Really quickly, we're going to blitz through a lot of the talk today. We had the same talk at Black Hat with about 20 minutes more and didn't get a chance to cover everything in depth. So we might talk a little bit quickly. Really quickly, to go through the agenda, we're going to do who we are, what we do, what the talk's about, and why we actually care. We're going to touch on the background of timing attacks a little bit, and then we're going to start looking at timing more as we care about it. So as a channel for attacking networks, we look at timing as its own vector. We look at some of its privacy implications or privacy implications, just so that we can introduce a new acronym or make it more popular because there aren't enough of those going around. So we look at cross-site request timing. Then we'll add a D just to make it distributed, cross-site request timing, and then we'll go into questions and conclusion. So really quickly, Sense Post is a small computer security company based out of South Africa. We were formed way back in 2000, so it's quite a bit in internet years. Our analysts have written a few papers, spoken at a few conferences, so we've done Black Hat Def Con for about six years in a row now. Our guys have written in a few books, showing that the publishing industry is doomed, and we've done a little bit of training. Most of our time we spent preparing for this talk was just to pull these two Simpsonized me characters, so that's Marco down there and me next to him. Both of us just researchers at Sense Post, and down here we've got the mandatory blog, so if you've got nothing to do, go visit us online. So really quickly, what this talk is about other than timing and why you should care or who should care. If you're a developer, something that's interesting is that we've been protecting against info leakage for a long time, and we might not notice how timing is leaking information. If your pen tester is something that you'll pick up from all of the examples and demos, is that you could be missing huge attack targets, huge vectors just because you're not paying attention to it, and we're hoping that'll change going forward. And if you like new acronyms, you can start using XSRT and DXSRT when you hand in your pen test reports. So before we actually get into the nitty gritty of our tool and the techniques that we've got, we thought we'd give a very brief background into timing attacks and where they sit in terms of attacks against software and hardware. So basically, side-channel attacks, if we step even further back, have got this long and illustrious history against computing systems. And two of the very common hardware-based attacks are of course power analysis and EM emission analysis. But those are very specifically against hardware. And if we're looking at side-channel attacks against software, one of the attacks that crops up very often becomes timing attacks. Next slide. So in the traditional sense, timing attacks are generally used in crypt analysis, right? So the guys that are trying to break algorithms are trying to expose weaknesses in various algorithms. And timing attacks are remarkably efficient at this because they don't attack the math behind the crypto. They're attacking the implementation.  We've listed four here. There's lots more. But these four are kind of the seminal papers for timing attacks against crypto. We started off with local attacks against RSA. That moved to attacks over the network, deriving RSA keys over the network. There were weaknesses that Daniel Bernstein showed in AES. And then finally, Clive Percival just two years ago showed timing attacks, again, local, but this time on hyperthreaded processes. So if we move away from crypt analysis, what we find on the web is actually there's not a lot of stuff to be had in terms of timing attacks. As long ago as 2000, Felton and Schneider had a paper in which they showed that there were various timing attacks that could be conducted, but they focused mostly on privacy and users' privacy concerns. So two of the attacks of the four that they had, two of them are relatively interesting for us. The one was a browser cache snooping attack. So basically the idea there was through JavaScript they could measure load times of pages and based on that load time they could determine whether you'd already visited that page in the past given it was in your cache. So there was a privacy implication there. They also had another attack where they used a Java applet to make DNS requests. Based on the timing of those DNS requests, again, they could snoop on your DNS cache determine if you had made that request somewhat previously. But if we move a little forward, we get to the slide that I titled in this entire presentation. I think it's fairly punny, so feel free to laugh. I call it Web Timepoint 0. You can grow in as well, feel free. It is that bad. Last year we had two papers at Black Hat by Grossman and Nitzel Kowski and also by Spy Dynamics. And basically those guys all released JavaScript-based port scanners. And although they weren't explicit timing attacks that they used, the tools used an implicit timing attack to gather information. So one of the legs of their tool was basically if you tried to make a connection to a site or to a host on a port and that connection timed out, you could infer certain information about that host. And that implicitly is a timing attack, right? You don't know that that port is actually closed, but based on a timeout you're saying, we're going to infer that there's nothing there. And then a little earlier this year, a couple of guys from Stanford released a paper where they explicitly brought timing attacks to the internet, to the web. So they were conducting timing attacks against websites to see what information they could derive. And it was quite interesting. What they found was that you could split them into two categories. The first was direct timing attacks. In a direct timing attack, the attacker would make a request to a site based on the time of the response and information. So one of the aspects they looked at was, for instance, you have these picture gallery software where users have galleries and they can mark some of them as private, some of them as public. And based on the length of time that it took to build the response when you try to view a user's gallery, you could determine how many galleries that user had, even if they were marked private. So it's a basic timing attack, but it serves that purpose. One of the others that we'll get to a little later is inferring the validity of a username based on the time that your request took to come back. And the second point that they had was cross-site timing, which we'll talk about a little. This is pretty interesting. What they found was you could send a browser or a victim JavaScript from your own malicious website. And then based on that JavaScript would conduct or would issue requests against third-party sites and based on the response of those, or the timing of the response of those, you could infer whether that victim was logged into third-party sites and so on. So that cross-site timing, we believe is quite an interesting field to look at. Okay, so now that the background's done, we're going to take a look at when you pin testing. Okay, one of the things that comes up is you quite clearly need to establish a good communication channel with the box that you're attacking. Okay, so we're going to take a quick look, a quick progression at some remote command execution attacks. You find in the old days there were tons of applications vulnerable if you can bring this up on screen reasonably. Okay, and so if we take a look at this application, this is a pretty straightforward command injection attack, allows you to put in an IP and instead we're going to tell it to also run our command. Okay, and in this case, what's clear is this application itself gives us the channel we need to get our data out of the network. Okay, so you'll notice whatever we do, the app comes back and the app gives us whatever it is we need to know. You don't see so much of that anymore, mainly because you don't see so many applications written by sysadmins anymore. Okay, instead what you find is lots of applications making trivial SQL injection mistakes. Okay, so if we take a really quick example of a SQL injection problem, you'll find that again with SQL injection you sometimes find yourself lucky enough that you find a SQL query that actually returns results to you. Okay, and if it's going to return results to you, then you're fully able to use the channel itself to start to get information back. So what I'm doing here is just Union Select name from sysobjects and what you should find is that your SQL query should concatenate and again, you're able to use the channel itself to start to get information back. Okay, this would be perfect except it doesn't occasionally that avenue isn't open to you. You often find that in the past, through completely poor firewalling, you could actually run your attack and then have the victim box send a shell all the way back to you. Okay, again, it's a total pleasure. You don't need to do a lot of work. You've got your channel with the box. Okay, so the question is what happens when things start getting a little harder? A little while back, we came up against a web application. It was actually just the search box of a web application that had code similar to the pseudocode sitting behind it. Okay, and what you'll find if you look at the pseudocode is that a regular expression search is being done with input that the user gives it without the user input being saved at all. Okay, so it basically gives you a chance to use malicious input which then gets passed to this backend regular expression. So it expects a move or it expects something else, and instead what we do is use a regular expression for eval and we throw that into our browser. Okay, so what you'll notice here, we're just throwing in the uname command and uname possibly ran, but