So I hate to be the bearer of bad news, but Kenneth Copeland and Joel Osteen are still a problem. But you're like, Isaac, I don't know who these guys are. Why are they a problem? Well, let me tell you about it. Who is Joel Osteen? Pastor of Lakewood Church in Houston, Texas with his charisma and southern smile, he boasts of attendance of tens of thousands every week in his mega church. You'd be hard-pressed to find somebody who grew up Christian who hasn't heard the name Joel Osteen. So what's the problem? This guy's just doing his thing. A pastor? Sure, he has lots of people coming to his church, but that doesn't necessarily mean his preaching's whack. Well, let's hear from him from an interview with the late Larry King. What if you're Jewish or Muslim and you don't accept Christ at all? You know, I just, I'm very careful about saying who would and wouldn't go to heaven. I don't know, I think only God- Because you believe you have to believe in Christ. I believe they're wrong, aren't they? Well, I don't know if I believe they're wrong. So if you're familiar with Christianity, one of the biggest tenets is that Jesus is the only way to God. And in that clip, Joel demonstrated that he doesn't actually believe that. Not only that, but he preaches something known as the prosperity gospel. It's messages that Jesus came to bring us emotional, physical, relational, and financial prosperity on earth. And if you notice here, this directly contradicts a lot of the teaching within the Bible that Christians will encounter problems, difficulties, trials, sickness. In fact, Paul actually talks about how Christians should expect persecution. This goes in direct contradiction to Joel Osteen's message of prosperity, health, wealth, all that stuff. He also utilizes something known as name it and claim it theology. The belief that every blessing is available to us if only we would believe God enough to get it, to claim it. But think about it. That means that every time we don't get something, we're not rich or we're not famous or we're not extremely wealthy, it's because we didn't have enough faith. That's what it always comes back to.  It's a really dangerous thing, but honestly, the reason I wanna make this video also is to point out the prosperity gospel, the problems with these guys, and I'll get into Kenneth Copeland in a second, but also to recognize, look, these guys have not gone away. I realize I've talked about them in the past and there was definitely a big hubbub about them in the early 2000s and 2010s and all that stuff. That was when it was really popular to call out these guys, but these guys are still getting millions of views. Like Joel Osteen is getting millions of views on YouTube. So this isn't just like the random lady across the street watching Joel Osteen or just somebody's grandparent like tuning in every once in a while. He is reaching millions of people with this false gospel. Who is Kenneth Copeland? Kenneth Copeland is a popular preacher, televangelist. He was mentored by Oral Roberts, one of the father's or if not the father of the prosperity gospel movement. One of the first of the big name TV preachers died today, Oral Roberts, he was 91. Beginning in the 1950s, Roberts used television to raise spirits and raise money and he even once claimed he'd raised the dead. Don Teague now with the Oral Roberts story. Out of that barren ground. Oral Roberts was considered the father of televangelists among the first preachers to take religious revivals from tents to television. It's so sad how Oral Roberts really distorted the name of Christ in Christianity, but honestly that distortion didn't end when he died. Establishing a multi-million dollar ministry that reached around the world. My soul's at stake, I may lose my soul. I know I will if I disobey God. Roberts' faith and philosophy grew out of about with tuberculosis as a teenager. He said God cured him and gave him healing powers of his own. He trained Kenneth in his ways of televangelism and Kenneth has been at it for years. Even at the ripe old age of 74, he's still consistent with his weekly messages and televangelism programs. In other words, his same old garbage. And if you feel like I'm being too harsh with these guys, I want you to keep watching because I'm gonna explain exactly why I'm pointing this out in a bit. Thank God I call myself well. I call myself healed. I call my memory fine and restored. I call my body well. So I'm calling things to be in all this other world. Kenneth Copeland is sucked right up into the prosperity gospel movement, mirroring Oral Roberts. And honestly, a lot of what Joel Osteen says as well, Kenneth is really ingrained in this name it and claim it. You can see the example of this when he talks about I am is so important. What you call yourself is so important. And I mean, you could be like, yeah, that is important. But what he means is like, hey, if you call yourself well, you will become well. It's this name and inclement theology, like health is available to me as long as I truly, truly believe it in my heart.  And it completely denies the teaching in the Bible that, look, we're gonna experience sickness and Christians die of sickness. But that doesn't mean that it was because of our lack of faith in God to heal us. God has purposes even in things that look difficult or challenging or are difficult and are challenging and are heartbreaking. But it's about believing that God is a purpose behind each of these things. So number one, I want you guys to make sure your grandparents, your parents, because a lot of these guys are hitting older people up. They're making their ways into TV and, you know, like they're popular among old evangelical Christians. Like it's just the way it is. And you never know. Maybe your parent is watching Jalosti on a consistent basis and getting his theology from there or Kenneth Copeland. It's just a good thing to check up on people in your life. Like, hey, like, have you heard of this guy? What do you think about this guy? I'm just beginning a conversation because, man, what we're gonna discover is that a lie, when it is close to the truth, it is that much more dangerous. And that's why I'm calling out these guys. That's why I want us to be aware of it is because when something seems like it could almost be true, but it's not, that's the most dangerous lie. In doing research for this video, I came across something that I did not expect. Notice how I was saying before, like these guys hit up the parents, the grandparents, the previous generations with this prosperity gospel, mumbo jumbo, but it is infecting the next generation. And in fact, Jalosti's son, Jonathan Osteen, is now preaching his own sermons at Lakewood Church. And yes, it's toned down from his father's stuff. It's not as blatant prosperity gospel, but believe me, if you pay attention, it's there. And like I said before, something that is even more close to the truth, but it's still a lie, that is the most dangerous thing. And that's what concerns me is this stuff isn't gonna go away. This prosperity gospel stuff, it's not really becoming less trendy. It's still very, very prominent, especially internationally, not just in Western culture. And so as we're seeing people like Jonathan Osteen rise up and begin to take on the footsteps of his dad and continue on with the prosperity name and claimant gospel, I think it's that much more important that we are aware of the distinctions between the prosperity gospel and the true gospel. Because what God promises us is not just monetary wealth or financial success or relational success, it's not this pragmatic thing like sign up for God and you'll get the life that you've always wanted and all your dreams will come true. That's not what God is offering. He is offering us freedom from sin, forgiveness, a right relationship with God. And that does not mean it's gonna be smooth sailing. When people sign up for Joel Osteen's gospel, they are severely disappointed. In Kenneth Copeland's gospel, they are severely disappointed when they actually encounter problems. They're disillusioned. They say, well, what's going on here? And Joel Osteen and Kenneth Copeland are saying, you just don't have enough faith. You gotta have more faith and life will be better for you. And so you're guilting these people and making them feel terrible like they're not actually Christians or not actually living the Christian life because they're not believing enough because their life isn't going perfectly. It's disgusting, it's terrible and it's not the gospel. It's not Christianity. Let's cling to the true gospel.  It wasn't to just bring us all this like money and prosperity and successful life and to be loved and all that kind of thing. No, it was to break the bondage of sin and it was to give us new life in him and new identity in him. That's the gospel guys and he rose again defeating death. Let's cling to that. I hope you got something from this video. If anything, just a further love for the true gospel and a keen awareness to be discerning about what you're listening to and have conversations with people on your life. Just see who they're listening to and begin this conversation about what is the true gospel? What is this prosperity gospel and what are the things that are so dangerous about it? I think it's an important conversation to have, especially as new people are rising up with this false gospel. Thank you so much for watching this video. I hope you enjoyed it and thank you to all my patrons on Patreon. It is an amazing blessing to be able to have you guys there. The goal for February is to get to 40 patrons. We're like seven or eight away right now. And so if you guys could head on over to patreon.com slash daily underscore disciple and give $5 a month, that would be amazing. Like literally every time somebody signs up, I'm so excited and so thankful because you're making it that I can continue to make these videos. So thank you. Thank you for like, commenting and subscribing. I will see you next time. God bless.


