Hey, welcome back everybody. Jeff Frick here with theCUBE. We are on our Palo Alto studio. The conference season hasn't really kicked off yet into full swing, so we can do a lot more kind of intimate stuff here in the studio for a CUBE conversation. And we're really excited to have a many time CUBE club on and a new guest, both from Western Digital. So Dave Tang, Senior Vice President of Western Digital. Great to see you again, Dave. Great to be here, Jeff. Absolutely. And Martin Fink, he is the Chief Technology Officer at Western Digital, a longtime HP alum. I'm sure people recognized you from that in our great machine keynotes, we were talking about it. So great to finally meet you, Martin. Thank you, nice to be here. Absolutely. So you guys are here talking about, we've got an ongoing program actually with Western Digital about data makes possible, right? With all the things that are going on in tech at the end of the day, right? There's data, it's got to be stored somewhere, and then of course there's processes and things going on.  So we really want to thank you for that. But now there's some new things that we want to talk about that you guys are doing to continue really in that same theme and that's the support of this risk five. So first of all, for people who have no idea what is risk five, let's jump into that and then kind of what is the announcement and why it's important. Sure, so risk five is, you know, the tagline is it's an open source instruction set architecture. So what does that mean? Just so people can kind of understand. So today the world is dominated by two instruction set architectures. For the most part, the, we'll call the desktop enterprise world is dominated by the Intel instruction set architecture. And that's what's in most PCs that people talk about as x86. Right, right. And then the embedded in mobile space tends to be dominated by ARM held by ARM holdings. And so both of those are great architectures but they're also proprietary. They're owned by their respective companies. So risk five is essentially a third entry we'll say into this world. But this distinction is that it's completely open source. So everything about the instruction set is available to all and anybody can implement it. We can all share the implementations. We can share the code that makes up that instruction set architecture. And very importantly for us and part of our motivation is the freedom to innovate. So we now have the ability to modify the instruction set or change the implementation of the instruction set to optimize it for our devices and our storage, our drives, et cetera. So is this the first kind of open source play in microprocessor architecture? No, there's been other attempts at this. OpenSpark kind of comes to mind and things like that. But the ability to get a community of individuals to kind of rally around this in a meaningful way has really been a challenge. And so I'd say that right now risk five presents probably the best sort of clean slate. Let's take something new to the market out there. Right. So open source obviously we've seen take over the take over the software world first in the operating system which everybody is familiar with Linux but then we see it time and time again in different applications, Hadoop. I mean, there's just a proliferation of open source projects. The benefits are tremendous. Pretty easy to ascertain in a typical software case. How is that going to be applied? Do you think within the microprocessor world? So it's a little bit different when we're talking about open source hardware or open source chips and microprocessors, you're dealing with a physical device. So even though you can open source all of the designs and the code associated with that device, you still have to fabricate it. You still have to create a physical design and you still have to call up a fab and say, well, you make this for me at these particular volumes. And so that's the difference. So there are some differences between open source software where you create the bits and then you distribute those bits through the internet and all is good. Whereas here, you still have a physical need to fabricate something. Now, how much more flexibility can you do then for the output when you can actually impact the architecture as opposed to just creating a custom chip design on top of somebody else's architecture? Well, let me give you probably a really simple, concrete example that kind of people can internalize of some of our motivation behind this because that might sort of help get people through this. If you think of a very typical surveillance application, you have a camera pointed into a room or a hallway. The reality is we're basically grabbing a ton of video frames but very few of them change, right? So the typical surveillance application is it never changes and you really want only know when stuff changes. Well, today in very simple terms, all of those frames get routed up to some big server somewhere and that server spends a lot of time trying to figure out, okay, have I got a frame that changed? And so on, and then eventually it'll find maybe two or three or five frames that have got something interesting. So in the world what we're trying to do is to say, okay, well, why don't we take that find no changes and push that right down to the device? So we basically store all those frames. Why don't we go figure out all the frames that mean nothing and only ship up to that big bad server the frames that have something interesting and something you want to go analyze and do some work on. So that's a very typical application that's quite meaningful because we can do all of that work at the device. We can eliminate shipping a whole bunch of data to where it's just going to get discarded anyways and we can allow the end customer to really focus on the data that matters and get some intelligence. And that's critical as we get more and more immersed in a data-centric world where we have real-time applications like Martin described as well as large data-centric applications like of course big data analytics but also training for AI systems or machine learning. These workloads are going to become more and more diverse and they're going to need more specialized architectures and more specialized processing. So big data is getting bigger and faster and these real-time fast data applications are getting faster and bigger. So we need ways to contend with that that really go beyond what's available with general purpose architecture. So that's a great point because if we take this example of video frames, now if I can build a processor that is customized to only do that, that's the only thing it does. It can be very low-power, very efficient and do that one thing very, very well and the cost adder, if you want to call it that, to the device where we put it is a tiny fraction but the cost savings of the overall solution is significant. So this ability to customize the instruction set to only do what you needed to do for that very special purpose, that's gold. Right, so I just want to, Dave, we've talked about a lot of interesting innovations that you guys have come up with over the years or the helium launch, which I don't know, couple, two, three years ago, we were just at the Mamber event really energy assisted recording. So this really kind of foundational within the storage and the media itself and how you guys do better and take advantage of evolving land space. This is kind of a different play for Western Digital. This isn't a direct kind of improvement in the way that storage media and architecture works but this is really more of, I'm going to ask you, what is the Western Digital play here? Why is this an important space for you guys in your core storage business? Well, we're really broadening our focus to really develop and innovate around technologies that really help the world extract more value from data as a whole, right? So it's way beyond storage these days, right? We're looking for better ways to capture, preserve, access and transform the data. And unless you transform it, you can't really extract the value out of it. So as we see all these new applications for data and the vast possibilities for data, we really want to pave the path and help the industry innovate to bring all those applications to reality. Right, it's interesting too because one of the great topics always in computing is you got compute and store, which has to go to which, right? And nobody wants to move a lot of data that's hard and may or may not be easy to get compute, especially these IoT applications, remote devices, tough conditions and power, which we mentioned a little bit before we went on there. So the landscape for the need for compute and store networking is radically changing than either the desktop or what we're seeing a consolidation in clouds. So what's interesting here, where does the scale come right? At the end of the day, scale always wins. And that's where we've seen historically where the general purpose microprocessor architectures dominated, but used to be a slew of specialty purpose architectures. But now there's an opportunity to bring scale to this. So how does that scale game continue to evolve? So it's a great point that scale does matter. And we've seen that repeatedly. And so it's a significant part of the reason why we decided to go early with a significant commitment was to tell the world that we were bringing scale to the equation. And so what we communicated to the marketplaces, we ship on the order of a billion processor cores a year. Most people don't realize that all of our devices from USB sticks to hard drives, all have processors on them. And so we said, hey, we're going to basically go all in and go big. And that translates into a billion cores that we ship every year. And we're going to go on a program to essentially migrate all of those cores to risk five. It'll take a few