Right, hello everybody. Sorry for those of you who are expecting the Cillium and Kubernetes talk. The gentleman is a new father, and so this is a talk I had pre-prepared for other conferences. I hope it will be of interest here today. So I'm Andy. I've done various different things. You could call it DevSecOps, but it's a disgraceful term. I think that is just an engineer position. I work at Control Plane, a container in Kubernetes security engineering firm. We find right now a lot of our work is educating people who've deployed containers. Their containers may not be entirely secured by default, but like everything else, are as secure as they're configured to be. So I want to talk about open source exploits, web server exploitation and how containers have impacted the exploits we've seen over the last few years. So open source exploits, vulnerabilities in open source code, and insecure containers. Do they contain? What can they contain? And how have they defended against major recent vulnerabilities? Our users expect their data is safe when they hand it over to us. So is it possible to protect all data? Surely our users deserve some level of privacy. And if we can't protect the data of code in the system, is it possible to protect all data? Well, if we travel down and specified untested code paths, as bugs are, then we can't be sure that that's secure. So is bug free code possible? And if not, is anything completely secure? Or to lower the bar, is anything completely secure from teenagers? So this talk is about security, the anatomy of some recent major open source vulnerabilities, how containers affect security models and defense from future vulnerabilities. Right, we'll go through some internet melting open source vulnerabilities with a focus, as I said, on web servers and containers and see what part containers had to play. So Heartbleed, catastrophic flaw in open SSL. A commonly used encryption library referred to as a modest code base of outsized importance. Considered theoretically unexploitable, Cloudflare opened the competition and within nine hours, people had retrieved their private keys from the shared memory of their servers. Affected 25 to 50% of major sites of disclosure and impacted Apache and Nginx, email servers, XMPP, SSL VPNs. It's a problem in SSL heartbeat handling. So heartbeat is a message used to keep a connection alive. And in this case, a user sends a question with an expected reply word and untrusted data containing the length of the word that they're sending. As we know, that should always be done server-side, never trust any client-supplied data. So in this case, when the client says hat, this is 500 letters long, then the server responds with hat and the next 500 bytes, well, the next 497 bytes of private memory. Memory that should never be leaked that may be containing encryption keys and obviously breaks the security model of open SSL. This attack can't be seen in the logs because it occurs at handshake time and the poor guy involved missed validating a variable containing a length. So it's a buffer overrun and it was discovered by fuzz testing with American Fuzzy Lop. For those of you who don't know, it's a genetic algorithm-based fuzzer and you provide it the source code, it instruments, recompiles and then significantly reduces the brute force problem space by intelligently attempting to make your program crash. Mitigation, update, open SSL. So how do containers help with a Heartbleed scenario? Well, they don't really. The host's memory was protected, but this attack is only leaking process memory anyway. Heartbleed is essentially indefensible with a container, but containers do help. Hopefully having a mutable deployment artifacts in a Swift CI pipeline means that the time to patch is significantly reduced over traditional configuration-managed systems. So in kernel and container terms, Heartbleed is like building a castle, securing the walls and then having the guards give away the secrets. On to the next vulnerability. Shellshock, a bash vulnerability allowing local privilege escalation. By adding code to a specially crafted environment variable, containing a function declaration and executing code out of the calling context. So Heartbleed leaks data, Shellshock can be used for privilege escalation. Some impact, CGI web apps, SSHD, DHCP clients, open VPN again and all Linux boxes, all BSD boxes and all post-1991 Unix deploys and Macs, basically the world for most of us here. Although Debian Ubuntu with dash as a default shell were actually not vulnerable. So here's a Shellshock call. The payload is encode, well it's just sitting in the user agent field. Obviously that's just a bash function with a no op and then whatever you want on the end, executes, as I say, out of context. That's obviously executed server side when called remotely over HTTP. At the lower half of this Burp Suite output demonstrates the contents of the past, in fact the contents of the previous ping ID and password. You'd only see this attack if you were logging all HTTP headers in your web server logs. The bug was in the initial implementation of function exporting and importing on which was written by Brian Fox on the 5th of August 1989. So this was before the web existed, HTTP existed or Linux had released Linux version one. So it would be incredible if this bug wasn't being exploited in the wild at some stage during those intervening 25 years. Loads of CVEs all associated with this bug, but of note is that it was eventually fixed by Florian Wymer of Red Hat and he said he found the bug after fuzzing with American Fuzzy Lop. So the mitigation again, upgrade, how do containers help against Shellshock? Well, they provide process isolation. So the escalation of privilege or the running of that untrusted code is only within the container's PID namespace. So as opposed to Heartbleeds, we're able to cushion the impact of the host by segregating the process namespace, segregating the process space that they're then able to run code in. So back to the castle, the perimeter is secure but this is like allowing Trojan horse in through the front door but locking it in the dungeons. It's safe, it's observable and once it gets out and starts trying to do its thing, it can be effectively shut down and terminated. So the next vulnerability, drown. TLS based attack, decrypting RSA with obsolete and weakened encryption. It's a protocol attack again and similar to Heartbleed can't be defended with containers. The problem here is old US export grade cryptography on symmetric ciphers, 33% of sites vulnerable at disclosure, the mitigation disable SSL version two if that was being run for some unusual reason and upgrade open SSL, rotating any secrets that may have been leaked. As a side note, there are a lot of TLS attacks that containers simply can't help with and why so many and why the cluster after May 2013, our friend Edward Snowden, a renewed vigor was placed upon examining the protocols and algorithms used for encryption, searching for back doors or intentionally introduced vulnerabilities. So, was this more secure for being open source? Well, given the cavalcade of academics and researchers required to find this particular attack, it was probably in the realm of nation state exploitation. Back to the castle, this is like securing the entrance to the castle with an obstacle and only allowing people over a narrow bridge and then turning a blind eye as the most is drained and continuing to trust it provides security. Can containers help? Well, this is a protocol attack. No amount of containers are going to protect us from broken protocol specifications. The only benefit we reap is being able once again to redeploy quickly. On to the next vulnerability, dirty cow was Linux kernel bug which allowed privilege escalation on every Linux kernel since July 2007.  