We can find a way to break through. Welcome to Telecom Exchange. I saw a movie recently, The Great Wall, starring the oddly cast Matt Damon. I should admit, I love sci-fi and history. So mystical beasts coming to attack the Great Wall. Sign me up. The one scene that really did stay with me was when Matt Damon's character, who's really a fantastic fighter in this movie, he was awestruck at the Chinese army that guarded this wall. The army was huge with different sectors, like the archers and the spear throwers and the cannonball launchers. And they all worked so deftly in unison, across large numbers. And as I thought about this army of well-organized fighters, I thought about us. I thought about our collective global network, all the layers of the stack, the data centers and meet me rooms, the dark fiber, the lit, local, subsea, global, fiber, wireless networks leasing, buying, voice data, the unfathomable amount of information and communications that make our global economy tick. Make our towns secure. Make our education, our research, our health care, medical breakthroughs stronger each day. Make the way we decipher and utilize all this data faster and more efficient, software-driven, machine-driven. Our world has quickly slipped into sci-fi where it is potentially possible to be this global army, part human, part artificial, spreading as wide as needed to protect and conquer new lands, new oceans, new space, virtual or real. OK, so I don't think that the director of the Great Wall was trying to say all this, truly not in the movie at all. But getting back to the movie, one of the generals, a woman who I particularly admired, told Matt Damon's character, the way the army was so successful, the way it ticked, was through trust. Each unit, each soldier, trusted that the other was performing optimally as trained, that they were there for each other, acting at their best so they would be their best. I thought of the courage to have this type of team-driven trust, the confidence not only in oneself and what we can control, but in one's peers, and not in a small, manageable amount, but spread across thousands, millions, billions of people. And I wondered, is it possible? Maybe there's some mathematical equation where it's just no longer viable across x amount of people. At what size is a company too large or a country or a world? And what happens with this trust, with this advancement of time and technology? All right, so back to the movie. Matt Damon's character replies, I've stayed alive because I've only trusted myself. And my lady general, whom I might have mentioned, was kind of cooler and smarter than Matt Damon's character. She scoffed, and she said, you cannot be trusted until you learn how to trust. So I got back to our telecom and technology army, our day in, day out, building, working, partnering, cross-connecting, not just our cables, but our trust and our livelihood. My service, which will improve the lives of many, will run across your networks and flow in and out of your data centers. And I am trusting you that it will not be impacted by any hack or downtime much. So yeah, trust is a big piece of our army. And yet hackers and political upheaval and human error more chip away at our collective trust. How do we repair it? I only know of one answer. Strong partnerships with a singular goal, singular purpose, singular practice, to do better. Provide a stronger, better tomorrow for our children, where we build new fiber for our basic human need to stay connected, to communicate, and to keep delivering smarter, faster, better. With stronger partnerships, come stronger trust. So with this, now more than ever, I invite you to take part in telecom exchange. This is TEX, where communications and technology meet, where partnerships are born, where trust is fostered, where together we unite under one purpose, grow together for a better tomorrow.  This room is filled with service providers and the COLO and data center operators who phenomenally attend and support TEX each year. Welcome. We also welcome the national and global tech companies who require telecom to drive their apps and services. Today, we welcome the software, hardware technologists, who are making the most out of our capacity, as well as the security companies who help us protect against the constant threat of attacks. And today, we welcome over 40 journalists, analysts, and social influencers who see our thought leaders as newsworthy. Welcome.


This technology is great because it has the ability to save lives. We use roads every day and this technology has the ability to make us safer. With wireless communications, the technology can give vehicles more green time if there's more to spare or an early yellow for a safe stop at intersections such as this one. The way things are now is to use a loop detector via electromagnetic inductance to sense the vehicle. The new way of doing it is to use the virtual detector or a waypoint. A waypoint is a GPS coordinate written in computer code that the traffic signal controller interprets to determine the location of the vehicle. In this research project I help in the mapping of intersections so we can locate the connected vehicles that are approaching the intersection and at a dangerous speed and distance. We have been working with connected vehicle data to generate traffic signal performance measures and so far we have mapped over a thousand intersections just in the state of Indiana. Our research is funded by the Indiana Department of Transportation. The Joint Transportation Research Program facilitates research in collaboration between government, industry, and higher education institutions to improve transportation infrastructure in Indiana. This technology is just one of the many great things happening in the Joint Transportation Research Program. Our future research is to use connected and autonomous vehicle data to uncover new insights on traffic patterns during incidents, weather patterns, and vehicle electrification.


Hello everyone, it is a great honor to present at DevCoin. Welcome to our presentation, don't dare to exploit an attack service tool of Serpent Server. It is presented by myself, Yuhao Wen of SengFall, Steven C. Lee of Kill Hill 360, and Juniang Peng of SengFall. Let me introduce ourselves at first. Yuhao Wen, who is a web security researcher of SengFall, and also a CTF player of Team K-Pog. Steven C. Lee is a security researcher of Kill Hill 360, and he is a very good trainer. Juniang Peng is the principal security researcher of SengFall. Let's begin. The agenda we will be talking about is introduction to Serpent Server, exploiting server side, exploiting client side and examples, and a conclusion. Serpent Server really doesn't need an introduction as a part of Office 365 products. It is one of the most popular trustee content management systems that we have today. It has online version hosted by Microsoft Azure and Openversion, which we can deploy ourselves. It doesn't need too much professional knowledge and skill to deploy, but actually, in my opinion, it should have a more higher learning curve than other content management systems. You always need to spend some time to get similarly. But many schools and institutions like In-Fat, this is an example of what Serpent Server would look like in 2019. This is a default communication side. It looks pretty modern out-of-date and pretty professional, but hidden behind all that is a lot of features that don't necessarily have buttons or area to reach. We are going to explore a lot of that in this present day. With an introduction to Serpent Server, we can talk about the structure, the key difference, design recognition, and any customized page default danger. With the Serpent Structures, it's a side of the main who can manage different sides, and they can assess the other main panel which has global commigrate settings that can impart multiple sides. Or you can deploy a new web path, lots of features, so it's really a powerful position. To be honest, we have not fully explored the other main panel, but I do believe there is the ability to upload regular files on the server and it's called anyway. Then this is known as the side owner, and this is the regular permissions that given by most users. So if a new user is created and they have side owner permissions, because they can create their own side. If they are just side viewers, they cannot do anything other than just viewing the page. They can change any settings, and waste my side, so think of it as lack of my space or something. They can create their own page, and they can book ten on there and do what they like, but they cannot use their side to assess other sides. They are in a restricted sandbox. The key difference with Serpent and some popular open source competitor would be this. As I said before, this ability to create side. In the Sherpa eyes, side is a new structure, it has a new physical folder on the file systems, then a new visual directly is created and ported to that folder on the file systems. It's run on a different part, it's different application pools, but sub-side will not create a new folder just a visual one, and they can upload page in that side, like a JavaScript file. Those JavaScript cannot assess other side content, which is why Microsoft demo is safe to be able to upload JavaScript code on your side, because it means that JavaScript cannot assess content on another side of other main side. Where lots of dangerous things can be done, users can upload a custom page like a conversation, and there are several different authentication measures, like NTLN, form-based authentication, and so on. The design mechanism of SharePoint is the ability to use an habitually file-related vulnerability that can be leveraged to achieve remote code execution, because it's possible to read the webcomical file, which can contain the validation key of build state destilization, which can be used to generate a particular build state. Execute an habitually command again the application. Oh, I know some other researchers have talked about this before, and this is something that children as a default design of SharePoint. I'm not exactly sure why they have. Besides that, it's generated using a randomized FIST kit in the webcomical, because it's possible to generate a learning kit without using FIST one, like the patch of CB2020.0688, but I'm not sure exactly why SharePoint doesn't use that particular feature. I believe that there are some codes in SharePoint that require the validation key to be stored in the webcomical file. I'm not very sure. But regardless, if a file disclosure vulnerability is found in SharePoint, it means that you have an habitually command execution. The added customized page defaults dangerous. Other permission rather is allowing users with a display village upside on the rather to upload page on that side. So this also works on SharePoint online as well as SharePoint on-premise, but it should be enabled by other means in SharePoint online. It gets dangerous because users can upload also SPS page, can contain client side script along with server-side ACP.net controls. Those are known as sidepages. The controls are filtered by an allow list that is defined in the web config, so you can't just upload whatever control you want. And those controls will be decelerized using SAANL. That several evil payloads use the indie path with SAANL related load, but those payloads don't work here. We can't just decelerize whatever payload we want and get code execution in that way. Users can also not upload in light ACP.net script. It will not work because compilation is never. You cannot run the compiler code on the server. Additionally, the ACP.net server-side encodes are also broke. However, a combination of the allowed server-side controls and JavaScript can be quick problematic. And we will talk about several vulnerabilities that are listed by this. Looking at the table, sidepages which are created by users, the content of those pages are stored in a database. They are not compiled and they are untrusted. And so application pages are opposite. They are created by the system or installation. They are on the file systems. They are compiled and they are trusted. Those files will get compiled and executed when accessed. Now for the server-side. We are going to briefly discuss the attack surface.  