years to get there, but we'll migrate all of those cores. And so we basically were signaling to the market, hey, scale is now here. Scale is here. You can make the investments. You can go forward. You can make that commitment to risk five because we're essentially, we've got your back. So just to make sure we get that clear. So you guys have announced that you're going to slowly migrate over time, your microprocessors that power your devices to the tune of approximately a billion with a B cores per year to this new architecture. That is correct. And has that started? So the design has started. So we have started to design and develop our first two cores. And, but the actual manifestation into a device is probably in the early stage of 2020. Okay, okay. But that's a pretty significant commitment. And again, the idea is you explicitly said it's a signal to the ecosystem. This is worth your investment because there is some scale here. That's right. Yeah, pretty exciting. And how do you think it's going to open up the ability for you to do new things with your devices that you before either couldn't do or were too expensive with dollars or power. So we're going to step and iterate through this. And one key point here is a lot of people tend to want to start in this processor world at the very high end, right? I'm going to go take on a Xeon processor or something like that. It's not what we're doing. We're basically saying we're going to go at the small end that the tiny end where power matters power matters a lot in our devices and where can we achieve the optimum combination of power and performance. So even in our small devices like a USB stick or a client SSD or something like that, if we can reduce power consumption and even just maintain performance, that's a huge win for our customers. If you think about your laptop and if I reduce the power consumption of that SSD in there so that you have longer battery life and you can get through the day better, that's a huge win, right? But I don't impact performance in the process. That's a huge win. So what we're doing right now is we're developing the cores and based on the RISC-5 architecture. And then what we're going to do is once we've got that sort of design sort of complete is we want to take all of the typical client workloads and profile them on that. Then we want to find out, okay, where are the hotspots? What are the two or three things that are really consuming all the power and how do we go optimize by either creating two or three instructions or by optimizing the micro-architecture for an existing instruction and then iterate through that a few times so that we really get a big win even at the very low end of the spectrum. And then we just iterate through that with time. So we're in a unique position, I think, in that the technologies that we develop span everything from the actual media where the bits are stored, whether it's solid state flash or rotating magnetic disk and the recording heads. We take those technologies and build them all the way up into devices and platforms and full-fledged data center systems. And if we can optimize and tune all the way from that core media level all the way up through into the system level, we can deliver significantly higher value, we believe, to the marketplace. So this is the start of that that enables us to customize command sets and optimize the flow of data so that we can allow users to access it when and where they need it. So I think there's another actually really cool point which goes back to the open source nature of this. And we try to be very clear about this. We're not going to develop our cores for all applications. We want the world to develop all sorts of different cores. And so for many applications, somebody else might come in and say, hey, we've got a really cool core. So one of the companies we've partnered with and invested in, for example, is Esperanto. They've actually decided to go at the high end and do a machine learning accelerator. Hey, maybe we'll use that for some machine learning applications in our system level performance. So we don't have to do it all. But we've got a common architecture across the portfolio. And that speaks to that sort of open source nature of the RISC-5 architecture is we want the world to get going. We want our competitors to get on board we want partners, we want software providers, we want everybody on board. Right, it's such a different ecosystem with open source and the way the contributions are made and the way contributions are valued and the way that people can go find niches that are underserved. It's this really interesting kind of bifurcation of the market really. You don't really want to be in the big general purpose middle anymore. That's not a great place to be. There's all kinds of specialty places where you can build the competence and with software and with, you know, thank goodness for Moore's law, you know, decreasing prices of the power of the compute and now the cloud, which is basically always available. Really exciting time to develop a myriad of different applications. Right, and you talked before about scale in terms of points of implementation that will drive adoption and drive this to critical mass. But there's another aspect of scale relative to the architecture within a single system that's also important that I think RISC-5 helps to break down some barriers because with general purpose compute architectures, they assume a certain ratio of memory and storage and processing and bandwidth for interconnect. And if you exceed those ratios, you have to add a whole new processor. Even though you don't need the processing capability, you need it for scale. So that's another great benefit of these new architectures is that the diversity of data needs where some are going to be large data sets. Some are going to be small data sets that need high bandwidth. You can customize and blend that recipe as you need to. You're not at the mercy of these fixed ratios. Yeah, and I think, you know, so much of kind of the what is cloud computing and the atomic nature of it that you can apply, you know, the ratios, the amount that you need as you need, you can change it on the fly. You can tone it up, tone it down. And I think the other interesting thing that you touched on is some of these new, which are now relatively special purpose, but we're going to be general purpose very soon in terms of machine learning and AI and applying those to different places and applying them closer to the problem. It's a very, very interesting evolution of the landscape. But what I want to do is kind of close a new Martin, especially because again, kind of back to the machine, not the machine specifically, but you have been in the business of looking way down the road for a long time. So you came out, I looked at your LinkedIn, you retired for three months. Congratulations with that, I hope you got some golf in. But you came back to Western Digital.   And I'm sorry I had to teach you about that. But what do you see? What are you excited about that you came back and got involved in an open source microprocessor project? So the short answer was that I saw the opportunity at Western Digital to be where data lives. So I had spent my entire career, we'll call it at the compute or the server side of things. And the interesting thing is I had a very close relationship with Sandisk, which was acquired Western Digital. And so I had, we'll call it an insider view of what was possible there. And so what triggered was essentially what we're talking about here was given that about half the world's data lands on Western Digital devices, taking that from a real position of strength in the marketplace and say, what can we go do to make data more intelligent and rather than start kind of at that server end? And so I saw that potential there and it was just incredible. So that's what made me want to join. So at times, Dave, good get. Yeah, we're delighted to have Martin with us. All right, well we look forward to watching evolve. We've got another whole set of events we're going to do again together with Western Digital that we're excited about. Again, covering data makes possible, but kind of uplifting into the application space as a lot of the cool things that people are doing in innovation. So Martin, great to finally meet you and thanks for stopping by. Thanks for the time. Dave, as always, and I think we'll see you in a month or so. Always a pleasure. I'm Martin Fink, Dave Tang, I'm Jeff Frick. You're watching theCUBE. Thanks for watching, we'll catch you next time.


