Bitcoin's true believers have held on through its wild price swings because they see enormous value in its intrinsic properties, and now more than ever. While government money printing has created a global inflation crisis, Bitcoin has a fixed number of units that can't be increased. At a time when governments can block any transaction through the traditional banking system, Bitcoin is uncensurable, meaning no third party can prevent one person from sending value to another, no matter the reason. We support it because we've seen a need from dissidents under authoritarian regimes for it. Alex Gladstein is the chief strategy officer at the Human Rights Foundation and author of Check Your Financial Privilege. He sees Bitcoin as freedom money that's especially useful for people living in authoritarian states. So when we come from first principles here in the global struggle for human rights, the most important thing is that it's confiscation resistant and censorship resistant and parallel and can be done outside of the government's control. Bitcoin proved hard to stop in Canada. In February, Prime Minister Justin Trudeau declared a state of emergency after truckers parked their rigs outside the capital and blocked a border bridge in protest of the government's vaccine mandates. His administration ordered financial institutions to freeze donations flowing into the truckers, but hundreds of thousands of dollars worth of Bitcoin still got through. This man who asked to go by caribou and requested that we not use his real name organized the fundraiser. Here's the thing with Bitcoin versus fiat. Fiat, you can confiscate first, and then with Bitcoin, you have to go through the process of trying to confiscate funds before you actually take possession of them. And that asymmetry, it gives you the high ground as a defender, and it actually makes the law have to work first before action is taken. When you had GoFundMe, they were able to just freeze it with a phone call or a button click or whatever, but with Bitcoin they can't do that, so they have to literally file an injunction, they have to use police officers, they have to go to people's homes. It makes the government do the work to go like docks or arrest people, which is really important. Today, it's nearly impossible to stop Bitcoin, but not to uncover the real identities of those using it after their funds are sent or received. That's because Bitcoin transactions are recorded to a public ledger called the blockchain. By design, all participants are pseudonymous, but law enforcement agencies and the private firms they contract with have proven highly skilled at connecting Bitcoin transactions to real people, which is why advocates say that the Bitcoin community should do all it can to make Bitcoin more private. When you're running a fundraiser in a country in the Middle East or in Russia, for example, and you're doing human rights work or environmental work or labor rights work, it's already a crime to receive maybe foreign funding, it's already a crime to do human rights work, etc. So a secondary and very important consideration is then privacy, like how can we make sure they don't know so we don't get arrested. The Canadian government froze hundreds of thousands of dollars worth of Bitcoin intended for the truckers, and police raided the home of the campaign's lead fundraiser to confiscate his computer. But advocates say this problem is solvable. Various tools already exist that can help Bitcoiners stay anonymous, they just need to start using them. Gladstein says that the Canadian fundraiser could have set up what's called a BTC pay server, which generates a different address in the blockchain for every transaction. I think that today it's fair to say that privacy is much better achievable than it was perhaps five years ago. There's a lot of amazing tools in Bitcoin. You have to kind of know what you're doing. With the Canadian truckers, we see how governments can take away money, but more importantly than that, once money is in the hands of government, they have shown with 100% certainty that that monetary control will be abused. Craig Ra is the creator of a privacy-oriented application for storing and transacting Bitcoin called Sparrow Wallet. The Hong Kong Codal organizer told Reason that if he had to do it all over again, he would have used Sparrow Wallet. I think that that worked people out to the idea of maybe we need to have some funds at least that the government can't just freeze, that we have access to no matter what. Integrated into Sparrow Wallet is Paynim, another tool for creating different payment addresses for every transaction, throwing off the sleuths. Are these privacy-preserving tools illegal? Generally, they're not, just as long as there's no third-party service involved. In April, the Fed seized Bitcoins valued at $34 million from an individual in South Florida accused of selling stolen passwords, whom they caught by connecting his online profile to an address previously listed to receive shipments. The suspect was charged with money laundering for using a so-called mixing service that exchanges Bitcoin for other Bitcoin to throw off the trail. Using a custodial mixer is money laundering in the United States. You can't just send your Bitcoin to somebody as part of a business or as a client and have them send you new Bitcoin. It's like Alpha Bay, not legal. What is legally protected as open-source software and free speech is CoinJoin's, because they are merely their open-source code. There's no one taking control of your Bitcoin. It's a collaborative spend. That's completely legal here. CoinJoin's, which are built into Sparrow Wallet, are another technique for obfuscating the trail. They combine lots of Bitcoin and then break them back into pieces. So it's hard to figure out whose money is going where. I think the best analogy for it is like smelting gold. This Bitcoin developer who asked to be identified as Samurai is the creator of the Samurai Wallet, which created Paynims and a CoinJoin protocol called Whirlpool. You take your Bitcoin, you add it into Whirlpool, and Whirlpool smelts it into new pieces that are not associated to the original piece. How much of this is going to be kind of an arms race between you and the blockchain analysis type companies, where they're just going to change their heuristics and get more sophisticated in their analysis? Yeah, there's some of that. I think that we can move quicker. And we've proven that we can move quicker than the chain surveillance companies. What is the reason for that asymmetry? You're a small open source team and generally you can move quicker without the bureaucracy of a chain surveillance company. A front line in the developing Bitcoin privacy arms race is the Lightning Network, which is a decentralized payment network for Bitcoin. The Bitcoin network itself can never scale to the