Bypass sp-page-palace-filter-check. Sp-page-palace-filter overrides the page-palace-filter. It doesn't check files in file systems and read them directly. But check files in database if they can only save controls and without server-side included. In addition, this page is copied from learn for escape. We want to know what a save control is actually made out of. The root class is system.web.ui.control class and so every sb.net control is then phoned in. And to work out what classes can be used for SAM and other serializations. The controls that are marked as save in webconfigure files. So here is an example. There are two different controls. The first one is actually a net space. System.web.ui.net space. And all types under that net space are saved. Then you have another that has the system.web.ui.web.control.net space. A particular type of cycle data source that is marked as false. It is not safe. By the way, if it is inside save control tag and don't special save or not, it is safe. Let's think if a control is tanned for an unsafe control, is it safe? Yes, actually. Examples. If we look into the webconfig file and we see the cycle data source, it is defined as an unsafe control. But as it turns out, that is a particular class called spcycle data source that is tanned from cycle data source. This particular control is not blocked from the webconfig. It was possible to raise a cycle connection to open sync. Attacker can control the connection stream properties and it can be used to attack the client drivers on the server itself. We saw that this real research is interesting because not many people sat down and looked at into attacking cycle drivers on client side. But all we know my cycle driver is interesting. If you can connect to a malicious mycycle server, then the local server can send back a request for local file. This has been publicly known since April 2nd, 2006. I do know that this is by the data feature of mycycle. If you control the connection stream in most applications, the connection stream is not controlled. But not shared point. Here is an example of a payload. You can see here that the connection stream driver equals mycycle. Then the server to the attack servers, port and database name, username and password. But we need specifically here you can see a select command, select start from users. We need a select command to be able to trigger the communication or it can communicate with the server. And then on the server side, we will ask for the particular file, you know, web.config. We have a proof of concern video here. Note that you need a mycycle driver in the target servers. And the SAP cycle data shows file disclosure bug had a patch by pass. It was interesting because this particular by pass was a tunnel check tunnel use in the way that they check the connection stream. To be honest, we never tested this patch by pass. We just reviewed the patch quickly and see it was vulnerable. They added a check of the connection stream. And this was the message called the check connection stream. It will get the connection stream and call is allowed ODBC driver. Let's check it. The first thing it look out is a DSN in the connection streams. Then you will look out the DSN and find the particular driver out of the DSN. And if that equal to cycle server driver, that's the traffic cycle server, then it will be allowed. But if you look at the implementation of the extra connection to open, it look for either DSN or driver property, whichever is set first it use. We can exploit this for a tunnel check tunnel use by providing a DSN property out of the driver. The impact again is RCE. But we need to know the existing DSN or the target systems that use cycle servers. At the time, we didn't spend too much time on these particular vulnerabilities, but we think there is a way to leak the DSN then. Here is our port. You can see that we're using PowerShell commander at ODBC DSN, which will create a DSN on the systems using cycle servers. When we actually payload itself, here contain DSN equal PLC, as long as the DSN is in here, then it will be treated as trusted. But then when the cycle connection is made, it say the driver property first, and then say it's in my cycle, it's in my cycle driver, then what are the properties? And then it ignore the DSN because that there is no a particular property for that particular driver is a cycle server. And you find a server port database and then trigger it again. So we can continue to read the web config file and get remote code execution. Then look at the next example, CVE 2021 28450. It is an IED DOS bar and come for another unsafe control. We find this control and then the regular expression validator. It look like that link to like as validation. That is unsuncast input from the regular expression validator, it stand from it, which is safe. Okay, let's check this normal example. As we see, we can control the validation expressions and validator value. And it's else when we read the code and we follow that, we can control the time out too. So in this case, we can specify the expressions and the input, as well as the match time out for the expressions to be calculated.  Think about these expressions and our input is 1288 and exclamation mac. It will run very, very slow because the first power of these expressions will be excused repeatedly. It will keep matching and until run out of time. Here is the chart about how many steps will be excused when the number of A is increased. We can see that when we input 28, it will run more than 100,000 steps to try to match. And we will attack it with 1288 and we will, we can set a large time out value so these threads don't get close quickly. So we test it against SharePoint online and make it died after sending 50 requests. You don't need to send requests at the same time. Just send it slowly and save the result. And it will restart after some minutes, maybe 20 minutes or more or less. Then go to the next example that we will talk about. We found the two types that were blocked in web.config file. This was about creating users ready and trained password. And in this time, we can find any class that is trained from them. It is fine we ask ourselves, why are those controls blocked? Why are those particular controls? After doing a bit of research and investigation, we found that those people controls can reach an open file mentioned in the rule controlled class. The trained password and create user ways is standard from web controls, which has an open file mentioned. Of course, there was an additional controlled password recovery, which was not blocked in the web.config. We could use password recovery control to email ourselves, our own password, coupled with a file of our choice. We think it is designed to select an email template file, so email address will aside to account using the phone-based authentication, which was the default authentication for SharePoint Online. They will allow the users to email ourselves whether the web.config file and can ask you again. But the attacker also needs to leak the membership provider, and we can follow it by this session quick hit. And outgoing SMTB server need to be configured on the target system as well, so that we can receive an email of web.config file. This is what the payload looks like. All we have to do is specify the body file name equals a particular part to web.config. We load a quick proof of consent for that one and put it here. Email result here, we can receive machine key in our mailbox. Here we use both to capture it. Then let's put out ship control, and we will talk a little bit about server-side encoder. Server-side encodes are relative that placed in htl page and evaluated on the server while the page are being served. In sp.net, it's convenient to include web.config to still machine key, but it's blocked by default, or most case at least. When you were to make a sps page on the server, you will try to do it included for web.config. It's not allowed because sp page page filter is enabled by default, and it blocked the included. It's a side page and doesn't allow it, but as it turned out, there was a way to bypass some updates. Let's see this example. Here is a famous message named page control, which was introduced in look for escape presentation, and it was in many bounds with the share point. It will pass strings to control the class, and it has the ability to bypass the sp page page filter. If the second parameter to the pass control is true, an sp page page filter will be ignored, by ignoring that way could get an encoder going. So we want to find a message which will call page control with a dynamic flag. The data form will be part of control. It has a particular message called create child control, and it's called when the other control exists on that particular control, and inside this function it called page control. It is a good target if we can make the flag true, and the flag generated from verify spd control maker. We have to satisfy some validation to raise this code in a dangerous way. It has to be valid. Okay, first of all, it needs to be valid as an L, so we can illustrate up fast, because it is not available as an L format. We also need to have run an equal server, or it would be solved as client script and won't pass the modified control. It also needs to be a safe control. It can contain things like object data shows controlled, which is a famous gadget. We create a payload that will use server-side input instead, as you can see. It use phone with run and equal server tag. Don't need to use any unsafe control or object data shows. And then we include the web config file on that particular site, and that it will leak the validation kit and give us remote code execution back. As we have got a video demonstration here. Let's continue this presentation, next we will discuss another type of tag. Server-side requests for glory. Let's look at the bottom row code example. This server will retrieve the URL we controlled and park the URL into a request object. Send the request and return the response. We can set the URL to arbitrary address like verb, collaborator, localhost, file server, or other interesting HTTP servers. We found many SSI vulnerabilities in SharePoint. One of them will be discussed later. We found a very simple function called OLS. It passed the parameter URL of dimension to save create to get a request object and return the result of the request. It look very similar to the vulnerability example mentioned earlier. And here it can be considered as a wrapper of web request.quate. If we can control these parameters, here is a classical SSI vulnerability. At first, we need to judge whether we can assess these measures. Through the research of official documentation and online material list, we found out that when a measure is marked as client callable measure, it means that we can call it with SDP request. The generated format is slash sp slash namespace dot client callable type dot client callable mentioned. So the path here should be slash sp slash sp dot hashtag dot management dot call OLS. Know that here is SP SharePoint. Let's make a trend in there and we can control all the parameters of the client callable mentioned function. So it's very simple to write a proof of