And it's a race condition in the copy on write implementation in the kernel. Again, this is on every Linux device and embedded devices probably have no routes to upgrade. Exploitation of the bug doesn't leave anything unusual in the logs and the mitigation as with everything else is upgrade. So of notes, this bug was found in the wild by the researcher involved by packet capturing all traffic into his server. One of his sites was compromised. He was running this rolling packet capture. He extracts the vulnerable payload, reproduced it and submitted it back to the Linux kernel main lists. So how do containers help? Well, they couldn't contain this bug because the security subsystems that containers rely on are all kernel based subsystems. Containers rely on the kernel for protection, namespacing, C groups, invocation of further extensions. So if it's in the kernel, that's almost nothing they can do. We'll look at exactly why that is and what we can do to prevent, to protect ourselves against unknown vulnerabilities later. So back to the castle. It's like building a castle on the biggest rock you can find and then being surprised when someone burrows in underneath and steals the crown jewels. If the kernel lets the containers guard down, there's very little the container can do. We'll demonstrate this exploits in a moment. So a couple more vulnerabilities. Honorable mention to Cloudbleed, February 2017, an error in an HTML parser triggered the same error as heartbleed, buffer over read, private data leaked in HTML caches around the world. Probably could have been more secure of open source. There was a huge number of reads actually required to trigger this particular bug and potentially because Cloudflare will never quite reveal the intricacies of their internal development processes, we'll never know. And because it's been in slides already, Apache struts and Equifax, a simple example of failing to patch systems. Vulnerabilities will always exist but timely patch hygiene is imperative. Container networking policies may have helped here. We still don't know the full details but the AquaSec security team suggests that the data that was exfiltrated from Equifax was all done on the basis of one RCE. No pivots, just straight through all the way to the database. Obviously an application architected like that will be vulnerable almost no matter what. IDS, network policies, these sort of things are required. So again, without more information, it's difficult to say, still speculation at this point. So what these vulnerabilities have in common? Humans inevitably making mistakes and that will never cease. The people reporting a lot of these bugs were not part of the core project teams. So opening a project up and open sourcing it opens a huge pool of resources with demonstrable advantages. Fuzzing applications yields fantastic results. This should be performed whenever practical and containers are not a panacea. There are plenty of security exploits and vulnerabilities and application level protocol problems that cannot be fixed by namespacing and sandboxing application runtimes. Okay. Call to action for open source, review, fuzz other people's code. Donate to open source projects. Open SSL is horrendously overfunded, sorry, underfunded and overused comparatively. And as you've seen, people are migrating to other SSL libraries rather than trying to fix it. But we need some money in there. So finally, major vulnerabilities, kernel, TLS, remote execution for the last few years had no mitigation except upgrade. So let's demo a container breakout with Docker. This is potentially the most insane attack to demo because it relies on a race condition and I'll demo inside of VM and my CPU will be stepping that or actually on battery happily. But it's the most recent, serious breakout and potentially the most dangerous. Dirty Cow, as I said, was on all Linux versions since 2007 and all Docker versions. Because those Docker syscalls are going straight from the calling application through to the kernel, then there's nothing we can do inside the container itself. It's the container demon and the kernel that we rely on. So what this will do, let's cross, okay. Yeah, just wait for it to pop, everything. Is that all right? Well, there's gonna be a lot of data flowing, so we'll go through it once and then modify it if required. So what we've got here, so this is just a bit of bash to build a container image and we also popped some other windows. So the other Tmux tabs here, we use Sysdig to trace dead beef, which is the exploit name, hilariously. The file descriptor port one, two, three, four, that's because it's a copy on write bug exploitation. So the privilege of a piece of memory is changed and then Ptrace is used to try and write to the original piece of memory, exploiting a race condition. So writing to a piece of memory that root owns and then writing to it, one in every n, we will see a crash triggered. The ability to write some code is then written into the virtual dynamic shared object, which is mapped into all applications by the kernel. That bit of code then opens TCP connection back on port one, two, three, four, which is also running inside this container, mapped to the host and that will be the control channel. Then the next window will be dmessage so we can see what the kernel thinks is happening as this goes through and then the final window at the bottom will be watching this file temp.x, which is essentially used as a lock because this is a massively parallel attack. We're going from Debian, we're running the dirty cow VDSO and at this point, if we want to proceed, yes please. This is just to show that dirty cow is in fact matched to the kernel version. Do we want to run with app armor? Well, not in this case. I'm just going to make this a little bit smaller because there is a lot of outputs. Okay, so we can see the mAdvise call being filed off a lot of times. You'll notice that that barely increments in terms of time, ptrace call to attempt to write to that piece of memory and actually take control and write to it while it's still owned by root. And then this will carry on for quite some time. So at the bottom you see that we've got temp.x currently owned by root. And there we go, so the assisted call will continue for quite some time because of the volume of writes of syscalls there. But if we now just check who we are up here, then we're root and if we have a look at the process tree, we can see that somewhere up there will be the docker demon. We can see virtual box running in fact. So at this point, we started off inside a container. We ran an exploit that affected the kernel and the piece of shared code, the virtual dynamic shared object, used that to open a TCP connection as root back to our unproved container process and we are now root inside that box. So that's an example of the controls and measures the container puts around or the user's namespace in the C groups to put around a process being broken and we'll look at how to protect against that in a few minutes. In the meantime, let's shut all this down. Let's start it again. So we know we can't secure everything. We know there are problems in software development that will always generate bugs. And we know that nothing is entirely secure. The cost of formally specifying everything is very high and formal specifications can still contain bugs. And from an application perspective, security struggles to keep up with the cadence of delivery. The DevOps revolution means shipping software fast, sacrifices security, so unless we start to be penalized for insecure software, as Bruce Schneier suggested in front of Congress, then there is no incentive for the bottom line of these companies to prioritize security. Speed of shipping features is a competitive advantage and this is the case across IoT, phones, cars, wearables, everything. So we're not going to win by slowing down. So back to software. Is it possible to write bug-free code? Well, only with sufficient time and conformance to specification does not guarantee the absence of bugs. NIST has published an analysis of the state of the arts. This subject is quite broad, so we won't cover it now, but it's in the slides for posterity. Essentially measure software quality, efforts, people, be nice, make sure people are well-trained and if you're not measuring it, you can't improve it. There's also David Wheeler's secure programming how-to. It's a wonderful primer. So reducing bug count generally is one of the roots into this problem, but something that we can impact without the ability to change the application code itself is the architecture. So let's examine vendor best practices with regards to deploying containers. So where do containers excel? We know about these things, but is security one of those? Well, excluding the fact that integration with advanced kernel security features occurred rather late in the Docker lifecycle, are they bad at security? Well, not everything is names-based. We still don't have devices, Sys, bits of proc and dev. The demon runs his roots, so ultimately when we have one of these breakouts you saw similarly, we're escalating from a root-owned process. Rootless Run-C is coming, that's