So anyway, welcome to Network Nightmare, um, ruling the nightlife between Shutdown and Boot with PixieSploit. I want to take a few minutes, tell you a little bit about myself because most of you probably haven't heard any of my, uh, talks, the other one that I gave once, um, or, um, might not be familiar with me. I've done a lot of development with the Metasploit framework, um, I wrote the new GUI, um, I wrote some, a bunch of different exploits, payloads, um, post exploitation features, stuff like that. I also go by ScriptJunkie, so if you see tools or something like that, uh, that's probably me. Um, I do have a Twitter which, I don't use a whole lot, but you know, there's, there's a lot of peer pressure, I might start using that one more. And, um, you can find my website at ScriptJunkie.us, I run a blog, try to keep that, um, dealing with security research, stuff like that. And, um, if you want to contact me, you can go ahead and do that at ScriptJunkie, look at your keyboard, ScriptJunkie.us. So, first of all, let me give you a brief overview of what this talk is about. So, this is designed with the scenario in mind that you have access to a network somehow. Maybe you've gone and you know, plugged your computer into the network, or maybe you've compromised a system in the LAN, um, you got somebody to go click okay on your signed applet, or exploit their browser, or PDF, or however you did that, and what you need to do is you need to escalate privileges to root, you need to go compromise other systems on the network to get what you want to get. Um, they may be different operating systems, they may be, um, harder. Currently, you may do a lot with, uh, abusing legitimate credentials, so maybe you've gotten credentials from whatever key loggers, or maybe you could escalate privileges and dump hashes. Um, that's an option, but if that isn't working out for you, what you've got to do is you've got to go ahead and somehow use another method to take over this other system. So, you might think that, well, now I'm going to, it's going to come down to, I've got to exploit some service on the other system, but that can be really tough. Um, you might be able to pull off a web service exploitation, but, um, you might have to do, you know, real man's hacking, and go ahead and start fuzzing, do, or do static analysis to try to identify vulnerabilities in some, deeming that, you know, they have running, and, um, try to come up with an exploit for those, and then you're still stuck, because they may have exploit mitigation technologies like DAPASLR, which you've got to try to come up with a way to bypass.  So, um, it can be a lot of work, and a lot of people don't do that.  And so the idea here is, why don't we run an offline attack?  Um, that's kind of like a variant, another variant would be the evil maid attack. If you're not familiar with the evil maid attack, this is basically how it works. Um, I know a lot of you probably have laptops that you left in your hotel room. I actually paid the hotel maid to go over to each of your rooms, and go plug a USB drive into your laptop, so when you come back, I'm going to have a shell on all your systems. That's basically how that one works. Alright, the other, the other type of offline attack would be, um, you could, uh, from the crypto world, they'd say this would be, uh, rubber hose crypt analysis, and XKCD has illustrated that beautifully for us here. Um, you go ahead and get credentials via, uh, brute force of another kind. So, so there's, there's lots of good ways that you can go ahead and run these offline attacks. There are some problems with them though. Usually you will need physical access to the system, and if, you know, if you happen to be nearby, that's okay, but if you're trying to do a pen test on a company on the other side of the city, state, nation, world, um, that's not going to work, work out. Also, you're very likely to get caught, and since you're actually there, um, by caught it doesn't mean they know your IP address. It means you're in handcuffs. So that's also something that you want to avoid. Um, because jail is not a fun place. It's a place with bars, not a charute. It's, it's very bad. You don't want to be stuck there. Having said that, uh, physical access attacks are still common, not the rubber hose crypt analysis type, but the pen tester walks into a building and goes ahead and plugs in his phone plug or whatever and goes ahead and gets access. So it is still an option. Well that brings us to, uh, the focal point of this talk, which is the, uh, pre-boot execution environment, which is going to provide us with a way of going ahead and taking over lots of other systems on, on a land that we have access to. Um, a couple, a couple of things. This is not a, uh, new vulnerability. This is a protocol insecurity, and it has been around forever. Um, what I'm presenting here is really, uh, new way of exploiting that. I've not seen a lot of security talk on a subject. Um, so let me tell you a little bit about PXE. Intel and, uh, SystemSoft introduced this a long time ago. Um, it's a protocol they produce firmware, which is loaded into most BIOSes to boot from, uh, the network interface card if you have network booting enabled. And since this runs from the BIOS, um, it will provide you with full system control. You can go ahead and, um, run code straight on the processor, access a hard drive, access a hardware, do whatever else you want. Totally bypasses anything on the hard drive, um, if you're booting from the network since the hard drive has never touched, you know, any operating system, any virus, firewalls, all that kind of stuff. The other good part about this is it works no matter what operating system you have. You don't have to, uh, really find out a lot about this system. You can just use, uh, the PXE specification itself which gives you enough to work with. Um, and best of all, it works over the network. So you do not have to be physically at this system to, to run this attack. So, uh, put it, bring it down to, uh, layman's terms.  And it, it goes down and then, uh, before, before the operating system boots, when, when that boots up, uh, it notices something, something's a little bit different. Something's a little bit wrong. You might have something that you, uh, didn't really expect there.  So, makes a good attack though. So the question is, uh, all right, this sounds like a, a cool idea. How, how likely am I to see this? And from what I've seen, I, I'm not aware of any widespread, um, surveys or other measures which tell you how often this thing is available, but just about every system bios that I've seen is capable of booting off the network. And I have seen it left on, um, in this case, uh, what, what I'm talking about is the network boot is set in, it's enabled and set in a higher place in the boot order than the hard drive.  So, I, I'm not saying you're actually using PXE all the time to actually boot, um, it's just left on. And like I said, I've seen that. I've also seen it, um, occasionally enabled when admins, they'll go around, enable this and then use it to, let's say, push out an image and, um, then, then turn it off. Or I've seen it just left off all the time. So, it, it definitely may be something that you encounter. And so, okay, Intel has gone ahead and put this horrible bios level back door into all of our systems. How could they possibly do this to us? Well, my guess at the top is admin reasons for why this would be enabled in an environment would be, um, image deployment would be number one. Um, it's, this is where I've seen it most commonly used, um, just to go ahead and push out images. Um, in a similar vein, this could also be used for system restoration. You know, every time the system boots, it gets a clean image and it's ready to go. Or maybe it's enabled just in case we do want to push out images or do something like this and we just leave it there because it's another feature that we don't have to worry about running around all of our systems to turn back on. Or my favorite PXE, what, what's that? I, I don't know. Alright, so how does PXE work? Um, it follows, um, an extension of DHCP and TFTP protocols. What's going to happen is in the DHCP Discover, the first pack that's going to be sent out, um, on port 67, it's going to have an additional field and option which specifies this is a PXE request. The DHCP server, if it supports that, is going to send back a response saying, here's your IP and here are some PXE specific options saying, yes, um, I've got it. Um, I have a PXE server for you to boot from. Um, and normally it will include a server IP and a file name. So, um, the client will not have to go ahead and do this part. Um, although it can make another request to get the file name. And then what happens is it makes a TFTP download, um, from the TFTP server specified, which, uh, with the file name that was specified downloads that, um, and goes ahead and runs it. That will be the network bootstrap program. It will be, um, loaded up at address 0x7C00 and executed in real mode. So, this gives us a couple difficulties. You might be thinking, awesome, I'll just plug my shell code in and let it fire. Um, but you'll, you'll run into some problems. First of all, it's passive. So, you're going to have to wait for a system to boot to use this. Um, however, in some cases you may be able to send out a wakeonLand packet and make it boot or use a denial of service exploit and make it reboot. Something like that. So, that's not a big issue but, uh, there might be some waiting involved. Um, the, the main big issue or, or one of the, one of the big issues you're going to have, is you're going to have to beat the real DHCP server. So, when it sends out its request, you're going to have to send out your request, um, and, and beat it. Now, for some reason DHCP server is like taking in your IP and saving it to a log file and updating Active Directory and saying hi to the neighbor's dog and all this other stuff. So, I have not found this a difficult race condition to beat but it is something you'll have to take advantage of. At that point you're going to have to, for the forwarding to TFTP part, uh, you will have to have a TFTP server available. This is not a huge deal but once again it's another thing that you're going to have to have and then you'll be executing code. And this is the biggest difficulty hands down. You're going to be executing code basically on the bare metal in real mode.   And so, so there's a very small portion of you who are probably sitting out in the corner somewhere who are thinking, awesome, I love writing bootloaders. I'm going to break out my assembler and start coding up in 1AH instructions and go ahead and own this thing. This is going to be great.  