concern. Just edit the URL pattern for it. Then wait for the server to meet our address and return the result of URL request. Actually, there are more things about the server side request for gallery, but for some reason we can talk it this time. So the next thing we will talk is SNL pirating. SNL is a very popular make-out language. First standard in the late 1990s and adopted by Calderade Software Project. It is used for configuration files, document format, imagine format and network protocol. And it is so popular that any problem about it has will bring catastrophe results. In the process of pirating external entity, the SNL piracy can create better network protocols and survive like DNS, FTP, HTTP, SMB and so on. According to the protocol specified in the URL, external entities are very useful for create a dynamic reference in documentation so that any chance made to the reference results are automatic update in the document. According to official documents for lower versions of the event, the network. When reading SNL text container, external entities external entities will be automatic piracy. However, when dealing with external entities, many attacks can be launched against the application. Those attacks include the disclosures or local system files which may contain sensitive data such as password and private user data. Or the use of network access features of various programs to manipulate Internet applications. By combining those attacks with other employment files, the school of disc attacks can be extended to survey interruption and even habitually called execution. Depending on the context of those attacks, we call this attack type SNL external entity attack. We also share a simple vulnerability code example. The code snippet shows the classical SNL document.loadSNL mentioned. It will receive an SNL container and piracy to SNL document object. The DTD definition will be executed when pirating. There are also many ways to piracy SNL like as part document dataset.loadSNL and so on. In order to decrypt the huge problem caused by SSE, Microsoft recommends that users use SNL reader to read SNL test before loading and prohibit the piracy of external entity. Or upgrade to a higher version of the net framework which will not piracy external entity by default. But when we check SharePoint, we follow that. The dotnet version of SharePoint is photojello in SharePoint 2019 which means that we are likely to fight SSE vulnerability in it. Here is our fighting of SSE. The traditional vulnerabilities patterns can often bring supply without a message get public in content which will call SNL document.loadSNL. Like our example, it will literally content in the public in file and piracy as SNL content. Okay, let's take a quick look at the code state which appears to be accessible. We need to analyze the measurements. First, it will traverse all files in the slash catalog slash wp directly. We need to classify the files here in quotes or files in database and file systems because it is sp file which is a wrapper of the file object by SharePoint. Then looking for the file with the descent file then as parameter we set. Let it contain and pass it into load SNL. Including the visual file in the database is a good news. Users have enough permissions to upload such files on their website. If it can only read the files in the file systems, we are not be able to do anything. So therefore the first step in exploiting the vulnerability is to upload a sse file which shows it is sse.wp which contain sse payload. Note that the file need to end with .wp. But how to make the server related this file? Let's go back to the code state and take a closer look at the function in the live box. We notice that he has a special aptitude client callable. What does it represent here? It is similar to client callable mentioned we mentioned earlier but it is not the same. It means that we can call it with client-side SharePoint object model API. CSON sender for SharePoint client object model and it is used to instead update, delete and retrieve data in SharePoint. Microsoft provided various client object models like JavaScript models, SharePoint REST API, SharePoint.NET client object models. Then we want to use the last one, SharePoint.NET client object model. When we use debug tools to debug it, we found that every client callable function has a paired remote function. The calling process starts from the client code passes so the remote mentioned of the sender and then send the data to the server so SNL format. The server pairs the SNL and finds the policy mentioned of the corresponding mentioned so the invoke status mentions and finally falls to the client callable mentioned to complete the message call. Now we can start writing the second part of the exploiting, Clue the delete down of CSON and we need to pass the server URL and these users' credentials to get a client contest. Then use the contest to load the plugin file that we created before. And here we set it to SSE. Finally, we should call SQL query to package all the data and send the request which can trigger get public dimension as we wanted. After testing, this vulnerability can also work in SharePoint online. An example of reading window in SharePoint online and our demo of proof of concern is here. But if you notice that we call it SSE instead of Remote Call Execution because it is still 1% threat away from Remote Call Execution. We found that there is an unprecedented character in WebDoc config. According to the same test of the external entity, it will be considered as an entity definition but there is no specific name defined later. This will cause paraphrasing error and unable to read the content of WebDoc config normally. If someone can bypass this shortcoming for complete Remote Call Execution Explanation, please share your tips with us. Anyway, it is still an interesting bonus because it appears in SharePoint client code. Then we have discussed the security issues of the server side. They are often really powerful and don't need any user interaction. Next, we will assume that we have a user interaction. A big turn will open the URL you send in the SharePoint server, how to achieve an account takeover attack. SharePoint has a variety of user authentication measures including NTRN, FBA, OOS and so on. So let's check the FBA form basically authentication. Here is the login form and FBA is a form-based identity authentication. After the authentication is passed, SharePoint server will send a toolkit for users, RTFA and FedOS. If we obtain the toolkit of other users, we can fold user identities but the cookies have a TV-only spec so we can use JavaScript code to steal it directly. And users with decent cookies can access both admin panels and side collections if they have enough privileges. However, as we talked before, we don't trust on the JavaScript. We will introduce vulnerabilities that steal cookies or parameter binding. For these vulnerabilities, we need to solve a problem first. In addition to the request header, where does the toolkit exist? Can we get it? In Microsoft's documentation, a special value is recorded. IIS server variables provide information about the server deconnection with the client and the current request on the connection. IIS server variables are not designed as environment variables. Here is the value that we need HTTP Quickkit. Return the cookie string that was included with the request. Okay, we find another place to get cookies but it is a server values we need to bring it back to the page. When reading the sign articles, we notice that there is a special syntax called parameter binding. A resource can be brought to a parameter value in the current render SSL style shape. The parameter binding element includes a location attribute that specifies resource type. The syntax for this element is similar to the svdonate resource binding expression syntax. The location value is impressed as a function. We can use the location attribute to specify the values for context like query strings, server values, web part properties, control IDs, and so on. So, we can look at this process. When we send a request to the PLC page, the server will stop our cookie in HTTP Quickkit to try slow parameter binding and buy it to the data form of a part value and finally display it in the page. So, here is the proof of consent. We render the cookie back to the SSL value. Therefore, we have the ability to bring the cookies to the current site page. Then we can read the page slow down script without restrictions. Use SNL HTTP request to fetch the value of cookie and send it to our servers. And then check the server's request. You can see that all the cookies are sent contents, rtfa, and fitos that you can use to assign these side or big turns. So, here is our component of today's presentation. The above are all the vulnerabilities discussed in our showing. From the server to the client, we have studied many interesting tricks of SharePoint and most of the vulnerabilities are based on the permission we have to upload page. We're able to find many vulnerabilities in SharePoint because of the special use right. When you give users more permissions, your system is more dangerous. Users' great contents that can interact with server-side controls has the potential to cause some trusting violence. It is hard to build a strong enough filter to protect the systems. And multiple APIs give users different assessments and give an attack a large attack service for discovery tool. So, this is the end of our presentation. Thank you for your listening. Feel free to ask any questions.


Do you have a story where the situation seemed very, very doomed, like a good success story to tell us? There are so many different ways of looking at it. This is the perfect question for a narcissist. It's a perfect question for a psychopath if he was a psychopath. Because it's this, tell me your best hero story, where you were the hero, let me hear that one. And let me tell you, I was never in war, so I don't know about war stories. But this cat, he's got so many of these, he has to go through and think about which one he wants to tell for this specific situation. This is perfect for him. He's got the camera on him. He's already got this guy submissive. He knows where he's sitting in the situation.  Oh, it's Nirvana for one of those things, man, unbelievable. So I think we see him at his best here. I think it doesn't get any better for a narcissist than this.


Now, ahead of the 2023 General Elections political parties across Nigeria are working towards a successful primary election. The wife of the undosted governor, Betty Akreidolu, says she is the best candidate to represent Imo East Senatora Zeyn. Akreidolu, who presented herself to the APC Working Committee in Oweri, should party faithful of winning the main election for the party if given the chance to emerge as candidate for Imo East Senatora District. She expressed dismay over what she described as poor representation of the zone in the past, promising quality representation now, as well as a voice for the women's folk. Because of this kind of medication, there's no place I will not, my hands are the door that will not open, or I cannot interact with that person and make demands of build networks, build interpersonal relationships, blogging, and these are the qualities you need to be an effective blogger on Senatora. Senator Akreidolu, in conclusion, I know what it means capacity. Elections are capacity, finance are capacity. But I know we present a lot of time. We are brought to you at Oweri years ago. We saw the quality, the courage, the dexterity, the audacity, the vision. In those moments, my brother Akreidolu was very smart. He came for the best. And when I saw him, he came for the best. I'm also coming for the best.