an open-source thing, got a guy called Lexus Sarai's doing a lot of work. It's about a year's worth of PRs gone in or time to merge, but a lot of changes, meaning that we can actually unshare namespaces without privilege and shared kernels, but we understand the compromises of isolation mechanisms, cloud providers run stacked containers and VMs anyway. So with the advent of things like Intel's Clear Containers, which is essentially a very thin KVM wrapper, or hypervisor wrapper, but able to plug into the OCI spec, sorry, the container runtime interface spec, then, and things like Cryo, in fact, then we can choose our execution environment for the level of trust we have for our specific container. So, the good, Docker specifically is actually configured to prevent a large number of attacks by default configuration. The reduction of attack surfaces inside a container, so the reduction of dependencies, does minimize the attack surface per container. It allows a more granular application of privilege or, in fact, capability to be assigned per process. Speed of deployment, so running fast CI pipelines immutably means that we can ship patches quickly. Content trust signing, this was touched upon earlier by Lenard, but actually addressing things cryptographically means that we can take manifests and know what we have. It means that we can do things like scan everything we know in production offline, so, for example, union FS file systems are able to scan the individual layers, a new CVE feed comes out, then re-scan everything without having to go and check exactly what we've got deployed, and native log drivers, so post-mortem analysis is easy. These are a list of events. This is a list of events that were prevented by default, not comprehensive, of course, but you'll notice that the ones that are not mitigated are all beneath the container in the kernel. So, how does Docker provide this security hardening? I'll run over these briefly, I'm sure we're mostly aware of these. Namespaces provide a different window into the kernel or whatever particular entity we're looking at, so processes running within the container cannot see processes without. They've been in the kernel since July 2008, for example, the PID namespace, any time a process starts, it's assigned a PID in both the master namespace and its own particular namespace. So, these exist for a number of different things. Now, the username space has been touched on already, username spaces V1 are, as Lenard said yesterday, incomplete. I think maybe they're almost not fit for purpose from the perspective of the way Docker uses them and preaches about them as a security model. There are very real dangers using a root user inside a container because you're mapped to the root outside the container and that affects anything because the Linux security model is based on users, it affects lots of things all the way up and down the system. Now, by extension, this is why this is a hard problem because we want to be able to share bits of data between different containers, we want to maintain the right permissions on files and processes. As it stands, there's probably still a few years work to go until this is a complete story. Username spaces are not on by default for Docker, they have to be activated with a command line flag when you start the demon and this is because they were only introduced around Docker 110, which means if that was on by default, suddenly a whole raft of containers prior to that would not function, all container images rather. So, mapping the root user to a non-root user outside the container really aids with mitigating the risk of container breakouts but it's something that is incumbent upon each administrator on his own system to actually configure correctly. So, control groups, another key feature of isolation, providing resource counting so things don't run away. They're now all mostly implemented in Docker, the store is not quite the same for Kubernetes which still doesn't have network IOPS or block IO properly accounted for but the story, again, is converging. C groups are obviously fair sharing of resources and prevention of denial of service. Again, there are questions around how users actually operate here, so Docker runtime, there's various things you can set when you run a Docker image, you can create a read-only file system, so obviously in a mutable container becomes more difficult to write to, however, this isn't mitigating all the attacks because if you can pull code, if you've got, say, if you've got bash and curl installed, then you can just pipe to bash and you're still executing code on the mutable file system. Pid limits and fork bomb proofing, of course, this is now dependent upon the user namespace story which isn't complete, so without setting these things, then you can effectively starve the resources of the host from inside a container. And security options, no new privileges, again, it's a case of ensuring that your application doesn't require an escalation of privilege for a certain operation before you're able to activate that option, but these are things that should be on by default. So kernel capabilities and process restrictions, capabilities give us a more fine-grained view into what root can do and avoids just a blanket application of all privilege, but the kernel has over 600 system calls, obviously a bug in any one of those could lead to a privilege escalation, so only those necessary for a container to do its job should be allowed. This can also protect us from dirty cow. In this case, dirty cow, like the exploit demonstrated there, relied on ptrace. Now ptrace has a lot of valid applications, including just listing out processes, so PS and S trace both rely on the system call. So again, a blanket drop of that would be inappropriate for some operations, but we'll move on to how you can actually run debugging tools outside a container by mounting all the relevant namespaces, and then perhaps we can drop all these debugging tools from our production applications, again, reducing the attack surface that we ship inside a container. So Docker's app armor profile to definitely allow us ptrace specifically for the reason of running PS inside the container. Docker actually drops a huge number of capabilities. The container bounding set on the left there is kind of getting off at 40%, which is beneficial in some ways, but of course it's not a comprehensive story. Not many people really run their own hardened kernels in production, so that's more of a hat tip than a recommendation. But security policies and whitelisting, Set Comp and App Armor are now both, and Desi Linux, are all integrated with Docker and Kubernetes. The problem there is one of utility. It's not generally easy to statically analyze or dynamically analyze a program and see its entire range of system calls without theoretically exposing it to all the potential actions it could perform. So there's some benefit there, but again, the user experience is not quite what it should be for the average administrator. All those things said, when surveyed and asked how many people use security policies, not really very many people, still less than 50% in production, this is the only way to really be sure that you've locked down what you expect your containers to do and should probably be higher. So kind of a wall of text here again, but I'll just go through some of them and then obviously these are in the slides for posterity. A note here is dropping to an unprivileged user, well that's just not running as root, but debug by attaching to relevant namespaces. So this means, for example, when you're running from scratch and you've just got a statically compiled binary sitting in, or if you're running a dynamic language, you only put your interpreter in there and whatever libraries you need. Don't install bash, don't install your OpenSSL libraries if you don't need those things and then run, in this case, busybox, but another container and attach into the namespaces of the containers that you're interested to. So this gives you the observability that you require. You can also run this debug Docker image as privileged to do whatever you need to do, but it's just going up for one time. It's only running while your namespaces open up for you to use it and you close it and everything shuts down again. It's the most secure way to debug things in production which invariably we need to do from time to time. Obviously, certain good binaries are the worst. Shouldn't use them.  