by the attacker And you know it it can live in your browser cache for a year or two So that's another way and the the last category of things is even for web applications that do HTTPS properly There are there are some things that so if you have a sensitive web application that that's only using HTTPS So it's less vulnerable to the cache poisoning There are there are a bunch of bugs that that can allow attackers to inject those scripts So there are mixed content bugs where a web application loads resources over HTTP If the page is HTTPS which bypasses the HTTPS protections completely and then we have we can have stolen or forged certificates and we can have evil CAs issuing evil certificates and There's always a chance to get the user to click through a warning and and then they would connect to an attacker's web server That would cache some resource Under the context of HTTPS of the victim domain So So I'm I'm going to focus on cross-site scripting, but but please take into account that when I say cross-site scripting it actually all of these possible vectors are could could be used instead of cross-site scripting and One thing one other thing to to remember is that after an evil script runs In in the context of the vulnerable web application We can assume that the attacker can keep up the communication with With the victims browser and I'll talk a little more about that So we talked about Ways to to inject scripts, but now I'll talk about why what bad things attacker supplied scripts Can do in web applications So now it's time for me to to introduce the buzzword of today resident access so resident XSS by my definition is When malicious code is injected into the user's main web application window or tab so Contrast that with with the techniques. I I mentioned earlier where there is an hidden frame on some website that that might Execute the attack Resident XSS is when the attack that the evil code isn't contained to some hidden frame on some website It's when the the main window that you're interacting with for your say social network or web mail client or anything like that when this window is actually Executing the code that's that the attacker chose So let me just quickly tell you how that might happen So if there's persistent cross-site scripting when you When you use the web application, for example, if there's an email message that someone sent to you That doesn't get escaped properly. You open your web mail application The code runs and it runs right in in your your main web app window And it could be other things status updates and comments on a forum and they would all work that way It's actually a relatively rare vulnerability these days Compared to all the other kinds of cross-site scripting that are still prevalent on the web Another way is Many new web applications use client-side storage mechanisms you introduced in HTML 5 so local storage or Web SQL web database Functionality which lets them store large amounts of data in the browser But the problem is that when there is a cross-site scripting bug the attacker can quickly Backdoor the data in the victims browser and when when the for example when the cached JavaScript File gets loaded next time the user logs into the application. It will also contain the attacker's applied code and There was a great paper investigating that by Don Song and and the students at her lab at UC Berkeley I think it's called the emperors new API So it's definitely worth a read and they found that a lot of the new Sort of cool web applications are using those techniques and are indeed vulnerable And then there are other ways for example if you have a regular cross-site scripting bug it can open a new window to the To the main application So for example, if you if you fall victim to to that attack you You would see two web mail windows right next to one another and one of them is the one that you opened and the second one is is one that was opened by By an evil hidden frame somewhere and that frame managed to open that window and inject Attackers code into that so that that's another technique and there are a bunch of other ways. So My main point here is that Any script injection vulnerability Can be with a high degree of success converted into a resident XSS So I've talked quite a bit about all of that But now let's get to the actually interesting part of of the talk which is Once you run resident XSS in someone's browser all the assumptions they have about Interacting with with the web application are Violated so let me tell you what I mean by that. So first of all Once you have this the web application that runs attackers JavaScript You say you want to log out because maybe there's something strange You think maybe there was an attack on your browser or there just you just want to close it So the first thing you do is you click log off But well the the web application is now running the injected JavaScript so the attacker can hijack the log out button and So that when you click it actually So in the sort of basic case it might not do anything so you can't really log off and the attacker could also Do more sneaky things for example when you click on log out it could create a small window in the background That to bypass pop-up blockers then close the web application window, but keep its own session running in the window in the background and so basically Another thing that it could do is say for your banking application, which times out after You know a few minutes or half an hour or something like that The attacker when you click log off the attacker could show you the log out page. I'm saying thank you You know you have logged out Everything is peachy and then continue issuing keep alive requests to the Banking application server so that you think you're logged out you got the page that says you're logged out But it actually keeps pulling the server to and keeps the session alive until you close that that tab But when that happens the attacker has has yet other ways to keep the the infected session going Another thing is you can't really leave that web application that that's been infected. So if you If you have a link and you want to follow it and you expect the link to take you to another page The attacker can just open it in another window you can Basically any kind of navigation that you expect the web of the web application to do can be subverted But but those are just things to to keep you in The attackers hands But the interesting things is what the attacker can can do once you're once you're interacting with the web application. So for example off the record chats or Or any keystrokes that are typed into that application Are can be monitored by the attacker because he is running his his evil scripts there mouse movements or Any other thing basically is can be monitored that that you're doing even if There is no functionality to sort of save it to the web application just because it's in the Dot in the browser's DOM when you're interacting with it the attacker can get to it and the attacker can also modify anything So you can see messages in your web mail That that come from the attacker that are indistinguishable From valid messages and there's no trace of that at all So for example, if you know you get scammed you you get the police to issue a subpoena against the the web application the Web mail provider to try and track down the the scammers They won't see anything in their logs because it's not really a it's not a real mail message that you got that it's a spoofed one And and there are a bunch of other things so once you're in that application The attacker can show a fake login page to pretend that you're logged out. You will type in your your password. Maybe your You know one-time password or SMS code and the attacker can can get that data And then after you do that The overlay can just disappear and you see you're logged into the web application again And you just don't suspect anything because why would you it can fish for security questions So and that that's even sneakier because it lets you attack other web applications Using the knowledge that you get from from hijacking just one of the web applications that That the user is using and then there are things like geolocation API's or Microphone or a camera that you might have granted access to to just that application But you know the the way browser keeps track of which applications can can access those features is by Origins, so the attacker script run the scripts run in in the vulnerable origin and if there are any There's any functionality like file downloads, so you you're in your webmail application You click on the attachment to download that You think you're downloading just an attachment that you got from someone But it's actually an attacker is executable So you can you can just open malicious file download Dialogs and user might think it's a trusted Bit of code from the application and the same thing with malicious plugins So the application the attacker can prevent you from using the application at all until you Until you install the plug-in of their choice So, you know given the choice of Installing the plug-in that you you don't really know is evil and Just abandoning the web application most people would are probably inclined to just install it And there are a few other things as well. So for example If there are any so if you're in your webmail application and you you get a link to CNN comm What the attacker can do is open the the CNN comm page in in another tab and Inject its own JavaScript into that page So it obviously if there are no cross-site scripting bugs on CNN the attacker can't do it directly But if there are any ads on on CNN the attack the attacker can navigate the frames So the same origin policy has some exceptions for what kinds of Cross-origin Navigation can be done and even if you can't access a page directly you can navigate its Its frames to see if there is a frame that you can control at which point the attacker can inject its code his code Into that frame So and once you have all that Once you have the long-term access to the to the victim's browser you can do So other than monitoring all the data in the web