size of a Visa or Mastercard because every transaction needs to appear on the blockchain. And if there were too much data stored on this public ledger, it would become too unwieldy for users all around the world to maintain a constantly updated copy, which is what makes the network decentralized and thus highly resistant to government control in the first place. The Lightning Network was designed to extend Bitcoin's capacity almost infinitely and it's analogous to a bar tap in which lots of small purchases are added up and combined into one transaction at the end of the night. But it also enhances privacy because like with a coin join, chain analysis firms can't easily untangle what transactions were included in the bundle. You might have a cash app or Coinbase account or some sort of account that the government knows about and you have income coming in, but then you withdraw into the Lightning Network and you get that same degree of privacy, ditto with deposits. There are cryptocurrencies specifically designed to anonymize transactions such as Zcash and Monero, which use zero knowledge proof encryption, but RA and Samurai have focused their attention on Bitcoin because it has wider adoption, a larger network, and it's more decentralized. Monero is interesting from a privacy point of view but less interesting from a store of value point of view and really store of value I think is going to become the driving reason people turn to Bitcoin in the coming years. The people are using Bitcoin. Bitcoin is here. It has the longest amount of history and has the largest user base. So really what makes sense for us to just say, okay, all of you, you're screwed privacy wise, excuse me, that's not how it works. An unsolved problem is that all of these privacy preserving tools require that users maintain custody of their own Bitcoin, which requires some technical savvy. It's much easier to store your Bitcoin on an exchange like Coinbase, which requires you to upload an image of your driver's license to comply with a federal anti-money laundering regulation called Know Your Customer or KYC. Samurai isn't available for iPhones and Sparrow Wallet doesn't exist yet for mobile at all. Samurai says that using Bitcoin anonymously might be more difficult, but that it's the raison d'etre of a technology rooted in the privacy obsessed cipherpunk movement of the 1990s. That message has gotten diluted as the years have gone on, but at its root, it's a cipherpunk tool to route around the state, and it's only useful if we use it that way. Ra says that the biggest privacy boon for Bitcoin would be a protocol change built into the network itself that combines transactions automatically and affect making coin joins the default. It's one of those things that everyone in the privacy Bitcoin world really has their eye on. So that's for me the most important thing that I would hope for in terms of the future. Gladstein says that in a world where entire countries like Russia are being cut off from the global financial system, Bitcoin's privacy and uncensorability are more vital than ever before, and that privacy preserving tools can make Bitcoin more like cash. The ATM model, it gives people the option to have freedom of money. Yes, the government will know all the ins and outs of what the flows are coming in and out, but they won't know what you do with it when you leave. And that that allows us to preserve the privacy of cash, which I think is essential for democratic society. It's not always easy being a Bitcoin hodler. This past year, the world's most widely held cryptocurrency lost more than half its value down 70 percent from its all time high of about 69 thousand US dollars. But the true believers say it's still early days and that eventually the price will catch up with the tremendous value that a fixed supply, censorship free and ultimately private money brings to the world. Why should the government be able to see everything that we do from a transactional point of view? I mean, it's it's a very Orwellian world where, you know, all of that stuff is just available and furthermore, once it becomes available, it becomes easy to stop.


I'd like to thank the organizers for accepting my paper, although I can hardly be considered an early career researcher. I'm enjoying the company of the future faces of Viking studies, we hope. Today, I want to challenge the long-held assumption that Scandinavian Viking art of a period of approximately 750 to 1100 necessarily should be equated with animal-style art. And I want to combat the perpetuation of this belief, which has been, I would say, vitrified into a presumption that the Vikings only produced and were only concerned with animal art. And I brought this subject to a couple of other audiences, but I wanted to bring it to the EAA to get kind of a broader reaction as I get a little bit farther into this project. The animal-style is so ubiquitous in the Viking world that the Swedish artist-starring Leonard Carlson in 1983 proclaimed that, and I quote, in the North, animal art is almost the only and totally dominating art form, end quote. And in 1966, David Wilson had declared that, quote, animal art was the only art which really satisfied the Viking mind, end quote. So where did these assumptions come from? The paradigm has its basis in the typological studies of the later 19th century. The study of Viking-age art and its predecessors has focused on meticulous stylistic analyses of objects decorated in the so-called animal styles, ranging from the migration period of the 5th and 6th centuries through the Vendal or Merovingian period, and then extending on through the Viking age from the late 8th century to as late as the 11th century. Part of what's been so important about animal ornamentation is that it forms the basis for a Montelian typological, chronological underpinning of the study of this aspect of material culture, which is possible because minor details of the animals changed rather rapidly. Thus, the animals can be used as the organizing principle for our understanding of the chronology of styles, especially in the absence of otherwise dataful context. As long as the animal art could be considered the status quo, researchers were quite happy to consider the rather rare figural pieces as overwhelmingly important for the interpretation of mythology. The largest category of anthropomorphic figures from before and during the Viking age are the gold guber, or gold foil figures, which could be pressed as multiples and thus are quantitatively constituted very large number of the human motifs. But the images are very small and quite abstracted. The next largest quantity are represented by human representations on clothing and objects of personal adornment, mostly brooches and pendants. Human images on monumental stones, in particular the Gotlandic picture stones and also some of the Swedish