They're just a way to ship tiles around and to run them because running as privileged puts you in the same namespace as the host for almost all the operations that your container performs. It also means, fundamentally, if you're in that privileged container as root, you can remount the host file system and then you've got right access to the host. So it's really, there is no protection at all and that should only be used in the knowledge that it's privileged as a way of shipping around binaries that may require that level of observability. For example, a lot of monitoring agents require privilege, sadly. So just good hygiene, drop all capabilities and just add back in the ones that you need. Running that through a CI pipeline where maybe your test suite wants with and wants without those capabilities is a good way of introducing that to a team who may not be kernel competent, if you like, or aware of the range of capabilities because there's a huge confusing amount. Enable these namespaces, well, that's the demon again. It's just called whitelists. So all these things are relatively obvious and securing a Docker host, that can be done with Docker Bench or QBench has an equivalent. Signing images, mandatory. So Moby here has decided to try and have another pop at the way we interact with kernel capabilities by introducing entitlements, which are loosely modeled on the IOS nature of entitlements. That is now available, actually. So you can now run Moby from head and essentially what that will do is it'll bake in a set of required permissions and privileges capabilities at a build time. And then when you run the container, the image, you have the option to give it a level of trust. So if it attempts to, for example, request privilege and you don't trust it and the container just won't start. This is, it looks like it's a nice way of bucketing up all the privileges that are normally just capsis admin. But it's yet to land, but it's something to keep an eye on. Kubernetes actually supports set comp now, so we could be far more granular. FS, sorry, runners non-routes, again, just mapping to a non-route user outside the pod that you're running in. And then there's some extra SD Linux bits and bobs in there. Kubernetes has got some strange insecure defaults while we're on the subject. At this point, this was a default service count mounted into every pod and up to one-six with the introduction of RBAC. That service token was administrator access to the API server. Very bizarre default choice. That is now fixed. As in that service count has less privileges, but RBAC configuration is mandatory for Kubernetes. I've got to keep the KubeLit ports locked down by TLS, otherwise you can also write in there.  Going back to the old adage that speed of delivery affects security. Right, so going back quickly to the demo, just demonstrate what it looks like to run the same attack. But this time, with the application of an app armor profile, we'll actually have a look at what that profile looks like. So, again, just have a look. It's a bit noisy, I apologize. So, run the app armor, yes please. So, what does this look like? Well, this is default Docker app armor profile. It's relatively sensible in most places, but this call here, so ptrace peer Docker default, that means if you're Docker, you can run ptrace. In this case, a quick fix for our problem is to just disable that call, and we'll have a look at how everything responds when we do that. So, we have just had a SIG kill and D-message hasn't actually shown us what we want, but nevertheless, that is app armor kicking in and terminating the process and generating, anyway, killing the process off. So, this is how you would ultimately configure all your applications, minimum set of privilege, and then anything that attempts to call, system call that's not permitted to do, SIG faults, and it's just shut down. So, how do we actually generate these security profiles? They are really quite painful, that requires intimate kernel level knowledge in order to identify what your application needs. The reference example is probably the SockShop demo down here. It's got good defaults for databases, web servers, and microservices. There's various different attempts to do this. All the major container-based IDS solutions will also do some sort of dynamic observation where they will whitelist these calls and generate a set comp profile for you under the hood. Got some quick slides here. They're probably less relevant to the interests of this group, but I've got five minutes, so I'll just whizz through them. CI is probably the escalation point that people want to go for, because it contains all your keys. So, there's some nifty tools you can use to, for example, prevent key leakage into Git hub, in this case. Git Secrets is your actual repo. The two of them search for entropy in strings and Git Secrets, the fixed-length strings, actually AWS keys, so probably are better used as a pair. Sock container scanning, this is focused on open-source stuff. There's some vendors listed later, but broadly, Clare is CoreOS' offering. This is integrated into their Quay Docker registry. It also runs open-source, and it will give you essentially the CVE numbers that you have, which types, in which layers of the images that you post to it. Linus gets a shout-out for old-school gritty aesthetic. Docker Scan is an interesting attempt to dynamically analyze who is running a container at runtime, which is a less obvious problem than it seems. It can do some nasty trojanning and back-during as well, so demonstrating the fact that you shouldn't trust anything you pull off the Docker Hub. Orel mentions OpenScap, which is folded into Red Hat right now, and Banyan's older. So Docker Bench Security will essentially enumerate the configuration options of Docker on your host, and make sure you haven't left any glaring, wide-open mistakes in there, so there's things like default U-limit. It could actually be more brutal and fail a lot harder, but it just operates in more of an advisory capacity at the moment. Obviously, your application dependencies are a likely point of escalation as well. There are some nice plugins. Snick's really nice. That will actually pull requests for vulnerable dependencies and transitive dependencies on GitHub. It's currently only JS and Ruby right now. Obviously, AFL is the mother of all fuzzers. Just go through stuff there, and also there's no point securing all these things if we allow our web applications to have RCEs and open up an attack surface for people to get into our containers and actually do harm. So how do we stay secure? Well, ultimately, intrusion detection systems mandatory. There's a whole host of container native stuff available now, which is namespace-aware. As I said, we monitor system calls either in Sysdig's case. They've just launched Sysdig's secure products, which requires a kernel module to be compiled into all your systems. Your security guys might not like that. Mine don't.  Falco has now actually been folded into Sysdig's secure, but it's the open-source version and twist lock and aqua come very highly recommended. So is anything inherently secure? Well, obviously not. Is open-source software more secure than proprietary? Well, no one really tells us any of these things. Open-source vendors disclose everything. Close-source vendors live through obscurity and tell us nothing. But fundamentally, open-source is secure enough for our needs as demonstrated by its adoption in major enterprises and governments around the world. So this talk has been about exploits that are scary, shiny, hopefully some more interesting, but they're not the only way that people get hacked. The OWASP top 10, it's actually becoming OWASP 2017 right now as soon as they can stop infighting, is the definitive list of various application-level problems that we need to fix going forward, running consistent security scanning in the pipeline and ensuring that the base level that we set does not slip. These are boring, dull, and omnipresent. And application security is just as important as network security and user security. OWASP now recommend essentially pentesting is dead and that we should be constantly testing the security of our systems. So in conclusion, prepare for the unexpected, secure your networks, secure your application code, secure your users' browsers, and when all else fails, run intrusion detection systems. Thank you very much. So we have about one minute left, any questions? Okay, well then, thanks again for your talk. Cheers.