application itself You can do other malicious JavaScript tricks So you have a lot of time to do history detections can local networks possibly attack other web applications and distribute the denial of service all of that and And it really doesn't it doesn't show up anywhere because the the web application You know doesn't really see that there's anything wrong. You don't see that there's anything wrong It's just injected code into the web app. So Yeah, it's it's not good right I mean once you fall victim to that it's all bets are off We're sort of doomed But let's say that You know the resident XSS didn't really work So you you got to run cross-site scripting for for a few seconds then the user just closed the tab all together and Or you weren't able to do to achieve the resident XSS There are things you can do to maintain access to To the user's web application session regardless. So for example, you can backdoor HTML5 local storage and Various kinds of web databases you can backdoor flash cookies So if the flash a local shared object Data stores some kinds of configuration files or or executable data You can inject attacker code into there. So next time the user Loads up the web application legitimately They will execute your code again and if there are any cross-site scripting bugs based on cookies you can you can exploit that But there and there are also some new Mechanisms that are being developed in HTML5 that that make these kinds of attacks easier So I don't mean to To bash HTML5 because in many ways it's great and it's awesome But it gives Attackers the same features that it gives legitimate web developers. So it actually makes and makes some things easier for it easier for attackers as well But even without all those cool HTML5 tricks There are all these there are ways to keep the attacker code running in the in the victims browser so Opening up new windows That will that won't be visible to the user in the background that will keep That will point to the victims domain. So for example You know you would have your social network tab And if you close that the attacker can create Pop under window and before you manage to To close to stop all the attackers scripts They can be injected back into that that tiny window in the background So even though you think you've closed all the tabs that point that might have attacker-supplied code You you can have windows or frames in on completely unrelated websites where this code was injected that still keeps running in the context of of your domain and the name for that Is frame hopping where you where you keep injecting this code wherever you can so when the user closes one tab you the attacker can look at all the other tabs that it has access to and Either exploit cross-site scripting bugs in them which is much harder Or or just look for for frames to add domains when where everyone can inject their own code and and survive this way So After an attack like that executes There is there is relatively little that the web application itself can can do to eliminate The attackers access to itself because if you keep a tab open to To your social network to a page from the social networks domain That had the cross-site scripting code the evil code running It will always have access to to other pages within the same domain So when you you might log out of your social network in another tab But whenever you log in again that That evil tab has access to all your data again So and there is no way as the web application developer that you can close this tab in the user's browser So it's been sort of permanently scarred by the code that the attacker chose And it can always it always has access to the to your web application session And you might think that if you add some functionality so that Every page on your domain will Pull your server for some cleanup code that you might want to run So every five minutes you will you will get some JavaScript from the server and execute it and if the code Sees that there's something wrong with with the page. It'll close it just a sort of a precaution that obviously doesn't work because The attacker can always just disable that code because he is running JavaScript on that page And you can't really even tell the user that there is something wrong or that they should you know Close the browser and you and use a different browser profile or clean everything up because the attacker has control over everything that that you might Send to the user in some cases So So you can't just say you know fix everything to the user because the attacker can intercept this message and just hide it So as the user if you think you've you've been attacked this way What can you do so so let's think of some things that that might work so first of all What if we just close the tab with the web application? Well, that doesn't really help because there might be other tabs or other hidden frames that are still running the injected code If you if you first close all the tabs and then just close the browser completely so that there's no runtime That is that is maintained across the browser closure The problem is that There you might have the client side storage the html 5 local storage mechanism Or or a cache that has been manipulated by the attacker so next time you you open up the browser Even if you have no tabs the first time you navigate to the web application it will get Rehacked because of the the poisoned client side storage And so you might think okay, let's let's clear all the local storage and we'll restart the browser and well Everything will be okay, but between the time that you clean up all the local storage and you close the browser any tab that is open Can that is controlled by the attacker can actually re-poison all the the client side storage because there there's a small time delay between Clearing everything cleaning everything up and closing the browser so there sorry Wow, okay So There is something that that actually might let you clean up Your your browser profile after after you've been attacked this way So, you know you keep you close all windows you close all tabs you keep one tab open you navigate it to a Safe origin that that no attacker scripts should have access to you remove everything you restart the browser You hope that the vulnerability was fixed and that there are no Self-access s bugs that that might have been exploited in the meantime by the attacker But I mean try explaining that to to your mom or or or just a casual You know internet user. It's a really complex process So in a way just throwing away the the browser profile after you've been Victim to cross-site scripting in one web application Might be the easiest thing to do which which is sort of scary right because think of all the data that you have in Your browser profile you have history you have you know You have cash and cookies and and all of that and just to throw everything away because because of one web application that was That was attacked that that sort of it boggles the mind So, you know, but but unfortunately, I mean that that might be that that might be the most sensible thing to do So just sort of recap and talk and finally talk a little bit about about rootkits so Those are the analogies that I that I came up with between the the traditional You know client side bugs and and web application bugs So code execution or remote code execution is in a way cross-site scripting is the analog to that and the same way your exploit has to worry about the Mitigations on the client side you have to worry about cross-site scripting filters or web application firewalls that might not allow you to exploit the bug that you want to exploit and for maintaining access The poison local storage or frame hopping are techniques that you can use in in web browsers And one thing that is that is quite interesting that I haven't really talked about is for most malware you you have some command and control channel to the back to the attacker and Obviously in the web application you can just keep Loading a script from the attackers domain and get commands this way, but there are so many stealthy ways to to sneak in code that that would that would look completely Inocuous to to someone just running a sniffer So you could have DNS based covert channels. You can have There's this thing in html5 called web workers. You can create an invisible window in a way or invisible JavaScript execution context that will keep asking the attacker server for For a JavaScript file to execute that you will never see in firebug or in your web inspector in Chrome And communicate with the infected page with post message that there are there are whole numbers of ways of Doing that and the malicious payloads, you know similar to the client side just running a keylogger or Or doing denial of service attacks in web applications You can also compromise the data in the web application try and elevate access to other applications And and do the the usual malicious JavaScript Tricks that I talked about So this is Almost the end. So so the thing I want to leave you with today is There are two thoughts basically so the first one is that after You have been you are your users have been victim to Cross-site scripting or a script injection attack It's it's really really hard to reliably clean this up and to make sure that any future Interactions of the user with with your web application will be in will have Integrity in any sense of the word because you can always have attackers applied scripts hiding Somewhere in the browser that you're just not aware of and you can't get rid of And the second thing is and it's something that we haven't seen yet, but you know, maybe And I would be very happy if we didn't see it at all but the sort of attacks that that are Enabled by the resident cross-site scripting class of bugs are quite nasty Because of because of all the assumptions that they violate in users mind So you just don't realize that the application you're using might do all the things to to harm you. So, you know snooping on you Fishing you and and and just act against your interest because you we're not really used to that right for on the client side if you have