bro stones in particular, are fewer in number, but are very significant in size and narrative potential. And one-of-a-kind plastic three-dimensional sculptures of human are quite rare. Finally, textiles and wooden transport conveyances, that is, the Oseberg ship and cart, though rarely preserved, the wood is rarely preserved, also shows some important human imagery. It's been common, although problematic, to label certain of these humanoid figures as based on Old Norse mythological beings described in 13th century and later Icelandic sources, which were written by Christians. Although there is continuity in the use of the animal styles from the 5th through the 11th centuries, neither the styles nor the myths, that might have been referenced, remain static for this long period of time. So any identifications of specific deities have to be considered very cautiously. And I do concur with Nikkela Hembrek that only a few motifs can be plausibly identified with narratives preserved in medieval motifs. And Thor Fishing, which we see here on the left side, is one such identifiable motif that's recognizable from a narrative and is seen here on a rune stone in Sweden. On the other hand, I don't believe that some of the images, particularly on textiles, as well as some of the scenes on Gottleidig picture stones have been successfully explained. Perhaps we simply cannot explain it because we may lack pertinent extent tests. More common than the few narrative scenes that can be identified are simple human figures with or without distinguishable attributes. For instance, these depictions of women holding drinking horns or holding shields. And they've been identified as vocaries or shield maids for so long that we just call them all vocaries by convention, whether we're completely convinced that they all should be that or not. And in particular, I just want to remind us that, there are shades after what we just said. We have a real woman who was buried at Birka with a shield and well, excuse me, sword and is she a female Viking warrior or not? I know the latest questioning. But we do at least have women with these objects, not just a mythical being. So back to the figures. So although there is continuity in the use of animal styles through this long period, I do agree with Conhoi Umiessen as well that neither the styles nor the myths that might have been referenced remain static through this long period of time. So these identifications have to be considered very cautiously. And furthermore, Helmberg also just declares that the attributes of weapons and drinking horns, for instance, are not suitable for identifying figures from myth and legend. And in addition, just for example, there's still great disagreement about whether this tiny figure, only 18 millimeters, this cast-silver seeded figure from Lyra cannot be identified as Ovan on his throne with his ravens Huergen and Munen flanking him or is it a seeded woman with generic birds, for some other reason. Now these motifs of single figures with or sometimes without attributes are even more difficult to identify than larger compositions. James Graham Campbell suggests that the small three-dimensional figurines may have served as gods of the pouch or pocket gods he extrapolates as referred to in health rather saga and a few other places as well. In that case, a man carried a small image of Thor with him. But we don't know what these portable gods looked like. Now some of the images that we find may represent gods and heroes, but others may depict living, breathing, Viking age men and women. And from three-dimensional figures, three-dimensional sculptural work, we may learn something else about Viking age people than we do from images of abstract animal art. And some of the images such as hair, we see costume and hairstyles here of women that we do recognize from burials. And the billowing pantaloons that we see here on a very small figure from a bokra that it can be compared to images from large tapestries and a galleon picture stone. And it's also can be compared with textile fragments found at Hithibit. So whether some anthropomorphic figures depicted contemporary Viking age people or their conceptions of gods and goddesses in the form of human men and women, we have the opportunity to kind of take a peek at what people look like in the 9th, 10th, and 11th centuries. In any case, though, the corpus of human figures that we have available to study is growing. And it's being transformed by the flood of metalwork found by detectorists, including the many objects with soomorphic ornamentation, but also some with figurative subjects, particularly three-dimensional cast figures and brooches. And for over a generation now, metals are taken, particularly in Denmark, also in Poland and a few other places, well in England, needless to say, has greatly increased our quantity of Viking age artifacts, although the reporting and the publication of these vies is really inconsistent. In, I could say, greater Denmark, including Skona, as well as Hedvig and Schleswig, urban settlement excavations, making use of metal detectors at, do we want to call them several places or proto-towns or whatever we call them, for instance, Tissue, I've seen here, and also Lyra and Hedvig and Ubokrab and so on, are revealing numerous workshop sites and examples of figurative art. And small three-dimensional sculptural art has been discovered at such locations. Now, in contrast, many of the emblematic examples of the styles of soomorphic art were discovered in burial contexts. For instance, the early styles of Vendel and Throa, and particularly from the top here, the classic Viking animal age, the animal style phases of Oseberg, Bore, Yellinge, and Mannen, all from burials. So the early study of the Vikings focused on burials and sometimes hordes, and the primary ornamentation discovered on objects from these contexts was zoomorphic. So it may be possible some of the animal figures designated familial or other affiliations. Human-figural art may have had different functions from then animal-style art, and the new finds were metal detecting and large-scale settlement excavations are leading to new interpretations. And whether these newly found objects are stray finds or lost objects or the detritus from settlements, they include a greater proportion of human-figural art than the burials and hordes that were the focus of early investigations. And this is really becoming the focus of my current investigations, but I don't have the numbers to show you everything yet. So I ask, why are we finding more anthropomorphic art in non-burial contexts? And what does this mean about the use of this art? Well, unfortunately, whereas animal-style art is expedient for determining relative chronology of an isolated work of art, without context it can be notoriously difficult to date an undecorated three-dimensional