And, and even if you do want to code up one of these, um, the, the serious issue there is if you want to interact with one particular operating system, you can, without too much difficulty, read a file off NTFS. But then if you want to change something, you may not be able to write that without having a whole lot of drivers. You may not be able to access the whole hard drive. You may not support all the other file systems you want to encounter, etc., etc. So, so that's not something I did. This is a helpful diagram from the PXE specification of what that network bootstrap program is going to need to do. And no, it's not fun. Thankfully, however, there are admin tools which have already been created which can help us do this. Um, the, the problem with that is most of them are not written to be attack tools. Like I said, the biggest use that I've seen is with using PXE as imaging systems. So, um, there are, there are those tools and then there's also PXE Linux. So first of all, imaging systems. Now, imaging systems, you will need these software installed and it does take a lot of time and none of that really matters because this is how imaging works. We're going to take your hard drive and we're going to overwrite it with whatever our image is. So, if you're trying to extract data from a system, if you're trying to compromise a, you know, system and go ahead and pull anything useful off of it, um, if you're trying to, uh, think of it this way, if you're trying to get information from Hiroshima, this is not a good tool. This will not get you the information that you want. This will do this. This is bad.  So don't do that. So that leaves us, uh, with PXE Linux, which is really an awesome tool. Now PXE Linux is a Linux bootloader kind of like ISO Linux or SysLinux to Budaphe, CD or hard drive. And what it will do for us is it will read in a configuration file. Uh, we can have lots of different options, but basically what it's going to do is it's going to pull up a kernel and an NIDRD, which is an initial RAM disk, um, which will be basically an initial file system in memory. I'm going to go ahead and execute whatever program specified there. And, um, so, so that, that is convenient. Now, having said that, although it is nice, it does entail some difficulty. So like I said, we're once again, manually going to have to install all these servers, configure DHCP to forward this to us. Um, and this is, this is difficult to deploy. Most likely we're going to be in the case, um, where we're maybe not sitting with physical access to the LAN, and maybe we've compromised one system there. This, uh, is difficult in and of itself to deploy remotely. Also, uh, the PXE bootable systems that, um, are generally available out there, aren't really written as attack tools, aren't really easy to drop payloads into, and do things like that. Um, however, you can go ahead and, uh, use this for online control. So what online control is, is we're going to take a PXE bootable system on their different Linux live CDs which can be PXE booted. Um, DSL, Tinycore and Nopix are one of those. DSL and Tinycore, um, are really awesome because they're some of the only Linux distributions I know of that can fit entirely within an NNRD. Um, so you won't need anything other than PXE Linux to boot those. Nopix, um, can boot and then connect back via NFS. Um, that will entail some difficulties, uh, which I'll talk about later, but I just stuck with Tinycore because it's fast and small and all self- contained. So this is basically what you're going to do. You're going to take the live CD, remaster it, um, set up some scripts there so that when you boot it via PXE the scripts will auto-run, connect back, and you'll get a shell. So, let's try this out. Let's start this. Alright, so in this case, uh, what I'm doing is I'm starting with a backtrack image and a Tinycore ISO.  You're going to create a folder, um, to serve your PXE files from, this is going to be your TFTP server folder, and that's going to have your PXE Linux kernel in it RD and configuration file in it. And then you're going to create a folder in it RD, which you're going to extract the in it RD into, add your scripts, package it back up, and it'll be ready to go. So first thing we do is extract the ISO. Um, I'm making this video available so if you want you can see all the steps necessary to go ahead and do this yourself. Um, as you see in the ISO all we have is ISO Linux, which is a bootloader BZ image, which is a kernel and tinycore.gz, which is the in it RD. And we're going to take the kernel and in it RD, drop it into our PXE folder. And then what we're going to do is we're going to use, uh, the meta-sploit, uh, PXE-sploit server. Um, in this case we're not going to jump right into everything that that has with it. We're just going to use this as an easy to set up, uh, DHCP and TFTP server. And, um, in this case update one is, uh, PXE Linux. Update two is a configuration file. Update three will be the kernel and update four will be the in it RD. So all we have to do is paste those files in here, rename our files to match the meta-sploit names of update four and update three. And then we'll just tell meta-sploit to use our images instead of the, uh, PXE-sploit attack, um, images that it has with it. So at this point, uh, we have, we have tiny core set up to boot from, uh, PXE Linux but we haven't added our script. So what we're going to do is we're going to extract the file system. It is a GZIPT CPIO archive. So thankfully GZIP and CPIO are included with most Linux distributions. As you can see here we've extracted it. It's a typical Linux file system structure. We're going to pick, uh, a script which runs on boot. You could pick any script you want. I just picked one in etsyinit.d and we're going to go ahead and add our shell here right up at the top. Now one concern is when this is run, uh, the network interface might not be up. So we're going to put this in a loop, um, wait a few seconds, in this case 10 seconds. Then we're going to, uh, give ourselves an IP address with ifconfig and then we're going to send ourselves a shell back with netcap. And the IP of the system, this back check system that we're running off of is 101 and, uh, so it'll connect back. And then we'll finish that in a loop and put an ampersand at the end. That's very important because if you don't do this then the init scripts will never run and your system will never boot and you'll be stuck. So we go ahead and save that out. Now we've modified our RAM disk. We're going to pack it back up or we'll use find to send a list of files to cpil, which will go ahead and compress the, or package up the, um, initrd, gzip it and send it back over our file. Now at this point we have all our files ready for, um, the connect back. I started in rpc so I can just fire up the GUI and, uh, that will connect for us. And when that loads, my computer is not very fast. Metasploit comes up. So what we use is the pixysploit auxiliary server. And, uh, there are lots of options we could give it. Most of those will be automatically figured out. It'll figure out your IP, uh, pick a range to start from. The only thing we're going to change is the tftp root so that it serves up our files and then that'll start the tftp and dhcp servers. So at this point we are almost ready to go. What we're going to do is we're going to set up a handler. Uh, we could do this in metasploit but I just did it in a netcat for the connect back shell. And wait for our target system to boot. If you have the mac address you could send a wakeonlamp packet now and get it to boot. So it boots, um, searches for a pxc server. Um, that goes ahead and boots.  It loads the kernel, it loads the nrd and when that happens in just a second, the system will start booting. It starts detecting the hardware. Um, it'll be a few seconds until it is able to access the network card. As you can see tinycora has started and we are waiting for the connect back. And the shell comes back and we've just popped it. As you can see we're running as root. Um, online control live. Um, you can see our file system. At this point what we'll probably want to do is look at the hard drives which are available. Go ahead and mount them. In this case there are a couple of partitions. And let's see what's in this system that we just compromised. Sure enough, this is a fully patched Windows 7 64 bit system. And we have full control over it. And that only took five minutes from start to finish making the entire task. Alright that was fun. So there's some good advantages of online control. First of all, any operating system. We ran entirely from memory. Um, this could have been a Linux system, this could have been a Mac system, it could have been, I don't know does Mac have network boot? But um, it could have been any system. And we have the flexibility to put whatever we want on it, decide what we want to do with it. And we don't have to go ahead and code the whole attack beforehand. Um, now this does have some serious problems. And the first and biggest problem is um, in drivers. When I tried this um, before what I found was only about half the systems I tried, the drivers would work out of the box. What happens is even if uh, in Linux somewhere there's a driver for your car and you might be thinking well Linux has drivers for just about everything. And it does. But that may not be packaged into this tiny, a NITRD that we're sending over to the client. So um, what I found was the connect back was not very reliable.  The other big problem with this is the fact that when a system is booting, chances are someone just pushed the power button and they're waiting for it to boot up. So while you can disable the X server and make the screen blank or you know show whatever you want to show, the fact is the system is not booting and eventually they're going to get tired and they're going to push the power button and you're going to lose your shell and you're going to be stuck.  