there's no way for us to get feedback to know exactly what happened. Okay, in our example, that box was tightly firewalled so we found ourselves with no channel at all. What you did find though is that you're able to, instead of just asking it for a name, tell it to sleep 10 seconds. Okay, and what you should see down here is that the browser now hangs as this thing sleeps 10 seconds. Okay, which puts us in an interesting position. We're now able to get feedback on our command as it executed on the server. So instead of just telling it to sleep 10 seconds, we actually figure out that we're able to make our embedded command longer. Okay, so exactly the same way we said sleep 10, we're now telling Perl to call system to call sleep 10, which seems a little contrived, but actually the reason we're doing it is because we want the output of our sleep to go inside of Perl so that we can start mangling it on the remote system. Okay, what you'll find is this quickly leads you to much, much more complex Perl, and what you see down here is us saying run the command uname, then take the first character for uname, find out what it is or what its ordinal value is, and then sleep its ordinal value. Okay, so then we can say sleep the first character, sleep the second character, sleep the third character, and we should be able to get the results of our input, should be able to get the results of our command. Okay, so if I could get control of my presentation again. Okay, this leaves us with something like this. Okay, a script that we run, and you can see it slept 83 seconds, which gives us the S, 117 seconds for the U, 110 seconds for the N. It's painful, but you will find that you get the result sonnoss coming back eventually. Now clearly this has problems. Does anyone know the biggest problem with it? Sorry. Network delays for sure, and the second one, which is a lot more important, our analysts kept falling asleep while using this attack. Okay, so the results of that uname would have taken about 8 minutes, and if there were network delays, we were screwed.  So we were sleeping the ordinal, we were sleeping 65 seconds to get the A, where with slightly more complex pull, we could break that A down into a string of birds, and then if it was a zero, sleep zero, and if it's a one, sleep one, and that way at the most, you're going to take 8 seconds to get back a single bite. So at the time, we threw it into a quick script that we cunningly called One Time. Okay, we're not really good at naming stuff. Okay, and basically you told One Time, run this command, and the two says, every time you see a one, sleep for two seconds, and every time you see a zero, sleep for zero seconds, and what you should find is using this, you can send whichever command you want to your target server, and you should get your results coming back purely via timing. Okay, we could wait for this thing to spell out Linux, but at this point we tight on time, so you're going to have to take my word for it. It's going all the way for Linux. Okay, I'll leave it after the end. Okay, but the concept should be pretty straightforward. At this point, we're making requests, timing how long it comes back, and able to infer whatever we need to from there. Okay, SQL injection, there was a presentation earlier today, and we're going to touch on some of that stuff, but you'll find that with SQL injection, in the past there was the possibility that actually you'd have, you'd be able to use the same channel also. So, for example, we could have done execmaster.xp, command shell, echo, Defcon, greater than C, InetPub, root, backslash, dc.html. Okay, and if that goes through, we should be able to go to the box. If my spelling was correct, we should be able to go dc.html, and we should be able to use the box as our channel again. Okay, but like we said, you don't get that happening much anymore. Okay, and oftentimes, you'll find that your SQL server doesn't necessarily come back to you. So, one of the problems you have when you're pen testing or when you're breaking into boxes is you need to know whether your command executed or not. Okay, and so often what people will do is they'll try to get their target to come back and touch them somehow, as kinky as that sounds. Okay, so either via Ping or SMB or Netcat, you're going to try to elicit a response that you can measure. So, what people figured out was that here again, you are in the position to use some sort of rudimentary timing. So, instead of telling it to create a file, we could have told it to ping itself 20 times. Okay, if I could type, I would tell it to ping itself 20 times. And then again, based on how long it took, we'd be able to say something that we did definitely had an effect on the server. Okay, something else that's interesting is that you could tell it to NSLookup something. Okay, because if you tell it to NSLookup, one of the interesting properties is that with NSLookup, even if you don't directly talk to its DNS server, its DNS server will ask its parent, it'll follow its DNS tree, and at some point, something will come to your name server. Okay, so you XP on it, you ask for moomoo.sensepost.com, and then you watch your name server to see if someone requested moomoo.sensepost.com. Okay, and this obviously becomes an interesting attack possibility for us, so it's something that we figured would be worth chasing. So, when we've come across this particular problem in past assessments, typically what we did was someone hold out a cmd.exe reference manual and we'd start digging through it for appropriate commands that we could use. And the one that always comes up is the for loop. So, for instance, what we can do is construct a really bad attempt at a DNS tunnel simply through cmd.exe. So, what we've got is, again, our vulnerable website, and this line that I'm going to cut in paste here is, give me that.  It's going to execute the DRR. So, you'll see the DRR on your right-hand side. And for each token, or for each line in that directory, it breaks it up into tokens based on spaces, and then it conducts an NSLOOKUP on basically the first token to our domain, which is sensepost.com. So, let's attempt that. What I've got to show you that everything is actually, in fact, sending DNS requests is a terminal here. We've got TCP dump running. So, you will see the request coming through. All right, all going well. What we'll see on this side are blar.txt.sensepost.com. And basically, we'll get that file listing, boot.ini and so on. And this is a little bit effective. We can get a basic idea of what's happening, but there are clearly problems with this approach. So, we'll let that thing run. And what this process works for is for small pieces of data, so file names. But where it breaks are on other things. So, if your file names contain spaces, the script will break. If you've got anything binary, that script's going to break. And also, if there's anything that you're trying to extract, it's over 255 characters, it's going to break. The reason for that, domain names can't be longer than 255 characters. So, clearly, we needed to think up a better way to do this. And just to rehash that, what we've got is a SQL injection point. So, we're executing code within a database, and we've got a method of extracting DNS queries. So, this naturally led us to a tool we call Squeezer. It's inspired by the Sec 1 SQL Injector. And what it gives you is basically a very simple shell that allows you to pull server-side data into tables. So, you could, for instance, execute commands, copy files, or execute SQL queries on the SQL server itself and dump that stuff into an intermediate table. And then what it also provides you with is, in this case, a DNS channel to extract that information.  Squeezer gives us binary-safe transport. We do conversions of stuff to Hex. So, basically, if you want to copy out binary files, that's all possible if you want to copy out or if you want to do a command execution and the output of those commands contains characters that are not part of DNS domain names. That's also fine. It also gives us a reliable transport mechanism so we can implement file copy over DNS. DNS typically is UDP right, and that's best effort, but Squeezer does a layer on top of that to give us reliability. The requirements for Squeezer, if you want to run it, you're going to need Ruby. You just need a standard Ruby 1.84. Install should be good, no extra modules required. We use t-speed dump as a quick hack to get hold of those DNS queries. You need access possibly to a DNS server on which to run Squeezer. And the last point there is that you need a fairly large injection point in a vulnerable application. You're going to be asking me how large. We've got various injection strings, but they typically range up to about 600 bytes. So you're trying to do a lot of stuff in t-SQL, and this is one of the drawbacks. So very quickly, this is how we do things. We send an initial HTTP request. What that does is it builds that intermediate table somehow. And in the case I'll show you that table's built with command execution. And then for each row, we've got a piece of t-SQL that takes each row in that database. It breaks it up into fixed size blocks, which will fit into a domain name. They are the requisite length. It converts that to hex. We add a header to that, and we initiate a DNS lookup. And then on the client side with Squeezer, we've just got t-speed dump running where we capture that, decode it, and store it in our reliability layer. And then basically the last point there is if blocks are missing, we just re-request them. And in that way, we get our reliability. There's a couple of things to just keep in your mind as you think about Squeezer. The way that we get data into the tables is not related to the way that we get it out. So I can use... We'll talk about other channels, but DNS is one channel to extract information. We'll also see timing as a channel there. But those are not related to putting data into the intermediate table. So I can combine my command execution with whatever channel I want. The second point is that by default we use XPCMD shell plus NS lookup to implement our DNS lookups. But often that stored proc isn't available or you don't have permissions and so on. And so the rhetorical question that I pose here, can we cause DNS requests to be initiated? Otherwise, I'm asking the question so I guess there's an answer. The answer is, of course.  