sculpture unless it's part of an object that can be dated by its form, such as a brooch, and so on. In 2003, Torstenka Pella published a short piece on hidden people in Germanic ornamental art from the migration period through the Viking Age. And many of the examples he cited are from the earlier periods, but he also included the Viking Age. Headless man heads broken off on the horned disc from the River Thames, humans carved in wood on the Osprey cart, and the man being swallowed by a snake-like creature on the mammoth horse collar. These examples do fit neatly into the schema of animal-style art and can be used as a bridge for chronologically placing some anthropomorphic motifs in relation to the animal styles in which they were enveloped. With new finds, the overall picture of Viking arts changed since Odeclan Jensen and David Wilson wrote Viking art in 1966. In James Graham Campbell's new version of Viking art, about half a century later in 2013, he included several of the new finds, but he still referred to these works as an, I quote, atypical ventures into representational art, I quote. He maintains, and I get a quote, the main history of Viking art has to be written from a study of the decoration of ornamental metalwork. But I protest that we no longer can insist that it must focus only on the animal art. The works of Bill Wilson and Graham Campbell and also Figurissong and others continue to form the topological, chronological backbone of Viking art, and rightly so. They and others built up a detailed typology which together with carbon-14 dating, dendrochronology, and numismatic analysis has allowed this construction of a detailed chronology of Viking art. Yet, figurative art has emerged to be more than a minor afterthought among Vikings. The flood of new pieces found by metal detecting and on settlement excavations has brought a wider variety of art and another view of Viking visual culture to our attention. As more examples of this art come to light, we glimpse a view of Viking art and people that have previously been nearly unknown. So now I say that we really must regard figurative art as something other than an oddity, as something going beyond the vitrified old paradigm. So, thanks, thank you very much.


This study developed a novel pH-responsive nanocomposite consisting of chitosan, montmorillonite, nitrogen-doaked carbon-quantum dots, and doxorubicin for targeted delivery of the anti-cancer drug. The incorporated nanoparticles increased the loading and entrapment efficiency of the drug, resulting in an extended pH-responsive release of the drug over a period of 96 hours. This pH-responsive nanocomposite also showed reduced cytotoxicity and induced more apoptosis in cancer cells compared to free doxorubicin or the chitosan montmorillonite doxorubicin nanocarrier. This article was authored by Irfan Ramani, Mairabh Pormadadi, Saurabh Ali Gorbanian, and others.


Hello and welcome to malware analysis for Hedrox. Today's topic is Rep files and how to unwrap them. At least it's one method to unwrap them. I think I will show some others in other videos. Our file today is win32.bat. I changed the extension so I do not accidentally execute it. And let's check what this file does. And I will explain along the way what a wrapper actually is. Okay, Dye says it's possibly a VBS to EXE file. And that means it assumes it's a VBScript that has been put inside an EXE Portable Executable file. So a wrapper usually works that way that you have a script or let's say or Java or Python script or VBScript or batch. And that there's an application that turns it into an EXE by creating while putting it into a step. And this step will drop the script inside into the temp folder executed and delete the script after execution. And the execution deletion part happens so fast that you often cannot just grab the file from the temp folder. So you need some tricks to get it. Okay, so it says it's VB to EXE possibly. And the compiler is pure basic. But we don't care about the compiler. If we know it's a rep file, we just want the script inside and nothing else. So we do not want to debug the unwrapping or something. So don't care about the compiler. But yeah, I now I want to know if that's indeed the case with the VBS to EXE. So first, I like to check with products and laser visualization where the interesting areas are. So let's just check this. I still don't get a mic stand. So the typing is a bit loud. That's the visualization. Oh, I missed one part. Give us a visualization. There it is. And the fan is loud. Sorry. Okay, there is the visualization part. And in this area, at the end, there is a, well, there's a higher entropy here. So it might be where the script is packed. And we have strings here, these strings here and here they come from the import. So we can see the imports there. And the strings here in the end, they are part of the resources. Often if they are part of the resources, you have the manifest there or other information that's in strings. And here are also some strings. So let's take a look into the area at the end. This at the front, it looks more like code. And that's something you would look at in a digital sampler on Oli. But for now, I want to look at it with a hex editor. And that's where I usually see the strings and so on. So yeah, that's more code like. And here is the area of the imports. Let's take a look at the end. Some some padding strings. And indeed, there's the manifest. And this area is the version information, which sometimes gives away some information like what what the file was intended to do. But actually, even if it says it's from Microsoft, you cannot rely on that because everyone can just edit this version information. And some people do. That's an interesting string here b to e decompile p even dot but b to e stands for batch to exe. And let's see if we find some similar strings here. That's the imports part. This regular pattern is often it can be image or icon. Okay, now that's interesting. Here, we have the strings that belong to a batch to exe exe wrapper. And there's also some kind of batch script inside here. But it's not our batch script that we want. Our batch script is well, saved somewhere and encoded or encrypted somewhere in the file. Now, we know it's a wrapper. And with that, we can use only to get the file inside. We open our file and the idea now is that we just set a breakpoint on the right fall call. So let's do that run. We are now in couple 32 at the beginning of the right fall function. And we already see that there's the beginning of a batch script. So let's follow in dump. And there it is. We will see if we see the end. Yeah, here's the end. So we can just copy that binary copy binary copy. That's a good idea. Now open your hex editor, new file and paste it. And there we can save that. That's all dumped batch. Here it is. Now change the language. And