Injected code it Doesn't really inject itself into existing applications most of the time So if you have a backdoor version of of Microsoft Office, it doesn't really Intercept your click on the file menu because why would it and things like that Are possible and are actually remarkably easy to do with with JavaScript in web browsers So I just want to Tanked two of my colleagues who really helped flesh out the ideas that I talked about today Mihał Zalewski is a great web security guy and security guy in general He recently wrote a book called the Tangled Web and if you if you have any interest in web security This is the book to read. So I strongly encourage you read it Just a word of caution if you search for it on Amazon There are some other books by the same title. His one doesn't have the naked guy on the cover So so just search for it for that one And Eduardo Villanueva is another one of my colleagues who has amazing at all client side things and he helped me out a lot as well So Thank you very much Thank you very much Arthur for that great talk Let me just reiterate what I said at the beginning if you would we're gonna have a Q&A session now, so if you would be so kind to maybe Stay seated and quiet until we're done so everyone can enjoy it and Take all your trash with you when you leave later and leave by the front door, but let's Start with some questions Right, let's just wait half a minute for the impatient Okay Let's start with a question from the front row So I noticed you haven't actually covered anything about like attacking browser up plugins or like sorry add-ons All like stuff like that because like this have been hilarious bugs and stuff like tweak deck and whatever else and like in Chrome So some there's like permissions to the somewhat restricted, but like Obviously because they are going to use local storage. I mean wouldn't that be a better target? I'm just surprised you didn't cover anything on them So this is actually a very good point. So most of the The plugins that or the add-ons that use local storage do it in the context of the In the origin of their Sort of web application, right? So you have Or often they trust that data So by by running cross-site scripting in the context of that origin you can actually elevate privileges because the The add-on will will treat that data as trusted because why wouldn't it? It's their domain And yes, so it would it would give you a privilege escalation because you would execute in the context of the Of the add-on rather than just just a random web app. Yeah, thanks All right further questions Do you have any knowledge about known exploits of this concept in the wild? I'm not really so so I believe right now. It's actually easier to get users to run Malicious executables in many ways unfortunately, so, you know, there are so many easier things to do than than doing all the work to backdoor someone's Web application session if you can just get them to to double click on an exe but I Do think I'm a little afraid that that's something like this Will come to the web world once the sort of low-hanging fruit attacks are Harder than they are right now. So just the question is, you know, will they ever get? Difficult enough that it'll be worthwhile for attackers to use these techniques Hi Hi Hello I have I have two questions for just for understanding this better The first is if I'm so I'm I have the scenario now I go to a website I get this malicious code somewhere in my local storage. I Close my browser. It's there in the local storage. Now the website detects the malicious code Remove the malicious code and now I go back to the website. So what is the help in the local storage? I mean, it's not a wall evolved the local storage. What does the attack I get from my local storage when it's still there? So so the main The main problem is that the web app with that a lot of web applications trust the data in local storage, right? So they They just eval at JavaScript resource that that's in there. So once once the web application cleans it Okay, so you mean the local storage is evolved sometimes from the website by By intention. Yes. So so this is so we can treat it as a as a bug and The paper I mentioned the the emperor's new API's They were actually They got in touch with a lot of web application providers telling them, you know You you maybe you shouldn't be trusting the data in local storage Because it can have a negative consequences. For example secondary cross-site scripting Okay, okay, so then everything is clear. I Didn't know the fact that websites really aware you are the locals. So it doesn't have to be eviled, right? So there are many other ways but otherwise so you can no advantage. I think so well There are other ways in which they trust the data that doesn't have to resort to eval for example If you use it in an inner HTML assignment if you store some snippets of sanitized HTML is You know you sanitize it on the server side your application puts it in local storage Then you trust it then when you when you use it again the attacker code can can be injected. Okay, okay Right. We then have a question from the interwebs Hello One question from Brussels He asks what can assist admin do to prepare for this? That's that's a tough one So I hate to say nothing, but but really Nothing So so I actually so my my main worry is that there is relatively little debt web applications themselves Can I can do about it? Right? So even at that level? I mean for just the local storage attacks you can make sure you you never trust anything in local storage or you can You know you can have signatures on on any data that you want to eval or something like that But for For assist admins, I don't really see any mitigations Okay, another one another one Quick question. What about the privacy modes of web browsers today? Mitted Jade the problem of recovering from once it has been infected Yes, yes, so this is a very good point that I didn't mention. So if you run in private browsing mode For for pretty much all your your web navigation. This will this will help right because there will be no So once you close it All the local storage data gets wiped out the execution context of of all the code that might be running in hidden Windows or or tabs or hidden frames. It will also get wiped out So the the only problem I see with that is is if flash doesn't play well And I know historically there there are some incompatibilities between Flash shared objects and and bribes browsers private modes You could put potentially inject some some Data into flash cookies that that would persist after you quit the private browsing mode But but yes, this is a good mitigation But then you sort of So I actually think it's a very good solution But when you do that you lose on some of the benefits of using a modern browser You don't have any history any any saved data, but but might be a worthwhile trade-off Wouldn't it be possible to to use some kind of hashing like just get us for the local storage Maybe an external program to check it up when the one the bra before the browser starts or anything like this So you could so as a web application if you if you intend to eval a blob of JavaScript When you when you load when you start your application you can definitely You can have a signature-based system to verify the integrity of that the problem is that you can't really store the signature anywhere on the client side because Because that can be tampered with but if you You know if you always get the signature from the server You run some kind of you know you run the RSA on it and you verify that that the local storage is Is correct and And then you load it It might have some problems for example if between the time you you run the check and the time you actually load it If it has been tampered with then you would still you know there are race conditions there But but in general it's it's probably If if you use local storage cache Which is which is actually a recommended solution for? mobile apps, so we have a lot of the people in the performance web performance community pushing for for using the the client side storage mechanisms as cash for CSS and JavaScript and and other kinds of resources So I actually think some kind of signature system would be a good way to make sure that you can use this mechanism safely Thanks. Okay. There's time for one or two more No further questions Right Then let's thank Arthur again for the great talk


comes away from his man infield, the desperate challenge by Ince, runs to Selankey, top of the box, might be a hook here for the sevens to get in the ball, Ince. Joyne's in low, with a more forward thinking roll, he locks it into Selankey again, Ryan Christie's there, but Selankey runs away, pulls it back to the penalty spot, Ince feeds Ince, right corner of the penalty area, Ince swaps one into a very deep... If he misses it, then he... Another readying corner, over on the far side, whips in again, another good delivery, Philips climbs high only to as far as Ince into the air. We've got a strike in that, we have to say it's our own doing, in from the corner, headed away initially, he pulls it on the hook, he catches them right on the half volley.