The one that we decided on was get file details. This is a stored proc that'll take a UNC path and based on that we can initiate lookups. So to show you, this is the permissions on that particular stored proc. As you can see, all that's required is execute permissions. You don't have to be essay at all. This is an example of a path that we might pass into get file details. You'll see it's a UNC path. We've got this header and then there's this fairly long hex string.senseface.com and a share. And what that does is it forces get file details to attempt to first look up this particular machine. And because of the way DNS works, of course, this request will eventually wind up with us. So we're going to do a very small demo of Squeezer to give you an idea of the test setup before we carry on. There's an attacker. He's going to be sending inbound TCP on port 80 to a vulnerable web server which passes SQL queries to back in database. But nothing can come out from that firewall. So we can't get... Well, for the sake of this example, assume you can't get error messages, you can't get Netcat Tunnels and all of that stuff. All we've got are DNS requests. Come here. Did you all see that? I'll try it again. In case you're sleeping, what we've got is some very silly ASCII Art animation. I figure that's about... That took us the other half of our time. Yeah. Okay. So what we've got with Squeezer is a simple config file. In the config file, there's a typical injection type stuff. So we'd specify a target host, we'd specify a target URL, HTTP methods to use, vulnerable parameters and all of that stuff. And based on this config file, Squeezer will construct the injection requests and send them off for us. We are a Ruby file. So as I said, Squeezer's got a couple of modes that it supports. The one is command execution mode, and that's what we're in at the moment. To give you an idea, again, we've got TCP dump running here. That's just all good. We'll switch back. So what I'm going to do is execute a simple directory listing in C drive, and you'll see our TCP dump that those requests are starting to come through. Again, these are all hexified, so it's kind of hard to interpret. But Squeezer will obviously decode all of that stuff for you with the output. So we can also break this up into blocks by default Squeezer's only requesting the line at a time, but we can request five lines at a time, and so on. And it supports lots of other funkiness. The one thing that I want to show you before we move on is it's also got a SQL extraction mode. So we've got a command mode where we can execute commands on the server. We've got a SQL extraction mode which will pull out various information from the SQL database. So the one is we've got a pre-built query that will extract table names. The interesting thing about this particular mode, the SQL mode, is that it uses the GetFileDetails stored proc, and you'll see that with the GetFileDetails stored proc we've got five requests come through for each domain name instead of the single one with NSLookup. So it's slower, and because UNC pods are shorter than domain names we can also extract less information at a time. But it is effective, and what we've got here are a list of the tables in the database. It's somewhat similar to Patrick Carlson's talk earlier. I don't know how many of you guys saw that. He's also got a similar kind of idea for extracting database schema. What Squeezer does support is it allows you to also execute arbitrary queries against the database. If you find out that there's a user's table with a password and a username column you can construct your own query quite easily. The toy example I'll give here is here's a query that will extract all of the columns in a particular table, the table sqcmd. That's basically the format of your arbitrary query is a column name, table names, and a where clause. It's fairly rudimentary, but what we'll see is that it does work. There's the first arbitrary data that we can extract. It's a column name of data, and so on. That's basically what Squeezer gives us at this point. We'll talk a little bit now about the other stuff. At this point you should be saying, what's all this DNS stuff? You were told that the stuff's about timing. The DNS stuff is cool. It gives us a channel of getting stuff out using DNS, but there is a reason we bring it up. That's because SQL Server also supports this wait for delay function. There's a few injection tools out there, SQL Injector, PowerShell, SQL Ninja, SQL Brute that try to use wait for delay, but most of them use them as a sort of Boolean operator. They do a M-I-S-A if I am wait for delay 10, if I'm not wait for zero. If you consider that what we've learned from Squeezer 1 and consider what we figured out from one-time.py, you can pretty quickly put two and two together and say, we can do the same thing on SQL Server. Let's execute our commands, let's dump it into a table on the database, and then let's use the same sleep commands to decide how we read our output. This gives us another chance to check a little bit of how lamely I was doing this. The first thing we came up with was something else cunningly named AnotherTime.py, and what AnotherTime did was you gave it all of your details for the SQL injection point, and then you just told it the command that you actually wanted to get back. Okay, and pretty simply, this is doing what we discussed. It's going to run your command on the target server and then sleep for two seconds for one, sleep zero seconds for zero, and at this point you're going to start to get your information back from SQL Server, but purely using timing as your vector. Okay, so where the previous one used DNS, in this case you assume even DNS can't come back to you, you're just going to get your data out using timing.  Does anyone know where this is going to go wrong? It's not our guy sleeping. Again, the problem is going to be potential latency on the line, which brings you to Marco's creveness. Okay, so when we implemented this in Squeezer, what we figured was actually we need to think about that timing issue a little bit more. So I'm going to give you a brief demo of the way timing works in Squeezer. So what I simply do is I switch my channel from DNS to time, and I can execute, we switch back into command mode, and then we can simply execute a hostname. Now, as Harun said, the problem with sort of specifying static values for, say, a threshold value. So a typical way to approach this would be to say, well, we'll ask the request to pause for two seconds, and anything that comes back over two seconds will take as a one bit, and anything under that will take as a zero bit. But the problem arises, if you get a request that takes 70 seconds, at that point you're not in any position to actually say if that was a zero bit or a one bit, because there's too much, there's too big a differential there, clearly something went wrong. So the approach that we took here was to introduce a calibration mode for the timing channel, and basically within the calibration mode what we do is send out a bunch of samples, sample requests for zero bits and one bits, and there are appropriate delays, and we do a bit of simple stats on that, and what we derive are two landing pads. Now, you'll see that over there, my hostname has come back, it's intranet mh, so the timing channel clearly works, I can simply switch between that and DNS. So to get back to what I was talking about, this thing, this is in the slides if you want, go and check this. It's basically a summary of what I said, but essentially what we get is this thing, we diagram with timings for one bits and zero bits, and so with a bit of simple stats, what we can do is derive two landing pads, one for the zero bit, one for the one bit, and then all we do is if a request lands, or if a request timing lands in one of these landing pads, we'll treat it as either a zero bit or a one bit. If it does not land there, then we can simply discard it. And so by doing that, what we introduce is a measure of control over the timing values that we get back. A couple more things with Squeezer, so just very briefly, we also support the original SQL Injector HTTP error message channel, so that means Squeezer's got three channels, you can get info out via DNS, via timing, and via HTTP error messages, dependent on your circumstances. It also supports file transfer, so you can copy files from a server to your local client, and the third point is H's word, you can just basically keep adding on there. But Squeezer's hopefully written in a way that it's fairly easy to add other modules to it, so if you've got other channels and so on or other modes you'd like to add, it should be pretty simple. Something I'd like to point out at this stage is that Squeezer is MS SQL Server-specific, and that turned out because that's what we conduct our assessments against for the most part. But we believe that most of these techniques should carry over to other databases if they have support for most of those, so DNS requests and a pause, literally you just need a pause function. So you can find out a little more about Squeezer at that website, the stuff's not up there yet, when we get back to South Africa we'll stick it up, but what you can find out, or where you will find Squeezer currently is on our blog, it's posted there. Okay, so I'm going to start talking even faster. Timing as its own vector starts to become interesting when you application pen testing, and it's not just because pen testers want to write down used genetic error messages in their report. Okay, you'll notice that any app that