So there's uh, another way um, that would be with offline code injection. And the fact is we might as well go ahead and code it up because really we're going to do it anyway. Without offline code injection that is dropping our code to be run on boots that we can run as admin or root inside the system as opposed to root outside the system. Um, we're going to need to do that cause say we have to, you know, we'll want to listen for key logs. We're going to have to watch somebody log into something, maybe take a domain admins hash or something like that. There's, there's all kinds of stuff that we're going to want to do that we can't do um, from outside the system. We'll want to be running inside. So on Linux this is not difficult. Um, what we can do is we can take our shell code, we can write it to um, and one of those scripts in etsyinit.d or drop it in a bashrc or any of the other million at bashrc files or we could add a user. Let's say the system has SSH enabled. We can just drop something in etsy password or even add an entry to the authorized SSH keys and we will be ready to roll. In Windows, uh, we have, we have some difficulties which I'll talk about later but I came with a list of seven different ways that you can go ahead and do conjection offline. So that's with bootkits, we can do it with binary planting, with binary swapping, uh, with binary embedding or modification, dll preloading, registry edits or a combination of the above. Now at this point maybe you're thinking ooh but I have bitlocker, true crypt, whatever, um, you can't get me and there, you could use bootkit techniques, um, might be able to bypass some of that stuff but, um, that's not the research direction that I went in and it seemed like a lot of work so we're lazy hackers. Moving on, uh, bootkits, there's a lot of different bootkits which are available. PXE is kind of an ideal way to deliver bootkits because even if you can't, uh, read write certain hardest sectors from within let's say, uh, Vista 764, uh, with a bootkit you don't, you don't have any issue with that with PXE. So there's lots of different bootkits which have been released or been made available or out in the wild or they're on your laptops right now because they may just put them on there. Um, and so, uh, Cinewall is one of them, uh, Stone is another one that was released at Black Hat a couple years ago, uh, Whistler is one TDL, also known as Allureon, also known as TDSS, also known as Just Stop Giving It Names. Um, EI Boot Root is one that was deployed, this is kind of the motivation here, uh, they deployed it with a virus they called the PXE virus, this is as far as I can tell one of the only instances where PXE was used as an attack vector. So they are available and they have some cool features, they have some cool advantages. Um, so first of all you get extra points for skills because it's, uh, it's pretty cool to be able to run a bootkit and get yourself bootkit privileges, you can, um, also end up running stealthily inside this system and it gives you full access.  There are some disadvantages with that, however, uh, bootkits are very operating system specific and if you don't have the right architecture, the right, um, the operating system support, this isn't going to work, so it's going to take a lot of effort to try to maintain that. Also if you're, if you're spawning a rootkit with this, what happens a lot of times is Microsoft will update patch guard, which will then crash your system and, um, that's happened to a lot of the bootkits here, so it takes a lot of work and like I said, we're all lazy heckers so that seems like some difficulty. Uh, one, one illustration for this, the stone bootkit was presented like I said a couple years ago in 2009 with great fanfare that, I don't know if the author's here, but he said, um, he expected this to be the number one bootkit used in 2010 and yet by February 2011, uh, he had released a statement on his website saying stone is out of date, um, go find other projects, it's not going to work, so, um, awesome, awesome projects but not what we're going to run with here. Now an easy way would be with binary planting, so you might be thinking just drop a file in the startup folder and that's right, uh, here are the startup folders for various versions of Windows, so we can just drop our executable in there, um, and that will go ahead and run when somebody logs in. The issue with that is whoever's logging in might not be privileged and we might be stuck with where we likely started, which is just another, uh, user level shell and, um, that doesn't give us the privileges to do what we want, you know, dump our hashes, go on, do whatever else. So we could use the WBEM dot MOF method, which was used by Stuxnet. Um, the problem with that is, um, and Metasploit does have a mix in to do this, um, it's implemented, you can use this as an option in PS exec Metasploit, um, but, uh, it's not compatible with Vista and later, so that's probably not your best bet.  Um, I've tried this, it works awesome, at least on my XP system, it's guaranteed remote code execution, you don't have to wait for a login, it runs you with full privileges, and it's portable, it runs on, uh, you know, different versions of Windows, it's awesome, there's one problem with that, it's kind of a big problem. A lot of these early boot processes are, uh, monitored by the operating system or other boot processes, and if one of them exits, it's going to cause a blue screen, because it knows, oh no, the core component of the system crashed, even if the equivalent process is still running, it's still gonna, uh, throw a blue screen. However, to clean up after yourself and swap the original executable back where it belongs, you will need to exit your running executable. So there's not really any good way you can run around blue screen in the system, unless you leave the system in a perpetually, uh, broken state, um, well it's not really broken, but it's not, it's not going to do what you want it to. Um, so you could move to one of the later boot services, uh, like the principal or spoolsv.exe. Now, these are useful because, um, they're non-critical, so the principal doesn't have to run, it won't blue screen if it exits, um, but the problem with that is, it doesn't have to be enabled. They might have the principal or disabled if this is, you know, maybe a core server or something like that. So it's, it's not as reliable as I would like, but it's still definitely an option for attacking work stations. So that brings us to binary embedding or modification. So one thing you can do is you can take, um, your shellcode and add a new section to the exe, embed it into one of these core boot processes, and then it will run. So, um, I wrote some code in my display, you can go ahead and do that with MSF encoder, MSF Venom now, which is the, the new version. There are some problems with that.  Or, and, uh, the other problem is you might not have one issue. And the big issue is, of course, cleanup. If you still want to clean up after yourself, you still have all the same problems with trying to clean up. So then you might say, okay, well I'll just use DLL preloading. So I'll just take a system DLL, which I know is going to be loaded up, swap it with my own, that will have my shellcode in it, that will do whatever I want it to, um, or maybe I could load it higher in the search list, but the other problem is with the imports, um, this DLL is probably going to be loaded because it's probably going to be used, and you will have to emulate or somehow proxy the DLL calls which are made to that DLL. So this, because it's changes in different versions of Windows, I didn't want to, um, go ahead and mess with the difficulties inherent with that, but this is still an option and it is still available. So you might say, well I'll just put myself in the registry. Well there's the run keys in, um, Microsoft Windows current version in HKLMRCU, and that's reliable. Your executable will get executed. Um, the problem is this is basically the equivalent of a startup folder. It's going to be running as the user. Or you might say, okay, I know I can add a service. Just, um, add something in current version, or a login. Um, there are some differences in the sub keys, um, which, which you have to implement, or the values which you have to implement, but that's a great option. Or, uh, another thing that you could do to work around that difficulty is to edit a service. So you change the bin path to a service that you know is running. You change the start and type to make sure that it runs, and this will work on, you know, different architectures, all different Windows versions. Um, and it is a really, really great idea. Or you could add it to a list of known DLLs, and it will also get run privileged. So there, there are a number of different items that you can use to make this modification. There is one problem with this, however. We are running a Linux image from a Linux in NRD. In order to make registry edits, I'm going to have to use, uh, the library, which if you add a string, and it causes Hive expansion, will give you a warning that this could lead to Hive corruption. Now, if you know about corruption, and you can ask my buddy Blagojevich here, corruption is not something you want to be caught doing.  