Boom. Welcome to Off Topic Tuesday, where we are going to be on topic, off topic today. Yes, we are going to stay on topic about the off topic things. Yes. That's how it works, right? We're progressing in our lighting situation. We have made progress. We've heard changes have been made and we heard the audio problem in the last one, which we couldn't fix in post because it was echoey because of a mic setting. I think we have that solved. Hold on. All right, that's solved. Two thumbs up. We're ready to go. All right, and we can't ignore the elephant in the room, the bad software that led to epic problem. This is actually scary. People said goodbye to their families. Oh my gosh. One guy, there's some stories I'm ready of what did you do when this happened and one person's like, I called my family said goodbye and I told them I was just gonna sit on the beach and watch the fireworks. Yeah, people were headed literally underground. In case you're wondering, one person had commented that apparently the former, the Clintons were on the island. Oh, really? And they seen the Secret Service getting completely all done up and everything went on locked down there. So I mean, it was like, they didn't know that this was a mistake. Now, I've seen people already pointing conspiracy this and that and there's more to the story. No, no, no. It's so true. And it comes down to bad design and someone made a joke of because we don't know what it actually looks like, but we from the descriptions, we've heard it looks a lot like what's on the screen right now. Mm-hmm. They had a little pull down and right next to it was like Miss Alert Test or Miss Alert. Yeah. And they had one person without verification who had this pulled on as an option on a computer. And look, we've worked long enough in the software and hardware and computer industry to tell you that dumb things happen. Bad UIs are designed all the time and you're gonna tell me that the lowest bidder that built whatever government program sends the Miss Alert out has a good UI design. We've seen billion dollar companies with bad UI design. Yeah. Trust me, I'm not thinking that. Yeah. Why is it like when I want to download an app, I have to click yes, I'm sure, 17 times. But when this person clicks the pull down of tell Hawaii a missile is coming. So that just goes. Yeah. There's no, are you sure? Yes. It's just. Or maybe there was, but the last time they did it, they checked the don't show me this again. Something like that. That was probably it. Don't show me this again. This is just clicking next and yes. And there's apparently there wasn't a confirmation either. So that makes it like, are you sure you want to panic everyone in Hawaii right now and all the government people and everything else? So, yes. Yes, I am. They might have still clicked it. Yeah. That's why we sometimes need human intervention as much as we like all these systems. We need another one. Bob, should I press this? Yeah, go ahead. All right. You know, so it's have people go ahead spend if that's what you want to spend your time doing believing there's some deeper game at play here.  Well, which is usually the more likely case and a much more plausible explanation for so many.  It is. It's one of the. I love this. This is one of the reasons people love conspiracy theories because you can beat them.  Oh my gosh. You can't. It's easier to think that there's some behind the scenes person plotting and going it's because it becomes us versus them. We've seen this in the movies and if we can figure out their secrets and who they are and unmask this villain, we could take over. When really you're like, oh boy, it's a whole lot of dumb people. And then it comes to the quote, never underestimate stupidity in mass because it just gets worse. What is it?  They'll drag you down to your level to their level and be with experience. Yes. So yeah, I know. I know it's fun and conspiracy theories are entertaining, but I'm sorry. It's unless the conspiracy was putting that pull down in knowing that one day somebody would click the wrong. That's the conspiracy. That's the conspiracy. All right. Now, because Spectre and Meltdown was so much fun, we have a do-do-do-do-do-do. Inspector Gadget. Do-do-do-do-do-do. It's a little gadget made by Steve Gibson over at Gibson Security Research Corporation. If you're not familiar with Steve Gibson, he's a co-host of the Security Now podcast. I know there's people that have mixed emotions about him. I don't agree with absolutely everything Steve Gibson does, but I think he's a pretty intelligent guy. He's been around the security community for a while, and I love when he writes these little tools and gadgets like this one. It tells you whether or not you're vulnerable to the Meltdown or Spectre. It's a little Windows tool, and it lets you know whether or not you've been patched and if those patches are in place. Cool. We want to give you something useful today.  Yes, see. And this show, when we go off topic, we're on topic. And Steve missed the opportunity to put a little Spectre Gadget logo and call it Inspector Gadget. So if Steve actually bothers listening to me, which I'm sure you don't, I'm going to tweet this at him. Please recall it that and make an Inspector and Gadget-inspired Spectre logo. Because that would be wonderful. And I love that kind of humor. And please, when you fire it up, let it play do-do-do-do-do. And that's it. Yes. That's all I wanted to do. When you start it do-do-do-do. I want to do do-do-do-do-do when it opens. Recompile it, Steve. Please. That would make me so happy. We beg of you. CES.  Well, it's done now. So it's done. The blackout was wild. There was a part of me, and I've seen someone tweeting about this. This is so awful. There were people who had their phones and those charging things that you lock. You know, you put them on the charge. When the power went out, they just... They couldn't unlock the box. Right. So they just had to watch their phones slowly dying that they couldn't get into the box for because there's no power. That's going to be a horror movie in like 20 years. That's tragic. That's tragic. People just like scratching at the... So are you ready to talk to your toilet? You're assuming I don't already. True.  Well, sometimes you have to tell it to choke it down. So the... So, I don't know. I... CES to me this year was a lot less exciting. I didn't go, which is also... I never went, so I guess I would have saved if I went. But it wasn't exciting. I usually look forward to some new products that might come out that are cool. But it's just like the phone market. Guess what chip is in my new phone? The same chip that's in all the new phones. It's become almost cookie cutter boring. But where the differences are, we put assistants and everything because they introduced 8K TVs last year, which means this year they're going to introduce... 16? Nope. They've been the help of the standard yet for 8K. More than 8K for transmitting the data. So we're still stuck at 8K. Oh, by the way, we're still working on... There's a lot more 4K content. I don't know where the 8K content maybe it'll come one day. So there just didn't seem... Other than they made some TVs bigger and brighter. But what they really did was not just shove one assistant. Some of them shove two assistants in them because we want an assistant and your assistant, man.  Yeah, some assistants need assistants. Sometimes I need assistants when I'm on the toilet. Yeah. I mean, on the off chance that you didn't bring your phone to talk to while you're in the bathroom, you have a toilet that strikes your ball movements and you can talk to it. These are some of the products that... It's keeping you healthy. It's the Kohler Numi and Internet Connected Toilet. My wife just said no.  And I'm like, well, it's $5,000 which will also set me from buying it. Wow. Yeah. I know. The Kohler's latest high-end toilet connects the Internet in response to your voice commands. Beyond flushing, you can ask Amazon's Alexa as well as Google's Since and Apple series to lift the seat or activate your favorite bidet spray configuration. Programmable bidet spray. That's what I missed. I went to CES because I probably would have more footage of this than I should. I want to test the portable configuration alpha. I love my Alexa bidet spray. This is like Star Trek. It's losing it here. Hey, serious. This is like spraying my butt. I mean, I want to know the Amazon skills that I have to enter to get it to control the bidet. The tech pattern alpha. I want it like a Star Trek. I want to hear Picard's voice doing it. The tech pattern alpha. See, we thought the feature would be spaceships. No, no. See, it's how it attacks other things, dingling. Okay, we're getting way too mature. But they made this. This is a product. I'm laughing because this is a real thing they made. And they intend to sell it and people will buy it. You know what? To be honest, I would get one. I would totally get one. If I had just money to spend. Yeah. Yeah. Some people want solid gold toilets. I want to talk to them. I tell you what, if any of you buy this. Oh, please. I will do the video review. Yeah. As long as I can travel to wherever you're at, I probably can. No, Tom, think bigger. Kohler, send us one of these. Kohler, please. Believe me, we will punish it and let you know how well it works. You've seen our hot sauce videos. Yeah. So this is just, yeah. Go read about it.  That's what we wouldn't want to hear though, is at one point our toilet would be telling us guys, lay off the hot sauce. Oh, man. So that's so far, that was the king of the prize. I should have left it last, but that one was pretty bad. But the cringe, the cringiest thing. So maybe that was definitely the most immature thing we've come up with. The cringiest thing has to be CS20 LG robot Chloe repeatedly fails on stage at his unveil. Oh, if you're ever feeling bad about how your day is going, if you're ever worried you'll mess up a presentation, you can't fail bigger than LG. No. The robot didn't respond to him, didn't respond properly when it did before it quit. So it's probably better that it stopped. And it's another thing that I don't get it. Well, and remember the whole point of the presentation was that it was a smart kitchen. It's part of your smart kitchen. It's part of your smart kitchen, right? So the headline is a robot created by LG to help users control it from repeatedly failed on stage at its CS20. Chloe was meant to be a centerpiece at South Korea's first presentation where it was supposed to show new artificial intelligence that could use enhancing kitchen appliances. Quick plug in your toaster to the internet. Yeah. So from someone who cares a little about security and a lot of these companies that plug toasters into the internet, don't. If you were a hacker, you could turn on the toaster when you don't want the toaster on. These are problems I foresee. You know what I don't have a problem with?  