speed to the Poseidon adventure. Now this is a tale of how we tested one cruise ship over the course of one week. There were two of us on the vessel, me and a colleague, six engines on this ship. It's quite a big one. There was a seven meter swell. Now the weather got quite rough at one point, at which point I found out my colleague was actually quite seasick. Yeah it was pretty rough to be honest. There were 500 Wi-Fi access points distributed across the ship, 500 CCTV cameras, 1,200 crew and over 2,000 passengers. So this is really really quite a big place. And there were of course a pile of vulnerabilities, some of which I'm going to tell you about now. So what is on a brand new cruise ship? Well it's not only a ship obviously but it's also a hotel. It's got to perform all those hotel functions. You've got shopping malls, you've got shops, you've got restaurants, you've got all of these different things going on, taking payments and so on. And lots lots more when you think about it. When we break it down a bit further we've got the off-board communication. So we've got visa, iridium and fleet broadband, things like that, the ship's radio. We've got physical security. So how do we stop people getting onto the bridge, into the machine rooms, into the engine room? We've got to keep the navigation systems up to date and secure so the ship can navigate safely. You've got all the networking equipment spread across the vessel doing both passenger and industrial control side to things. You've got the load computer and the load monitoring systems to make sure that the stability of the vessel is good. You've got all the ICS equipment, you're going to have a crew network. People can browse the internet on their laptops and phones when they're away from home for long periods of time and it just gets complex really really fast. The attack surface is huge. So a modern cruise ship, and this isn't the one we tested it's just an image, is divided up into vertical fire zones. Now these are both fire and water type barriers. The idea is if there's a fire or a hole in the vessel, it's still safe. So that fire can't spread quickly and water can't get from one compartment to another. Now why is this relevant to us? Well it drives how the network is designed. So the network is divided up into fire zones. So we've got something called an RDP, a remote distribution point. It's essentially a very very large rack of Cisco gear. There'll be multiple ones of these per fire zone. Now for each fire zone we need to split that network out into other ones. So what we have are things called cabin switches. So we've got multiple loops of cabin switches on each RDP. So these cabin switches are connected via wide ethernet. The RDPs are connected via fiber. So we'll have big big loops of cabin switches, maybe 10 or 20 cabins. So each RDP will have multiple loops on it. Now to provide a degree of redundancy they actually have port and starboard side RDPs as well. So they're all connected via a fiber network. Now of course as well you're going to have servers. So you've got things like the TV, you've got the Wi-Fi access, you've got the V-SAT so you can gain access to the internet when you're on the vessel. So this is kind of what it looks like. It's divided up into these fire zones and you've got this massive loop of RDPs connected via fiber with lots of cabin switches connected in loops. Now this is what one of those RDPs looks like. This is half of one of them. So you can see the sheer scale here. Bear in mind each pair of ethernet cables coming out there it's actually going through a loop of cabins. So when you think about the sheer scale of this it really is quite huge. Now to look into one of those loops in more detail I've broken one of those cabin switches out. Now there'll be a cabin and we've got IPTV. So you can watch the TV in your cabin and some of it's streamed from servers. There's live broadcasts of the shows on the ship. That will be done over IP and it's on a VLAN and it's connected into the cabin. You've got a VoIP phone as well so that's another network connection into the cabin. But then the really interesting one to me was the cabin control system and that controls the lighting. It controls the HVAC or the air conditioning. It controls the door, the access control and it controls the hot water as well. It's really important that you heat the water up beyond a certain point periodically to prevent Legionnaires' disease on ships. Now that's quite a lot of control. The reason they have it is when the cabins are not occupied they can turn the lights off. They can turn the HVAC down so that they're not using as much energy and yeah it's an important system. Now each cabin switch actually worked on a pair of cabins A and B. They were almost identical in almost all situations. But some cabin switches also had other networks hanging off them. So they had Wi-Fi access points, 500 Wi-Fi access points that were distributed across the vessel. Ships are made of metal which means you have to have a lot of access points to have good coverage. But we also had all of the CCTV cameras. What that means is that that trunk that flows through the cabin switches contains the TV, the VoIP, the cabin control, the Wi-Fi and the CCTV. So it's quite an important trunk network. So what is the threat model here? Well I've called this talk Speed 2. Why did I call it Speed 2? Well I don't know if you've seen Speed 2 but in Speed 2 an engineer of the shipping company on the vessel, on sailing on it, take control. He also kills the captain but we're going to ignore that bit. He takes control of the ship and he programs it to crash into another ship. So the important thing here is the attacker was already on board. It's not always a remote attack we're worried about here. When you regularly invite 2,000 people onto your ship there's a chance that some of them might be malicious. Now they might not be malicious enough to crash the ship into another ship but they still might want to do bad things. So what are the risks? Well Speed 2 highlighted control of the vessel. Now if you've got physical access to the controls on a ship you can nearly always take control of it. But the thing is the crew should nearly always be able to stop that. Despite the fact that all of this fancy control systems connect everything together, you can nearly always take manual control of things. You can at least stop them. You can always take control of certain things. So control of the vessel also needs a fairly strong motivation. For an attacker to want to steer a ship into another ship, particularly one with 2,000 people on it, they've got to have a screw loose. So although the impact of this is huge the likelihood is probably quite low. But the other thing that cruise companies are worried about is loss of passenger services. So if everybody's suddenly locked out of their cabin and has to visit guest services that's 2,000 people queuing up to get new access cards. If the ship can't sail from a port or the ship can't dock at a port, they're going to have to pay you money. If people can't pay for things in the shop, if they can't order in the restaurant it costs the cruise company money. And this is what we were trying to investigate mainly on this test. What impact could be caused by impacting the passengers? I'm going to talk about a few issues here. The first one, the satisfying Wi-Fi. Now there was guest Wi-Fi on this ship. So these access points were spread about the vessel. Now they gave access to the corporate network. They gave access to the passenger management system that we'll talk about later. But they also had the guest Wi-Fi. Now we could connect to that obviously and then we could start exploring the network. Now one of the first things that we do when we connect to a guest network like this is we do a trace route. And we did a trace route out to Google DNS. And what we could see was the first few ping times were 25 milliseconds give or take. Which means we're on the vessel. The ones after that jump up to 700 plus milliseconds. That means we've gone over that Vsat link. Vsat satellite connections are latent. So we know those first three steps in the routes are on the vessel. So we decided to explore them in more detail. And what we found was in fact that second to last hop allowed us access to equipment in the Vsat RAG. So from the guest Wi-Fi we connect through to the Vsat RAG. Now we've worked a lot on Vsat equipment in the past. So we know the default passwords for most of the bits of equipment. So we found that we could log into the modem. We found that we could log into the router. So we could log into the modem. Now the modem tunnels all traffic on and off the vessel. What my colleague did was spent a period of time looking at the firmware examining how that device operated. And what he found was that he could gain root access to that device. So now we've got root access on a device that all of the off-board traffic is going in and out of. We could therefore intercept it. So we could intercept everything going on off the vessel. So any credentials in plain text anything unencrypted was ours to see. So this is quite a serious problem. Especially as we could do it from anywhere on the guest Wi-Fi. So the problem here was the passenger Wi-Fi had access to the Vsat equipment. There were default passwords on the Vsat equipment. There was a vulnerability that allowed root access which allowed us to intercept all off-board traffic. Now the thing was this could be solved at multiple stages. The network could be altered so that the passenger Wi-Fi couldn't access all of these management interfaces on those devices. The Vsat installer, a third party, could have changed the passwords on those so that they couldn't just trivially guess them. The vendor could have not had a vulnerability in their device which could have prevented us doing this. But you'll notice I mentioned the third party there. All of the Vsat equipment is installed by a third party not the cruise company. So that will come in back in a few a few vulnerabilities.  