So, um, this, this is probably reliable. It will probably work just fine. But on the off chance, uh, that it does cause some serious problems, um, it's not something that maybe you want to do as a pentester. So instead, uh, what I did was a combination of binary swapping and registry editing. So what I did was I swapped a non-essential service, in this case I picked the print spooler, swapped out spoolSV for another executable, and then edited the d-word start key in the registry, which changed the registry size. It's a very simple edit. We'll not give you angry warnings, and we'll make sure that this thing gets run on boot, privileged, reliably, in any version of Windows. So now we are cooking with gas. And, uh, one last part of this is the pivoting part. Um, prior to a couple days ago, uh, the only thing that was available was you still had to install Metasploit, or install TFTP and DHCP servers. Um, what I was able to do was, uh, enable this for pivoting. So what this lets you do is, uh, tackle the systems on a land where you have one system, and this will be run in memory via the interpreter. So there's a couple of different ways you could do this. One would be writing script using, uh, API calls, or the rail gun is one way of doing that. Let's you make arbitrary Windows API calls from the interpreter. Um, or you could do it as a compiled extension. Um, communication, um, over-interpretor happens over packets called TLV packets have type length value. Um, I-I used an extension, uh, so what it was, was an embedded DLL, which then pulls up a reflective loader, basically loads itself in memory without touching the hard disk and then goes ahead and makes the method calls necessary. Um, the-the reason that I didn't do this via a script or a rail gun, which would have been easier, was, uh, a base condition. So you can do this without a custom extension. You know, wait for a DHCP request. The problem is the interpreter would have to then encrypt that, send that to your controlling system, which could be on the other side of the country, which would generate a response, encrypt that, send it, interpreter would get it, decrypt it, send out the response. But at that point, you've probably lost the, uh, race. So I, uh, re-wrote it in C++, um, it's now compiled and happens all on the interpreter and, um, the controlling system will just load that all in memory and, um, it'll be ready to go. So once again, here's our attack recap. Uh, we're gonna go ahead and dynamically generate our payload if we want. Um, the system boots, uh, we could trigger that with Awake on LAN. Um, as for DHCP, DHCP acts, sends it to, uh, TFTP server, which goes ahead, downloads the pixie linux image. That pulls down the configuration file, the kernel and NRD loads it, it reads the hard disk, swaps the binary, edits the registry to make sure it'll be run, then it'll reboot to the operating system. At this point, the pixie, the attack pixie server will not re-serve that client because it wants it to time out and boot from the hard disk, um, rather than try to re-infect it continually. So then, when that boots, the swap DXC will be running inside the system, it'll spawn a real payload, and then clean up after itself. So, let's see how this works. So, what I'm gonna do is I'm just gonna start with Metasploit, I started a handler, in this case, on the foreign LAN, I have a Windows 7 system, I left a thumb drive line around with a shortcut in it. Shortcuts can run whatever, uh, command you want. This particular one will run a VBScript downloady val, which will drop a Metasploit binary. And in comes our interpreter, Shell. So, I now have, uh, Shell running in the interpreter, as you can see, um, um, it's running live here on the system. From the foreign network, what I'm gonna do is I'm gonna run the PixiSploit extension. It's going to load up the extension, load up the four files necessary to serve, and it's gonna issue the commands to start the TFTP and DHCP servers. And we can go ahead and see this in that stat, make sure so you can see they're running on this system. Um, we can set advanced options for which IP to serve back, file name, stuff like that, but we don't really need to. At this point, we have our target system, which is a server, Ubuntu server, um, which has desktop loaded because it's nice. As you can see, there are only a couple of accounts there. It's going to reboot. It's on the same LAN as the Windows 7 server.  That was the, uh, dropped attack, so if you blinked for those, you know, two seconds, it's very easy to miss. Now, it's going to reboot. Again, request a Pixi, uh, server, which is not going to be served, so it'll have to fall back, boot to the hard disk. And at this point, we wait for Ubuntu to load. At least we're not waiting for Windows to load. And... in a few minutes here, that will start up. So we could do this over SSH, but just for the good. What we're gonna do is we're gonna put in Metasploit. If you remember, there was no username for Metasploit. We're gonna put in a password of Metasploit, and sure enough, we are going to log in. Open up Terminal, and sure enough, that's pound sign. We are, uh, running as root. So we have, we added a new UID0 user, and we have now taken full root control of our fully patched Ubuntu system. So at this point, uh, there's probably some of you who are, uh, sysads who are working on the other side of the fence, right? Just great. Look what you did to me. But don't, don't worry yet, because there is, uh, plenty of advice out there. Lots of people willing to help. I'm sure there's lots of people at Symantec who are very intelligent. Um, whoever wrote this article, this may be not one of them. Um, so there's lots of bad advice out there on how to secure PXE. So some of the suggestions which are put forth in the, uh, mitigating risks of PXE are, uh, IP reservations, which is a change on the server side. To be honest, most of these are just changes on the server side. If you remember our typical attack scenario, um, I'm beating your server, so it really doesn't matter what your server's configuration settings are. Um, any change on the server side is not going to make a difference. IP reservations, what that does is that, uh, sets make sure that your machines are always given specific IP addresses. This probably won't help at all. NAC is, um, another option. Well, NAC will probably prevent you from accidentally plugging in something that you didn't want to, but I really haven't seen that as a, uh, big difficulty to a pentester who's got physical access to your switch to plug into. And from the remote attack scenario, where I have a shell running on systems, um, this doesn't do anything. So NAC is also probably unlikely to get you to any, uh, any success here. Pixie force mode is another curious suggestion. This is a change on the server as well. Um, assign specific clients to specific PXC servers. Won't do anything against our attack. And BIOS passwords, um, again won't do anything to our attack. That would only affect someone who's trying to use PXC to compromise a system they have physical access to. And they're trying to manually enable PXC to boot from. I'm curious as to, you know, what attack model has somebody who has, uh, has a computer in their possession and thinks, wow, I'm going to take an ethernet cable, plug it in the back, take my computer, set up a DHCP and TFTP server, configure those to serve PXC and use that to compromise the system, which I'm right here except, oh no, there's a BIOS password, I'm, I'm hoes. So, so, anyway, those, those are advice there, so, so that's one way to fail. Now, you can fail less, um, by at least having something available out there to detect rogue DHCP servers. So you could have, uh, software monitoring, uh, scanning for them or listening for duplicate replies to, uh, requests which are sent out there. Um, there is a possibility someone could use art poisoning to pull off this attack. That would be difficult because you can't art poison them beforehand, you'd have to do it right as they were booting, um, but that is something, you know, another thing that you could check for on the detection side, um, and unregistered clients, um, if somebody was using the plug into the switch, um, style attack, that's, that's one thing. At least hopefully you, you have some, uh, mechanism of detecting anomalies on your network like this. Um, a good idea would be with firewalls or, for example, access control lists on your, uh, Cisco switch to only allow DHCP traffic, um, to and from your server, so not allowing DHCP servers somewhere else. That will be, um, a very good idea for, for protecting this. Now, if you do it based on IP, you might have to watch for art poisoning, but you'll be in, you'll be in a pretty good shape, so, so that's a good idea. A very good idea would be VLAN isolation. Um, if you can, go ahead and isolate, um, all your systems are as many as possible on individual VLANs, so one system can't go ahead and pull off, you know, this isn't the only layer 2 attack of, of course there's art poison routing and all the other kind of stuff that could be done. VLAN isolation would also stop this attack. Um, then you'd forward DHCP traffic somewhere else. A very good idea, and, um, part of the spec that was actually made for security, if I can talk today, was the boot integrity services. So this is an extension to PXE which only runs signed code. So what you'll have to do is you'll have to run around to all of your motherboards and put in a certificate into their boot integrity services. And then you can use PXE and nobody else will be able to, um, will be able to have their network bootstrap program executed unless they have signed it with your private key. So that is a very good and effective way. The problem is it's not necessarily available in a lot of firmware and it's a lot of work to run around and go ahead and pull this out. But if you can pull that off, that is probably the best idea to have, um, PXE running. And the overall best idea goes to turn it off. And with that, um, we might have a couple minutes for questions, um, but in a second, I will let the next speaker start getting set up. Um, if you want to come to the Q&A room for track number one, um, I will be over there for the next probably hour until people stop asking questions. So, um, you can go ahead and find me there.


Anne-Marie and her uncle were sitting and talking to one another. And her uncle said, you are so brave. Anne-Marie responded and said, yeah, but you know, when I got there, my friend wasn't there nor her family. There at the boat, I saw nothing. And her uncle responded and said, yeah, they were actually there. Anne-Marie said, how? I didn't see anyone. Her uncle said, you know the boat? Well, right underneath the deck, there's a hidden compartment that you couldn't see. Anne-Marie said, really? I didn't see anything. If you're curious to know what happens, go ahead and read.