I'm complete. Matter of fact, I don't even have a digital toaster oven. I got one with a knob and a little clicky thing. Even if it's unplugged, the clicky thing counts down. It's amazing. Yeah. It's just one of those it ain't broke. Don't fix it. Yeah. It's like a better mousetrap. You don't need it. It's just, it's going to make your bread brown. Yeah. So I, I don't know. They're trying to really make the ultimate connected home. I sometimes feel, and this is where I get jaded a little bit with CES. Like, are you just trying to come up with something like just like, what can we put in here? A toaster that talks to your fridge. Okay. What does the toaster have to say to a fridge? They make this cooking thing. I remember it was a problem. I can't remember the name, but because it always goes out to internet to get cooking stuff. It's like when the servers were down, they couldn't finish cooking something. I'm like, this is just wrong.  Right? Yeah. Oh man. The refrigerator is like, that's, that fail is so cringe worthy. It's just, the refrigerator is like, Hey toaster, you're pretty hot. Toaster's like, that's cool. Yeah. That's cool. Killing myself. I know. Anyway. Oh yeah. Do yourself a favor and watch that video. Yes.  Or watch Silicon Valley season three where he hacks the fridge. Did you see that? Yes. Epic scene. Love it. That's the future right there. Yes it is. All right. Foldymate can fold your entire load of laundry in four minutes if you do most of the work. That's the caveat. I will admit, less a fan of folding laundry. So I don't. Here. I won't lie. I bought all of the same socks and I continue to buy all the same socks. So I never had to pair socks because I got rid of all the socks. It didn't match and I have all the same socks all the time now. Well, but the only problem I have run into some socks are newer. Some socks are older as I keep replenishing the stack because my toes wiggle all the time because I'm fidgety and I wear holes in my socks. So some socks now become lighter gray and darker because they're been washed more times than others. I saw that by just not matching socks. I think life is too short to match socks. In fact, right now I'm wearing a red sock and an orange sock. My kids do that because I just don't. Well, that's like it. And I find out it's like a style trend, but I haven't matched socks for years. He was cool before it was cool. Yeah, man. Here's my thing. It's like you have to load the laundry in and then it folds it. But you got it. I don't know. It's dumb. We'll leave a link so you can watch it be dumb. It's just. Yeah, I don't. I don't understand. I mean, yeah, that's how I feel. I'm watching you load it going. I don't understand. So you put in a towel straight and it comes out folded. By the time I straighten it, Tal, I could do this. Yeah, that's just it. It's just not that hard.  I had to have kids for that. Yeah, right. I don't have kids. So it doesn't work for him. My clothes live on the couch in the basement. I mean, having kids is a real expensive way to do it. Now, if this machine will fold a fitted sheet, it might be worth it because those still just kind of end up in a ball. Yeah. I roll stuff.  I guess that'll work too. Matter of fact, if you take pants, I just throw them out. You don't fold them. I roll them and they don't become wrinkled. You know, I've been doing that for a long time. I never, you know, I do that when I pack. Like in a suit case. You didn't know you were going to find on a tech channel. I don't know why I didn't do that. Why don't you just do that? So every day instead of when I'm just. Yeah. I do it when I'm packing. I like to go on a trip because it takes up less room. All my pants are in rows. I never really thought to do that. By the way, if you didn't know, if anyone ever wonders about this. One, Tom wears lots of swag shirts and I'm a, I don't know. There's probably a term for it. I'm a straggler that hangs out when shows are about over. So it'll give me all the shirts. So I have like three and four and six of the same shirt and it makes me really happy because I don't like to think about what I wear. I think they call those cheap bastards. I'm a, maybe, but when I, and even when I buy pants or things like that, they don't have pants to give away at any of these shows I've been to. That's an untapped market. Trust me. I'll drop trial and put whatever pants you have on. So if you've got some pants that got some logos on them, I'm in. I don't care. I want some pair of pants that says, free-nass on the blinds. I want some free-nass pants. P-F-Cents. P-F-C-E-N-T-S. This is actually is. I mean, they have the pink ones that everyone's wearing. Right? Yeah. Why not have tech pants?  I'll wear, I'll wear Linux logos on my butt. Anyways, what was I saying? Oh, pants are everything. Like I just buy all the same pair all the time. If I find one that fits, like I try one on and if it fits, I go buy all the rest of them in the wrecks I have. So I'm like, these pants fit. They're like, but it looks like you're wearing the same pants every day. I'm like, I don't care. They're comfortable. So now I have seven of these. So I can go on entire seven days of changing my pants, but having the same pair. And I'm so happy to do that. When I seen Zuckerberg talk about having an entire closet of gray shirts. Yeah. My man. Well, it's a great idea. Right? I mean, like, I don't think about what I'm going to wear. Yeah. But I'm like, I grabbed my shirt and I put it on. I think, I think style's fascinating. I have none of it though. So. So that's your folding mate story. The last thing is a fun thing we've seen on Reddit here.  It kind of revolves around this urban legend thing. So the urban legend thing is why NASA uses pens. This is the joke that NASA's dumb. Ha ha. And let me pull this up so I can actually read it word for word and be accurate here. When NASA started sending astronauts into space, they realized that the bullet point pen would not work in zero gravity. A million dollar investment in two years later resulted in a pen that could rate in space upside down at almost any surface and temperatures ranging below freezing over to 300 below. When confronted with the same problem, the Russians used a pencil. Ha ha.  You spent money. We get it. So this was posted on Reddit.  And here is the actual answer for those who care about science and research and actually not killing the astronauts. There's that. Russian space is amazing. They did it by sheer willpower. And watch CosmoDrome if you haven't seen it. It's an amazing documentary. I mean, amazed at the Russian space program. Also horrified at it at the same time. Like you guys did it at such a cost. Yeah. So here's the real answer. There were a lot of meanings that ended with this. Yes. Ha ha. Yes. So anyways, this is what we'll end this on. In the early space flight, both Russians and Americans used pencils in space. Unfortunately, pencil lead is a made of graphite, a highly conductive material. Snapped graphite lead leads to particles in zero gravity are a huge problem. A hugely problem. Oh, you are hugely problematic. Bad wording. Anyways, as they get sucked in the air ventilation, electronic equipment are easily causing shorts or fires in a pure oxygen environment in a capsule.  Fisher spent over a million dollars of his own money creating a pressurized ballpoint pen, which NASA bought for 295 each. The Russian space program also switched over from pencils shortly after. The rest of it is 40 years later, snide morons on the internet still snigger about it. Because snide morons on the internet never know what they're talking about. Yeah. So, there's the behind the scenes story on there for those that care about science and things like that. And someone sent me a message and it wouldn't... Yeah. It couldn't see the bottom of it. It couldn't see the bottom of it. So, yeah. We'll leave you with that. Thank you for hanging out with us. You know, if you want to tweet off topic articles or something that you want me and Marvin to laugh about, we're actually thinking about covering some of the security stuff next week.  And it directly relates to multiplicative stupidity. Because...  Time clickerly say it. Multiplicative. And it's... Well, the oatmeal has the definition of multiplicative stupidity. Oh, is it like one of their infographics? Yeah. Yeah. They will put up... We'll leave you with this. Yeah. It's called an idiocy, but it's... I said stupidity. The oatmeal's immutable law of multiplicative idiocy. And this is really what happens. This is... If you've worked... He worked in academia, so he's really well aware of this. All of it. And we want to cover more of this stuff. Because actually, this especially applies in so much of technology. If you take two half wits and put them together, you have a full wit, right? Wait. No. No. You have two half wits. You end up with a quarter wit. Yes. So, a bunch of people in the room does not make the meeting better. It's the multiplicative idiocy of if you have a lot of people with bad ideas, the meeting goes downhill faster. It is not additive. Yes. It's not additive. It's not... Remember your fractions? So, two half wits equal a quarter wit. This is... Because they're being multiplied together, not added. That's right. Yes. They're stupidity. They're idiocy, like, multiplies. It really begins... It becomes exponential, really. And I'm sure this is what led into this Hawaii thing at the beginning. Oh, yeah. So now we've brought it full circle. Oh, yeah. There was multiplicative idiocy of what do we just... What do you only need to one? Yeah. Let's keep making it less menus with no confirmation. Well, let's see. We only need to play one pair of spell verifications. No. No. I don't know. Just keep it simple, man. Keep it simple, man. If we make it too complicated, mistakes will happen. Right. All right. See you guys. If I don't do a video for them, we'll see you Thursday for a vlog Thursday. Yes. But I may have another video for tomorrow. And if you have off-topic ideas, send them to us. Tweet them to us. Put them in the doobly-doo below. Thanks. Yeah. Oh, like, subscribe, too. Yeah. Clickity-click. And send us a smart toilet. If someone wants to send us a smart toilet. Or if you've sat on one, let us know. Yeah, we want to know all about it. Or we don't. I don't know. Well, I do. See ya.