betrays or tells you whether you're a valid user or not is giving away information that's useful as an attacker. Okay, we have all ever been saying this for a really long time, so it's not that common for you to find an application that'll tell you you have an incorrect username or you have an incorrect password, because if we were able to trivially mine usernames on your system, that would be a pretty big deal. It turns out, though, that there's often subtle timing differences for valid user logins when the user exists and when the user doesn't. We just haven't been timing them that often. Okay, you find it particularly prevalent when some sort of hardware token is being used. If there's a round trip time that's needed for a valid user as opposed to an invalid user, it's pretty easy as a remote attacker to say when I put in this name, it took longer because it was going all the way to the hardware security device. Okay, so we spotted this example a little while back during testing. We're obviously not hitting the live site right now, but if you pay really careful attention, you should see that for user Bob Bob, that happens, and for user Marco, whatever, that took a millisecond longer. Okay, so in the example that we were looking at, you basically found yourself in a situation where if you threw a big enough username, if you threw a big enough, sorry, if you threw a big enough username at the target, you were actually in a position to time whether a user existed or not. I can't actually see what I called it. This was called yet another time. Okay, so you take yet another time, you pass it a huge user list, and basically what it does is times how long the login took to come back, and you can see there for user Marco, it figures that took a millisecond longer, it's doing some rounding, but basically it comes back and says that's a valid user while the others were not. Okay, this becomes interesting to us and scary at the same time, because we took a look at a whole bunch of popular web application scanners, and from the little reading that we did, none of them make any mention of ever checking for timing stuff, so they'd happily tell you that you've got a different error message for valid and invalid logins, but if that difference was coming through on a timing channel, most of those scanners would be blind. We've got a web app scanner called Suru. Some of you would know we put it into Suru, but we've actually only put it in after we discovered this, so if you've got another app vendor, you should probably speak to them and have it bolt into the tool, which brings us to another place where timing gets interesting, and that's with privacy or privacy. Okay, so for those of you who know the same origin policy or have heard of the same origin policy, basically it was there to protect you online. It said, if you get scripted from my page, my script shouldn't be able to figure out stuff about what you're doing on some other page. Okay, so the question is, how did Jeremiah and those other clever guys figure out how to do the port scanning coolness, and Mark already told you they used some sort of timing. They said, go fetch this resource and we'll time it, and based on time, we'll figure some stuff out, because it turns out that the same origin policy doesn't really work for timing stuff. So it does allow me to time what's going on on another page, even though the same origin policy is in place. Okay, so after Jeremiah and them came out with port scanning, there was the history hacks where they basically tried to figure out using CSS if you had visited another page or not. In honesty, like Marco said, way back in 2000, Felton had figured some of that stuff out, and basically what he did was, he tried to make a request to Scientology.org, logo.gif, figured it took 80 milliseconds, sent you a Java applet, and if you got it in 10 milliseconds, he said you got it from your cache, so clearly you visited Scientology.org before. Okay, at this point during our testing, we were actually really excited. We thought we invented a new acronym, so we thought we invented cross-site request timing. Unfortunately, Andrew Boatts earlier this year at a conference published it and discussed it, and we did pretty much the same vector as he did, which basically says if you visited LinkedIn or in this case Facebook, and if you made a request for friends.php, if you were logged in, you would get this page, which is a whole bunch of HTML, and if you weren't, you'd get this page, which is a very terse you are not logged in message. Okay, so obviously if I was timing stuff, I'd be able to figure out whether you were logged in or not based on how long that page took to load in your browser. Okay, so really simple, you visit my page, I have you make a request there, and I figure out if you logged into Facebook or not. There's a small problem that needs overcoming, and that's line latency. In South Africa, it takes us about a minute anyway to surf to anything, and so we needed something to normalize that. So what we do basically is introduce the concept of a base page, so you come to us, we tell you fetch friends.php, but also fetch login.php for example, and based on the ratio of those two pages, we get a latency neutral way of determining whether you are logged in or whether you aren't. The question down there is what about cached pages? We get to handle it simply, so we have you load the pages twice so that we're always getting your timing off your cached page and whether you cache it or not doesn't make a difference to us. Okay, so the quick example we're going to look at here is a webmail system. Okay, I'm going to quickly log into it, and actually this is the trickiest part, webmail sometimes breaks. Okay, so what you've got here is pretty straightforward, one guy logged into webmail, he visits my page, and my JavaScript basically loads two frames. One is the base page, and the other is his inbox, and based on that I say, yep, you are logged into webmail. Okay, and so we can test that and sign him out, and hopefully reloading this page should come back and say, sorry, you're not logged into webmail anymore. Okay, so like the slide says, this is entirely underwhelming because we're now able to tell someone on a web page whether he is or isn't logged into webmail. Okay, but why this is interesting is because we can actually export this information so that an attacker sitting out there on the internet is able to now figure out if the user is or isn't logged in. Okay, so what you're seeing is the request going to a complete stranger saying yes, this guy is logged in or no, he isn't. Okay, so if we summarize all of the things that we've spotted really quickly, you'll see a whole bunch of things starting to converge. Firstly, you have sites on the internet that'll tell you whether a user does exist or not based on timing. Then you've got something worse, is that you can figure out whether a session is valid or not effectively based on timing. And then you get the last bit, which says instead of using my timing, I can use your browser to figure out whether someone's logged in or put time on that. Okay, so really quickly, this allows us to introduce the last part of our acronym, which is distributed cross-site request timing. So basically, if you remember with timing.py, I could determine if a user existed or not. But now with JavaScript, instead of running the Python on my box, I can run it in JavaScript on your box when you visit my web page. Okay, the small problem you have is JavaScript's timer is not granular enough. Fortunately, a little while back, Lars Kinderman found that you could call Java applets directly and it's the trick that Jeremiah and PDP and guys used to get your IP address. So we use the same trick to import Java.Language.system's nanotimer. So we get a much higher res timer inside our script. Proof is that's a small number and that's a bigger number. Okay, but effectively what it allows us to do is have you visit us. We send you JavaScript. You run JavaScript trying to run a whole bunch of brute force attacks based on timing. And once you get a success, you come back and tell us whether it succeeds or not. Okay, which brings us to this last screen, which if you look at what's going on down here, we basically load, so some guy visits us.  It's going to come back and say, when I tried user Harun, I actually found that user Harun existed on the system. Okay, so there's username Marco and there's username Harun coming through. Okay, so effectively we're looking at this Vizio here. We either inject our cross-site scripting onto some popular page, get ourself upvoted on Reddit or Slash.  Guys browse our site. As they get to us, we send them user lists. Okay, and everyone who visits our site becomes our zombie trying to log into this victim application. As soon as they find a user that exists based on timing, they send the success back to us. Effectively we've done nothing.   They come back to us with valid users or valid sessions. Okay, so really quickly in conclusion, if you're developing, you need to make sure that you're not throwing information away via silly timing channels. You need to look at cross-site request forgery because lots of this uses the same sort of thinking. Network admins. You need to re-look at least privilege. Figure out whether your SQL server really needs to make DNS requests at all to stop the DNS channel. You need to be watching your network to look for timing stuff going through. If you're pen testing, if you're a researcher, some interesting area for research is going to be injecting fake headers into XSS because if you can do that, this whole attack goes into a whole different space. You can basically brute session IDs, the worlds you're oyster. Grab a copy of Squeezer from our blog. Send us feedback. Make sure we make Marko work on it. He doesn't have a social life anyway. Add modules. It's true. Add modules. Drop us feedback. Visit us on the blog.  And if you've got questions, we'll be down in the question room.