As-salamu alaikum Hello dear friends, dear colleagues, dear new affiliates As-salamu alaikum from Atil Toshkilat Hello guys Hello everybody, happy Eid to everyone On the auspicious occasion of Eid al-Aha I would like to wish all our students, staff and all our friends in the public a very very happy Eid I would like especially to wish everybody a very safe Eid Eid Mubarak Eid Mubarak Eid Mubarak everybody Eid Mubarak Happy holidays everyone Eid Mubarak, happy holidays I hope you get to spend this special occasion with all of your loved ones Happy Eid Please enjoy the holidays All the best to you and your families, your friends, your relatives Prosperity, health, wealth Please stay safe, enjoy the holidays, happy Eid Wish you health, wealth and success Happy Eid to all of you, wish you health, prosperity and success


I am Dr. Bhaskar Shanay, Head of the Department of Pediatrics at Manipal Hospital, Bangalore. Now that the government has given permission to administer COVID vaccines for children between 15 and 18 years, there are so many questions being asked, so many doubts are arising in the minds of people, parents and the general public also. I am today answering some of these questions. So the first question which is being asked is, why do children need to be vaccinated? Yes, this is an important question because people think, is it necessary to vaccinate? The fact is that the children between 15 to 18 constitute a large chunk of patients. They are the people who can get infected. In fact, if you look at the UNICEF data, there are about 25 crore adolescents and about 14 crore children between about two years. And with these large numbers, they may not get infected and they may not suffer much, but they are likely to transmit the disease to others. So when we vaccinate these children, the transmission can be prevented to others. Are children at risk of getting sick with COVID? If you look at the previous two waves, the children got infected, but they never became very sick. They can get fever and cough and other symptoms. But the rate of hospitalization, rate of seriousness, rates of ICO admissions and death rates have been very, very low in children. Having said that, these children, though they are not suffering much, but they are likely to transmit the disease and they are likely to infect the other members of the family. So it is important that we halt this transmission. They may not get sick, but they are likely to transmit the disease. Are COVID vaccines safe for children? Yes, it is safe. These vaccines have been tried in large number of clinical trials. And we have the experience of vaccinating the adults, crores of adults across the globe. And we have seen that the amount of or the number of side effects are very, very minimal. And the same thing holds good for children also. And especially in the age group of 15 to 18 years, the chances of side effects are very, very low. And even if the child gets a side effect, these are minor side effects like any other vaccine. The routine childhood vaccines also can give rise to minor side effects like fever, pain at the site of injection, myalgia or the body. The vomiting sensation and tiredness. These are the common side effects which may be there after the vaccine. But these are not life threatening. These are not serious side effects. These side effects can come down with some simple medications. Within 24 to 48 hours, they generally become all right. Is it safe to get other vaccines at the same time as COVID vaccine? That means, can we administer the routine childhood vaccines during the COVID vaccine? Yes, it can be administered. Or you can have at least 15 days gap between the two vaccinations. But absolutely there is no problem in simultaneous administration of all the childhood vaccines, including flu vaccine. Any contraindications to COVID vaccine? In fact, there are no absolute contraindications. Only if the child has the previous history of hypersensitivity or NFL access to the vaccine before or any of the components of the vaccine, then probably we may have to avoid. Otherwise, there is no strict rule that we should avoid. There is no contraindication for the COVID vaccine. So what are the common side effects of COVID vaccine? As I told earlier, there are no major side effects of the COVID vaccines. Most of the side effects are very minimal or trivial.  They may get fever, headache, body ache, tiredness, vomiting. Sometimes the pain may be there, swelling may be there at the site of injection. And usually these disappear within 24 to 48 hours with some simple medications like paracetamol. Should I get the second dose even if I have side effects with the first dose? As I told, the side effects are very minimal. But in spite of that, even if you have some side effects, you have to get the second dose. There is absolutely no problem unless there is a life-threatening event. Otherwise, there is no problem. People do ask, there are not so many brands of COVID vaccines in the market. Which one is being administered here? What is the vaccine name and is the dose same as adult dose? The vaccine which is approved for children between 12 to 15 years in India at present and which is available at present is manufactured by Bharat Biotech. That is called co-vaccine. The dose is same as adults and children. 0.5 ml intramuscularly at a gap of 28 days. The difference between the first dose and second dose is 28 days. Is the vaccine compulsory? This is one question which people do ask. In my opinion, yes, it is compulsory. Whichever can be prevented, we have to prevent. Why it is compulsory? Because one is to protect the individual. Second is to protect the community. Prevent the spread of the disease in the community. Am I protected from COVID post vaccination? What are the possibilities of getting COVID after the vaccination? This is a very common question.  To the tune of about 75 to 80%, sometimes up to 85%. If you look at all the vaccinations, none of the vaccine gives 100% protection. So is COVID vaccine. It can give protection up to 80%. The importance is that even if the person who is vaccinated gets a COVID infection, he will be protected from the severe disease, death, hospitalization. It has been found that vaccinated people are less likely to get admitted, less likely to get a severe disease, less likely to have ventilation, less likely to have intensive care admissions or ICU admissions. So even the death rate is very, very negligible in the world. People who have been vaccinated then got infected. So what I'm trying to tell you is that after vaccination, the severity of the disease and death rate comes down to a large extent. How many doses of the vaccine are required? It is two doses at 28 days interval. People do ask, if I have fever post vaccination, what should I do? If you are comfortable, not very sick, just take paracetamol. Next 48 hours, you just take paracetamol. Generally the symptoms will subside. But if the fever is very severe and too much tiredness, you may have to consult the doctor. Otherwise generally most of the symptoms get okay with some simple medications and lot of hydration, oral fluids will take care. Who are eligible to take the vaccine? All children between 15 to 18 years are eligible to take the vaccine. And especially those children who have underlying immunocompromised condition. Immunocompromised condition means whose immunity is low. Maybe due to a chronic liver disease, chronic kidney disease, chronic lung disease, neurological disease, malignancy or those who are in steroids, those who are on long term treatments like immunotherapy or anticancer therapy. And these are the children who are especially they need the vaccine and they have to be vaccinated. Is registration at Covin portal is mandatory? If you can register in Covin portal. But there is a provision for walk-in also. Walk-in and then get registered. Both are okay. So direct and prior registration both are okay for administration of this vaccine. What should be the point of concern in inoculating the kids? As of now there is no point of concern as the vaccine has been found to be very safe and efficacious in adults. So same thing when you extrapolate in children. It has been found to be very safe. And this has been tried in multiple centers across the country. The clinical trials have been done and they have been found to be very safe and efficacious also. There is no point of concern in inoculating the children. So I request everyone to get your children who are between 15 completed within 18 years to get the vaccination and protect the child, protect the family, protect the society. Thank you.


well guys I didn't want to make this video I know it's cliche to start off these types of videos with that with that opening but honestly truly this is a video I really wish I didn't have to make but I want to get back into making videos and I know I'm not gonna be able to do that without all of you guys spamming the comment sections asking about my thoughts on the drama which has already happened by the way and if you follow me on Twitter selfless plug you'll know that I've been very very vocal about about it I have no script for this video that might be a bad idea I'm just kind of I'm popping on here because I want to be done with this again I want to go back to making videos you know we've we've got a new game theory I want to react to I got I got news to talk about I got you know the puppet corp to talk about you know DDLC plus got announced I'm hyped about that we have E3 this week there are so many exciting things happening right now but I'm just I'm so weighed down by all of this so I'm making this video as kind of my final send-off to this whole controversy which by the way shouldn't have even started in the first place I'll explain it in a second but basically this is all a huge invasion of Scott's privacy while technically yes the information about his donations was public it doesn't mean people should go out searching for it it doesn't mean people should go out doxxing him and sharing around his direct address not his mailbox by the way not his PO box his direct home address and sending death threats to him his wife who is six weeks pregnant by the way and the rest of his family yeah I guess I really should have had a script because I'm already going off topic let me quickly explain what's going on so basically it was found out that Scott has made several large some donations to several political members of the Republican Party I'm so shocked that people are shocked that Scott is a Republican I mean he's a Christian who lives in southern Texas so I don't know I thought that was kind of self-explanatory but whoop-de-fricken-do I guess everyone's freaking out about that as you can see from this graph thanks Kane over on Twitter for the image we're gonna come back to this in a second but as you can see the total sum of money that went to the political campaigns was forty four thousand six hundred and ninety nine now let me just say I am perfectly fine with Scott's beliefs everybody has their beliefs I'm not bashing him for believing in what he believes in who he believes in but I think a big problem people have with this is that it's it's money from the FNAF franchise this is money from the games the merchandise sales the books all that stuff that we pay for and when you see where this money is going to and what it what it's supporting again you know Scott can have his beliefs but when you see exactly what the cause of these donations is I think that's what everybody is is making a big deal out of so I'm gonna say it again I'm not bashing on Scott for believing in what he believes in do I disagree personally yes I think Phil Moore the developer for FNAF plus actually had a really good statement that I'm gonna read out on Twitter he said I don't agree with Scott's beliefs on modern trends and issues I believe he's very misguided and uninformed about these topics for what he wants to accomplish ignorance can cause just as much harm as malice especially referring to those in positions of power or influence and I completely agree with that statement I think Phil said that amazingly it's perfectly justified if you don't agree with me if you don't agree with Scott you know again