Now one of the most important things for safety of a ship is stability. So you've got to make sure that the fluid levels in all of your tanks keep the vessel stable. So if you ride too high in the water you could be unstable. If you ride too low in the water the ship's inefficient. If you put too much stress on the hull the ship could become unsafe. Now ships are hugely complex now and you can't do these calculations on paper. So you use something called a load computer and this will take readings from all the tanks around the vessels. It will take things like the passenger manifest. It will take things like the stores telling you how much food, beer, wine is on board and it will calculate if the vessel's stable or not and tell you what to do to make it stable. Now it's vital for a modern ship that this is there and we managed to compromise it in this instance. But not only compromise the load computer but you also managed to cause a denial of service to bridge systems that were important for day-to-day operations. Now most of these ships have something called an integrated control and monitoring system. So that's all the screens on the bridge that's all the screens and HMIs all the PLCs down in the engine room. So it glues all of the industrial equipment on that ship together. So that'll be the power, the generators, the propulsion, the rudder, everything is glued together by this massive system. Now it's a blend of IP and serial networks like you'd see in most industrial control systems. Now ideally it should be segregated. There should be an air gap between those two of them. So we've got the passenger network on one side and we've got the bridge network on the other. But quite often we find that this gets eroded by changes that are made by third parties. Now when we look into the bridge system in a bit more detail we've got the IP devices so the PCs driving the screens and so on but they also need to interact with serial connected devices. So that'll be things like GPS anemometers, speed loggers, all of these different bits of equipment but it also has to interact with the ballast tank monitoring system, the fuel tank monitoring system and the whole stress monitoring system. So you've got these things called IP to serial converters. They go from an IP network through to a serial network RS232, RS485, Modbus, something like that. So you can interact with these serial devices. They look like this. So on one side you've got Ethernet coming in, on the other side you've got Serial. There's lots and lots of different brands. Moxer are probably one of the most popular ones. If you've done any industrial control system work you'll recognise these. Now you remember I mentioned the load computer. Now that has to get those readings from the ballast tanks and the fuel tanks. So how does it do that? Well they've got a load computer server that's buried in a machine room and it's got its own IP to serial converter that connects into one of the serial networks that's on the bridge that interacts with all of these different monitoring systems. Now to actually use the load computer there's got to be a UI which is another computer set up on the bridge. So you've got a problem. How do you connect the two of them together? Now if you've ever worked on a ship you can't just go drilling holes through the floor. You can't just make holes in walls. You've got to go through specific cable penetrations and then put fire ceiling around it, change requests. It's really really awkward. So if you've got to go down three decks you probably don't want to have to run a cable. Now this load computer was installed by third party and what they found was that they could plug into any wall port and connect together. So that load computer server down in a machine room there's a wall port near it. They plugged into it. They plugged the load computer into another wall port on the bridge and they found they could connect to each other. So they used it. That's a lot easier than making a hole through multiple decks. Now on this vessel what happened was if you plugged into a wall port, if you had an 8021x certificate for the corporate network and 8021x certificate for the PMS you'd gain access to that network. But if you didn't you ended up in a tar pit, a specific VLAN and a specific network that didn't have internet access, didn't have access to other networks on the ship but it was its own network and devices could communicate with each other. So this was what the load computer company exploited. They found they could just plug in, get tar pitted and communicate but that becomes a bit of a problem because me as an attacker I can come along and I can plug into a wall port in the bar. I can plug into a wall port next to the swimming pool and I gain access to that same tar pit. So now I had access to the load computer, UI and server. Now we tested ships with this same load computer system on it before and what we found was there's a default username and password stored in an any file. Now with physical access to the machine of course you can read that username and password. A big problem on ships is that you can't lock computers on the bridge because they've got to be used and got to be used quickly. You can't be remembering a complex password, typing it in to gain access to something so they stay unlocked. So we found this default username and password on a previous test. With that what we could do was connect to that load computer server. We could then pivot through it to take control of the IP to serial converter. Now you've got those ballast tank levels, the fuel tanks, the whole stress monitoring system and I've now got the ability to inject messages onto there. Now serial networks have got a bit of an issue here. You can just generally spoof messages. If the ballast tank's sending out a message of a given type you can send out another message of the same type onto that serial network and there's no way to tell that you've been spoofing that. The problem here is of course is the bridge systems will trust that data. So what we found is we could inject our own ballast tank levels, our own fuel tank levels onto this system. So the problem here, the load computer system needed a network connection and the third party found that arbitrary wall ports connected together so they used them. That meant the load computer was accessible from any wall port. A shared password that we learned on a previous test allowed us to gain access to that load computer. We could pivot to the IP to serial converter, we could inject tank readings onto the control network and then we could spam the bridge ICMS. We could spam all of the screens on the bridge giving them wrong ballast tank readings. Now what is the ICMS going to do when it's receiving two different readings? It's going to probably toggle between the two. There might be some filtering but sometimes if you spam twice as fast, sometimes if you change how those the messages are being sent. The thing here is when you're on the bridge you want to concentrate on navigating, you want to concentrate on safety. If suddenly you're getting loads and loads of alarm showing up saying that a fuel tank's empty, that a ballast tank's full, that something's leaking that would be really bad. It distracts the navigators on the bridge. So it causes a denial of service to certain services. It might be the case that when this happens someone would have to go around and do something called manual tank dippings. You actually dip a weight with a string into the tanks to find out how much is in them. It becomes time consuming so something you want to avoid. Now issue three, time and tide wait for no VLAN. Yeah he's punter bad sorry. Now coming back to the idea of the cabin switch it's got that black trunk network flowing through it that's got all of these TV, VoIP phones, Wi-Fi, all of these different VLANs that are quite interesting to us as an attacker. Now the problem is this cabin switch was located in the passageway, the corridor between the cabins. They're quite narrow on a cruise ship so I had to open a panel, I had to open the box it was in, I had to then physically unscrew the switch and then connect to it to mess about with it. Now the problem with this is 500 CCTV cameras, people walking up and down the passageways, you're getting in the way you're going to get noticed. So we thought well what can we do to make this easier? What can we do to access this from our cabin? So coming back just down to one individual cabin what we did first off was we disconnected our TV and VoIP phone. So we just unplugged the Ethernet cables from the back of them. We then went to the the cabinet in the wall in the passageway and we bridged directly onto the trunk with those cables so we took our cabin switch out of the network. So it was feeding into our cabin via this structured cabling that was already installed. We then put our own switch into that loop. So now we were part of that VLAN trunk, we were connected in that big loop. What that meant was we could intercept all of the traffic flying about that VLAN and we could connect to all of the devices on