Hello, welcome to the session on cache memory principle. I Mr. Dayanand Patil, working as assistant professor in department of computer science and engineering, Walsh and institute of technology, Solopu. At the end of this lecture, we will be able to explain the cache memory principle and differentiate between the main memory and the cache memory. What is cache memory? That cache memory is a small and high speed RAM that is located between the CPU and main memory. This memory is small compared to the primary memory and the secondary memory and it is much the speed is high compared to the primary memory. The cache memory holds a copy of instructions that is currently being executed. We are already familiar with the basic concept of the memory while executing the program that program will be loaded from main memory to the secondary memory to the main memory. So after loading to the main memory, CPU will access those instructions from main memory and it will execute. So, while accessing from main memory that instructions which are currently being used, those are loaded into that cache memory. That cache memory will hold that copy of the instructions currently being executed. When those instructions are repeatedly used, those instructions are accessed from the cache memory only. The main purpose of cache is to accelerate the computer speed because that cache memory is speed is very high compared to the primary memory. If the instructions are copied in a cache memory, if it is repeatedly used, so that time that CPU will access those instructions from the cache memory, so that time that speed of execution will be increased. So, while considering this reading the instructions from the cache, these are the two important term that is cache hit and cache miss. That cache hit is when that executing application needs the data and that data will be find first in a cache memory. If that data is available in a cache, that if that data is accessed from the cache that no need to access the main memory for that instructions. So, if that data is available in cache memory, that cache hit occurs. That cache hit means the data which is required for that executing applications. If it is found in cache memory, so that is the cache hit. So, then cache miss is when the application needs a data and that data that data does not find in a cache memory, then that CPU needs to access that data from the main memory and it will execute. So that accessing that data from the main memory will be slower. So, if that data does not find in a cache memory, we will say that that is the cache miss. Here we can see that CPU that cache is located between the main memory and CPU. So, that word if it is found in a cache that word is transferred in the CPU and cache. If that CPU is accessing the main memory in case of the cache miss, it is accessing that block from the main memory at a time. In the next slide we will see that what is block and what is word transfer. So, to calculate the hit ratio, so that formula for the hit ratio is total number of hits divided by total number of hits plus total number of miss. This we can say that total number of access, either it might be cache or main memory. So, that total number of hits occur divided by total number of hits plus total number of miss is the hit ratio. The cache or main memory structure. Here we can see that. So, assume that this is that main memory structure and this is the cache memory structure. So, here So, here we can see that main memory is divided into the equal number of sorry the number of words the size of each word is same. So, we are saying that this is the word length usually it will be 1 by 2 by 4 by but here we are not interested in the size of the word. So, here we can assume that that size of each word is 1 by if I use the word 1 by or 1 word they both are same here in this lecture. So, it is divided into the number of words the length of each word is same and again this memory is divided into the block. So, here in this lecture we are assuming that the number of words are divided into that 1 block equals to the 4 words that memory is again divided into that number of blocks each block containing the 4 memory word here we can see this is the zeroth word this is first word second word third this is the binary address this these first 4 words are considered as 1 block. So, these are binary address up to 2 raise to n minus 1 here the n is the number of bits used to give a binary address for each word. So, based upon the memory size we are using the number of bits to address each word in a main memory. So, these blocks whenever that CPU access the main memory it will read that 4 blocks at a time and loaded into the cache memory. So, here this is the cache memory we are considering. So, that block length that block length means the CPU will read the 4 words that is 1 block at a time it is loaded into the cache memory we are saying these are the cache lines zeroth line first line second line up to c minus 1. So, that it will be divided into 4 words as a 1 block and it will be loaded into cache and whenever it will read the 1 block that is loaded into the cache line that the size of the cache line equals to the block size of the main memory. So, 4 blocks are read at a time those 4 blocks are loaded into each line of the cache. So, these are the line number this tag and this is block the block is that 4 words are loaded into the block and what is this tag. So, here we can see these are this is the minor address of each word. So, this based upon that size we are using the number of bits, but always last 2 bits identity the 2 bits are identifies that block number the word number in each block. See this is the zeroth block in the zeroth word in the first block this is the first word in the first block second word in the first block third word in the first block next again see here we can zeroth will repeat here zeroth this is zeroth block from the next zeroth word from the next block first word from the next block second word from the next block. So, so on. So, this will repeat again for the next block. So, these are these last 2 bits identifies the word address in each block. So, the remaining bits will be common for each block here you can see the MSB 6 bits are same for zeroth block again the next 6 bits are same for next block. So, these MSB 6 bits are considered as tag address and this will identify each word we will see the next video lectures. So, this tag address hold which block that word belongs to and if that tag address is present in any of these cache lines then all those blocks in that line belongs to that is stored in the cache line. This is time to reflect the question is the total number of memory access is given that is 12 and heat ratio is given 0.5833. Now, we need to calculate the total number of heat and total number of miss that we have as we have discussed the formula is the heat ratio equal to total number of heat divided by total number of hits plus total number of miss the total number of memory access is given that is total number of heat plus total number of miss and the heat ratio is given that 0.583 0.583 divided by total number of hits divided by 12. The total number of hits equal to that 12 into 0.583 is 7 and the total number of misses that is 5 is the total number of miss this is the simple mathematics. So, you can calculate from the given parameter that basic principle of that cache memory. So, starting CPU request the content from the main memory location if the CPU request for the main memory location first it will check for that required data whether it is available in a cache. If it is found in a cache then we say that cache heat that access from the cache. If not present read that required block from the main memory and that block is loaded to the cache and deliver it to the CPU parallelly. I cache includes that class includes tag to identify which block of main memory is in a cache slot just we have see that first we will check for the that cache tag and if that block address is found then the all words in that block will be present. We will see in the flow chart. So, this is start at the starting that is CPU will generate that receives that address that array from the CPU that CPU generates the read address. So, that based upon the read address it will check whether that block is containing in a that read address is containing a cache that the tag address available with each cache line. So, if the tag that block address is available in the cache tag means all the words are available in that clashed cache block. So, then the next step is if it is yes then fetch that required address word from the cache and deliver to the CPU and that execution is done and what in case of no. So, if it is no if that block is not available so that access the main memory from that access that particular word from the main memory that containing in which block and then allocate cache line for that main memory block once that it access that block from the main memory it will allocate that cache line for that particular block from the main memory and that block is loaded into the cache. Here the two tasks are performed parallely that one that load main memory block to the cache and deliver that required address word to the CPU. So, after performing these two tasks so that it will complete and that is done. So, this is the cache read operation that is flow chart for the cache read operation or that cache memory principle. These are the references I have referred. Thank you.


From the Revolutionary War to Operation Enduring Freedom, the Army holds a long history of women in service. Be it seamstress or soldier, riveter or rifleman, women have earned their place in the Army's Warfighting Hall of Fame. Women like Mary Macaulay, a.k.a. Molly Pitcher, for carrying water to soldiers on the front lines during the Revolutionary War. And Mary Corbin, who fought alongside her husband after he was wounded in battle. American Red Cross founder Clara Barton for her efforts before and after the Civil War and Latter-day Joan of Arc Annie Ethridge for her heroism during the Battle of Fredericksburg. Dr. Mary E. Walker, who served as an assistant surgeon during the Civil War and Confederate POW, was the first and only woman to be awarded the Medal of Honor for her gallantry. Determined to contribute to the war effort, former slave Cathay Williams disguised herself as William Cathay, making her the first African-American woman to be enlisted in the Army. And many are unaware that underground railroad pioneer Harriet Tubman risked her life to help recruit slaves into the Union Army. Throughout many wars, women also served in hospitals as nurses. In 1942, Brigadier General Anna Mae Hayes was commissioned into the Army Nurses Corps. She later went on to become the first woman to be appointed to the rank of general officer. Also in 1942, following the attack on Pearl Harbor, Congress approved the creation of the Women's Army Auxiliary Corps, or WACC. Organizations like the WACC paved the way for soldiers like Sergeant Leanne Hester and Sergeant Monica Brown, both of whom received the Silver Star for exceptional valor in combat and the first women to receive this honor since World War II. These women and many more, like the military's first female four-star general officer, General Anne E. Dunwoody, proved that the heart of a warrior is not limited to one gender.