privilege and a great personal pleasure to welcome you to our country and to this, our capital city. Only a year ago, President Kennedy brought to you and to your countrymen the goodwill and the good wishes which we of the United States feel so strongly for Costa Rica. Today, your visit symbolizes anew the growing strength of the friendly and cordial bonds between our countries. More than 100 years ago, representatives of your country and mine signed a treaty in which it was declared. There shall be perpetual amity between the United States and the Republic of Costa Rica. We can be proud in both our lands that the promise of those prophetic words has been fulfilled through all the years since 1851. We have worked together in the past with the spirit of mutual understanding and cooperation. We work together in that same spirit today. As good neighbors should, servicemen of the United States are today working side by side with Costa Ricans to ease the threat of floods in your country. But our common vision and our common hopes bring us together in greater enterprises for the betterment of the common future of all Americans. The work of the Alliance for Progress, which President Kennedy began, goes forward with growing momentum among all the good neighbors of this hemisphere. In your country, Mr. President, on the joint efforts of the Alliance, new homes and new schools are being built. Textbooks are being produced. Loans are being extended to farmers. The 12 million inhabitants of the five countries of Central America are benefiting from the common market that your countries are building. We are deeply gratified by the promise that this undertaking so clearly offers. As President Kennedy said when he visited your capital last year, the unique inter-American system of international cooperation is now demonstrating in this hemisphere that economic prosperity is the handmaiden of political liberty. The work all of us are in together, all free Americans in this new world, is a great enterprise that's filled with difficulty and challenge. But it is an enterprise befitting the revolutionary spirit of our peoples and their quest for independence and their search for social justice. We of the United States, Mr. President, are steadfast in our conviction and in our determination that we shall succeed in achieving the goals of our great alliance for progress. I am proud, Mr. President, to welcome you to the United States this morning as a fellow American, as a fellow partner in our hemispheric alliance, and as a fellow worker in the cause of peace and all mankind. Mr. President, Mr. Johnson, I am grateful for the warmth and generosity of your welcome. As you have so well said, there is a perpetual enmity between our countries. It has been expressed in countless ways over many years. You have our deep gratitude for the most recent manifestation of your enmity, the generous help of the United States in assisting my government and my country in meeting the great crisis resulting from the volcanic eruption of Mount Hirashu. In the area covered by floods or your magnificent CBSR, as you said, Mr. President, working side by side and shoulder to shoulder with Costa Ricans. This is a true meaning of perpetual enmity, the friendship of good neighborhoods who stand truly to help each other in their hour of disasters. The alliance for progress is indeed, as you point out, Mr. President, the supreme example of perpetual enmity which unites the hemisphere. What is more than that as you have widely perceived, the alliance unites us because it represents a philosophy of human dignity. In our preoccupation with the technical and social problems of development, we are prone to forget that the final objectives of our efforts is man himself. We need bridge. We need roads. We need regression systems. And we need a vast catalog of other scenes. But why shall these things have provided us if we forget to practice effective democracy? If we lose respect of human rights, if we sacrifice man's freedom at the price of economic accomplishments, we fight hunger, disease, and illiteracy under the banner of the alliance for progress. But let us always be mindful that the allocation of these courses of mankind are only the means to reach the end of man's struggle. The right of the people, the ordinary people, to be heard, the right of the people to be respected, the right of the people to become citizens of their countries instead of being very faceless inhabitants. It is my hope and pleasure that you are, that in your lifetime, Mr. President, and mine, we shall witness the fulfillment of Boliva's dream, political unification. And that the legislator of the North Central and South America will sit side by side in the parliament of the hemisphere. Mr. President, thank you again for your warm welcome. It is a great pleasure to visit again my second home as the guest of a good neighbor and fellow American whose leadership of the Continental Alliance is respected and admired throughout the Western Hemisphere.