those VLANs as well. So this gave us a lot of power. We found out the TVs had default passwords. We couldn't really do much apart from stopping them working though. The VoIP phones again default passwords, we could change their settings so they didn't work. The Wi-Fi was actually really quite secure, there wasn't much we could do to that. The CCTV however, the CCTV VMS, the video management system, connected out to all of the cameras using RTSP which is a plain text protocol. Now there was authentication, the cameras did require login, but we could intercept as well as connect to the cameras. So we could see the password flying about in the network which meant we could connect to all of the cameras on the ship and view all of them without just from the comfort of our own cabins. So this was a bit of an issue. Now coming back to that cabin control system that does the lighting, the HVAC door and water. Now most systems like this that have got hundreds of nodes will connect back to a server so they make a connection from the device through to the server. This one was a bit weird though. It worked the other way around. The cabin control server established connections out to the cabin controls in the cabins. This was this was a bit weird, but what that meant was we didn't have to compromise the cabin control server to interact with the cabin controls. We were on the VLAN that they were all on. So we could come along with our switch and we could actually compromise all of the cabin controls. So we could turn the lights on and off, we could mess about with the air con, we could lock people out their cabins, we could even open doors on the accessibility cabins, the ones with automated doors. Quite a lot of power. Again you're impacting the passengers, you're costing them, you're making them uncomfortable, which means they're going to complain it's going to cost you money. The other thing we thought would be amusing would be writing something on the side of the ship. Now some ships have this functionality where through the cabin control system you can actually write things on the side of the vessel. This isn't the one we tested, but it'd be great to write something on the side of a ship that big. The other problem with this cabin control system was that the switches were physically accessible to us. Now of course we had to be in the passage way, but there's an attack that we carry out against switches quite a lot of the time. Now it does require physical access. Most Cisco switches have something called password recovery mode. What that means is you can reboot it and through the serial console on it you can dump the existing config file off it. The idea of this mode is that you can change the password if you've forgotten it with physical access, but we're relying on dumping the config off a device and it containing interesting information. Now it contains things like what VLANs are there, it will also contain hashes or possibly even encrypted versions of the passwords. So we managed to dump a config off one of the cabin control switches. It took about two or three minutes to get this, which isn't too bad, and they were hashed passwords. We put them on our cracking rig. It took I think about two days of effort to recover the password. Now the password wasn't bad, it was a reasonably good password. I mean I know two days isn't too long, but it wasn't Cisco, it wasn't ship. And we tried that against the the cabin switches, but none of them had a network logon, so you could plug into them by serial and connect, but that's not particularly bad. However, remember we've got access to this trunk, which means we've got access to those RDPs, and what we found was one of the RDPs had left its management interface exposed to the trunks that we could access. And that RDP had left the web interface enabled. That username and password recovered from one cabin switch worked on that single RDP. Now it turns out that during commissioning that single RDP hadn't fully been commissioned, so they hadn't changed the password on it. We gained access to that RDP and that allowed us to intercept all of the traffic on that fiber trunk. So it wasn't just the things on the cabin switch loops anymore, it was pretty much everything on the vessel outside of the ICMS, the industrial control systems. So these VLAN trunks run all over the ship and you can connect from inside the cabin using the TV and phone cables. And it allows access to many many systems, but it also allows sniffing to get any plain text orth, so not using HTTPS actually had impact here. The cabin switches had that brute forceful password and that password worked on just one part of the core network. That allowed us to intercept all of the VLAN trunks. So we've got a pretty significant compromise here. Now this was just an omission and it did take quite a lot of effort to get to this point, but it was a problem, a vulnerability. Issue four, I'm the captain now. Now if you've been on a cruise recently you'll probably notice that a lot of the crew will carry tablets. So when you muster, if there's a safety drill, they'll be taking muster on a tablet. If you order in one of the restaurants it will be on a tablet. If they come to your room with room service they will have a tablet.  It does cabin assignment, it does access control, so quite often it'll be linked into the access control system so that your card works on your cabin. It does restaurant booking and the billing in the restaurant, it does mustering, and it also can hold your passport details for immigration. It's kind of core to how the vessel operates. Now what we found was all of the tablets on this vessel used 8021X certificates for the Wi-Fi and the tablets were actually quite well hardened. We couldn't get anything off them easily, so we can get those certificates to gain access to the Wi-Fi. And we could have spent time doing something to possibly route one of the tablets or gain the credits from somewhere else. But remember, we've got access to every VLAN on the vessel, including the VLAN that carries the Wi-Fi traffic from all of the tablets, and we can intercept that traffic, which is what we did. So we found that the tablets, although they're using 8021X, that was actually implemented by the cruise company. They decided they wanted to layer that security on top. However, the PMS used HTTP. There was no encryption between the tablets and the server that let us sniff credentials and other things going backwards and forwards. What we found of course was that there was a SQL server which was passing its username and password in the plane across this network. So once we gained access to those VLAN trunks, we could get this username and password. We could then add our own user into the passenger management system, and we could pretty much do what we want. So I could book myself into the best restaurant on the ship and not have to pay for it, for example. But perhaps more fun was we actually worked out how to log in as the captain on this system. So we could go to the restaurant, we could order the most expensive bottle of wine, and we could bill it to the captain. So this isn't good really. You know, this is a serious impact. The PMS had good Wi-Fi security that was put in place by the cruise company, but the PMS vendor used HTTP for the communications. It just wasn't secure enough. We've covered those common SQL creds. We've not managed to test them on any other ships. They could be the same across other ships, and with that we could become anyone. We could write details. We could order things in restaurants. It's pretty crazy. So I think we pretty comprehensively owned this ship. It was a really, really good fun test. So what is the conclusion here? Well, these attacks did require detailed knowledge. We had to be on the vessel. We had to have a good level of understanding. We weren't really strictly detected.  So you might be able to sniff traffic and things like that, but you've only got limited amount bandwidth to send that back to a sock. So no one really noticed us. We dressed smartly, and the couple of times that people noticed us opening cabinets and things like that, no one said anything. Now interestingly, most of the risks on this ship were actually introduced by third parties. The cruise company had done a lot to secure those networks, but it was third parties putting systems in and making mistakes and not doing security properly that introduced most risks. Now for a ship, denial of service is very costly. If you can stop a cruise ship leaving its berth, especially in one of the smaller ports where there's only one or two berths and another ship's waiting to come in, the port can charge you huge sums of money. We're talking tens or even possibly hundreds of thousands of dollars per day. You've got passengers complaining. You're going to possibly have to reschedule flights, get hotels for people. Your next cruise may be delayed. So causing any denial of service, whether that's locking people out their cabins or stopping the ship sailing, can cost you huge sums of money. So don't always think about it as steering another ship into another ship. Think about how you can impact the passengers. But lastly, cruise ships are massive amounts of fun. It's rare that you'd be able to explore such huge complex machines with such level of detail. Definitely one of the most fun tests I've been on this one. Thanks for listening. I'm Cyber Givens on Twitter. If you've got any questions or you want to know anything more, just ping me a DM or send me a message on Twitter. That'd be great. Thanks for listening. Bye.