The biker community is infamous for being hard to engage and often impervious to the usual road safety campaigns. They are also particularly vulnerable. They make up just 2% of French road users, yet account for 20% of all deaths. But though they may think most of their accidents are thanks to careless drivers in urban areas, in reality most fatal accidents happen on wide open roads, in the countryside, in broad daylight. So our insight was, the biggest danger is thinking that there is no danger. In this peer-to-peer tribe a top-down and outside-in approach would not work. Only a campaign which truly understands them would be spread around and generate the needed conversations within the community. To do so we created a holistic 360-degree campaign to put the keys for communication in the hands of bikers. Through storytelling, a 30-second spot featuring a famous biker stunt driver. Every day the rider risks his life. But all this is quickly forgotten at the first chance to open the throttle. When you ride the biggest danger is to think there is none. We set up an experiential event in Paris and around the country at biker meets. Online PR to engage with biker influencers, traditional and specialized media relations, a dedicated YouTube channel with additional content. The campaign resonated far more than we could have imagined. Targeting France's 1.7 million bikers, we got 1 million views on YouTube and 250,000 unique visits to our website, leading to hundreds of online comments and memes of the spot. The year following the campaign, France saw the lowest number of motorcyclist deaths on its roads for at least 15 years. A considerable 14.5% decline over the previous year and 110 less lives lost.


So MTC is known to migrate application from one OpenShift cluster to another cluster, but in this case now with this new feature I can migrate an application on the same cluster, but changing the underlying storage for one or multiple applications So here's I just went to the operator hub I've already installed the migration toolkit for containers So if I would go to the install operators now, you can see it's already deployed If I click on it all I did after that is to Create the instance of the migration controller So the migration controller by clicking that button will install the controller inside MTC And will deploy the UI for me to and all the other components I need to actually execute this this migration so here I actually just Use the route of this application now of my MTC operator To connect to the UI with the same credit and shoulder that would connect to my cluster And the host where this is installed is already pre-configured for me and as I'm migrating to the same cluster I'm doing in place migration. I don't even have to add additional cluster I'm just gonna migrate from this cluster to this cluster, which is the host I'm on right now Then I'm gonna create a migration plan And I will pick an application and change the underlying storage. So here. Let's do that I'll call this plan demo and And This is the new this is where I will find a new capability, right? So MTC has been known so far for migrating to do full migration including pvs from one cluster to another I can do state migration, which was a feature. We already had in 1.6 Allowing me to migrate the state or just the pvs from one cluster to another But potentially we deploy my application from pipeline on my secondary cluster So sometimes it's only the state that I need to migrate But from but with the storage class conversion feature now, I can stay on the same cluster I don't even have to migrate to another cluster. I can just select that I will select the host I'm on right now, which is the only cluster available. Anyway, I'm gonna click next and Here I only have two simplistic Projects which are websites. I'm gonna click on the first one and this is the one I want to migrate the underlying storage, right? so let's click next again and MTC will look for all the pvs that exist inside that that namespace and will allow me to to pick a new New storage class for those pvs So let's give it a second So here only one pv was found I could potentially have multiple pvs with some other applications but in this case, it's only one pv claimed by a mi SQL at a base and And There's the type of storage class class doesn't really matter Actually, what is used behind the scene is our sync to copy the data at the file system level So this would be working from any storage class to any storage class. So think about changing technology from one type of storage to another one or Changing to another storage class that would have more space into it If I'm running out of space, so there's all kinds of use cases Where this is applicable. So in this case here, I'm just gonna select another storage class, which is Which can be anything that I would have available in my cluster. I'm gonna click next And that's pretty much it now my plan has been created and I will be ready to execute this migration And again in this case, I only selected one namespace But I could also do mass migration of storage class classes So if I would want to migrate a large amount of application from one storage class to another then I could do that as well So now that my plan is ready, I can execute this plan. So I can either Stage so what stage you would do is pre copy the data to my new storage class and We'll reduce the downtime when I do cut over as this is our thing that is actually doing the migration It it depends on the kind of file system I have at the amount of files and so if I have multiple files, it might be better to do stage To reduce the amount of downtime because when I do cut over to do the final copy I will need to shut down the application to finalize that copy before we can relaunch it again This is to make sure that we don't have any data That is still in memory or any log files So there's a little bit of downtime, but that can be reduced by doing the stage process first in this case for demo purposes I'm just gonna click cut over and I'll and I will click the migrate button. So this will take a Little bit of time a few seconds or a few minutes depending on how much data needs to be copied over If I would want to see what's happening during this process, then I can click on the migration button here and I can go down to see in details. What is happening during the migration? So all and if anything goes wrong, you can also look at the migration resources That are behind where I could potentially look at the logs or the describe of the of the CR to understand Exactly what happened behind the scene, but hopefully this will go well here We'll let this run and then we'll come back at the end of the migration. So that's it This is how you can actually do in place storage migration using the new MTC 1.7 race. Thank you


So people, I am back with another Destiny 2 video, two in a day! What is going on? But today guys, I'm going to showcase to you how I've gotten to basically that soft cap by the end of the Beyond Light story campaign add-on. That quick. How's it going guys? My name's DP Jane. If you enjoyed the video, leaving a like really helps out and if you like what you see and want to see more, be sure to subscribe. So we all know by now that all in which we need to obtain loot to maximise efficiency in gaining quick power level. Hit that soft cap via getting blues, use those powerful gear to get to that hard cap, then pinnacle to get to the pinnacle cap. With Beyond Light, they are as follows. Soft cap is 1200, 1200. Hard cap is 1250, 125 and pinnacle is 1260, 1260. So use blues to get to 1200, powerful to get to 1250 and pinnacle to get to 1260. It is as simple as that. Now this is what I've done and have been doing for a long while and although I haven't really posted much on Destiny for a long long time, I've still played the game. So the best way to hit that soft cap of 1200 is obviously blues, but the quickest method in doing this is as follows and this is what I have done. So firstly, do the story. Complete the campaign add-on for Beyond Light. Get this added away because along the way of you doing this you will get so many blues and legendaries drop which will boost you up for sure. Even if you rush through it, you've got no choice but to take out adds or pen chests and on your way you'll even find yourself doing the Adelaus Sector and Public Event which will also give you those beauty for blues. So once you've done the campaign, the other best way to earn guaranteed fast blues which are stupid high level sometimes 20 higher people is to get those gold chests on planets. Now with the Cosmodrome coming back as well as Europa, there are a ton of these gold chests which guarantee that high level blue loot or even legendaries sometimes. All are also marked on both maps so they're real easy to get. I mean I'm almost at that soft cap already and I still have gold chests to collect and if those gold chests don't get me to that soft cap it's a quick in and out public event job where I just go through each planet do the easy public events then just fast travel to another one. It really is as simple as that guys and it's seeing me get into that soft cap in little time and it leaves me with everything else still to do in regards to powerful and pinnacle. So yeah guys as of right now I am level 1198. I've still got basically all of Europa's gold chests to open so my means of doing this and getting to that soft cap is definitely one of the quickest out there and if you do decide to do it I hope it helps you out. But on that note guys we have come to the end of the video if you guys enjoyed it leaving a like really helps out. If you're new around here and want to see more Destiny 2 be sure to subscribe and if you never want to miss a video I upload can turn notifications on by hitting that bell button guys. Thanks as always for stopping by hopefully you enjoyed the video and hopefully I will see you on that next one.