So, to get the evening going, I would request Chairman and Editor-in-Chief, Exchange for Media Group Mr. Anurag Bhattra to please join me on stage and welcome all of you. Come on, let's welcome him with a round of applause. Here he is. Thank you, Zinnia. It's the first event of the new year. So, I wish all of you a very happy new year and while this is an event about digital, I wish you mindfulness and spending less time on digital, but making the most of the time you spend on digital. So, you've got to strike a balance at least. I've posed a lot. I was telling Mr. Basim that I should get an award for tagging him in most posts. So, I'm saying this more to myself, less to you, but on this happy note, let me welcome you to the second edition of the Densu Ages Network E4M digital report. The fact that Mr. Rajiv Verma is there, it's 14th year at Eshti and he's transformed Hindustan times and he's done many initiatives, launched Bombay, launched Mint, grown the radio business, grown the language. The fact that he's made time to be at a digital event tells you that all media owners understand that the digital is an opportunity you cannot miss and spending more and more time in understanding and learning that. So, first of all, I'd like to thank Mr. Rajiv Basim and the whole Densu Ages Network for building a fantastic media network in India and partnering with Exchange for Media to do this because the amount of interest in digital is overwhelming. Just to give you a number, the IDMA, the Indian Digital Media Awards, which will be in the eighth year this year, gets about thousand entries. The average entry in any other awards is about 400. Some awards is 200 entries. The mobile awards that we do, mobile marketing awards, gets 250 entries. So, if you take digital in the, Mr. Nayak, good to see you. Thank you for being here. Gets about 1,250 to 1,250 entries. So, digital in mobile is where the growth is, where the optimism is. I don't want to take away the thunder that Mr. Basim will present in the second edition of the Densu Ages Network Exchange for Media Digital Advertising Report, but I want to give you three top lines. One, I want to show you a small slide. It just gives you, Amisha, can you project that? What happens in one second on the Internet? I mean, just, this is huge. And I'm not counting what Trump does. That's another story by itself. So, we all have become digital natives. The second point I want to mention is that, Mr. Basim will talk about it in his report, is that digital is growing by three times than any other media. So, it's the fastest growing media. The last point is that digital over the next three years will be 24% of the advertising pie. So, digital will be about 20,000 crores or 80,000 crores. That in three years, the advertising industry will be. Now, 20,000 crores is a lot. I hope the only thing I want to say is that we welcome, we are a country unlike China, which has welcomed Google, Facebook and every other platform. But I hope that the Indian digital players, and you know, one shouldn't distinguish between Indian, it's about, it's a free market. But I hope Indian media owners are able to, because if you look at where we are at about 13,000 crores, 85% of that is Google and Facebook. So, I hope that what we learn from Mr. Basim and all the leaders, like Mr. Nayak, Mr. Verma, the young leaders who work in digital-only companies, we're able to implement and we're able to get a significant pie. Just to give you a simile, yesterday we had the Indian Magazine Congress and Rajdeep was speaking there, I loved his address, and Rajdeep talked about the fact that he compared print to a test game and he compared one day to a, you know, news channel like a daily product and he compared digital to a 2020 game. And the fact is that the Indian media publishers have what it takes to be relevant to audiences, to engage with them because we've got the legacy. You know, look at Hindustan Times or look at what colors are built in the last 10 years. We have legacy brands, we have Stature, most of the brands have Stature, you know. Third, we have the unique content in each of the brand and fourth, as professionals at companies, we have the skill to be able to develop solutions and creatives and ideas that brands love. So I hope we are able to make the transition from being a single-form media player to a multi-form digital-led mobile-led. We've been talking about this for five years at least, but I think today is the time when we have to think of digital as the first business because I think what I have seen in business world is we tend to think of print as our primary business because we are protecting the revenues of today and we don't spend enough time and enough learning curve on the digital. I think in the last three months I've told myself I don't run a print media company, I run a digital company telling the starting of a journey. So I hope today we are able to go back with ideas and learning that helps us build at least 7,000 crores out of that 20,000 crores should be Indian companies. And that's my only, I'm sure Google and Facebook will do well, that I'm assuming and Twitter and every other player. It's also budget time for all of us in the business media space. That's a very, very important time when the digital peaks. And again I was told yesterday by Nawa that when Star is selling its rights, the cricket rights, it's looking at 150 crores. Last year the sponsor paid 62 crores and the standalone digital sponsorship was about 20 crores last year. If you take that 62 and 20 that is 82 crores, so why the 150 crores? And this year they're putting about 40 crores to digital as value. Now that's how digital is growing because numbers can give you a picture that nothing else can give you. So I wish all the media owners, agency partners and clients all the best in engaging with consumers and building ideas and initiatives that work. We at Exchange for Media will be at the forefront of bringing those ideas and lead us to you. Thank you for partnering with us and I look forward to learning more things about digital today. God bless you.


Yes, welcome back to Why in the Morning and this is our first segment of the day and Studio with me is a gentleman by the name George Bush, not the one that took the troops to Iraq, but Kenyan one. So Bush is a graduate of computer science and information technology, but due to lack of employment, he decided to find a way for himself and this is the outcome. Very beautiful indeed. He has an art gallery in Kiambo County in Georgia in particular and is here to share a story with us. Karibusana, Mr. George Bush. Thank you. All right, your camera is number four. Just in case you missed anything in the intro, introduce yourself. Thank you for having me this morning. As you've heard, my name is George Bush and I'm an artist. That's the title I go by right now, IT specialist or computer scientist. No, that's a plan B, that's a side hustle. That's a side hustle. Yeah, right now. In most cases, people have like a formal job and then artists side hustle, but this is the hustle for you. Yeah. All right. So I want you to take me back to before you went into college to study computer science. Is this what you wanted to do? Actually no. Not what you wanted to do. No. All right. Let me take a wild guess. Your parents wanted you to study computer science or study something pertaining to technology so you can get a good job? Actually we have a free will at home. So it's basically you have to just study. You get a degree, you get a good job basically. That's what your parents wanted for you. So you go into school to study computer science, you learn a little bit of coding here and there. Yeah. Do you still code by the way? Yes. I'm doing too because it's a side hustle. There's a project I'm working on. Some tech I want to build for cars. All right. Yeah. Some tech you want to build for cars. Yeah. All right. So are you planning to fuse that technology with the art that you're doing by the way? Yeah, sure thing. Yeah. Sure thing. How is this going for you in there? What is the plan? So far recently I was studying the JUMIA platform, how they work with the