I've made a new button. What's going on in that room? Nothing mom nunbar Made some new buttons Anyways, what are we doing welcome back welcome back You'll dream where you'll take it out Today we got another Best ever food review show in ya. Yeah, why South Indian Street food destroys North Indian Street food It was a fighting words. Well, yeah, that's probably why they put it in the truly truly truly like Well, we do know that North Indian food really does produce some of the best south Indian food Yeah, if you want real south Indian food go to Delhi if you want real food and not that little baby crap stuff from Sorry just trying to make points gonna be my favorite button now. Yeah, I need to edit it though Because I feel like they pause it in the front is too much. Ah, here we go How about this? Oh, there you go. Yeah, that's more act. That's a strict hit the button, and it's right there Me too Nothing mom. I'm just watching YouTube anyway, see where you go I shouldn't be allowed to have buttons. Here we go In this video, I'll be showing you five reasons why South Indian food absolutely destroys North Indian food But first let's back up For those of you not living in India You may be surprised to know that North Indian food is quite different from South Indian food. What I Don't believe it. What South Indian food is considered to be one of the most well-recognized cuisines around the world The noun first crispy dosa's coconut infused curries and an abundance of rice-based dishes It's coming under the giant rice cooker that would make any Asian lady in Korea jealous But how are these flavors shaped the cuisine in Chennai the capital of Tamil Nadu in the southern most state of India? Well today we're gonna find out from a pancake bursting with savory curry goodness challenging the best of any waffle house menu Iconic dish here all the way to a factory turning out 15,000 pounds of rice every day So get ready because we're taking a tour of the most iconic South Indian treasures from Chennai We begin our journey with Chennai's favorite cheap breakfast dish a doughnut that's stolen the hearts of Tamil Nadu's locals since its creation in Krispy Kreme Like your mom Introducing Medu Vada this famous South Indian breakfast is crafted using one of India's most highly priced and expensive legumes The legume known as black gram exclusively grown in the southern part of India and also northern Bangladesh and Nepal But that is it and it is very exclusive To make this dish start by blending the black gram soaked overnight into a thick batter Next add our seven spice ensemble black pepper human aromatic curry leaves zesty green chilies red onions a dash of salt and a hint of pepper root Mix everything well Then take a blob of batter and with a little thumb magic sculpt it into a doughnut shape This trick ensures our doughnuts cook up evenly giving you that perfect crunch from the outside to the inside Once they are perfectly golden brown take them out and serve This savory doughnut brings all the heat It's a flavor journey a pilgrimage of pleasure where legumes and spices collide into a spicy tango Pepper and curry explosion and in the texture department Oh, look at that whole effort a crispy coat embracing a fluffy cloud-like center fun fact Medu means soft Well Vada is a type of Indian savory fritter You learn something every day. Yep Ah Now introducing an irresistible sweet sensation that steals the spotlight at every public holiday or wedding in Chennai Get ready for a sugar rush because this egg-based delight is not holding back. I'm not kidding It packs a whopping 10 pounds of sugar. Will you believe me? This thing is gonna be very very sweet. Let's take a look I Behold the mutt up mitai this recipe emerged just over six decades ago casting a spell on the taste buds of Tamil Nadu ever since Now it's the star dessert at almost every local event First things first crack a couple dozen eggs into a bowl. Yes, I said doesn't many dozens Next the koya into thick dairy ingredient somewhat similar to dry ricotta cheese made from dried whole milk or whole milk thickened on an iron pan Carefully fold that into the egg follow that with all the sugar you can find at Indian Costco Crazy While folding add the magical ingredient. No, not more sugar. I'm talking about ghee also known as clarified butter Now place it over a gas stove and using a hand blender mix everything well until it gains a custard like texture For the final step glaze up a tray with a bit of ghee and pour in our eggy mixture Make everything for six hours and serve I Creamy egg custard with a seriously sugary kick blame it on the ghee or the Irresponsible volume of sugar but despite its simplicity this treat is bursting with rich intricate flavors that'll leave you craving for more Looks amazing Kind of like flying a little bit Chennai a massive coastal hot spot in India it boasts a cuisine That's heavily influenced by its oceanic surroundings seafood rain supreme here served up in countless delicious ways But the seafood that's topping the charts the legendary fish fry seriously. It's everywhere. Oh, that looks so good Say hello to the palm fruit fish fry. No locally is bubble mean Baru ball This spicy shallow fried delight has had magical power to turn everyone into a die-hard seafood Enthusiasts even one cousin with a seafood allergy would give it all up to try this You'll see why as we get to the cooking lady's secret steps. That was my calm First she carefully washes the palm fruit fish then scores its entire body using the traditional boutique knife Next up the spice game begins She adds salt turmeric powder red chili powder and fenugreek powder You probably thought she was done Well, you thought wrong after a few splashes of water She adds a blend of ginger turmeric and fish masala mix it up for those flavors to mingle and work their magic Finally, it's frying time 15 to 20 minutes till it's crispy to the bone This dish, it's the epitome of comfort food in Tamil Nadu with a pump for me like flaky and oh so tender After a solid 20 minutes in that oil It's crispy on the outside and fall off the bone soft on the inside Wow Yeah, delicious and now your cousin with the seafood allergy is dead Get ready to dive into the ultimate dosa experience We're talking a dosa stuffed to the brim with juicy mutton curry and eggs of fries and all of it topped with even more spiced drenched mutton This my friends could very well be the heavyweight champion of meaty dosas Wow Simakal Konar Kadai is a restaurant which is originated in Madurai in a base called Simakal around 1943 After 20 years of time 1963 around, Kari Dosa specific dish has been invented It is invented by Mr. Manikam Konar, his father Mr. Sundram Konar founded Kari Konar Kadai So from then almost eight years it has been here From that time it has started the story of Kari Dosa Let's dive in to Chennai's culinary wonders dosas and curries But why settle for one or the other when there's a dish that masters both Meet the mutton curry dosa one of the city's most magical food creations Step one spread that dosa batter on the hot tawa Step two top it with a dose of rich mutton brain gravy Did he say mutton brain gravy? Step three crack an egg right on top and mix it all together to create a fatal 15-car pile up of flavor in your mouth Good lord Step four enter the star ingredient mutton sukkha If it came from a cow we would call it brisket But this is intensely seasoned chest meat that's been cooked low and slow Flip it let that meat caramelize and you've got yourself a dosa fit for royalty That looks amazing Wow This dish is experienced in layers First a crispy nearly violently seasoned mutton meat kicking off the flavor parade Followed by a creamy curry mixed with egg at the heart of it all Wow to seal the deal The final layer of warm slightly crispy dosa batter that ties everything together That's amazing I want it in my mouth Before we put an end to this onslaught of South India's culinary excellence Let's shine a spotlight on the ingredient reigning supreme Not just here but across all of India I'm talking about rice basmati rice And if there's a dish that's the ultimate rice ambassador is biryani For our final escapade we're making a pit stop at a biryani factory Where they're churning out a mind-blowing 11 to 15,000 pounds of biryani each day That's almost enough biryani to feed your mom Hahaha Our biryani style is channai style Well done Pusseem bedding biryani Biryani was popular by muslims because they only brought it To the Tamil customs by the bedding biryani They know about the cooking timing and dum I don't know how to open it That is only the specialty So Muslims are using mostly dumb biryani That is a fine quality biryani Compared with any other style Dumb biryani first most favorable for all the people Our biryani is not so spice Compared with other other biryanis And our biryani is easily dying from it. Biryani is probably one of the first dishes that comes to mind when you mention Indian cuisine. But did you know, there are over 70 different varieties of biryani. Here they make it in the dumb style.  This style originated from the Arabic Peninsula. And it's more similar to a plough than other classic biryani's. Instead of layering in the ingredients as usual, they mix everything together in a huge pot. Start by frying up red onions with ghee in a giant cauldron. Once they're golden, add ginger, garlic paste and diced tomatoes. For seasoning, add salt, turmeric powder and red chili powder. Now it's time for the protein. Here they like to wash the chicken thighs, season them with turmeric powder, then drop them in the main cauldron, followed by water and fresh coriander leaves. Finally add the par-cooked rice and let it boil for another 45 minutes to complete the dish.  