On this episode of the anxious truth, we're going to talk about why making up recovery as you go along is a bad idea. So let's get rolling. Hello everybody, welcome back to the anxious truth. This is podcast episode number 194 entitled making up recovery as you go along is a bad idea. This episode is recorded on February 1st of 2022. If you are new to the podcast, I am Drulan Solada creator and host of the anxious truth. This is the podcast where we talk about all things anxiety and anxiety recovery. So if you're dealing with problems like panic attacks or panic disorder or gorophobia, this is the place for you. I'm happy that you're here. And of course, if you are a returning listener or viewer, then of course, I'm happy that you're still here. Thank you for spending time with me as always. This week, we're going to talk about the idea that making up your recovery sort of as you go along and not really having a plan or some structure is a bad idea. I'm going to give you three primary reasons why it's a bad idea to do that and why you should have a plan and why you should have some structure.  I resisted on an almost path, almost pathological level, but in my recovery, I had to come to grips with the fact that I needed a plan and I needed some structure. It helped me so much when I finally did that. Now, before we get into it, I want to remind you of a couple of things. The anxious truth is more than just this podcast episode. So if you're new and you just sort of stumbled upon because you search for anxiety podcast and you found me, there's way more than this. If you go to the anxious truth.com, you will find the three books that I have written on anxiety and anxiety recovery. You will find all of my social media stuff. You will find links to get me on Instagram and Twitter and Facebook and all that good stuff. So take advantage of all that. There's a ton of free information that I put out over the years. There are three great books. If you've been reading them and you liked them, maybe write a review on Amazon. And if you are not already subscribed to the anxious morning, which is my weekday morning anxiety recovery email newsletter, which is also a little mini podcast, go ahead and do that. You can go to the anxious morning.com and subscribe to that completely free. Everybody that is subscribed is loving it. It is probably the best work I've ever created in this space. I'm really proud of it. And I would urge you to take advantage of that for sure. The anxious morning. Okay, let's that out of the way. The housekeeping out of the way. Let's move on to today's topic. And that is why making up your recovery as you go along and not having a plan is a bad idea. Now, let me first acknowledge that putting a plan in place to do scary things repeatedly and intentionally and difficult things is not terribly easy.   Right.  First of all, recovery is about doing scary and difficult things that is so much of what kind of moves us forward. We don't want to do them, but we do. So the reason why having a plan becomes really important and injections injecting some structure into this. And let me just say that it doesn't have to be completely and utterly rigid. You don't have to schedule every minute of every day. And not every minute of every day has to be about recovery. That's a really common mistake that people make, especially in the beginning when they get excited about the stuff and they just, I'm going to recover. I'm going to do it right. I'm going to do all the things and listening to the podcast, reading my books, whatever. Life also happens. So we can't schedule every minute of your recovery, nor should we. Right. So not every minute of your day, even if you have a plan and a schedule in place has to be about recovery, you cannot recover during every waking moment that's not realistic. So just be careful as we go through this episode, be mindful of that and be careful about flowing into the traps trap where you think that every waking moment has to be about recovery, or that you have to actively be doing recovery things. If you are conscious and awake, that's not realistic. That would be very unkind to yourself because it's not doable and it doesn't have to be that way. So that being said, when we know that we have to consistently intentionally, incrementally do these scary and difficult things, we have to do our exposures, we have to do our ERP homework if you're working with an OCD therapist. We have to face the things that we've been avoiding. We have to get rid of all of our safety avoidance behaviors and crutches. We know we have to do this to get better. And it is the natural propensity of an anxious person, and I speak from experience here, to want to evaluate how you feel all the time. So you are probably stuck in a loop, most likely if you're listening to this or watching on YouTube, you are most likely stuck in a loop where you are constantly evaluating, scanning and evaluating how you're feeling and what you're thinking. So how you're feeling in any given moment is the single most important thing in the universe, most of the time for an anxious person, generally speaking. And this means that we will fall into the trap of deciding whether or not we are ready to do difficult things. Am I ready to do my exposures? How do I feel today? Do I feel like I can today? So if you do not have a plan in place and you wake up every morning and first evaluate sort of how you feel, how am I feeling today? Am I anxious today? Is it a good day? Is it a bad day? Is it going to be a bad day? Is it going to be a good day? You will make decisions in that moment as to whether or not you should do your exposures, whether you should do your homework, whether you should meet the challenges and go toward the fear. You will make those decisions based on the premise, based only on how you feel. Do I feel ready? Do I feel strong enough? Am I too afraid? Do I feel too weak? My legs are too shaky. I'm too nauseous. I feel dizzy today. I'm having all these scary thoughts today. You will put those in front of recovery on the priority scale, then you will almost by default fall into the trap of deciding to not do the things that will lead toward recovery because you won't feel like you can do them. I don't feel good today, so I shouldn't do these things today. That's a mistake. Recovery happens most when we do the difficult things, we do the exposures, we meet our challenges, we go toward fear consistently and incrementally, even when we don't feel like we can. Because the recovery process is at its heart all about learning that we always can even when we thought we couldn't. We were always safe even when we thought we weren't. So it is so important for you to be able to say, well, today I'm going to take my walk, I'm going to do my exposures, I'm doing my homework, I'm going to the dentist, I'm going shopping today, whatever it is, it doesn't matter how I feel. That is not going to enter into my decision making process, right? So it's really important to understand that. That is really an important thing to understand. And when you make a plan and have a plan in place, like, oh, no, this is what I am going to do. Apologies for the notification sounds. But I have my plan in place. This is what I am going to do today. Doesn't matter how I feel. I'm just going to do that. So it takes away that propensity to evaluate how you feel first before making your decisions. The second point is related to that. And that is in anxious and fearful moments, all human beings, not just people without anxiety problems, all human beings tend to be bad decision makers. So when the chips are down, when we are under the gun, we are in anxious, fearful, stressful situations, we make our decisions based almost always on just escaping that distress, right? So we are feeling distressed in that moment and under the gun and uncomfortable and afraid and all of those things. And so the decisions we make in those moments tend to be based almost entirely on how can I feel better right now?  I want how I feel to change right now. And the bad news is that when we do recovery things, we are kind of working in opposition to that. Recovery things are not about what will make me feel better now. They never are. They're not about feeling better now. They're about getting better later on the long term. So if you're going to wait until you are in an anxious state to decide what to do today, what should I do today? What exposure should I do today? What challenge should I meet today? How can I go forward today? If you have no plan and you have not already decided what today is going to look like, then if you wait in those moments, you will not want to make those decisions. You will make decisions based on short term relief as opposed to long term recovery.  While you're anxious, you're not going to make good recovery focus decisions. That's reason number two, why just waiting and making it up as you go along is a bad idea. And reason number three is one that most people don't realize. But again, this is probably this might be the most important one because we know, and we've talked about this before, that the lessons of recovery happen after the challenges, right?  The lessons really happen after the reaction after. What was that experience? Well, that was really unpleasant, but I was okay. I was really afraid, but nothing happened. I kept thinking I was going to pass out, but I didn't pass out. I kept thinking I was right on the edge of a psychotic break. But once again, I did not have a psychotic break. So that's the most important lesson. Reality shows us that the things that we feared the most don't happen. And those are the lessons that we have to take. Those are the recovery lessons and they happen after the fact.  If you're feeling particularly brave on Tuesday and a little bit more motivated, you might do a thing, but then you don't do another thing for another six days or another three days. Then you sort of do another random one and you call that exposure. That is going to lead you to into the other common trap, which is you will fail to take those lessons and you will begin to only evaluate your success and failure and your progress based on how you feel. Again, the anxious person is primarily concerned with how they feel all the time. And if you don't have a plan, you will default to that. Like, I don't know, am I making any progress? And everybody has those days where it feels like it's not working. It's going too slow. You're frustrated. You really want to get better right now. Everybody has that. That's normal. That's normal to feel that way. I wouldn't take that away from anybody. I used to feel that way too. I was impatient. I would get angry. I would get frustrated. Very normal. All human beings are going to experience that. That's okay. But without a plan, you have nothing to evaluate your progress by objectively. You will subjectively evaluate based on emotions and based on how you feel. I'm just feeling so scared today, so this must not be working. This isn't helping. It's not doing anything. Well, you didn't have a plan, so you were kind of making it up as you went along, which means you didn't really do the work consistently because you decided every morning whether or not you were ready or not so you weren't consistent. Then when you were kind of feeling like, okay, I know I need to do stuff, you were making decisions not based on a predetermined plan, but based on how you felt and trying to get immediate relief. And then when you did those things quite a scattershot once in a while when you felt like it, you have no way to evaluate other than, well, I felt really scared. I'm still scared. You know, I went to the supermarket three times in the last two weeks, but I'm still really scared. This isn't working. This exposure doesn't work for me. Very, very common mistake to make. Very common mistake to make. You forget that like, oh, wait a minute, I only have to evaluate my success and my failure, my progress based on what I do, not on how I feel. And the way to take away that subjectivity and the evaluation of your progress and your success and failure is to have a plan.  For instance, that was my plan. What's my success or failure? Did I do that plan? Yes, I did those things. Did I die? No. Did I go crazy? No. Did bad things happen to me? No. Done. Evaluation, you know, conclusion? Success. I did it. I did it. That's success. So you can judge that as a successful outing. But if you didn't have a plan, all you would know is, well, I don't know, I went out and I was really scared. And I didn't like it. And they almost panicked. And I panicked in the parking lot and I thought I was going to die. But no, the plan would say, what were you supposed to do today? I was supposed to go shopping with my mom. Did you do that? Yes, when then you win, right? So that's the third reason why we really care about having a plan and some structure. So I'm going to wrap it up. I'm not going to belabor this too much longer. But if you are in the habit of making this up as you go along, you are really kind of stepping into three traps that everybody steps into and making a plan and knowing at least a couple of days ahead of time. This is what I know I need to do. This is what I'm going to do on this day, this day, this day and this day, no matter how I feel. And then I don't have to make a decision when I'm anxious. The plan already tells me what to do. It's letting me off the hook. It's actually a very kind thing to do for yourself. Oh, I can make a decision without having to make it when I'm afraid. It was already made when I planned my schedule for the next three or four days. And then the evaluation afterwards, the plan said to do this, said the plan doesn't say anything about how you feel. I did that. And oh, when success, I executed the plan and it will help you get motivated to the next plan. So I would urge you to every few days at least make that plan a few days ahead of time at a minimum the night before for the next day at a minimum.  That's a good time to make your plan.   I'm going to take the kids to school. I'm going to finish reading that book. I'm going to take two walks around the block and I'm going to call a friend and catch up with them. That's my plan. Know that before you wake up so it doesn't matter how you feel when you wake up. You just do it because the plan says to do it. You don't have to make decisions about what to do with your day when you wake up anxious. The plan tells you what to do. It lets you off the hook, much kinder to yourself. And then after you do the things you can compare it against the objectives of the plan, which again will tell you, oh yes, I did those things and nothing bad happened to me. That's why we should not make it up as we go along. A plan might seem rigid. It might seem like this is crazy. How am I supposed to schedule mental health? It's a amorphous thing.   So consider this. Start to put a plan together. Understand that you should plan a day in advance, a few days in advance, a week in advance. You don't have to plan a year in advance, a month in advance, two weeks in advance. That's probably not right. But you can plan tomorrow tonight. So if you've never done this before, maybe start tonight. Sit down and decide when I wake up tomorrow, this is what I'm going to do tomorrow, no matter how I feel.  Did I do those things? I did. And you'll see that it starts to make a difference. Again, this may take you some time to get into the swing of it did for me because I hated doing it. But once I did do it, it really started to make a difference.  That is loaded with traps and pitfalls and start planning and adding a little bit more structure. It will matter. That's it. That is Episode 194. You can tell it's over because the music. So I am going to leave you guys with Afterglow by my friend Ben Drake. You can find Ben in his music at bendrakemusic.com. Check him out. Tell him I said hello. Awesome dude. Great song. Means a lot to both of us. And what else can I tell you? If you're watching this podcast on YouTube, hit the like button. Subscribe to the channel so you know when I've got new episodes and new videos coming out. If you're listening to the podcast on iTunes or Spotify or someplace where you can rate and review, leave a five star rating. Take a few minutes and write a review. It helps other people find the podcast. That's why I do this to help as many people as I can. So thank you again for taking your time and hanging out with me for these 15 minutes or so. Hopefully this has been helpful. We will be back again next week with another topic. I don't know what we're going to talk about, but we will be here. So thanks again for coming by and remember, this is the way.