different suppliers to meet customer demands. So I was just thinking about the similar thing with artworks. With artworks. Yeah, but. So we managed to see a platform for a marketplace for art. Yeah, sure thing. All right. And bidding. And we managed to see artwork going for as high as a million dollars like we see in the US and Europe. Yeah. All right. So let's focus on it. What's your style of art? Actually, I just go with the creativity, you know, maybe a good example is this table. Just seeing it and I was, an idea has just popped. I probably can do something with this. With this table. All right. So when you talk about this table, are you talking in terms of painting something or just making it look chic and arty? Arty. The whole thing is, wow, when you look at something, of course it's a table, but you want to be like, wow. All right. So you get inspired by the world, so I can tell, by your environment. And that's how we get pieces like this. So this is a painting and that's a string art. That is the great legend, Mr. Bob himself. Are you a fan of Ricky? No, my brother is. Your brother is. So this is something you did for your brother as a result of hanging out with your brother so much. All right. So let's talk about this particular painting. What went into this right here? Let's start with the concept of having a couple in black, a silhouette of a couple, an umbrella. The umbrella is not really covering the heads. The umbrella covering the heads are like, like vertically, it's covering the heads on the side. Yeah. So what is happening here? The whole idea was trying to create a romantic, you know, something romantic.  Express an emotion. Yeah. And this is an emotion that everybody goes through. Yeah. Including yourself. Yeah. All right. Like the texture around here, I feel like even a blind person can touch this piece and just get a feel of it. What kind of material did you use around this?  So it's basically an emotion, you know, amongst all the crazy stuff going on in the world, there's always a happy place. Yeah, there is. So there's darkness, then it gets lighter, then it gets lighter, and then this is a happy place. A happy place is, you know, it's human to human. When we get to that level, me and you without all the titles or the crazy things going on. That's the happy place. No, that's a happy place. But this represents all the crazy things that are going on in the world. Using a glue gun to come up with the darkness and everything else, is this a textbook way of doing things? Have you seen somebody do this before? I'm a big fan of DIYs, because I've also made some furniture and some other things, so I don't limit my creativity to just canvas. I try to, you know, maybe I might surprise you one day, I come up with an old school vintage classica, you know, built from scratch and all that, so I don't tend to limit myself to something.  Your art is limitless. So maybe if we come to an exhibition by Bush, there might be paintings on this side, we might be having furniture on this side, we might be having string art on this side. Lump sheets. Lump sheets and things like that. Alright, so how many hours a day for you? It's eight to five job. It's an eight to five job. It's an eight to five job. Yeah, that's how I treat it. But you turn the hobby to a job. Yeah. Y254 channel on Twitter, Y254 underscore channel on Instagram, and Y254 on Facebook, George Bush is in the building, the founder, CEO and founder of Bush Concepts. Yeah. Alright, so I'm interested in the string art. This, you use nails, strings, and wood, basically. Yeah. Alright, how do you get to convert the idea of a face or the impression of a face in your head to nails, to nailing first and combining the strings so that I can see it and say this is Bob Marley, right? What I do is my background, my IT background helps me to, maybe I can take a photo of you and then you posterize it. Yeah. There are many apps that can give you that effect. And then for those who don't know how to draw or sketch, you know, you can just print it and then you can do the nails, outline, and then you can do the strings.  Exactly. Digitally. Yeah.   It was not a waste of your time. Actually, no. It was not a waste of your time. It wasn't a waste of time. Alright, between that period that you finished school and you started your own art gallery and company and started experimenting with art, what was going on in your life at that particular time? Because so many people go through that face and it's a difficult face. Some of them even end up committing suicide. I think with all this, I'm recovering from a depression and it wasn't easy, you know.  And when you walk out of that door and everyone is like, ah man, how are you doing? I'm good. You're good. But in the house, you're hiding. But I'm hiding. And there's so much pressure coming for moments. Yeah, true. So during this phase, what kept you grounded? What kept you from taking the next step? There's this particular day I was on my balcony, that was last year.  The worst thing right now, the best thing right now is me being in a coma and then wake up when at least life has moved on. And all these people don't exist and the pressure is all gone. So I walked out of the door and I was like, God, you know, you own me, right? I was like, God, you own me and today I'm okay if you take me.  And that very day things changed, you know.  You should sell this. You should be serious with this. You should be. And then I sold my first ring art. Actually it's, the client came from the United States, we never even met. So it was through a friend of friend. And I felt if I sold my first artwork, then the world hasn't seen the best of me yet. So I thought, let me go back to what I'm familiar with. And that's my childhood. I could do art, I could make stuff, I could. So right now, let me live my childhood life, but I get paid for it. So that's how Bush concepts started. So boys will always be your boys. Sure. All right. So, wow, wow, wow. All right. So you never went through therapy. No. It was self therapy. You just had to sit and talk to yourself. Talk to Bush. Yeah, talk to Bush. Criticize Bush. Hate Bush. And then forgive Bush. Yeah. And then move on with Bush. Yeah. We have a piece here on the screen. This is a lion. This is one of the big five. This is one of our biggest exports as a country. And you've given it a different form. A lion is never blue. A lion is never yellow. A lion is never green. A lion has never, ever, ever, ever been white, I think. But you have painted this. You've painted a lion in this way. What inspired this? This is an inspiration that I got from one of the artists. They used to pass. If I got a shop, there's a friend who gave me some space where I could do some IT stuff, you know, fix iPhones and laptops. So before I took artwork seriously. So he passed and told me, like, you should come to our studio. So I just went. I found him doing this similar piece of art. So I thought, okay, I've never painted on canvas. I want to try. And I want to beat him. I want to do it like, you know. You were motivated. That perfect piece. It took me two months to finish this. Right now it's in Kitui County, the county offices. And the inspiration is, you know, the world. All the colors in the world, I tried to squeeze them there. And it's called a pop art. You know, when you look at it, it just pops with colors. Sure. I'm pretty sure the offices of Kitui County, I really fought them because of that piece. So Kenyatta Trust, you've sold another piece to Kenyatta Trust, which is transforming lives. And they've transformed your life as well. How did this come to play? Actually, this was, the Kenyatta Trust was, it's because of my brother. The Kenyatta Trust took him to high school, paid for him. And they're still looking after some many other more kids, because we were victims of post-election violence. So, you know, that economical stability we didn't have. So they took my brother in. It was a victim as well.  