Despite its colossal production, this biryani is on a whole different level. Every grain of rice is infused with those aromatic spices, making each bite an absolutely blissful experience. Now that we've gone through the most iconic dishes in Chennai, showing off the amazing variety South India has to offer, it's time for us to pick our favorite. Was it the crispy meduvada, the eggy mutton tie, the flavor packed mutton curry dosa, the legendary fish fry or the mouthwatering biryani? That did not look good to me. Today, the biryani stole the show from me, the mastery of crafting such deductible food on a grand scale and then serving thousands with affordable, high quality dishes. Well, that is just plain old worthy of my respect. So how about you? Which one of these Chennai classics would you try for yourself? Let me know downstairs in the comments below. And for more indulgent tips for your senses, be sure to subscribe to Best Ever Foods. He claimed that it destroys North Indian food and he said nothing about North Indian food to make a comparison about it. It's just provocative languages all. It's clickbait. Exactly. That's what I do when he's crying. I can't hear you. Have you seen the reels and videos around of how to stop a kid by crying by throwing a slice of cheese on him? Yeah. It's great. Have you tried it? I threw a piece of cheese on Leland a long time ago. Did it work? It wasn't crying. I just threw a piece of cheese on him. I really want to try that. See if it stops. See if it stops crying. Oh, hungry. Yeah, very hungry. That was, as always, those are always great videos. The mutton briani looked great. I mean, I'm not... No. Yeah, I know what you meant. The mutton... The briani looked great too. But I don't know about that because I love, like, dosa for breakfast. That's a pretty heavy duty rich breakfast right there. Pretty heavy duty rich thing right there. Dang. So what do you guys think? Nonebar. I need to edit that one because I need to... To begin with space in the front? Yeah, to begin with space. Nonebar. There you go. Nonebar. What do you think? Nonebar. Do you think it was good? And it's better than north? I don't know. There was no whatever. It's fine. I'm sure he has a video that says, Why north Indian street food destroys south Indian street food? As long as it gets the comments going. That's why we say a bunch of stuff we don't mean. Always. To get the comments going. It's for the comments and the free cocaine. Yeah. I was like, Rocky Irani is my favorite. I did that just so you guys wouldn't... Yeah. We never say anything we actually mean. No, we really... This is all of a sod. We don't think that LJP is that good of a filmmaker. That's true.  Everybody knows that. That's true. Yeah. We much prefer... Well, we don't even really like Indian anything. Do we Corbin? Maybe some Bengalis. Maybe. Maybe. Pondu. That one's too big of a space as well. I need to edit it. I need to edit it. It almost sounds like I'm saying pondu. Which I'm sure is a completely different word that my wife would say. You shouldn't be saying that. More like bonedu, am I right? Oh, yeah. What else should I add to my little thing here? Pondu. Bakwas. Dost. Nanbar. Pondu. Pondu. This is you at night. Pondu. Pondu. Yep. Pondu. That's about right. That's our love speak. Pondu. Pondu. I should not be allowed to have buttons. No. No more buttons for you, sir. Anyways. Have you had any of these foods? I want to do any of them. Are they as good as they look? I'll do another food video soon. We got to go over to the kitchen.  Not my kitchen? Oh, okay. The Andhuri chicken, the Tanduri, Andhuri place that's owned by the former food truck of, I don't know if it's former, they may still do it, the Bollywood food truck. So it's any good. It's been a long time. Well, I was going to say it's been a long time since I had an Indian food, but my wife makes stuff all the time. But there's not really great Indian places around. Once you've had real Indian food. Pondu. Pondu. Having fun? We need to make one that's just... We need to make one... Hold on. You're going to make one right now? What are we doing? What's going through your evil mind? That's any time you talk about Andrani.  Rick's like, oh, to my... To my sweetheart. My sweetheart. Oh, Andrani! Oh, that's what we're missing, but we wanted Ashley to do it. We're missing it's so juicy. Yeah, we are missing it's so juicy. Any time you talk about Andrani. Oh, Andrani! Oh no, it should be... It should be like... Did you know I'm married to a Bengali? Just any time you mentioned anything Bengali. That's true. Won't you be, did you know I'm married to a Bengali? What else do we need? White devil! White devil! Any time we mention Mark Benington. I don't know, don't give me buttons. It's not good. Very, very bad. Oh, Andrani! I'm going to end the video now. Juicy!


Hi Rachel! I would not have guessed that when we began live streaming chapel for distant students last fall it would turn out to be such a grace. While the center of our gravity remained in Elkhart, our worshiping community here learned to attune itself to the Holy Spirit and connect with each other even when geography and time zones separated us. So when COVID-19 hit, students in my Christian worship class were much more prepared to lean into what Zoom chapel could be rather than trying to replicate in-person worship in a online format. In the final course evaluation one of them said before this semester I would have never suggested specifically addressing online worship. Going forward we will meet too. This is something we at AMBS do well. Create a community of practice where leaders learn to improvise thoughtfully in ever changing circumstances. I'm looking forward to teaching classes that I never thought I would teach online. I'm revising courses like preaching and biblical storytelling so the students can learn from a distance. As a teacher who draws on theater studies one of the issues I'm curious about is how preachers and biblical storytellers and even worship leaders can shift from the congregation in the room to a congregation that is gathered on Zoom. While I long for the days of in-person worship again there's a lot to be learned about the church, our faith and the good news as we worship online. AMBS professors deliver high quality theological education to students from many backgrounds and in many learning formats. Your gifts are essential in helping us continue to do this work. Consider making a year-end donation to AMBS.


There are a few examples that don't fall in this classes even of globular proteins Disordered proteins. Do you see all the green parts here? I've actually shown you an example like that before. Do you remember when I showed you that toxin? This too is a spider toxin from a Tarantula. I think We do not I don't know exactly about this molecule But the reason why things are disordered is you should think again when and how are they disordered? And in this particular case it was disordered when I determined the structure of it. That's obvious. Well Think once more Why would something be disordered in a structure? It might have more than one structure. What if this protein were to bind to another protein? Compare that to the prions. So in particular for toxins It's quite common that they might appear a bit disordered in their isolated shape And somehow they would interact with other proteins in the cell and maybe Maybe get more structure and then in general that's something that happens for Disordered proteins that they're just disordered in one of their forms But when they're interacting with and binding other proteins they might actually create more secondary structure here and of course if we now determine the structure of the protein in Isolated form without those interaction partners. Of course, it's gonna be disordered. So disordered Normally if you had to take a bet if I were to show you this and say that is this just a bad structure Or is it likely that there really were some beta strands here? To tell the truth if I if this was a protein that I knew absolutely nothing about I would probably say that it might have been a bad structure It's more likely that we have a regular structure, but more likely it does not mean never There are certainly lots of very interesting proteins that are disordered and we're learning more of them every year now It's a fairly hot area and this is an area when NMR spectroscopy is awesome because NMR spectroscopy can tell you how these disordered behave in actual water solution at 300 Kelvin and also what residues are interacting with what? That we can't get from Crye or X-ray crystallography


Hello, and welcome back to the seventh year of the industrial control system village, the ICS village at DEF CON. We're really excited this year because one, we made it. This was a more difficult year for us than past years because all of those ranges, all of that industrial control system equipment that you've seen in the past, we had to figure out how to get it completely virtualized for you. So I want to say thank you to grim, who has been hosting a lot of our equipment for us new this year, besides everything being virtualized for access for our CTF. The last two years are CTF the winner has won a black badge so crossing our fingers we can pull that off for a third time. No guarantees. Is the Department of Homeland Security CISA agency is going to be they have some special range equipment that they have integrated into a part of our CTF. So, there's going to be a lot more fun and a lot more challenges this year. The great lineup of speakers, one of the biggest things that we took advantage of this year with the conference being completely virtual was reaching out to get a lot of international speakers. So the kinds of folks that work in industrial control systems elsewhere in the world. That would not typically be able to make the trip to Vegas so a lot more variety in international representation with the speakers so really looking forward to that logistics for it this year. We're going to talk about everything that's going on discord at Defcon with the ICS Village specific channels around that q&a will be done there. Some speakers will be doing doing q&a for the live sessions so live speaker sessions q&a will be in zoom otherwise you can beat with the speakers and discord and check out and subscribe to our new channels and YouTube and twitch, where we'll be streaming everything live to you. Have a great Defcon. Keynote for this year is the director of CISA Chris Krebs reflecting the continued collaboration between the agency and the village with bringing education and more equipment to the community. This Defcon, we are kicking off the first of many opportunities to bring real ICS to even more hackers to get to work with. So without further ado, Chris Krebs with the ICS Village keynote for Defcon. Hey, hello out there. Welcome to Defcon ICS Village safe mode. My name is Chris Krebs. I am the director of the US cyber and infrastructure security agency today going to tell you a little bit about the things that we've been doing over the last couple years. This is a approach to control systems but more broadly not just our approach to things we're doing working with you and the community to improve control system cyber security out there across this great country and throughout the world. So I think what I want to start with is a tell you a little bit about who we are CISA. Again, the cyber and infrastructure security agency youngest federal agency coming up on our second birthday here and talk to you a little bit about the threat landscape as we see it and tie it to a few actors out there. In improving their capabilities and then stitch that all up into a story of the things that we've identified as important and how we work with you and the rest of the ICS security community to actually achieve these objectives that we're all working day and day out towards. So that yeah CISA almost two years old now we are a part of the Department of Homeland Security we've been around in one way shape or form since the creation of the department but the US Congress gave us the authority to stand up as an separate operational component like the Transportation Security Administration what you normally would have had to deal with if we were in Vegas like last year and ideally next year and FEMA if you're paying attention to COVID or hurricane