Alrighty, so we are here to do something completely different for our channel We finally got my cool background for the channel And we that is the main component to these new style videos that we were gonna do I really wish we have a video footage of us putting this wallpaper up because it went up and came down at Least six or seven times. It's a lot harder to put up wallpaper than you think and there's two pieces here Believe it or not, but we did so good. You can't even tell well when you say that now They're gonna notice it because now I notice it But what that said that you guys aren't here to watch this, okay? So Craig knows absolutely nothing about Universal Studios and absolutely nothing about Epic universe So I thought what better way I've seen the video just to be transparent, but what better way? To have to react to the epic universe announcement than have someone on that knows nothing about it So that's what we're gonna do today. Perfect. Can't wait. He's never been to Disney or Universal by the way So drop some hate comments in the flags and see her Farah and that is it Centerpoint who owns Center Island and Marine line? Those have good theming too Marine line has okay theming, but we won't get into that. We're gonna get canceled. Okay. Here we go My standard answer is the next one We live by the ethos that the next thing we do is going to be better And the last thing we did so even though we've created some really incredible Experiences we're always looking to how do we make the next one even better? And it really starts back with the origins of our business back in 1964 with the world famous Universal tram tour and From there we expanded and built the first standalone park at Universal Studios, Florida Which really became about writing the movies and that was an invention of Steven Spielberg So you don't even know jobs stories. No, not just the interaction experience or the money Velocity tie. I lost this but was it in willed of Harry Potter came. Nope. What can we do? Never seen a video? Nothing. I love Harry Potter. We tried to find out. What's a Harry Potter world? Yeah, you come We went to the fans and we asked them and the answer was pretty compelling Give us more of your great storytelling more of the immersive environments and do it in the most visceral manner possible Universal epic universe is comprised of five Okay, what are we looking at here first and foremost? This is this is like we got Super Mario over here Which is like one of my favorite things are is a who's this that's don't come The wrong place that's the Donkey Kong ride. That's Disney first of all Latin. I Think it is spiked to the bar there. You need me triggered. So this is Celestial Park, Craig This is supposed to be if you were listening to the video inspired by an actual park coming to a theme park That's crazy Honestly, it's really stunning like like like now I'm lost for words with this. I also I just want to take enough to account that they only show us one ride Deep can you see they can't even see it because we're covering it. Let me help you guys out here There is only one ride. They allow us to see I'm circling the ride with us All right, shall we keep going you have any other thoughts do you see the hotel? The Ministry of what's a hotel? What's gonna be a hotel that big thing right over there? And then this is the Harry Potter world. Can we wait wait wait wait wait? It's 12 o'clock at night Mm-hmm. You're tired and you want to go outside. What do you do when the universal is closed and you're at this hotel? Okay, considering it's almost 12 o'clock here. I thought you were literally talking about here I assume that it's going to incorporate Celestial Park a little bit like obviously not the themed Parks and portals, but I'm not quite sure but I would assume that you could walk around the the park This is gonna be so cool. This area looks great I am most excited for the Wizarding World of Harry Potter But also the monsters land because universal is known for their monsters So the fact that they've never had a monster themed area. Yeah, I was about to say Hulk Hulk's not a monster What a terrible guy, what's it Frankenstein Dracula the wolf guy were wolf Who's the wolf guy? I don't know Wolverine Wolverine. That's probably no Who's the wolf guy? That's X-Men The wolf by the evil Wolverine guy. I think they tease him in this video Quite embarrassing ourselves here, Craig. Ah So we shall we keep playing before we I think what you can continue this before we dig ourselves a grave Over 50 you need compelling experiences the idea was to bring you I love first of all I Love the design of this mini whatever this animation thing is supposed to be but like Look at the sheer size. This is gonna take up. Is this real or is this animated? I'm seeing an actual table there. Is that real? Yeah, this is real Oh, cuz yeah, they they're gonna set up a little showroom But look at the sheer so first of all it's like five tables big look at the size This is gonna take up and this is look at all the tender world like put into perspective That's a roller coaster train how long that is normally and look at the size of everything in comparison to it No, like that's not to bring you to these rules What can otherwise possibly imagine that to do that we wanted to create a mechanism that allowed you to be Transported into another world and it starts at the very entrance of the park itself You'll enter underneath the Kronos the first portal where all the planets will lie and Exhilarating discoveries await as you begin your journey into celestial park Celestial park is a world in and of itself where fans have come to seek the ultimate adventure It's where we put the park back into theme park. It has beautiful Landscaping to correct them there. This is where we put the theme back into theme park. My god. Look at this place That statue there. I heard was moderate I Think more accurately the old the whales and the water were modeled after I didn't see no whales Oh, but that looks like a good restaurant. This looks that's why I had to buy at the boss I had to pause this year What? What that looks above my pay grade though? Like I feel like you and I would walk in there and they'd be like The Burger King's across the street and forward to eat here like what the what is this? It's stunning and Universal's known for their food like I don't even think Las Vegas has places to eat that look like this Oh What in the Gordon Ramsay's health kitchen on top of the water true like come on this looks like something out of Athens like that? Yeah Fantastic shopping opportunity. It's all like ancient architecture. We'll get the theming there I didn't notice that the first time rewind. I actually didn't notice that Look at that. Yeah, no, that's is that real guys. Is that like is that it has to be an animation No, that's got to be real and it's got a fog effect. Is that shooting star the theming that's gonna be on the ride? Also, look at the lighting package on the merry-go-round That is not the merry-go-round that is Wow, that is the Sun first of all Wow This looks beautiful Brendan, so it's absolutely stunning Is the American you're gonna see it eight times in this video. So get used to it Can we not talk about how this is probably not one of the coolest merry-go-round ever There is no center platform the center spins and then there's like five or six spinning platforms around it It looks cool Astronomica where you can play with dancing fountains and Starfall racers a dual launch coaster where you race through the sky Upon a shooting so we actually get to see a rollercoaster. It's mongrel. It's too. I believe is the amazing universal We just got to get like a round of applause maybe going for universal on this one Brendan like what I know look at it Look at it. It's gonna be like a three thousand dollars a night Again above our pay grade. They're like daisins down the street. This is what we have the amusement insiders credit card for Yeah, that's maxed out No other theme parks in the world And from here you can jump into any world I'm so excited for portal like an adventure to find all of the worlds. You've ever seen And there's how to train the dragon isle of Burke We made the dream a reality This one I think it does another launch coaster This is like it's hinting at it with all the swooping around it has to be and the ultimate wish fulfillment of flying dragons Hello, they're not gonna show us the rollercoaster Okay, you said you don't get to know a lot. I was so upset monster family That's a movie trailer. It really is Universal's classic monsters are reimagined in an ominous That's who I was talking about. Is that the guy from star wars? Who is that? I don't know that is That's not universal When the fans told us to give us more of what we did really well This is making me want to call him daddy in other chapters of the wizarding world of harry potter In the wizarding world of harry potter ministry of magic, you'll get to experience moments from both 1920s Paris from my classic beasts and the british ministry of magic from the harry potter series The ride inside of that world. I can't tell you because it has to be a surprise You come to universal lando. You're gonna get this trilogy. It's gonna be so storytelling that is unlike anything else in the world I I don't think I've been even more excited than super mario world. Yeah Aladdin, you know, but no at the area. That one's super mario princess peach and donkey kong You'll arrive in the most interactive Colorful that is like straight out of the ds. You get to play in the world that you've only played on a screen That's crazy. Epic universe represents a tremendous edition Almost doubling the size of universal orlando. Look at the sheer amount of space This is the opportunity to bring people to universal orlando for an entire week of the most incredible experiences they can imagine Universal epic universe changes everything you thought you knew about universal looks like it's a boat too The overarching emotion that epic inspires Is what it's like to have your wishes ultimately fulfilled Beyond the storytelling and the inversiveness There's an emotional component to each of the worlds The worlds that were chosen represent fantastic beast never gets to the recognition of desert And they're so vastly different The thrill and fear and joy and all of it comes together In a type of experience that you have never been able to find anywhere else everything that we do Is really the culmination of decades of innovation and creativity and immersive storytelling So we continue to perfect our craft and there's some I love that merry-go-round. I'm all the theming pieces there. I just showed it again The idea that you can go into Look that is the steven spielberg director of back to the future and apparently creative consultant at disney or My god, I'm gonna need to hire a cue card universal So honestly can someone correct me in the is this new information like Is he new to the team or is this something they've just had hidden the entire time because this is such a flex This is like wow Hiding it at the end of the video