We are together in Bush Concepts. We all paint. We all do art. So he went and told them they don't have jobs, you know, and they could use anything around, you know, not necessarily what we've studied for. So I told him instead, take these artworks to them. We don't want to look like we're begging or asking for something, you know. Everyone is. Let's do it differently. Let's sell them art. And yeah. All right. So your brother, it's you and your brother at Bush Concepts. Yeah, Bush Concepts. And there is a third-born, Job Sunday. He's the one who is on, you know, the program. All right. So you are the person who pushes the envelopes. You look like the person who does the pushing of the envelopes. Yeah, of course. As a first-born, you know, it's something you can't run away from, you know. So you just have to. All right.  I'm not a first-born. So I don't understand. Yeah.  They know Bush is the tough guy, you know, but yeah. So you have to be, you know, the image. How has this helped you in this corporate side of life? Okay. I can say basically confidence in my product and the future, because I have a feeling it's bigger than what I see right now.  It's bigger than the Bush concepts. And I just can't tell. All right. Being a victim of post-election violence, like myself, so I try to use my talent and my voice to actually educate people and just let them know that politics can be done in a different way. We can always disagree to agree sometimes, because politics, you are bound to disagree. Yeah, true. You can't have 40 million people agreeing on one thing, but there are different ways of handling things. How are you using your art for the sake of this country, not to go back to a dark age like that? Okay. Right now, as you know, any nation that has the younger generation, you know, there are no jobs, and we are the majority. And now you can imagine right now if, God forbid, if it was to happen again, we'll be the most hit. So at my studio, what I try to do is try to avoid, you know, you come from this tribe, you're this and this, you're this and this. So when we all merge under that roof, we're just artists. It's a tribe of artists. Yeah, we don't care where you come from. You just come. You're people first. Yeah, we're people. And I think that's the best thing to do. Let's be human. Let's be... Let's just forget about all this. What's the painting saying? This is Zody. What is the painting saying? So let the darkness just exist somewhere in the galaxy. Yeah, somewhere else. On Earth, let's just have this. Yeah, let's just have this. That's simple there. Wonderful. What is this on screen right now? This is a mirror. It's a concept I was trying. Yeah, bush concepts. Actually, I didn't tell you. Bush concepts is concepts that come from the bush. It's not bush.  So there's a mirror. And yeah, these pieces on the side, these are wastes. So there's a friend called Dan at the same place we have a studio. He sells mirrors and glasses.  So it's on my wall, actually, and I've already sold one piece on that very day. So yeah, more is to come. So you can get a mirror custom made for you by Bush Concept. Yeah. All right. So the ones on the sides are wastes. Yeah, they're wastes. Yeah. So recycling is also taking place under Bush Concept. Yeah. Excuse me. So do you cut glasses while at the studio? Dan does it for me because it's a way of creating employment. All right. So you outsource some things. Yeah, you don't have to do everything, but you have to be keen on the costs so that I can be able to sell it because I'm around J-Quad. So students, I can't sell crazy prizes to the students. So I try to do the budgeting and still make Dan a good job. Put some money in Dan's pockets. I love this so much. So the big question is always, how do you market your product? Creating the product is one thing, but getting it to the consumer is always the biggest part of the equation when it comes to business. Yeah. So good thing is on August we have an exhibition. So we try to go to these exhibitions and create. So Jujja artists, we have an exhibition coming this August. So that's one way we use, we invite people to the exhibitions. They get to experience your art. Yeah. In the process they can tell somebody, they can take pictures, post it, in the process they can also buy. Yeah. And they can also get to interact with you as an artist, not just by my painting. And also, of course, the biggest influence is social media and online platform. Yes, we're living in a very beautiful age right now. You can do your business online and you can sell anything online as well. Anywhere. So social media exhibitions are the way for you right now.  What's that?  Alright. And doing amazing pieces as well. That is a marketing tool. Alright, please remind them of your social media and now they can find you as we carry on. You can find me on Facebook at Bush Concepts, yeah, so basically pretty much I'm big on Facebook. So Instagram, they are coming soon, basically under the same name, Bush Concepts. Bush Concepts. Yeah. Coming soon. Alright, so as we wrap this up, there are no jobs, we've talked about that for sure. This is Entrepreneurship Tuesday and yes, people complain so much and people get on our Facebook saying they want to do some jobs for us. What can you tell that person who's waiting on a job to put some money in their own pockets and feed themselves?  Instead of complaining about it.  You find that thing, that gap, that thing. Even if it's the government that should be supposed to be doing that thing, you can make money off that thing. You try and sell it, that's what I'm trying. That's what you're trying. Thank you very much, Mr. Bush, for coming through to Y in the morning, we appreciate you so much. So how, what is the location of the gallery? It's in Kiambo County, Georgia, just next to Senate Hotel, yeah, that's a long bigger road. There are some stalls there, you can't miss them. You can't miss them. Yeah, blue and yellow, yeah, so stall number eight, that's why you'll find Bush concepts. That's why you'll find Bush concepts, all right, when is the next exhibition? That is on August, yeah. So I think I'll fill you in on the details. So they follow Bush concepts on Facebook, like the page, follow, follow, follow, and dates will be on Bush concepts. Yeah, and also bring ideas, bring ideas. It's Bush concepts. It's Bush concepts. Yeah. Thank you very much for coming through to Y in the morning. Mr. Bush, keep doing what you're doing, we appreciate you so much. And be sure to follow Bush concepts on Facebook, like the page, and support Kenyan art, and just experience art. So her, this is where we get a question from one of our viewers. And our viewer, her here goes by the name Ishmael. And Ishmael is asking, how do you price pieces of art? Because it doesn't get the concept of how this can cost 100,000 Kenyan shillings, and this can cost 10,000. And sometimes they look more or less the same. Yeah. Okay, one thing is originality, as artists, we try to identify ourselves with our techniques, what you do. So that basically prices something. The work you put into something, like the painting that you're holding, that determines the pricing. And also, who are you selling to? That also determines. How they appreciate the artwork. Because there's someone who'll offer even more. Because of how it makes him or her feel. How it is all about how you feel. And how you see it. How you see it. And how you feel it. How you see it and how you feel it. Thank you very much for that. And the last one here is, what are some of your inspirations when it comes to painters or artists? Da Vinci. Mostly because he used to combine... I can say he wasn't an artist, the painter-painter. But the idea that he... He was an architect. He was an engineer. He was so many things. He's just so many things.  This marks the end of this segment. Thank you very much Bush for coming. We appreciate you so much. Keep doing what you're doing. And sometime in August we'll have an exhibition, my Bush concepts. Yeah. Bush concepts on Facebook. Like the page. Follow the page to get more info. And just support Kenyan Art. And just appreciate Kenyan Art. I go by the name of Barry Moses. Or it's Barry Mone if you're a social media platform. Enjoy. And Alex will be coming up with other interviews. You don't want to miss this. Don't touch that doubt.