season. They're out in front so that's where we come in where CISA we are the nation's risk advisor as we style ourselves. But the concept here is to get an understanding of what the risk landscape looks like and how it intersects with the nation's critical infrastructure across a number of different lines of effort, but I tended to steal them down to five. First is traditional info sec. We are the home of us cert and we have been working some aspect of info sec for two plus decades now. The second aspect or discipline is control system security. We are also home to ICS cert and have been in this game for quite some time with varying level levels of investment and capability but we are fully committed to this mission. Third is supply chain security, lots of activity on the supply chain front over the last couple years, particularly since I've been here, and really looking forward to building more capability in site in maturity across the supply chain risk management and the last two pieces insider threat. And this is more about that blending of close access operations, allowing an adversary into your network or into your perimeter that they can then combine with other techniques to get to achieve their their objectives and then lastly physical security. So in this broader cybersecurity and infrastructure security space. We're also out there day and day out conducting physical security assessments of facilities to help protect though things like schools and hospitals right now, and places of worship. Back when sports start up again at larger scale and you can actually go attend the sporting event, assuming you like sports ball. We are out there helping the facility owners and operators understand how to best secure their facilities so that's kind of the disciplines that we focus on. And we have a very different approach, I think to engaging our stakeholders or customers as it were, then you might find another parts of the federal government. They're usually persuasive hooks that agencies have whether it's law enforcement authorities or it's regulatory authorities or they have money, things like that we're in a little bit different spot. We were in the public private partnership business and that's a kind of cliche thing to say, I think, certainly over the last 15 plus years, but I we spend a lot of time listening. So it's not that old tired, you know, we're from the government and we're here here to help. It's more along the lines of we're from the government we're here to listen we want to understand what your problems are what your challenges are, what your gaps are. We have certain advantages where at the end of the day profit and revenue is not our prime objective. We have the ability to overcome places where there's no legitimate business model for the private sector to chip in and contribute so that's that's kind of a sweet spot for us and of course, there are other aspects here. We have access to classified information and you know when we know what the bad guys are trying to do or oh I don't know actually doing, we're able to distill that down and bring partners into the fight to counter those efforts. So again, we're this public private partnership voluntary effort agency. I'm not going to lie it's tough. When you when you really have to work that extra bit to understand what a partner's challenges are and then go back and craft something that is going to help them. That's that takes a lot more work than I think some of the other authorities that other agencies have. But in a sense, it's also pretty darn easy. If you listen the right way, if you listen to really what the challenges and the gaps are in the critical infrastructure community whether it's on the infosex side or the the OT control system side. Listen really hard, and you isolate the issue, and you address the issue and deliver some value. It's a self fulfilling prophecy in terms of your your ultimate success so we in a certain sensor are like the private sector right we're like an organization that has to develop the capability turn it do the market research. Whether a product lifecycle, have a team to deliver it to customers, and then have feedback and dial it in so we very much have that private sector mentality in that philosophy that approach is in part why I'm here today, wherever here is. That's why I'm here today. It's part of market research is part of engaging a community and understanding what the challenges are and how we can all work together to close out those gaps. And I honestly think, which means I'm not lying to you right now, I guess, that right now, the threat landscape, the bad guys out there doing bad things is as active as I've ever seen it. And that's not to say that the bad guys out there haven't been doing bad things for a long time 2012 2013 dating all the way back. We've seen, particularly in the control system space and the hard infrastructure space really dramatic. Adversary activity so go back and look at the 2019 worldwide threat assessment, there's a very specific piece in there that talks about Chinese capabilities to disrupt pipelines, cause localized out outages. That goes back several years. A couple years ago, the Russians, what we called at the time alien viper, but they absolutely targeted energy infrastructure. They went through the supply chain, they went through contractors construction organizations in this case. They knew where they were wanting to go. And they used a range of capabilities, a range of accesses to get there. Even more recently, we alongside the National Security Agency issued an alert that was pretty clear and pretty stark in the terms of if you have OT systems that touch the internet, you need to get them off line. You need to harden them, you need to protect them, you need to install or implement better email security measures because what we found is flat, unsegmented networks provides the adversary the ability to pivot off the business network into the OT networks. Again, these are very, very active targets for the bad guys. It's only a matter of time as I think Dale Peterson said back in January down at S for an interview I did with him that ransomware will come to the control system space, it's a matter of time. Let's get there before them. So our mindset has been going back to that general philosophy of the agency. How do we understand how do we build a community of practice here. We're not the ones building it to be clear, we want to be able to foster that community of practice. So, year and a half or so ago now, when we came out of a pretty historic not pretty but a historic shutdown of the US federal government, I laid out a series of priorities for this agency. First, half my budget goes if you haven't checked me don't, who looks at the federal government budgets, but half of my budget goes to federal cybersecurity. I have a chunk of money and so that's a top priority for me. What else is a top priority for me election security, looking forward to participating in parts of my team participating in the voting village, defcon voting village as well. We're also doing physical security as I mentioned for crowded places and soft targets. When we were sitting there as a team trying to identify the greatest areas for opportunity, the greatest areas for community progress. Two things immediately jumped to mind, and they're related supply chain supply chain risk management is an untapped area that we were we are putting a significant amount of effort behind but the last piece of course why I'm here today industrial control systems as I mentioned, we are the home of ICS cert it's a game that we've been playing for quite some time. And we are reinvigorating our partnerships we're reinvigorating our investments, bringing and building a fantastic team and our overall objectives is to be able to stitch together. The US government in support of industry and the control system security community. Together, that's it together we're just working on doing this together. And so coming out of that shutdown, I challenge the team said tell me how we're going to do this. And of course, federal government agencies is what we do we build strategies, right. That's why we released our industrial control systems initiative, which is our strategy it says here the things that we are aiming to accomplish here the main thrust of activity. Now, you didn't come here today to hear me talk about strategy about another federal government plan. Another. It's actually pretty tight in terms of page count, but that's not why we're here. But I do need to lay out what our objectives are and how we're going to do that. And then I'm going to tell you about the mechanisms we're using and some of the key implementation priorities and that'll give you a sense of where we were going. Most importantly, how you can participate because together, to me, means one thing. And I mentioned it earlier this year at the industrial control systems, a joint working group that we, we had to do online just like this. Our top line objective is to democratize industrial control systems security efforts. And what that means is making it open for everyone, bringing the community together. It's not about releasing products and tools and services that only a handful can afford. It's not about restricting access. It's about diversity. It's about inclusion. It's about democratizing security. That's what's behind our strategy. So real quick, the philosophy behind the strategy is about empowering you empowering vendors and owners operators and integrators to make better risk management decisions. It's about informing your investments. It's about integrating the US government, CISA, and our partners in the intelligence community Department of Defense and FBI to it, integrating our efforts into yours. It's about moving to a proactive industrial control systems posture. And lastly, it's about driving towards a sustainable, long lasting control systems security community. That's the top line. All right. How are we doing this pillars, we got four pillars every strategies got to have pillars, we have four pillars. First pillar is asking more of the community, but doing more for the community from the federal government perspective as well. Second is advancing technology in the ability to secure our systems, not just tomorrow systems, but we have to figure out how to continue to defend today's deployments while thinking through the next generation and having more security baked in secure by design by deployment. The third piece is developing deep data capabilities to better put our understanding of risks against the current deployments and think building frameworks building resources and approaches that take advantage of just this wealth of information we all have, pull it all together and putting into meaningful frameworks. MITRE continues to lead in this space with the industrial control systems framework. Those are the types of activities and approaches that we look to be a part of, not necessarily invent, not own, we just want to be a part of this effort. And lastly, increasing that risk understanding of the interdependencies that are out there. So that we can drive smarter investments, smarter solutions, smarter engagements between the government and industry to get to that objective of democratizing control system security and making the environment safer and more secure. So it's those four pillars that drive our approaches.  