too like steven spielberg He's just the creative consultant for universal studios parks Most of us and our parents have a favorite movie directed by this guy. Yeah And now he's directing a theme park Like that's crazy and the fact that they have this guy on their team and they do howling hornites like hello It's gonna be full movie productions going on in that uh in their haunt A world through some kind of a portal And you come out in a world you never could dream of you could experience it I think it's going to Just feed the imagination of so many people of all ages What I think we're trying to do most Is give people the opportunity to really experience the full thrill of being alive That is like wow that is first of all a perfect place to stop right and second of all I want to go through these portals It's the second is rich are you running in and out of the portals like imagine you had a great day at universal You got a couple drinks and now you walk through that portal and you're a completely different land That reminds me of one of these stories when I went to universal studios I'll really tell me never heard it. I've only told this story many times Um, I went to universal studios and I took benadryl to get myself on the plane and over there and then I had some drinks And the first ride we decided to do with me being on both things was Transformers met some big brother celebrities in there and they were rude But I rode the ride drunk and it was an experience If any of you have been transformers you would know what I'm talking about that was I was blown away because my home park's wonderland So, you know the difference in ride technology is pretty insane I can't even imagine and you're you're here obsessing over walking through a portal I'm obsessing over the portals and they're merry-go-round because they won't show us any other rides that they're making anyway You can ride them Though I feel like that would make you dizzy It probably will yeah Um, I'm really excited. This is epic play on words. I'm excited. I'm really excited I can't wait till we tap the amusement insiders credit card away on the debit terminal declined $3,000 for a burger and like $8,000 a night for the hotel It literally It'll be worth it though. It was it would I wouldn't come back. I'll I'll get a job there Like I'll wash dishes over there You have to work at the restaurant outside universal Brendan if the merry-go-round breaks. I'll power it. Yeah pedal it Um, but honestly like this is crazy like excited. I'm really excited That looks like it's gonna be a great park and the fact that they've engaged with their fans to come up with this park and like I've been reading online. They're like responding to people's comments people are really liking the engagement coming out of universal studios for feedback and all that and it's showing like they're slaughtering disney in terms of growth and Imagination honestly like disney is supposed to be the imagineers of the amusement industry and theme park industry But universal is really taking like this is yeah, this is gonna be I don't know how you're gonna top this ever Right, that's the screen ever top a park like this I saw a comment actually under the youtube video that was that said something like that that this is the theme park You're done after that. There's not much more you can do So I know there's not many ride announcements. We don't know too much But there is a little spinning coaster themed to the wolf guy from the whore. We know that the star wars guy The star is good. Um, we have the donkey kong ride, um, which is new technology as well the morio kart ride Morial right that's how you say that's mario morio. Okay, um, then we have the celestial like, um shooting star ride Or is it mario and then uh, what is that? Might be mario Oh, you got me distracted. We're talking about universal. Um And then there is a launch coaster in the dragon world, I believe And that's all I know so far What do you know krega? I know there's a merry-go-round and portals Okay, but honestly, this is just just moved to the top of my list of parks I have to do Where else would it go? This has to be at everybody's top list top of their list like this is ridiculous No, where's this located krega? Cincinnati, ohio. Hmm. Yeah, that's not even a real place. First of all, it Is Cincinnati in Ohio? I don't think yeah, it is is it did I say a city and a state that we're right?  No, it's located in florida orlando florida not ohio not toronto florida is the final destination. Yes Yeah, well, let's hope not. It's not the final destination The movie scares me. Yes. Yes for this part for this part. Um, but yeah, that's that's my thoughts Is that everything you have to say? I would say that's everything I have to say. All right epic Bye take care


Hello and welcome to this section of tutorial 12 entitled, Hydrologic Modeling Using Microwave Remote Sensing. So Earth's global hydrologic cycle has benefited tremendously from advances in active and passive microwave sensors. And by now we know that they provide key information about parameters that are relevant in hydrology which are used in hydrological simulations such as soil moisture and the snow state. So in this section let us try to understand about soil, water and assessment tool that is SWAT. So this is an open source software supported by the USDA Agricultural Research Service and Texas A&M AgriLife Research which is part of Texas A&M University System. And over the past two decades or so this tool that is the SWAT model has been widely used across globe for various applications and of course with time there has been numerous additions to the individual components of the underlying codes. And shown here is the current version of SWAT+, which is like a revised version of the model and the utility of this tool is to simulate the quality and quantity of surface and groundwater. Now it is to be noted that SWAT allows various subunits to be defined within a watershed such as a subbasins, unlimited number of hydrological response units or HRUs, pond, wetland, point sources etc. So let us begin with the installation of SWAT+. So the installation requires QGIS and SWAT+, installer. So QSFAT+, is a plugin for QGIS and shown here is the installation process for Windows users. So if you are a Linux user, your Linux distribution may have QGIS package as part of its standard collection, otherwise one can visit the QGIS download page and follow the instructions for downloading. So I am going to go for Windows 64 bit version and again a similar process needs to be followed for users of macOS. More details are available if you access this particular website as shown here. It has a lot of documentation available for running and using SWAT+. So in my system, already QGIS is installed, so I do not need to install it again. As I mentioned earlier, please install QGIS before installing SWAT and the details about QSWAT and its various documentations are made available in this website for easy understanding. So once the download gets completed, let us click on the SWAT+, tools installer exe file which will take me through a list of processes for extracting the files into the C drive and then the SWAT+, editor will be set up. And I can check in the system and make out how the interface looks like. So what I am doing here is a hydrological response unit HRU that is part of the sample files given for demonstration purposes from the website we have just seen. This is shown just to give us an understanding that land area within a sub basin can be divided into HRUs. As I mentioned it is hydrological response units and they are nothing but part or portion of a sub basin which is having unique land use attributes. So HRUs were incorporated into SWAT as part of the hydrological unit model for the United States project and they simplify the run because they lump together all the similar land use areas as a single response unit. So for this tutorial I shall be using the sample files that are made available in the robbit underscore demo folder. Now this has been set up in the Q SWAT+, which means if I go and directly click on the particular file, it will open up the QGI's interface. Now please remember that you can also access the Q SWAT+, manual and set up your own project. The example data provided in the website in which we are now going to use it includes all the inputs required for SWAT+, and now we can try and explore what is available to us. There is an option known as manage the plugins wherein you can see Q SWAT and Q SWAT+, is checked. You can see the icon appearing here and you see the details represented here. If you have installed the SWAT+, you will see the icon here like this and we can explore the different data that is available for HRUs, hillshade, floodplain. You can see the different layers that are made available as part of the sample demonstration file. Details about soil, about slope, you can even check or uncheck these to see what difference it makes to the diagram. So now if you have installed SWAT+, as I mentioned earlier you will see a small icon here. So the moment you click on this icon, this is the interface that is going to open up interface of Q SWAT+, wherein you can see that the first two processes are marked as done that is process 1, delineate watershed and process 2 that is create HRUs. So they are shown as completed which means I can go ahead and click on the third step that is it will open up an editor project from Q SWAT+. So I am going to now import the GIS data into SWAT+, this is the project summary and there are different icons towards the left side which you can click and explore. So Robbit demo is the sample file that we are using. The details about channels, about basin, land use management all are made available in the left part, the parameters you can explore the details made available. What we have to do is we have to edit the inputs. For that let us try to decide about the weather data. So the weather generator needs to be set up for us for which there are different options provided. One can click on the import data and select the CSV files as the data format. So if you see here the project summary is visible. So if I just click on the add weather generator option and import data this is the interface that is going to open up and it gives us options to select the data format and the database file. You can either go for database or CSV file and there are different table names in database. Remember this is for the sample file that is made available. So I am going to click on the CSV files and go to the folder WGN wherein 2 files are available. This is for the station data and then I am clicking on the next data. So it will give the monthly values. So now I have imported and as you can see just a single row is made available. I can see the different variables that are being imported like maximum temperature, minimum temperature. So what we have done? We have imported the data by clicking on the weather generator option. So now the weather generator is set up and we need to select the weather stations which is also present at the top left. At any