nice. That's a ransomware or yeah, that's a ransomware. Now you can see what's a pretty cheap ransomware. I mean, like for the lines again. What it does is it deletes a safe boot keys. Okay. It adds itself to the usual auto run. Why you it disables task manager registry tools and CMD removes the desktop, I guess. And then, well, you know, it is disabled CMD and then it says Windows blocked Windows blocked in the CMD. I'm not sure that this will be shown. If CMD is disabled. Sometimes I wonder if the mother of us actually test their mother. So what's that? That's the code. So and this turns everything back except for the safe boot option. I guess it's disabled safe boot if you remove these keys. So but this this will be reverted. So you can just enter this password. Or you can't because the command the CMD is disabled. Well, let's run the file. I think this might be interesting. Yeah, but just as showed notice, now we unpacked the batch script using Oli by by breaking the right file call could have also waited until it writes it has written the file and like before the deletion could have breakpointed there and grabbed the file from the template. Alternatively, you can change the security settings on the template. So no one is allowed to delete any file in it. And this might obviously this will prevent the deletion so you can grab it from there. It doesn't work for this sample. I tried it and it creates a folder folder in there and then a file and then because it can't delete anything, it will just break the application will just stop working. So okay. But this usually works. Okay, executing it. It's not a batch really. This one's the PE but our windows doesn't care if it's dot but or dot easy or anything. It's as long as it's executable. So okay. See, and that's it. No CMD and no ransom node. I doubt that they got any money from that ransomware. Now if I try to open task manager, it says it was deactivated by the administrator. Okay. And that's already it for today. Thank you for watching. And next week, I'm probably pretty busy. So for now, it's a bit hard to keep the schedule of one week. I guess for now, it's more two week schedule. But I try to get back to one week again. Okay. Oh, see you next time.


about how we are applying deep learning to create SKUs. So SKUs are stock keeping units to clean fashion commerce catalogs. I know that I'm standing between you and your lunch. So I'll try to keep it as much interactive and interesting as I can. So the first question to you folks is how many of you have ever bought an item online? Items like tops, t-shirts, jeans, or shoes. Oh, wow. Almost all of you. How many of you actually work at any of the online commerce portals, like Amazon, Flipkart, or Mintra? I see fairly a large number. So what I'm going to do is jump directly into defining the problem as to why do we have to create SKUs for fashion commerce by showing you a few examples. So when you sit down to search and shop, you have some intent in your mind. And you type some intuitive search queries. So this is one of the famous Indian fashion commerce portals. And I typed here Indian wedding dress. And it is not showing me any kind of results. So you might ask what could be the reason. I also don't know. But one of the reasons could be that none of the dresses are actually tagged with this tag of wedding. Now, I type one more query. I type here evening party dress. And what is being shown to me is a footwear item. So there is complete mismatch between what I typed and what I have received. And this is not just a problem with one or two commerce portals. This is a systemic problem. So I take the same search query. And I type it in a different portal. And here I get belts and house dolls. Most likely the search engine is working fine, because it is picking up those keywords party and evening from the text. But it is just that the dresses are not tagged with either evening or party. Now you might say that I'm typing very generic search queries. So let's try some specific search queries. So here I typed men sports t-shirts. Now these are the top eight results that I get. How many of these are really sports t-shirts? So I asked a fashion expert. And she said these four. So these four are sports t-shirts. Now if you look at the second item, the label is arrow sport. So the search engine is picking up this text and showing this item as a sports t-shirt. But in fact, it is a casual t-shirt. And there are more casual t-shirts in the results. Now I can take a very specific search query. I type blue tunic. Now a tunic is a very popular fashion wear for women. And I see these top five results. And if I analyze these results, only the first result is correct. Rest four are not. And in fact, I see some dresses which are in green, are not even in blue. And if you see that the last two items are actually duplicates. So the same item is being shown to me multiple times. Now why do these problems exist? These problems exist because fashion commerce catalogs are not very well tagged. And we saw a few examples. So there were missing tags. There was a mismatch between what you type and what you got. There were non-sunder tags like casual versus sports. And you also have lots of duplicates. So the next question is, why are these products not well tagged? So there are primarily two reasons for it. A, the tag creation process itself is very complex. Fashion is one domain which has very high dimensions. There are lots of patterns and styles that keep on changing over time. And on the top, there is no single standard that you can use to actually attack these items. And hence, because the ecosystem of commerce is distributed, different sellers apply their different standards to attack these items. So let's understand these reasons some more. So why is a tag creation hard? So I have shown here some 15 dimensions in case of fashion. I don't expect you to read through all this text. But the idea is that you can imagine the number of combinations that you can have if you have so many dimensions. For each dimension, you can have, on an average, 10 values. Now imagine a seller sitting and uploading one fashion item in case of there is no standard reference. Now it is not the case that standards don't exist. So we have ISB in case of books. We have UPC in case of physical retail. And these help both consumers and businesses to track items and to also search for items. So let's take example of ISB for books. When you have to obtain ISPN in appropriate form, you first have to enlist the author, name of your book, the edition, the country, and there are several parameters. And only after that, you get to see a number which is unique, which you call ISPN. Now as you can see, because you have these attributes, it makes it very easy to index and search for books. Now it is not the case that in case of online commerce, there are no unique