Okay, this is the part that matters. The strategy is about what we're trying to do. Our approaches are how you can work with us to achieve these objectives. So got a few things that are worth talking about here. I already talked about one of them. And that's the industrial control system joint working group. This is what is now a twice a year. That's by annual twice a year. Now a virtual event, but it provides a free opportunity for anyone that's either getting into the control systems game, or is in a jurisdiction that doesn't have travel funds, because those are always a challenge with, you know, the old days conferences. How do you get the money to go to Vegas? How do you get the money to go to Miami? The ICS JWG is about opening up a more inclusive environment so everyone can come together and learn something even if it's at the 101 level, or the 10 whatever remedial is the 100 level doesn't matter. The point is, we have the opportunity to bring more people into this community. And that's what we're working towards with the ICS JWG. We had our most recent one in, I don't know, it was a month or so ago. We've got another one coming up in the fall. So that's point one ICS JWG. So back to that kind of integrating the federal government with the community. We also have an effort called the control systems interagency working group, the sissy wig. Now, it says interagency, but don't take from that that it's just government again. This is about bringing the executive leadership of the federal agencies that play in control systems together with leaders from industry from the research community from the vendor space, and everybody together and figuring out, okay, what are our opportunities are threats it's really in part we're doing a SWAT analysis. How are we strong together where are we weak together what are our opportunities to work together. And then what are the threats. Now, out of the last year or so work of the CS the control systems interagency working group. Well, we figured a few things out. One is, the government needs to be more coordinated together. Everybody does some part of this game. How do we do it in a more coordinated fashion. Well, one place we can really achieve I think some alignment and advancements is in standards. All of the federal government players together on standards and working towards the same common purpose we can really drive the advancements we're looking for. Also, we can help work to build the workforce of the future. Rather than doing bits and pieces here and there. Let's have a collective approach to workforce and a lot of credit to nest in their efforts and and we're also doing subcoding, creating clarity and messaging clarity and hiring practices. So we have an opportunity there. And also on the investment alignment. So R&D, lots of different R&D efforts across the federal government. We should have a more unified R&D agenda that can get better uses out of our investments. I think some duplication or redundancy and efforts. Always a good thing, maybe put those save dollars towards another effort. And then lastly, working towards a more unified streamline coherent and value added incident response approach within the USG. And in part, what we want to do with this is make sure that we're taking the relevant information out of an incident response effort and sharing that information back out in a protected way for the victim. We're not in the business of revictimizing a victim, but to the extent that we can extract insights from single or multiple incident responses. That's a good thing. And that's something that we've done recently. In fact, in a natural gas, in the natural oil and natural gas sector, we issued an alert earlier this year. Now, we're not perfect yet. We're still working at this. But your feedback on all of our control systems products is always welcome. So go to sysa.gov, cisa.gov, check out our control systems page, and all of the products we have there, the alerts, the guidance, the advisories. Let us know where we're hitting the mark. Let us know what else we need to do. And then work with us through the industrial control systems joint working group. There are a few other things that are worth highlighting, particularly since we're doing this DEF CON safe mode thing, something you'll hear about. And that got kicked off last year, or rather earlier this year, down in Miami, ICS for ICS, industrial control systems for incident command system. Not sure if everybody knows what the incident command system is, but it's what the physical emergency responders use to coordinate their efforts, whether it's a hurricane or wildfire, it's actually the firefighters out in California, the fire service are the ones that develop the incident command system. But it's got great application for physical disasters. But I bet if we ever have one of those big time larger scale physical or cyber enabled physical event, guess who's going to show up the fire department, the emergency managers, state and local officials. There's absolutely a role in control system security in its response for state locals. But they also recognize we recognize that their roles for the security community. So what we've got to be able to do is develop those frameworks, develop the frameworks that put everybody together, clarity of roles and responsibilities. So a lot of credit to Megan Stanford for her work there and ICS for ICS and looking forward to continuing to contribute to that effort. And of course, the best for last here, ICS Village. This year, we were proud to partner with the ICS Village, a lot of credit and thanks goes to Bryson board for his efforts. But the idea is, we can do more together. That's why we're here. That's why you're seeing the feds show up at DEF CON even if it's virtually we were there last year. But we look forward to really growing out this and building out this partnership with the ICS Village and other villages. We're doing that in a couple ways. This year, we've got our control environment laboratory resource or seller that is going to give simulated environments so that everybody can walk through a couple different scenarios. Work on your blue team skills and run some incident response. This is an effort that we think again place to that democratizing incident, rather industrial control systems. It's been a long day. Industrial control systems security again democratizing making it more open. If we can pull more resources out of the national capital region out of specific locations out west and then make them broadly available virtually good for everyone. If we can put things on wheels and drive them around. To various parts of the country. Again, these are good things that's what we're trying to accomplish here a control systems ecosystem security ecosystem that is open and accessible to everyone, whether you're in the private sector or your municipal water facility. Everyone's got requirements. We have to be able to do this together. So last thing I'll talk about for wrapping this one up is our role in vulnerability management. This has been hell year, I think, for the vulnerability managers out there. Six months of week after week of big bone after big bone. I was thinking at some point it's almost a race to the bottom, because think about it you drop one vulnerability and somebody's probably going to drop one next week. And so you got tops of seven days in the new cycle. But it's really stressing the teams that historically we haven't invested too much in the vulnerability management side is one of the most important. Teams within any organization. We play a key role here in coordinating vulnerability disclosure. We fund in support the cert coordination center cert CC up a Carnegie Mellon. We also fund the national vulnerability database. And next, so between the cert CC CVE process and the national vulnerability database, two key resources for any network defender, any vulnerability manager of understanding what's new what's coming and how do you defend against it. We also play a role again through that cert CC process where the private sector or security researcher rather, if they identify something. We can help facilitate the conversation between the appropriate vendor. Now, sometimes we don't need to play a role. In fact, we encourage programs we encourage vendors to have vulnerability disclosure programs to have as needed but bug bounty programs again have a healthy vibrant ability to engage with the security researcher where you don't need the government. Even if it's just fostering or facilitating a protected conversation, but that's not always how things are right now. That's not where some organizations are in their maturity of their own vulnerability disclosure practices so we play a vital role last year calendar year 19. We process and manage through our CVE process 11,500 plus vulnerabilities. I think based on this year, we're probably going to exceed that. But that's a role we are happy to play. Again, we are going to continue to issue advice and guidance to organizations of all sizes and stripes. So we have some guidance on there on how they can set up their own vulnerability disclosure programs just last week. We issued some guidance to our partners in the state local election community about how they can set up vulnerability disclosure programs for their systems and it's so it's not just about the code that the software they're coding or whatever. It's their implementations. But if you find that vulnerability in a voter registration database, please, you know, first off, if you own that database, you need a process. But if you find that vulnerability, you need a way to report it in a coordinated manner so it can get closed out so that it's closed out for the bad guys get there. So vulnerability management is exactly where we are going to continue investing more broadly in the infosex space. A little known fact. This was supposed to be the year of vulnerability management.  But here we are we're here we're part of the team. Let us know what help you need. So I'm going to wrap this one up right now. Again, CISA is here as an advisor as a partner is a friend our objective again top line democratizing industrial control system security at all levels. I don't care where you are. We want to work with you. We are here to provide support resources technical assistance. This is the kind of organization you need to be able to protect your systems, but ultimately, it's not just about defending today's deployments. We've got to make sure that tomorrow's deployments are secure by design secure by deployment. So that we're going to wrap up these remarks, and I'm going to jump in a time machine, and I'm going to have a costume change and all that and think we're going to do some live q amp a. Thank you.