point of time you can edit these values and save the changes and there are different parameters and files codes that are available at the left side of the interface which you can explore and change as needed. So now I am going to go to the weather stations and you can see all the parameters are shown as null or either same SIM which means it has not been imported yet. So we have set up the weather generator and we need to select the weather stations that are at the top left. For that I can go to import option and again I can select the data format and the directory. I am going to use the sample files that are made available and the directory to save the input files there will be a default directory present here. So now the weather station data has been imported and you can see the values have been replaced now. So if I can open it in notepad and see that the data is made available from year 1990 to 2013, the precipitation data, solar radiation, temperature data all these are made available and it has been imported. So now the next step is to Run SWAT plus. Now before we click on the Run SWAT plus button, there are options for us to confirm the simulation settings as is visible at the top. For example I can choose where to write the input files. I can set the simulation period. There are advanced user options which you can explore. For example the time steps for rainfall, runoff and routing you can specify that. So once I make the necessary changes I can click on the save settings and run selected button which starts writing SWAT plus input files and basically it is running. It takes some time based upon the settings that you have made in the page that was shown. So typically after you run SWAT there is an option for us to select the SWAT plus check. Now we can perform SWAT plus check which reads model output from a SWAT plus project and performs many small simple checks. So as to identify the potential model problems, this is mainly done for example if you have some issue it helps us to identify the issue and they are brought to our attention. And this is often essential to find out the hidden problems which require us to say recalibrate the model that ends up consuming a lot of time. So once the run is completed this is the interface, the dialog box which will be visible for you that all the selected tasks have been completed and after that I am going to see the SWAT plus check just to check whether everything is in order. As I mentioned earlier the purpose is just to bring attention to unusual predictions. Now I have run the SWAT plus model and I have applied check SWAT plus check. The next step is to visualize the results. Now to visualize the results I am going to click the tab on visualize which is going to open up this interface for me. I will just expand it so that it is more clearly visible. There is an option known as plot wherein you get to plot the results. We get to choose SWAT plus output table. I have made the selection and then we get to choose the period that is the starting date and the finish date and then I get to add the units and the variable has been selected. So now you see it is visible. Let me just expand to show you that there is options for us to add the observed data file as well. This is the place where we add the observed data file. Now I press on plot and I am going to name it as trial. So the output is plotted here. This is the simulation output. Say if I had entered a CSV file for observation data it would have plotted the observation data versus the simulated data in the same plot with different colors. Just a few options which will be easy for you to use while dealing with SWAT plus. Now the details and demo files are available in these links and I am just useful for you to gain more understanding about SWAT plus. So till now throughout tutorial 12 we have started with trying to understand how does the hydrological model work and then we looked at the different types of hydrologic models and now we have tried to see how running a demo file in SWAT plus looks like. So with this background let me now take your attention to land surface model which is abbreviated as LSM. So LSMs are based on the solution of water and energy balance equations in the VEDOS zone and land atmosphere boundary and it mimics the physical conduct of flux transfer in soil plant and atmospheric continuum. So in particular let us try to understand more about NOAA LSM as part of this tutorial. Just to reiterate land surface models are nothing but integrated models that can assess the available water source as well as predict the impact of future changes in management and climate and it is an integral part of weather forecast models. Some of the widely used LSMs are the NCAR community land models CLM variable infiltration capacity model VIC and the NOAA model. So just a little bit about the history of land surface model because you know it started with the first generation model wherein there was no heat conduction into the soil constant soil depth was considered with fixed soil properties water content was limited and then the second generation of models happened wherein vegetation impacts energy and water budgets momentum transfer all these were included and several soil layers were also included followed by third generation of land surface model which also included carbon balance modeling and there was semi empirical representation of vegetation conductance. So a simple comparison between the NOAA CLM and VIC model is summarized in this table with respect to soil for example the NOAA model has 4 layers of soil moisture CLM has 10 layers of soil moisture VIC has 3 layer moisture and temperature similarly different vegetation that is adopted in NOAA CLM and VIC are shown here for example NOAA the dominant vegetation type is in one grid cell is seen dominant vegetation type in one grid cell. And for CLM up to 10 vegetation types are possible in one single grid cell and VIC there is tiling in one grid cell similarly for the option of snow. NOAA has one layer of snow CLM has 5 layers VIC has 2 layers so different land surface models have different underlying characteristics that is what I want to emphasize through this table. So just to visualize the concept of land surface model assume I am running a land surface model over India I have several meteorological forcing data that go as input into the land surface model okay and then I am trying to simulate realistically a hydrological variable say a runoff or soil moisture that is coming out from the model. So let us try to understand more details about the NOAA land surface model this is a schematic representation and model configuration of NOAA land surface model. If you remember in the earlier part of the tutorial we were trying to understand how a hydrologic model represents the different processes and we were trying to understand it through the water cycle. So with that background if we try to look at the schematic representation of NOAA LSM it is easy for us to understand that NOAA LSM has 4 layers of soil moisture the depths of each layer is given 10 centimeter for layer 1, layer 2 is 30 centimeter, layer 3 is 60 centimeter and layer 4 is 100 centimeter. Similarly we can have different processes okay and you see the long wave radiation incoming short wave radiation then there is direct soil evaporation infiltration happening transpiration happening and there is of course the soil temperature flux, soil moisture flux and gravitational flow happening just a schematic representation of what is contained in the NOAA LSM. So a 1D soil vegetation atmosphere transfer scheme underpins the NOAA LSM to compute the water and energy flux components for unified soil vegetation surface. Now owing to the 1D model assumption lateral flow is neglected in the NOAA model which is a valid assumption for terrain with moderate relief. So during the simulation process each grid cell is designed with its corresponding land cover and soil class which helps to determine the corresponding vegetation and soil parameters. Therefore the uncertainty in geostationary soil and vegetation parameters affect the model simulations. For instance the uncertainty in wilting point and soil porosity leads to erroneous estimation of evapotranspiration which in turn affects the movement of moisture and soil column when combined with uncertainty in saturated hydraulic conductivity. So moving on just to give you a glimpse of model thermodynamics the surface skin temperature in the model is determined following mart and pan by applying a single linearized surface energy balance equation along with the ground heat flux which is controlled by the diffusion equation for soil temperature. So here C is nothing but the volumetric heat capacity thermal conductivity is KT formulated as functions of volumetric soil water content that is theta. Moving on the flow of water in soil is described by the Richards equation that is derived from Darcy's law under the assumption of a rigid isotropic homogeneous one dimensional vertical flow domain. So here in the Richards equation theta is the volumetric soil moisture content, D is the soil water diffusivity, K is the hydraulic conductivity of the soil, Z is the depth of soil and F theta is the source and sinks of soil moisture that is precipitation and evaporation. Just to give you a glimpse of the underlying equations that are embedded or followed in NOILSM. Now shown here is a table which depicts the sample sources where you can find model for forcing data which can be used in NOILSM. For example, if you need say the near surface air temperature and near surface specific humidity and the details about pressure and wind and rainfall rate at a particular spatial resolution and say 3 hourly temporal resolution, you can go to the website of GDAS Global Data Assimilation System. So you know similarly this table summarizes the sources from where we can access the geostationary parameters. For example the land cover, modus, the soil texture, one source is the food and agriculture organization that is FAO. For the soil fraction also we can get it from FAO website and for the slope type it is found in NCEP list, elevation data, SATM, albedo, NCEP, greenness fraction, NCEP. Remember there are many other sources from where we get information about these variables shown here is just one sample source. Now for more details about the land information system I would urge you to visit this link that is shown here. So for this tutorial 12 we understood very briefly about hydrologic models and then we saw details about the SWAT model and then brief details about the NOAA model and among the different types of models available which is best for your application for example which model to choose from. So to answer this question some benchmarking studies need to be conducted which compare and evaluate the performance between different models. So please note that I am not endorsing any particular hydrologic model or commenting on the performance capability of any model shown here are the contents for demonstration purposes only. So let me hope that you found this tutorial useful. Thank you.