opinions and opinions beliefs and beliefs they they should be respected because everybody has them and you are you know allowed to disagree but sending hate you know sending death threats doxing that is that is completely unjustified and uncalled for it is absolutely disgusting and especially the person who dug up all the stuff on Scott simply for the laws for the for the shits and giggles there was a um a very special place in hell for you we'll get to Scott's post in a second because I do I do want to read it out but they they have been through so much pain and nobody nobody should should have to go through this but in the end I do still respect Scott again it's it's fine if you want to disagree with me but in my opinion Scott has he's done so much for me for millions of people and I think the positives outweigh the negatives I'm trying to choose my words very carefully here because if you know me I I try my absolute hardest not to bring politics or religion or anything like that into my channel because for the most part I'm not a political guy I think politics is quite the disgusting topic I think it brings out the absolute worst in people I definitely do have a loss of respect I find it very hard to to turn against him he's done so much for me he quite literally saved my life and I most definitely would not be here if it weren't for uh for for him I owe so much to Scott and I guess to just throw it all away is is not really an option I see from the seven years I've been following FNAF Scott has been such a supportive and from what we can tell amazing individual to the community to creators to his family to everybody and that's why I do feel very confident and continuing to support him I will still be covering FNAF I'm not leaving it again I think as I've already said I owe so much to this franchise I can't just leave it behind it'll be tough I know a lot of people think that this is going to kill FNAF you know the the community is going to disband and all that stuff I do think it's going to be rough I don't think FNAF will die I do think it's going to be a very rough next probably a couple of weeks maybe minimum couple of days I don't I don't know I'm gonna move on now to Scott's post I feel like I I've said everything I I need to say of course I still have more to say my response and maybe last post of course I have to make a video now when Scott titles his his Reddit post maybe my last post this message isn't specifically directed at the Friddick community this is just the community I care about the most and where I choose to post these things I never cared much for Twitter anyway to say the last few days have been surreal would be an understatement I've debated greatly how best to address this including not addressing it at all but with so many people from the LGBT community in the fan base that I love that's not an option I'd like to think that the last seven years would have given me the benefit of the doubt in regards to how I try to treat people there I was trending on Twitter for being a homophobe getting doxxed with people threatening to come into my house my wife is six weeks pregnant and she spent last night in fear because of what was being said online she's already been struggling with her pregnancy so seeing her so afraid really scared me all of this because I exercised my right and my duty as an American citizen to vote for and support the candidates who I felt the best could run the country wow I'm sorry I pictured that for everyone and that's something that I won't apologize for and I'm happy about that a few spoilers I do wish Scott maybe would have said something about you know what the money went towards but I'm happy he did not apologize for believing in what he believes in but yeah I do wish maybe he touched a bit more upon where the money went to and I think everybody's general concern about where the money went towards for those who took the time to look you saw that the candidates I supported included men women white people black people republicans and democrats I supported Kimberly classic in Baltimore because I believe that she really cared for the african-american community there and wanted to pull them out of poverty I believe she could have really made a difference in a time when so many black communities were struggling she lost unfortunately I supported Tulsi Gabbard a democrat even though I disagreed with her on several issues because I felt she would have been a good and fair president and yes I supported President Trump because I felt he was the best man to fuel a strong economy and stand up to Americans enemies abroad of which there are many even if there were candidates who had better things to say to the lgbt community directly and bigger promises to make I believe that their stances on other issues would have ended up doing a much greater harm to those communities than good all of this explanation I fear is wasted as people don't want to discuss with one another anymore they want endless apologies and submission people who are expecting those from me will get neither I've always been supportive of creators and I've tried to treat everyone fairly and treat everyone with dignity and respect I've never cared about anyone's race religion gender or orientation I just treat people as people everyone the same and because of that I've ended up with a very diverse group of people that I've worked with over the years it wasn't intentional it just happened that way I choose people who are best for the job I treat everyone the same and I ended up with many from all walks of life in my professional life and my personal life as well that's the way it should be that's the way I want it to be that's the way I will continue to be I'm Republican I'm Christian I'm pro-life I believe in God I always believe in equality and in science and in common sense despite what some may say all of those things can go together that's not an apology or promise to change it's the way it's always been if I get cancelled then I get cancelled I don't do this for the money anymore I do it because I enjoy it if people think I'm doing more harm than good now then maybe it's better that I get cancelled and retire I would accept that I've had a fulfilling career besides most things that people can take from you are things that never had much value to begin with I've always loved and will continue to love this community and this fan base even if someday it doesn't include me anymore I don't think FNAF would be the same without Scott and even then I wish that Scott if he were to retire it would be for you know the simple reason that he didn't enjoy it anymore maybe he wanted to focus more on his family his his personal life rather than being cancelled on on twitter.com you know again I disagree with some of Scott's beliefs I disagree with where the money went towards but I'm not going to bash on him again that that that's his beliefs that's what he believes in I you know everybody is entitled to their beliefs and opinions and I can definitely see where the outrage is coming from but again I think the the absolute hate and um terror that he's getting is completely unjustified doxing something death threats all that stuff I hope Scott is okay I hope his family is okay well I knew I was gonna forget something that I wanted to talk about and here we are remember how I said we'd get back to that graph on Kane well I never got back to it so I'm hopping in now to talk about it I think a big reason why people are leaving the community getting upset about Scott you know refusing to support him anymore is because of where his money went towards apparently it went towards a lot of anti LGBTQ plus community things and a lot of people are saying that Scott is you know complete homophobe you know he hates you know LGBTQ plus community members and all these nasty things when I think it's pretty obvious that that is clearly not the case again this is something I wish Scott had touched upon in his post because this is just wow this is it looks bad on him but as you can see you know he directly walks with steel wool and hex docos brand who are both very vocal about supporting the LGBTQ plus community Kieran who if you don't know as the CEO of Illumix the creators behind FNAF AR is a Indian American feminist entrepreneur one of the many Claudias who illustrated I believe the twisted ones graphic novel she is a Mexican lesbian artist and of course you got Phil Morgh who is probably gay no but in all seriousness as you can see you know from the chart from the graph you can see that 44,699 of again the franchises money went to politics which again is the reason why people are choosing to boycott FNAF and refuse to buy security breach because Scott is using some of the franchises money to support these you know political figures yeah 44 and a half thousand went to politics but then as you can see here the community led charity drives sums up to one million two hundred sixty one thousand two hundred dollars which is only like three point five percent which is insane right again I do disagree with Scott on where he put his money in the politics but it's like you look at all the great things that he's done and it it's insane yeah I just wanted to pop in real quick bring this to your attention so let's let's continue so I'm popping in because I want to state my opinion that I don't think Scott had any ill intent towards the LGBTQ plus community with these donations from his warding in his post it makes it seem like he was only supporting these people because he thought they would do well in this field you know he thought they would do well helping these people and he even had a line that says I believe that their stances on other issues would have ended up doing much greater harm to those communities than good so I'm not trying to put wards in his mouth I'm not trying to find excuses for any of this I sure hope Scott didn't mean any ill intent but it is really hard to not do that especially with politics something that I think I mean it seems like Scott takes politics very seriously so I I hope he knew what he was donating to but um but yeah I hope he didn't have any ill intent it seems like his warding he tried to explain what was happening I think it just got lost in the text though but all in all I think I've said everything I I'd like to say again maybe I should have written a script for this video because I'll I'll be looking back and thinking oh I I should have said this or I probably shouldn't have said that I'm about to get cancelled but I really just want this to be over with I want to go back to making videos I know the community isn't going to be the same so I think wishing for that is lost hope I guess I don't know I know this video might not have been what people wanted uh when people asked for me to make a video on it but it's all I feel comfortable making I didn't record my face so I don't know what's on the screen right now hopefully it's entertaining hopefully it's uplifting and light-hearted because I think that's what a lot of people need right now I think it's important to note that fans are getting hurt too a lot of people are getting doxxed for siding with Scott a lot of people getting called terrible terrible things and slurs it's a very dark time right now I'm I'm not gonna sugarcoat it I think a lot of people are having to deal with a lot right now so I'm sending the biggest and best amount of love and support not only to Scott and his family but also uh everybody watching I hope soon maybe we can brush past all this I definitely do think it'll take a while it's gonna suck for a very long time in summary I I have lost quite a bit of respect for Scott I will still be making FNAF content I don't plan on leaving the the franchise the community anytime soon I I disagree with some of Scott's uh incentives I'm not trying to bash on him again everyone's entitled to their own opinions and beliefs I personally don't agree with some of his um and also don't agree where the money went so I think that's it for me I'm gonna hopefully move on from all this I hope we can soon all of us and I'll see you all very soon for a lots of other videos again news puppet cover new game theory came out at just the perfect timing and I'll catch you all later