Today we're going to be talking about psychosis, and I know that's a weird topic to start out with, and a scary topic to start out with, so I guess that I should start with a bit of background about me. Five things to know about me, one, I'm really passionate about chocolate, two, I'm really passionate about mental illness, three, I'm not an animal person, four, no I don't think it's just really so great, oh my shirt matches my back thing, go me! I'm a senior in high school, currently 17, and I can't wait to get out into college, but I've experienced mental illness in the past, and I know the effects that it can have on people first hand, and one of those being psychosis. My psychosis wasn't really a laughing matter, I mean, I'll tell jokes and you'll hear lots of jokes coming from me in the future, but sometimes we'll get serious, and serious is okay. My psychosis started when I started hearing the voices, and the voices were scary, and they're scary for lots of people.   Psychosis is characterized by when your senses are sensing things that aren't there. It's also characterized by delusions, when you have beliefs about things that are proven to not be true. For example, you could believe that you're God, or you could believe that things have a special meaning just for you. I know that this happens with me a lot with music, I got into a fight with my friend the other day about whether the song Starving by Hailey Steinfeld is actually about food, and as someone who exhibits eating disorder behavior I definitely thought that it was about food, but turns out it's not, what would you know? I think that it's important for us to really talk about and have discourse on the issue of mental health. Psychosis is not an exception for us. Psychosis is definitely to be included in that match. I think that it's most important that we as people in a community who care about one another actually care about one another, and one of the main ways that I found to do that is by reaching out and offering support to those who need it. And a great way you can do that is by looking at a website that my friends and I have created called connecttoprotect.net. There you can post about your experiences with mental illness, whether it be psychosis, or be OCD, or just having a bad day if you think you're prone to mental illness. Mental illness is not a joking matter, and it's time for the world to start taking it seriously, one person at a time. Thank you.


He's back. He said he'd be back. He's back. At least for a little bit. And I think you did a pretty good job. Terminator Dark Fate, number six in the franchise, I want to say, and personally, the only good sequel after T2. Sorry, Jeremy, if you are for whatever reason watching this, I actually liked the movie. I personally disagree with you. I actually liked the way the movie started. I do see your point, but I personally liked the neat little twist that happened with the movie. I don't think this movie was necessary at all, but I thought it was fun. Like a lot of fun. A loooot of fun. I'm gonna liken this movie to Halloween 2018.  I do not like the Terminator sequels. After Judgment Day. I'm not biased, but let's get into the actual meat of the situation. The story about this is like every Terminator film.  If you didn't think that was what she was from the trailers, you are wrong. And resistance and sort of person back to save them. Thus completely f***ing up the timeline and changing everything that's supposed to happen. Except in the first Terminator, that one actually explains, actually makes a little bit of sense to how it occurred.  Sorry about that. I, back to the actual movie. I thought it was entertaining. There are a lot of action fight scenes in the film that for the most part are grounded in reality until the end of the movie when it kind of goes full action, which that bothered me a little bit. But at the same time, I personally enjoyed it. There is a bit of an explanation as to why Arnie is in the past, like how his Terminator is there. But that explanation is a little weak in my opinion. So there's a deleted scene in T3 where it's revealed that Arnie, um, is actually that the T-800 is based off of an Arnie, a U.S. Army Commander that was who Arnold is supposed to be. I would think it would be kind of interesting if he, um, if that was him, just as a little nod to T3, but I don't know. Um, the way they did it, I thought was a little dumb, but it also makes sense is weird.  Terminator isn't a franchise that really lends itself to sequels. Acting, that's what I wanted to talk about. The acting in this movie is really good.  Solid job with what they're given so they put on a good performance as an entertaining movie and I enjoyed watching it. Yeah, no, it's, I thought it was fun. I liked what it did with the material. I liked that it tried to take it in a different direction than the other movies have been. Overall, I thought it was a lot of fun and I can see why people wouldn't agree with that. The certain things that they do to certain characters kind of completely screws over their legacy. But if all you're looking for is an entertaining Terminator film, this has got that in droves. You don't have any stupid plot points about John being turned into a Terminator, which completely rocks over everything that the other movies did. You don't have Salvation, which is somehow boring despite being set in the future. You don't have T3, which is already in goddamn glam rocker starshades. I still am never going to get over that. I very much enjoyed this movie and so for me, I would say that it rolled 15 out of 20. Highly enjoyable movie, but honestly could have been better in certain aspects. But again, I just watched it as an action movie. I didn't try looking at it as how it compared to the Terminator sequels. If you think differently than me, please let me know down in the comments below. I would love to know your opinions. That's all I have guys. If you want to follow me on Twitter or Instagram, links are going to be in the description down below. That's all I really have for now. Peace out guys.


What if anything can be done to stop the heroin and opioid epidemic in Pennsylvania? Pennsylvania ranks among the top states in the country for drug overdose deaths. Here at home a number of people becoming addicted to powerful pain medications is climbing at a very alarming rate. The governor says it's time for Harrisburg to wake up and face the problem head on.


Next locks and egg tech field days Brad introduce yourself and and Ryan as well and let us know what you're doing here Hi, I'm Brad not project manager vidi visor and this is my team member Ryan tan Ryan is part of the the ground-based vision system For the video vidi visor project you may remember we spoke about vidi visor as a dashboard and a ground-based vision system This is the ground-based vision system here and Ryan's going to very quickly talk about the functionality of that But at a higher level this is being developed open source And we're here today because we want third-party technology organizations to start working with this Prototypes the project's ending in June 22 at the end We'll have a prototype of this ground-based vision system working and we want to engage in an open-source way for companies to come harvest all part and the data is included so you can either look at the the data sets the algorithms and the hardware mix and Develop this as a whole product or to value add to your own products and services excellent Brian. Do you want to take us through it? Okay, I'll show you guys that there are two different products. We have over here one is we call it a vt-box 2.0, so they are pretty much a handheld device that you can either carry it throughout the farm or you can attach it on to the meal or quite bike and then While while you're doing pruning or doing something in the farm you can still take photos of of the incidental capture of the farm and he has a High accuracy RTK GPS data up to three centimeter So this will give us a geospatial plus the information of the plan which is really useful when we combine all the information together Okay, so this again is a prototype But by this time next year It will be something really good So the other one hanging at the back. It's it's sort of the Against prototype of the we call it a tricam. So it has three cameras Top middle and the bottom which is facing up We can we can attach infrared camera thermal imaging Laser a LiDAR in it as well So that will essentially give us more information as in we can even detect if there's any leakage just happening in the irrigation site Plenary index how healthy is the the plan? So again, this this is this are all modularized units So it will be really good to get some feedback from growers as well as Developers over here. So at least we can move forward and make it a better product at the end Excellent, Ron. I think you've summed it up beautifully. Thanks so much