tags or unique IDs that these portals don't apply. So in case of Amazon, you have this Amazon standard identification number, which is nothing but SKU. SKU, as I mentioned, is a stock keeping unit, which is essentially a product code that you assign to unique products for your internal use. Now unfortunately, when you have to onboard this fashion commerce inventory, this process of identifying different attributes is not followed. If that were the case, we would have products that are very well tagged. So let's further understand why this problem is more important from the commerce perspective. Now I have shown here a simple value chain from manufacturers to users. So manufacturers manufacture fashion items, which are then sold to sellers and brands. And sellers and brands then upload this inventory into commerce catalogs, which is then exposed to us users when we search for it. Now in case of direct e-commerce, the commerce platform has very tight control over the sellers. So you essentially create brands. Mintra is an example of a direct e-commerce. In case of online marketplaces, you want to have more and more sellers onboarded onto your platform. But you don't have very tight control over them. You can onboard small, medium-sized, and large sellers onto your platform. Now for both direct e-commerce as well as for online marketplaces, the way this inventory is onboarded is not at all. So there are no standards maintained. And because of which, you see all sorts of variations in your catalog. And your catalog is very poorly tagged. So why is it a problem for us? So we act as aggregate over the existing direct e-commerce as well as online marketplaces. And we want to provide a very good consumer experience. And we want to do that. It's your laptop. So you're getting some email? Sure. So we want to provide discovery and search experience to consumers by having a very good technology. And towards building that technology, we want to ensure that the catalogs that we onboard, these are very well tagged. And you can see that because we have to onboard inventory from a variety of people, we have to have a common standard, which we can refer to when we have to attack these products. So in other words, we need a magic box which can create these SKUs for us. So we actually went ahead and built this magic box. And I'm going to show you a preview of what would happen if you have this box. So I'm going to take one apparel category. That is women's tops. And I'm going to analyze inventory of two portals, portal S and portal M. Now, when we analyzed their inventory and looked for how many products have missing or incorrect category, which actually means that tops are not marked as tops. And we saw that about 15% products from a portal S and about 7% from portal M had this issue. Now, when we filtered for unique products where there are no duplicates and the naming is consistent, we saw that there are only 65% of the products that are well tagged in case of portal S and about 86% in case of a portal M. And when we applied one more criteria where we say that, I'm going to say that a product is well tagged if there are more than two attributes that are well tagged. And we see that the number has jumped down to 45%. So these attributes are like pattern or length or sleeve. So clearly, we have a problem. How do we curate such fashion catalogs? And how do we create SKUs? So creating SKUs involves two steps. As I've been mentioning, we have to have a standard where we have defined these 15 dimensions. And we have to have a method by which we can identify these dimensions automatically for an incoming product and tag the products appropriately. Now, here is a pipeline that we have at our company when we have to create SKUs. So we take data from different commerce portals. We put it into a staging DB. Most of you know that a product page has text and images. So text has title and description, and you also have images from front, back, or side. So we deeply pass this text and image, and we normalize them. We normalize them into 15 dimensions, which is now acting as a standard for us. We also compute a feature vectors for the primary photos. And after doing this, we now have accurate tags. So now we create SKUs. And only if we find a product to be unique, we actually put it into our DB. So this is our production DB. So for the rest of my talk, I'm going to focus on this block where we are going to do text and image passing. So to build this block, we wanted to have a solution where we have to do as less feature engineering as possible and also have as less reliance on HTML tags or passing as possible. Because these two things will change, and in fact, they change pretty quickly. Being a startup, we did not have luxury of offloading the task of getting a lot of data tagged manually. And when we are building this solution, we want to ensure that the machine learning product models that we build, those are properly calibrated. So what I mean by that is, if a model is predicting something, it should better be with very high confidence. So what are the challenges in building such a robust solution? So let's say you want to do identification of category by images. So you'll be sometimes quite surprised with the variety of photos that you see on a fashion commerce portal. Now these are three different products. Nowhere in the text of these products, it is mentioned that whether it's a single item or a pack of items. Now how do you process such images? Can you simply train a simple CNN classifier on the top and then get done? I don't think so. So let's say you want to identify attributes using images. So you want to identify attribute like sleeve using images. You look at the amount of variety that you have in the poses. So you and me can easily identify that it's a full-sleeve formal shirt. But if you look at the variety, so first of all, you have to figure out which of these images you have to parse and then see whether you can really identify the sleeve type or not. Now let's take one more example of identifying a category from images. So these are three different items. And we asked a few online women shoppers to mark them with category. Now 60% said the first item is top, 40% said second item is a tunic, and 50% said that the third item is a kurthi. Now how many of you think that, let's say, third item is a kurthi? Can I have a show of hands? Actually, yeah, I can understand the reason, but yeah. So when we asked our fashion experts, she said that the first item is a tunic, second item is a kurthi, and third item is also a kurthi. The reason I'm showing you these examples is because you can see the complexity. So if you have to train a machine, what kind of features and where should that machine focus so that you can execute this task of identifying categories? So let's also quickly see a few examples of text processing. So