PUSH control pregnancy went 250 degrees, 1-0 Keesley, 1-4 You're climbing out of the structure, left turn, climb on course, cleared for takeoff All right, you take 1-1 1-6-2.5 seconds Now, can you hear me? I'm on the stretch, we're ready, we're ready Three sub-parts here, hold Got it Job told, right? I have a work order to radio Aircraft 1-1-6 On Baker 1, UHS enough Roger, work order to radio, 1-1-6 That's a good message, and once checked in 500, 5-step, 1-return of missiles Not required No toes Noted Watch enable switches A and will Mark 4 Mark Sunstar 0-3 You've got your show Roger, ready for disconnect now We are in the command post of the strategic air command at Offit Air Force Base 10 miles south of Omaha, Nebraska From this location, some four stories underground The endless activities of SAC are precisely monitored and controlled Every second of every day The controllers, who man this facility Provide the length between the president through the joint chiefs of staff And the commander in chief of the strategic air command And the length between the SAC commander And the strongest and most ready military force ever conceived A moment ago, the duty controller pushed a button and picked up a telephone And those two simple motions Put him in touch with over 70 subordinate SAC command posts Command posts which supervise over a quarter of a million people The strength of SAC is its people Their every effort contributes to the success of the mission Who they are, where they are How they feel about their jobs is our story A story best told by the people who live it every day This is Navigator coming up on EIP in one minute That was a navigator telling us that we're coming up on our initial point This is the point from which the bomb run actually begins The bomb plot is going to be looking for us at this particular point And we must arrive over this point on the ground So that they can pick us up with their very narrow beam radar After we pass over the IP or initial point The bomb run effectively begins And everybody in the whole crew The radar navigator and the EW and the co-pilot gunner Everybody's concerned this time of getting the bomb on the target When I say put the bomb on the target I don't mean it It's an actual bomb, it's a simulated bomb The Air Force or SAC stations these trains At about three month intervals Places around the country Most of the places are isolated So that the targets would be difficult to find And SAC sets up all their equipment To score the bombers as they come across this bomb plot Knows where we are and when we release the weapon Plot us down and grab a big plotting board For my crew and for most of the crews in our wing While we fly approximately three sorties a month That's three missions a month that we fly On these missions I'd say we've had maybe Oh five or six bomb runs And this is not only my crew The crews in this wing, the crews in all the wings The squadrons in SAC Twenty seconds to go, the radar navigator Actuates the tone downstairs with a switch He turns his tone on, the bomb plot hears it And they track us, their final track On their big plotting board Now set up number one, I'll get them Twenty-five, ten Get a similar tone That's forty-five left It's okay, bomb door's coming open Roger, two, one So we're in frame number 0172, gunner 172 That's the first run, we have several more We won't know how well we did until bomb plot Computes and calls back to us our coded scores Like everything else of this nature it requires A great deal of practice Practice to keep ourselves at peak efficiency And carry out SAC's mission of deterrence That's deterrence not only for a nuclear war But to keep a limited war from escalating into a nuclear war Maintaining a nuclear deterrent Demands precise and positive control of the force This applies not only to the delivery of weapons In time of war, but to the readiness of them In time of peace We live positive control, we have to Behind that console and those screens up there Are over one thousand combat aircraft and nearly one thousand ICBMs Positive control evolves around a system called The two officer policy That is to say at any level of command In regards to positive control No action towards a strike or execution of force Can be taken without Concurrent actions by two designated positive control individuals Regarding the aircraft It can be launched under positive control And continue to appoint geographic fix short Of enemy territory If prior reaching that fix They have not received a valid and authentic go code They will turn around and return home without striking Receipt of a valid go code By a combat crew in flight Must be verified by the aircraft commander And at least one other positive control officer Even if they should experience radio failure While airborne and enroute to this geographic fix They would return home because they have no possible chance Of receiving a valid go code Now in regard to missiles This is a missile procedures trainer Where crew members can practice almost everything That they can accomplish in an actual capsule operation And get the proper reactions Now I can take this key Insert it and turn it And I wouldn't launch any of the ten minute man missiles That I monitor It takes another key in the hands of my deputy Turn simultaneously with this one After we've accomplished several checklists To get a vote in Beyond this it also takes two other crew members In another capsule miles away To accomplish the same procedures In order to launch any missiles This is an aspect of positive control That is very precise If we should undergo an all out attack It is planned for the missile forces To ride it out underground Any decision to launch Must come from the president Whatever happens we'll be ready Being ready means many things To the crews of the minute man To the combat crews it means being prepared At the beginning of each duty day To pass a test of procedures With a grade of 100% For this is the only passing grade And if an individual does not achieve it He does not go on duty The single duty day averages 30 hours From portal to portal And being ready means being psychologically And physiologically fit We spend 24 of these hours 60 feet underground In a capsule enclosed by earth And reinforced by concrete and steel Through change of command After change of command The systems are kept in the green Ready to launch in a matter of seconds Miles from the consoles Of the launch control facilities Are the silos of the missiles themselves Almost 1000 of them Are deployed in areas isolated and remote Here the men train to send The minute man missiles on their way Backed up by those trained to maintain them And what they do Lends true substance to the definition of Being ready to go They're always checking us out one way or the other They say we're highly skilled technicians Why shouldn't we prove it Now in the process of removing the missile With the transporter erector To send to Vandenberg for test firing When we do get the word We're going to launch one at Vandenberg The teams immediately pick up in morale We've been working on this missile for quite a while We have no doubt whatsoever That the maintenance has been performed correctly The missile field is different From the aircraft field Because the maintenance people in the aircraft field Can see their bird fly every day Missile people can't They just go out and work on it It comes in the green That's the last they have to do with it Until it goes out again They never see it actually fly Until they get a proficiency launch Basic idea for the missile crew members Is to get experience launching Actually launching a missile And they can't see them when they launch it themselves But they know it's all actual operation We sometimes think that we're sitting out there That a big man on the other side Stops and looks and takes inventory Of our deterrent circumstances here And he says to himself today isn't today And as long as we can continue Having him say this every day We're continuing this deterrent effort And it is effective We expect it to be a perfect launch With no hold ups, no delays whatsoever Everyone really gets out They work hard just to get to go out on these launches Because more to it than just working They get to see what happens They get to see the final result Of what we're all working for This is the peace of our nation The order for the proficiency launch Into the Air Force Western test range Comes from the commander in chief Of the strategic air command Through the senior controller on duty At the command post And it comes without warning Noted Launch naval switches And we'll arm while you breathe I agree, sir Arm left forth Which is arm, war plan, select switch Rebar in position Launch key It's inserted The port on the missile Looks good From tests like this A sack can judge the confidence of its people Ability is something you can't take for granted Even when things are working smoothly Now here in the SAC command post We get into just about everything it goes on From my position as senior controller I can see a mounting respect for the command and control system That enables SAC to carry out its daily commitments With swiftness and accuracy In the event that the SAC underground command post And alternate command posts were destroyed In an all out conflict An airborne command post Assumed direction of the command's bomber missile force And execution of the command's emergency war orders Under authority of the president We have this airborne command post Operating day and night 365 days a year Along with every other general officer in SAC And on a roster basis I am serving as the emergency airborne actions officer We have a very highly qualified And competent staff aboard here Consisting of operations Materiel Intelligence And communications people In fact it's very much like being downstairs In the underground Once we're airborne We establish and maintain contact With the SAC underground Down in the