When you are afraid to make content, when you are thinking about the judgment of certain people, who are you thinking of? When you think of that judgmental comment you might get, who is that? When you think of the judgmental look or the judgmental voice of somebody who might make you stop making your content, who is that? Well, let me say, here's the truth of this. That person and people like that are not your true fans. They are not the ones you should be making content for. And when they make a judgmental comment, which sometimes they might do, they are simply showing themselves to the world as a judgmental person. It's unfortunate that they reveal themselves that way, but that's what they do. You are not making content for them. Stop thinking of them. You know who I want you to think of? I want you to think of somebody for whom you can make no mistake. It doesn't matter what you do. It doesn't matter how unpolished you are. It doesn't matter if you make mistakes in what you say. If you forget what you're going to say. It doesn't matter if your writing isn't perfect. It doesn't matter if you got the facts wrong, but you tried anyway.  They still like it. They still really enjoy it. That is your true fan. And guess what? There are probably 10 to 20 to 30,000 of your true fans on the internet, but they just haven't met you yet.   So why are you thinking of the judgmental person? When you should be thinking of the person who's like, where is, you know, I'm just looking at some of the names here on the live video. Where is Michael? Where is Elena? Where are they? Where are you? They just haven't found, they haven't found you yet and they can't wait to find you. So being yourself is all that you need to be for them to love you. That's the amazing thing. And this is why I try to show up. It's just funny. I try to be as boring as I can because I don't mind losing some of you. Okay. Because it doesn't matter how boring I am. It doesn't matter how when I make mistakes, I lose my train of thought, I go in a different direction, I come back unpolished. Doesn't matter. My true fans stay with me. That's just, that's the definition of a true fan. It's not like you have to try to stay with me.  There are tons of people. When I first started, none of my friends and family were my true fans. Nobody cared. None of my friends and family bought my courses when I first started 11 years ago. None of my peak. I had to go out there and find true fans who then started to buy some of my courses and then they liked it and they kept going and they bought. That was, I had to go do that work and that's what I'm asking you to do as well. Now, of course, I have, if I'm really, really conservative, I have probably a couple dozen true fans who buy many of my courses. If I'm less conservative, I have a couple hundred true fans who buy a course from me every now and then, but they keep coming back. Every year, they might buy one or two or three or whatever and on my true fans every year, they buy five or six or whatever. But there's always a spectrum of fans. But you have, like I said, everybody has tens or 20,000 of them out there. You just haven't found this yet. And I want to tell you, even with my a few dozen true fans that I have, I make more than $100,000 a year.  I am in an extremely competitive industry. How many people do you know who do marketing and business experts? They're like, you throw a rock and you'll hit 10 marketing experts. There's so many of us out here, right? It's extremely competitive. And yet I make it work. I make more than $100,000 US dollars a year and it's been going 11 years straight now. So I'm sorry. First year, I didn't make 100,000. I always forget to say that second year. I did and then on and on and on. So I have been making good money for years and years and years with a few dozen true fans. And I feel like I'm just getting started. Like I barely got started. Like I said, all of us have at least 10,000 true fans on the internet. What are the, how did I come up with 10,000 true fans? Here's, here's how there are 4.5 billion people on the internet. 4.5 billion. Okay. And that's huge. And that's like so many people. You can't even imagine how many people on Facebook alone with ads. I just checked today. You can reach 2.1 billion people with Facebook ads. 2.1 billion people have seen a Facebook ad in the last 30 days by advertisers like me and like you. You can run Facebook ads too. Instagram ads, Facebook ads, all combined 2.1 billion people. 2.1 billion people, if I'm being super conservative, like 10% of those people, okay, that's, that's too broad. 1% of those people, 1% of people who are on Facebook ads, that's, that's small, but that's still too broad. One tenth of 1%, one hundredth of 1%, down to 10,000 people, 20,000 people, your true fans is not, it's not unrealistic to name that number. So they are looking for you. They're looking for somebody just like you. They will like the way you talk about your topic more than anybody else who talks about your topic. That's a definition of a true fan.  That's the wonderful thing. I hope this helps you get out there, forget the judgment of anybody else. Your current audience is probably not your true fans. Think about the ones who, for whom you could be, just be yourself and they will love you just for who you are because they're out there. They're looking for you. Go and be found by them. Go and you make content. Think of them. Think of them with their, with their just totally accepting and supportive and encouraging look or, you know, presence or comments or whatever. So I hope this helps. Be well.


Alright, good morning everybody. Our investigations into the alleged theft of two rings from an Indooroopilly jewellery shop on Friday are continuing. The circumstances surrounding this matter are very unusual and the procedures required to recover the rings have throughout presented a range of operational health and safety and welfare issues. The QPS consulted with medical practitioners regarding which procedures should be adopted to ensure the safety and wellbeing of the accused and those collecting the samples to be examined. A process using medical bags was used in an attempt to recover the rings. Recent medical tests have confirmed the presence of one ring inside the man who remains in police custody. The second ring remains outstanding after having been passed by the man and inadvertently disposed of. All attempts by the QPS to locate the ring so far have not been successful and at this time we do not expect it will be recovered. The circumstances surrounding the loss of the ring are the subject of an ongoing ethical standards command investigation. The QPS regrets this incident and will confidentially discuss matters of compensation with the owners of the ring and will explore and consider any further opportunities regarding compensation through the courts. QPS procedures in relation to this type of matter are the subject of ongoing urgent review to ensure that a similar loss of property does not occur in the future. Procedures for the collection of the second ring have already been amended accordingly. Happy to take questions, can I just say a couple of caveats on what I might be able to say. The first is obviously the matter of the original theft is before the court which will limit what I might be able to say and the second is that we have an ongoing ethical standards command investigation which has not finished and that will also have some impact on what I'm able to say. How have you changed procedures waiting for the second ring? We have decided we're going to use a specialist equipment that is available through our customs colleagues at the Brisbane airport. We're also urgently investigating the opportunity for us to install similar equipment in the Brisbane watch house here for our own use in the future. Is that a clear toilet? That's especially designed toilet to ensure that in these sorts of circumstances matter can't be passed covertly. No, we believe that it may have been inadvertently disposed of in one of two waste bags that were given to us by the prisoner and delivered as part of the normal waste collection from the Brisbane City watch house. So in short, the skin aside you lost it? Big part of it? You lost it? Yeah, it would appear at this stage that it's inadvertently been lost, yes. You mean those bags were searched? Yes. The officers involved in this were obviously confronted with some rare and unusual circumstances. They put procedures in place in good faith which they thought would lead to the recovery of these items. In hindsight it appears there's been a gap in these procedures and that's allowed the ring to be inadvertently lost. How were the bags disposed of? They put initially in a biohazard bin and then transferred to the general refuse bin at the watch house and collected on a daily basis by the contractor. Do you think Mark was new that he had passed one of them? It was about to say he was under the pressure. He would say he had delivered one bit of evidence. Yeah, that's still part of the ongoing ethical standards command investigation but one possibility is that he knew he had passed it and didn't alert police to that. The other possibility is he was unaware or unsure and they're the options. Just to clarify, was it not somebody's job to go through what had been passed and checked just in case? I mean was he to know to have gone through his own waste that there was a ring in there or would it not appear that it was somebody's job to do that? The responsibility for the collection and retention of exhibits always remains with the investigating police. They didn't go through it? Not at this occasion, no. Are you still able to allege using the X-ray for example that the two rings were in the accused possession? Absolutely. Without, let's say with the caveat that this matter is still before the court, this will have no detriment to the prosecution of this matter. We will still be able to recover one of the two rings and the X-ray is very clear that was taken on Friday night that there were two rings inside the accused person. Do you know what ring had been lost out of the two? No. Is there any possibility of him smuggling the ring out that the other visitors are in the market? No. He's had no visitor contact. He's been under constant CCTV surveillance throughout. We reviewed all of that footage, examined and searched every place that he has been, sells cars and are confident as we can be that the ring has unfortunately been inadvertently lost in the waste disposal process. Can somebody be stood down over this? Do you mind there was two tasks to find both rings and one being lost? Somebody's got to be held responsible. Well that's why we instigated