here I have one product where if you see that title contains checked short kurthi. And if you see the image, it's neither checked nor shot. And if you see this example, the title contains both t as well as top. So you have multiple categories. Now where do you bucket this item? And especially here, if you look at the photo, you don't know whether it's a t or top. So again, there is some kind of confusion whether to call this product as t or a top. So my reasoning behind showing you all these examples is to convince you that it's a really hard problem. You have to do both image processing and text processing. And if you have to do image processing, you have to solve all these problems, whether it's a single item or a pack, if you have different poses, if there are confusing categories, and there are some more. In case of text, whether you have a single category or if you have multiple categories, then the categories present in the title or in a description. And just doing these two blocks is not sufficient. You have to have confluence of these two blocks. And if you can actually figure out a solution, there is potential for cleaning more than half of the fashion commerce inventory. So I think you had some question. So if you go to more, yeah, sure. So the question is that the product images that I had shown, those had a wide background. So my answer is that there are a lot of niche designer portals where you see those kinds of images, where the background is not white, but let's say the photo is taken in a park or so. But in most of the major fashion commerce portals, you have images which have a wide background. So for the rest of my talk, I'm going to focus on one problem, problem of identifying a category tag from text and images of products. So here is a very simple and intuitive algorithm that I have. I have here three cases. Case one is that, let's say, I'm not able to figure out any kind of category from the text. So I'm going to take care of image processing. If the confidence of my image processing model is sufficiently high, I'm going to mark that product with the category that my image processing model is saying. Otherwise, I'm going to filter that product. In case of a case two, if I have a single category in the text and if that category matches with what my image processing model is saying, I'm done. But if not, I'm going to go back to case one and solve this problem. Now in case of a case three, where you have multiple categories in the text, be it in title or a description, we have to figure out a way in which we can rank these categories. So you have, let's say, three categories from title and the description. So you want to rank which one of these is most probable. Now you can also take help of images. And if image has very high confidence, you are done. If not, you are going to take help of the most ranked text and most ranked image. And then you are going to mark the product with appropriate category. So this is the pipeline that we have for image processing. We first do back detection and then extract the item on the top. Then we do pose a detection. Then we apply a segmentation model on the top. Now for the segmentation model, you give image as input. And as output, you have an array of confidence score for each pixel. So let's say you have 30 categories. So for each pixel, you are going to get an array of 30 values. So this segmentation helps us in terms of clearing out the background, which goes back to your question. And it helps the further blocks to focus on the foreground. So here I have segmented the top where and bottom where. And then we take the segmented image and then we apply a scene-based classifier on the top of it. And in the end, we have a softmax module which gives us confidence scores. The same pipeline we can also apply to extract attributes from the images. So now I'm going to talk about these two blocks, image segmentation and image classification. Now image segmentation and image classification has been receiving a lot of attention recently because of advances in deep learning. So I have already explained the problem of image classification, sorry image segmentation. In case of image classification, you simply take image and you want to identify what are the confidence scores for the images. So we take the segmented image and then we give it to a convolutional neural network. And as I mentioned, we have softmax at the bottom, which has about 30 categories. So we did a few experimentations. We gave about 2K images per category for these 30 categories. And we received accuracy of about 88%. But this is not that good because if you see the average confidence, if I take the topmost category and if I take the probability and if I compute the average, it was about 79%. So ideally, you want to have this number to be very high. You want to have this number to be something like 95% because you want to have very high confidence when you are predicting something. So how do you solve this problem? We increase the number of samples that we have per category. And we see some marginal improvement in case of both accuracy as well as confidence score. And then we increased the depth of the network. So now we have 5K images per category. And we have about eight layers. And now we see that the average accuracy has increased from 79 to 88. Now you can apply some more tricks on the top. I will leave this problem here. And we can also talk offline. But with a few simple tricks, now we can bump this confidence score to about 95% or so. So now we know how to do image parsing. So we have a box where we can put an image and we know the category of the product with very high score. How do we solve this problem of text processing? So as I mentioned, on the product pages, you have title and a description. And we make use of this kind of separation. We apply a simple pipeline to extract categories from the text. So if we see that there is more than one category in this text, then we are done. But if you have more than one categories, then we have to figure out how to rank these categories. So here again, we apply a very simple and intuitive technique where we have the product text on one side. We have category on the other side. We compute feature vectors for both of them. And we want to know what is the semantic gap between the two. So I'll show this by a diagram. So here we have product description. We have the category that we want to rank. And we have two feature vectors. And then in the end, we're going to apply a softmax. So let's go through it step by step. So for a product description, I'm going to have a 2D array. So the product description contains words. For each word, I'm going to have a column vector. And hence, I'm going to have a 2D matrix. Now you can apply a CNN-based techniques on the top. And you can get a feature vector. See, you can use a word 2-vec. You can just. Yes. So