headquarters Alternate SAC command posts The Air Force command post in Washington And the joint war room in Washington Well certainly Having this facility at 30,000 feet Gives us a further guarantee That we can launch our global force Effectively in retaliation to attack Under a single tanker management concept SAC with some 600 KC-135 jet Stratotankers Is assigned the entire United States Air Force Aerial refueling responsibility Tankers strategically positioned Help to maintain the deterrent power Of the United States And are prepared at any time To extend the punch of its fighter And bomber forces Global capability means getting out bombers To the target and back again That's where air refueling comes in That's our business That's what we're here for Air refueling could be a tricky business Flying along at 500 knots Transferring up to a thousand gallons per minute As you can tell this could be a bit tricky But I feel like with our professional crews Our bomber pilots Our tanker crews Boomers I feel like that we've taken the trick Out of air refueling When we're refueling When you're flying up there And of course you know once you're refueling This is all being coordinated on the ground You know you're either refueling B-52 Or B-58 or something like this You know exactly what you're doing The air speed you're going to be flying in And you know this man when he's pulling In the back of you Has more than like they've been doing This a lot of work Now my first thoughts And I look back there And start picking out You can start seeing him On the way back from six to eight miles And you observe him closely coming in And a few thoughts that run through your mind Like this is Well one of the co-pollards Going to be refueling today One of the pilots Going to be watching real carefully And what you know You know that they are You know this man that As he comes in there Has been at the game more than likely He's a B-52 pilot He's been at the game a long time And you can watch him You can tell as he's coming in Just exactly once What type of super-pilot he's going to be But he comes in real slow Cautiously moving in very slowly Taking his time You know that he's He's thinking about refueling He's coordinated He's got it on his mind And as you observe him moving in closely Of course you're all eyeballs You're laying back there And I know for sure that When he's moving in there He's relying on my skill And I'm also relying on his skill We trust each other We know that That we're both capable That we wouldn't be there We were a few bombers Of course In this business But also in the same In the same time that we do I'd say right now At the present time a greater More business for fighters And these people When they go overseas Of course you know With our global capability That we have now When they want to move a wing They want to move a bunch of people in a hurry They can rely on KC-135 The tankers to carry them across But as well our way across there They realize that When we reach past And get to the point of Past the point of no return That we're sort of a mother We have a life of blood for them We're providing them navigation And fuel on the way over I've had fighter pilots Pull up in the back of me And we're glad to see you And didn't think you'd ever get here They know that that pipe That big iron pipe coming out there They know that that means That means getting there I'm not getting there And when you get past The point of no return You're going or coming So it's pretty nice to have A mother and son out there In regards to the conflict In Southeast Asia The wreckage at the present time Of course you know we're busy With the B-52 and the The tank fighters at the same time We feel like we have a Probably just a vital job In series is Because we see the B-52 Pulling in the back of us Loading the bombs and armament And we know the The vitality of his mission A very vital function He's performing And what it means to the people On the ground over there And the same goes true to the Fighters We get some going coming also And we know that We've been right there also Providing a job as vital Not as dangerous perhaps I realize But a job as vital as theirs Because they have to Have the gas to get there And we realize that When we were finished With these people in there On the way of the target That the man on the ground there This is more than a welcome sign to him We know the support that the B-52 And the fighters are providing there When the man on the ground Looks up and sees the airplane That the man on the airplane Is also very aware of the support That he's given to the man on the ground And this just is A one-way effort here This is everybody combined With hands flash together To get this job done The aircraft and crews in Sack are combat ready But to keep crews at peak efficiency Means thousands and thousands Of hours of flying time every year And this means getting the most From the aircraft The question then How do you keep complex aircraft From wearing out under continual use The responsibility is in the hands Of those in maintenance Maintenance schedules are adhered To as closely as any phase Of an airborne mission It begins with a debriefing As soon as an aircraft lands Each air crew member reviews The entire mission in detail With the maintenance specialists All systems that have not worked perfectly Have to be fixed immediately Maintenance control is the heart Of the maintenance activity And top airmen regulate its every beat The system the controllers use Is so thorough, so accurate That they can tell a month in advance Where each aircraft by tail number will be And what it will be doing Because on every Sack base A portion of its aircraft Are on continuous ground alert As part of the 50% of Sack's Total bomber and tanker force Ready to react well Within the warning time provided By the ballistic missile early warning system As a result of the maintenance debriefing Of this aircraft We find we have numerous discrepancies This aircraft has got to be on the alert pad And we're going to do it Keeping the strategic air command's Mighty force of aircraft operationally ready Isn't exactly an easy way of life But neither is standing alert Waiting for something you don't want to happen To happen Yep, this concludes the briefing Are there any questions? There is going to be what? We go out to brief like this morning This has been our daily alert briefing Each day of our 7-day alert tour Starts with a similar briefing Consists of weather information Operational planning factors and maintenance During our 7-day alert tour We live here in this building We eat, sleep, and flight plan here We're now going out to pre-flight Followed by mission planning Alert activity to me Is a very important thing Of course with our crew we think it's very important We think it's important to the country for defense And it's difficult to explain alert Because alert to me Means mission planning Daily brief lights Daily briefings And a great deal of study And testing For example on the first day When we come on alert A good portion of that day I'll say 75% is made up of testing Testing in the areas of Launch procedures, tactics Emergency procedures And on the mission that you're Supposed to fly in the event We would have a war As a navigator on this B-52 crew Usually it'll take at least 2 hours 2 hours of flight planning for every hour That you will be in the air I have to get almost all of my paperwork done Before any of the rest of the crew members can start I will take it from takeoff through aerial refueling Into a nav leg or to fly AGM missiles Into several Race tracks for bomb releases Into the gunnery If we have it scheduled for that time Back here scheduled enough time For pilot work and then land It's a personal relationship with The other crew members It's something that I don't think Most people appreciate In that you have to not only work with this man On an 8 to 5 basis Such as a civilian would do But you also have to live with him You have to live in the same room with him You have to eat at the same table And you're never out of sight of that man And so after a week It's amazing to me that you don't get on I don't work We all stay together as a crew But we do have certain freedoms Outside the building The wife has to be able to accept Your job She has to be able to accept that You're going to be gone for 7 days at a time She can come down to see you If she remains out at the gate You can go out and see her in a car It's just like back in high school days Sitting in the car again The crew doesn't very often I like to stay pretty close to the airplane I don't like to get too far away That involves a traffic problem If you go to the BX plane For example, the copilot wants to go to the BX To get some toothpaste or something We all go along with him We don't all necessarily buy toothpaste However, we'll stand there while he does The system blows This creates a rush to the airplane And because of security policy We have to go in a group The time requirements are such We don't have one striker We have to get there within a very short period of time And the horn to me Just scares me to death every time it blows In fact, when they have the daily test eye jump Even if I'm looking at my watch It's going to blow in the next 5 seconds I jump And in fact, at home, if I I hear something that sounds like a horn I usually jump And I turn pale, I'm sure And I run to the thing like crazy It's a test exercise The order comes A complete surprise Whatever the situation is These men respond with all the Concentration, seriousness And confidence the occasion demands Despite the fact that the men of SAC are specialists Who work in an extraordinary environment And are trained to an extraordinary degree They are not supermen They are just as fallible as any judge Surgeon Or man in government anywhere In a word, they're human But with more than their share Of dedication and responsibility Beyond this What more than one asks