an urgent and immediate ethical standards command investigation to look at all the circumstances of this, including whether there had been any possibility that the ring could have been stolen by any person. Very satisfied that hasn't occurred. When the internal investigations report is concluded we'll look at the recommendations then. Will he be taken to a customer's facility to use this new toilet? He has been for the last several days being taken to that customer's facility. How about for a couple of hours each day and then brought back? No, for the majority of the day, for as long as possible each day. Where is the customer's facility at? At the airport. How embarrassing is this for police this lot? It's not embarrassing at all for me because the office is concerned of acting in good faith. This is a rare and difficult set of circumstances. No one sets out to lose evidence. It's in the best interest of the investigating officers to retain all evidence. So they've done the best they could in the circumstances. Unfortunately, there was a gap in the processes they put in place. In hindsight, do you wish you'd kept the bags of each waste that had been passed to be able to go back through them, trawl through it? Absolutely. The benefit of hindsight is we look at all of our procedures and work out how we can do things better. That's... We've been doing policing for nearly 150 years in the state and it's a constant process of looking at circumstances and amending our procedures as we need to. Was it occupational health and safety that kept the officers from going through those bags? Those two bags, you believe the ring is presently? Well, there are obviously health and safety concerns that have to come into play with the treatment of matter like that, but there are options for the material to be examined offsite in other places. And that's what we'll be doing in the future if we have to, if we find ourselves in similar circumstances. How often do you engage with an alleged criminal in good faith? It seems a bit of a bizarre way. Well, that was a judgment call made by the investigating officers. They were closest to the case. They'd spoken to the man. They formed a judgment. They put a procedure in place. They thought it would be adequate. As I say, they acted in good faith. With the benefit of hindsight, there was just one step missing in the checking process which would have prevented this happening. So did he know we'd pass it? We're not 100% sure on that. So they thought he was cooperating and would retreat and return the ring. That's interesting. That's my understanding of the arrangements that were entered into originally, yes. Because he obviously has an interest in returning the rings. His bail is a conditional on it, so... And he... So what day did you think that actually happened? We think it happened over last weekend. What are doctors saying? Is he in good health? Is the ring stuck anywhere where it shouldn't be? He is in good health.  We're in contact with the doctors every day about next steps and how we can, you know, progress the procedure. And we're taking medical advice day by day. Has he been given a special diet to speed up the process? We take advice from the medical professionals, yes. And on a day-to-day basis, we look at what options can safely be employed with his consent to try and get to the point where, you know, the second ring is passed. How does this affect his bail conditions now? Obviously, you said that it was conditional that both of these rings were returned. One's now been lost. He appears often acting good faith with you. So he's a party to this going missing. Is this going to affect his case? Look, I can't comment on that specifically, but can I say that the responsibility, as I said earlier, the responsibility for the custody of the exhibits lies not with him, but with us? I don't have any information to that effect. Can you honestly be really clear that officers were expecting this man to tell them when he had passed the ring so they knew which bag to search and that's why they didn't search those bags? That was the arrangement that they entered into with this person, yes. But wouldn't it be clear in that process? Well, with the benefit of hindsight, it's easy to sit here and say, yes, we should have conducted a secondary search regardless, and that's one of the procedural gaps that we've now fixed. But it doesn't even seem that there's a benefit of hindsight, surely to be common sense that if a bike's passed something over to you, it could be in there. I'm sure he hasn't gone through it with his hands. They'll look that there probably needs to be some sort of x-ray to determine if there's a ring in there. I'm sure that's the case in Good Faith. They thought the procedures they put in place were adequate. We can now say with some certainty there was a gap in the procedures, which we've closed. As a senior officer, what is your opinion of this stuff? As I said before... You must be livid. As I said before, the officers acted in Good Faith. They have an interest in trying to recover the material. They did their job as they saw fit. And, say, with the benefit of hindsight, we'll do it in a different way. The customs, that arrangement of customs, has that been going on since he was arrested only in the last, in recent days? Customs and our federal colleagues, as you know, have far more experience in this field than we do. They deal with it on a far more regular basis.  For the Queensland Police, it's a relatively unusual circumstance. So has that been something that's only happened the last few days or after it was realised that the ring, that first ring went missing or in the face since he was arrested? No, we took him to the customs facility and started to make use of that once we became aware that the first ring was not there. Can you think of any other cases similar to this where the police have had to do anything like this? I don't know if drugs might have been or other stolen items or anything like that. Look, not in the QPS and not in recent memory of the QPS. This is more routine for our federal colleagues, as I say. The fact is, if the exhibit's been lost, that's not an unusual circumstance in itself. Exhibits occasionally go missing in a range of circumstances. This is rather unique in terms of the circumstances in which we find ourselves. He might be ordered to repay the owners to co-op and compensation for the last ring. We'll certainly look at our options. As I said, we are in discussions with the owners of the ring about whether they wish to make a claim on us in the future. If they do, we'll consider that on a confidential basis. But we retain our rights also in the criminal court process. This is a guy who stole the ring, allegedly, and then swallowed it. How can QPS be responsible for something that he did? We'll need to take legal advice on that. But, as I said, we do retain a responsibility for not only his safety and wellbeing while he's in our custody, but also the recovery and safe custody of exhibits, which is effectively what this is. It's a piece of evidence in the exhibit. I was just going to say, his whole cycle... I'm sure, without having spoken to him, that he probably regrets it based on all the circumstances so far. It's not a pleasant way to spend a week of your life, and it's not over yet. And for you, is this one of the stranger cases you've been involved in in your career? I would have to say, yeah, this is fairly unique. As I say, the QPS doesn't often get involved in cases where people have swallowed things to prevent evidence being recovered by us. That's more familiar in the federal sphere. So, yeah, it's pretty unusual for the QPS. Has this gentleman been observed as he's been passing the stool? I mean, has there been a third party there who's been watching what's been taking place? He's been under constant CCTV surveillance since he first came into the watch house. Is there a time, like I know earlier in the week, doctors were saying, but it wouldn't be unusual for it to take seven days to pass? We're in daily contact with medical authorities and the suspect, and we're reviewing it on a day-by-day basis. And one of the many possibilities might be that we may need to look at some more significant medical intervention, so we're just playing that out on a day-by-day basis. Like surgery? Possibly. What was your response when you learned of the losing of the ring? It was an unusual set of circumstances and that's why I ordered an immediate investigation by the ethical standards command just to get a full appreciation of what had happened since the time we took this suspect into custody until that time. Well, to make sure that there was no possibility that the ring had been stolen, and that's clearly not the case. When will that report be passed back to you when we know it's been completed? I'm hoping it will have a report within the next few weeks. There's no chance that the contract has finished it or it's gone missing on that end? No. We're fairly confident that it's probably under a huge amount of landfill at a refuse site and will not ever be recovered. What was the value of the ring? Well, the value of the ring is a confidential matter between ourselves and the owner. Are we talking more than ten? I'm sorry, I'm not able to speculate. And you are confident that this is going to have no bearing on prosecuting as well? Absolutely, I'm very confident that it will have no detrimental impact on the prosecution. Can I just get a confirmation of when he was taken to the AFP so the practice was changed? Not the AFP. Customs? That was on Wednesday. So you believe the ring went missing at the weekend? Yes. So it only became clear on Wednesday that the second ring was not there? It only became clear on Tuesday night that we had to get the man re-exrayed. He was complaining of cramps. So we had to re-exray late Tuesday night. That's when it became... That's when we had clear evidence that the second ring was not there and we've taken the steps I've outlined immediately after that. Why is it taken until today to notify the broader public? Because up until yesterday afternoon we were exploring all options to try and recover the ring, searches of all places, and we got to the point where we believed the ring is under landfill at a particular site. Yesterday afternoon we finally got some costings for a search of that site. So we knew that the costings for doing a search would be completely cost prohibitive and not in the public interest. So effectively at that point we had exhausted all of our opportunities to try and recover it. Can we ask what those costings were? Significantly more than the value of the ring. Thank you very much. Can we just get some cutaways? Thank you.


Alright, thank you so much. So our next session is with a very well-known, established, someone who has easily been on both sides of the fence, the ravishing, the most prominent name in the film industry today in the OTT space as well. Ms. Raveena Tandon, thank you so much for joining us on E4Mplay on this session. Thank you Rohail, it's a pleasure to be here with all of you. Pleasure. So the discussion would be around how you have easily transitioned from traditional cinema to OTT. Give me a sense of was it easy for you to make the shift and then you tasted success as well. How do you see it now? Well, you know, honestly, I don't think it is very, very difficult for an actor to or an artist to make the shift from big screen to the small screen or from the small screen onto a streaming platform because I think every, I can't speak generically for everybody so I will only speak for myself. I think my love affair is with the camera. So when the camera and the character are given to me in my hand and the minute action is said, it's me out there giving my best into that lens which is ultimately the medium which will be streamed, it could be streamed anywhere. It could be on the big screen, it could be streaming on a platform, it could be on TV. For me, it is that connect with the audience that matters. As an artist, am I giving my best to the character that has been given to me to play and am I reaching out to my audience and the way for me to reach out to my audience is through that camera and then ultimately through the medium from what it is going to be streamed ultimately or finally at. And that I think is very important for me as an actor to do is to be in love with my work and try to connect with my audience. Right, absolutely. Love with the camera is what the real acting is all about and really performance is all about. From the 90s to 2020s, when you look back, how would you define the shift that we have seen in cinema overall? Honestly, from the 90s to now we are in 2022. There definitely has been a strong evolution and I think it has only happened for the best. To a certain extent, there have always been a certain kind of competition to the big screen, to the cinema, whether it came in the form of DVDs or VCDs or different channels opening up on television or then now with the internet streaming that is happening and different platforms that are mushrooming every single day. But I think the love for the big screen and the magic of cinema will always stay on. But the plus point, the advantage that has been is that somehow OTT platforms including television to a certain extent has opened or broadened our horizons to different kind of cultures, different shows coming from different countries and their traditions and their stories and their way of storytelling. So to be honest, in the 90s, we only had the exposure if we went to film festivals to see an Iranian film or if we had to see a Russian film or a film from China. That is when we would get the opportunity to see these kinds of different films and different kinds of storytelling. But now everything at the tip of our fingers for the audience also, it's been an introduction and exposure and awareness of different kind of filmmaking that is there globally. So it has, I think to a certain extent, opened out different avenues for a lot of directors, a lot of actors who probably wanted to make experimental cinema but somehow could never muster up the not courage exactly, but muster up the opportunities or going beyond the pressures of the main box office to be able to showcase their talent and their work, which now everyone has these great opportunities because every kind of storytelling today has a certain audience. It might be a niche audience, but it is out there and you're not pressurized by okay, I only have three hours to put or two and a half hours to make this into a movie and show it out. Today you have the platforms that are there streaming this into people's homes and you can give them a different whatever the directors visualized or imagined or what he wanted to give to the audience. So I feel in that perspective, our cinema has actually opened up, we've broadened our horizons, we've got amazing amount of talent, new talent, talent like me who probably was there but then we were not getting the kind of opportunity that we wanted to showcase the kind of work that we could do. And Aranya today, thank God, God has been really kind, has done wonderfully well, but I don't know if Aranya could have been made into a movie. You see, so that is the kind of opportunities that have come everyone's way, which are great for our cinema. Right, I totally agree with you. I think the opportunities to experiment are far more greater than we had earlier with these new platforms coming in, which also push this point forward. I want to ask you about, we also always say that OTT will OTT great content has come, but a lot of people say that great content was always there is just that you've got an opportunity to showcase it differently. So what do you have to tell people who say that today cinema is more content driven? I think I kind of agree with that and I kind of disagree with that because we've always had a lot of movies which have had great content, we've had great content, even then we have it now. But I think like I said, every decade, I think you kind of evolve into a different kind of filmmaking, you go into a different zone according to what the audiences want as well. I can give you a prime example. If you see the film Andaz Apna Apna, at the time it was released, unfortunately it didn't make the kind of noise that it should have. But today it's a cult film with all the youngsters. So maybe that was a film before time. It's not that we didn't have the content, but it also at the given moment, did the audience accept that kind of comedy? No, they didn't. At that time of period, if I remember very clearly, a lot of films are being made with double meaning dialogues and a little bit of buffoonery which was being translated as comedy and those films are working. But when a straight faced, a simple clean family film with a comedy like Andaz Apna Apna came, people were like, oh, what is this? And then later on, it becomes a cult film. So there are times where you want to give that kind of content, but sometimes you are kind of, you know, your hands are tied. But I think even then and now we've had great movies and we have some great movies coming up as well even now. There's great cinema and there's great happening. So my question is, in the wake of great content, have face values and acting styles become redundant in any way? Rohil, if you ask me, I think both to a certain extent, just a certain extent, work hand in hand. It might and it might not also. So it's not necessary that a big name will definitely sell the film or will definitely sell the show, the web show. It also depends on the content. And if you ask me, there are so many times when big names have been taken into a show and unfortunately the show might have not done well, or it hasn't lived up to expectations, but there can be many factors to that. But again, for filmmakers, if they are making a show where they know that this established actor will bring credit onto the table and will definitely be able to get into the skin of the character and give them what they want, then I think that's just an added bonus. So it's nothing that you can say definitely. Like for example, I mean, if again, you take my show itself, Aranyaak, it's not that there are no other talented actors to have played Kasturi Dogra. But maybe there was something about my personality that you'll have to ask Rohan and Sid why, but somehow that they preferred to go with me on that. And then of course, there was Param and then there was Ashutoshji. So these are these, this was our bunch of, you know, established actors. Param has proved himself in so many films and shows that he's done. And you know that you've taken him half your battle is won. For a director also, it's half your battle is won because you know what he will deliver. Likewise with Ashutosh Ranaji, there is no two ways. If I was the director, there was no two ways I would have thought that he would not do justice to his role because he's proven himself. You know, so there is a plus and minus in everything. My next question, Raveena is about traditional cinema versus the OTT. A lot of critics say, they still say that, you know, traditional maybe, you know, written off, while others say that they have to coexist because there's a lot of stories to be told, a lot of talent to be featured. What is your take between this OTT versus traditional? First and foremost, I don't think in my opinion, I could be completely wrong. Again, I cannot generalize this answer. In my opinion, I think the lines have fused somehow. I think even our traditional cinema as to speak what you call, I think has evolved a lot. We've got great past baking, breaking stories that are coming out every second day. A lot of experimental cinema also happening and a lot of inclusive cinema that's happening. So it's not that, oh, it's only traditional and conservative and we are not going into, you know, not walking into the future. As far as OTT platforms are concerned, like I said, there is no debate whether OTT platform or cinema. I think each holds its own. Yes, you can experiment a lot more with OTT. But then I think the risk for both is equal, whether you make a film that is experimental and whether that works or not, there'll be losses to the producer, the distributors, the actors, to everybody. Likewise, even on an OTT platform, I think the risk taken is also with everyone investing so much besides their hard work and besides the emotions that are invested. Everyone has invested a certain part of themselves. So even that for not working also can be a chance. But yes, OTT, you just still have that little bit of, you know, especially for the filmmakers, the risk is not there of that box office pressure or of, you know, yes, you have a certain viewership for the OTT platform, but you always do also find your niche audience. So for me, I think when you see the shows that are being streamed in India, a lot of them also are, you know, they're a lot that are experimental, but also kind of sticking to, you know, basically, I think country-wise, which culture and what kind of stories that we like seeing. And likewise, I think our film producers and directors are doing the same. And if you really go to see a lot of our production houses from the film industry are making OTT shows as well. So for me, the lines have fused. There's no partitions, so to speak, really. Of course, I think a lot of action is happening in that space and things will keep on changing, which brings me to my last question followed by some quick rapid fire question that I have. What do you miss about the 90s? Honestly, nothing. The song and the dance, a bit of the song and the dance. I think music was great in the 90s. The 90s music was just even now so relatable.  And I mean, they had great melodies. Even at that time, we had some great albums. I miss, yes, probably the music part of it. I'm glad the other sensibilities have moved on from the 90s. But I do miss the music of the 90s. I definitely miss the 90s for sure. After the kind of shelf life and the way the songs connected that time, it was another different story altogether. All right, now we move on to our next conversation, which is rapid fire questions. All set, Raveena, for this. Here it up. Okay. Munna Bhai or Kali Bhai of Mirzapur. The lovable Munna Bhai. Aranya to me is the strength of a woman, Kasturi Dogra. Actors looking for work across OTT need to. Lovely. Who would you like to do an OTT film with? Your favorite OTT show is? Aranya to. Tip tip Barsha or Aakhiya se goli maare. Garmi ho mein tip tip Barsha Paani ki prathna hai. Ustadhi ki to Aakhiya se bhi goli maar sakta hai. Do hi jaane, Rajnikamji aur me jo Aakhiya se goli maar sakta hai. Isra, aajkar ghuske bhi maar sakta hai. Final, two more questions. The strength of a woman lies in her inner faith. Do le raja aur aakhiya se goli maare. Do le raja aur aakhiya se goli maare to do le raja, aakhiya se goli maare to do le raja mein tha to do le raja ki bhi kya aakhiya se goli maare nahi ho sakta hai. Aakhiya se goli maare to do hi jaane is poore desh mein aur industry mein. Ek Rajnikam sir aur ek me. Absolutely and that's a wrap. We can't wait to see you come attend the watch show and collect your big win for the night. Thank you so much for joining us. Thank you. Thank you for having me here.