these column vectors are essentially taken from word 2-vec. You can also apply character-based embedding. So you can talk offline on that. Now using a word 2-vec again, you can have a column vector for a category. And then you can learn a similarity matrix in between whose output then you give to a feature vector, which has now embedded knowledge of the category and the description. And now you train a fully connected layer with softmax on the top. Now the output of softmax is whether these two entities are similar or not. So it only has two classes. And now you can give a pair of descriptions and category as input. And you can train this whole pipeline. So this is a very generic pipeline. You can replace the CNN box by, say, LSTM. Or you can replace the softmax by, say, contrastive loss-based function. But this pipeline has worked for us so far. So we gave about 12k pairs as input. And we received mean average precision of about 86% and mean reciprocal rank of 92%, which is actually quite good. If you give about 5k pairs or so, these numbers will be quite low. So now we know how to process text. And if there are multiple categories, how to take care of them? So we can go back here. We can rank the category by the text if there are multiple categories present. And we can solve the case 3. Now this algorithm itself is not robust. So it can also make mistakes. After all, we are making our decisions based on your confidence score and some kind of thresholds. So you have to do some kind of sampling analysis. So this is important because let's say you have normalized a 2 million products. How are you going to go back and then check whether your algorithm is working well or not? You can't possibly sit down and go through each of the products. So we do a very simple sampling analysis. And if this sampling block says that I have a sufficient confidence, we promote these models to production. Otherwise we'll have to go back and then give more data or increase the depth of the models and then retrain. So let's just go through a very simple sampling analysis. Let's say you have normalized 1 million products. And your sampling is going to consist of a bag of 25 products. So you essentially count how many of these 25 are correctly tagged. Now your hypothesis is that I want to have my average accuracy of a sample to be higher than 95%. And you do sampling, you take 50 samples, and you get average accuracy of, let's say, 93% with a STD of 6%. So how do you go back to your hypothesis and then say that whether I can say that my products are sufficiently well tagged or not? So in other words, you want to have this probability that what is the probability that the average accuracy is less than 93%, given my true accuracy is less than 95%. And if this block, if this probability is higher than 5%, it actually means that that is very significant. So I can expect to have a lot of products which are not well tagged. So you can do a simple T test. And for this particular example, this probability comes out to be 1%, which actually means that this probability has a very low confidence. So it will happen very rarely that your sample will have average accuracy which is less than 95%. So let me start concluding my talk. So we did all this to create SKUs. So how do you create SKUs? As I described, you have to have a standard for fashion commerce catalogs. And you have to have a method to populate different dimensions for each of the products. And now if you have this kind of product, you can create SKU like the category shirt. It has check pattern. It has polo neck, full sleeve. It has red and black colors. The brand is absent. But you have a 256 bit feature vector. So this is your SKU now. Now given you have such SKUs, what would happen to these numbers? So I had shown these numbers at the beginning of my talk. Now this number went from 45% to 84%. And by the way, this is for a woman's top for a particular portal. And you can also see that the algorithm is filtering out a few products because we have lots of else cases. So if text or image doesn't have enough confidence, you will have to filter that particular product because you don't know whether that product would be well tagged or not. But these cases are rare. So how does it help in the end? You can have improved visibility of catalogs. You can improve your search results. So the search results that I showed in the beginning, you can expect to see a lot of improvement in those. You can have hence improved user experience. And you can also use SKUs to recommend, let's say, similar products. Because you remember we had a feature vector. So using feature vectors, you can also figure out what are the products that are similar. So to summarize, I hope I have convinced you enough that it's a hard problem to curate a fashion commerce catalogs. I also showed you different pipelines in terms of how you can go about building SKUs and building image processing and text processing pipelines. And if you can actually build SKU a blog, you can hope to see a lot of improvement in the curation of the catalogs. So if you have any questions, I can take them now. The mic is here. Can just speak up. I'll repeat the question. See, in a way, we are now acting as a fashion commerce portal because we act as aggregate on top of them. So anyway, we have to have unique products in our database which are basically SKUs. Excuse me? Yeah. This product is representing I need to segment for the top way rather than the bottom way. So I showed a few simplified pipelines. So it's not that you discard the text altogether. So text acts as some hint for you to focus on whether there is upper bodywear that is prominent or lower bodywear. So you can also do text and image embedding. You can have a model there. And then you can figure out this problem. But most of the photos have either upper wear or lower wear, which is very prominent. And one more just small question regarding this how did you come up with the training data for the after image you have to classify it into a category? So that training data is something that requires manual intervention or is that also something that can be pre-processed? So what we did is we did this in iterations. So we initially had a pool of samples that were manually tagged. We trained a model. Then we used that model to tag some more products. And there now the choice was if the model has sufficiently high score, if you filter them out, those that don't have high score, you have to give them back to tag manually. So I just answered that question. Correct. So I just answered that question to repeat that answer. You start with small data that has to be tagged manually. But you can train a model on top of it and you see how do you make use of that model to tag some more data. So let's say you have 100 photos which are tagged. You trained a model. Now you apply it on 1,000 photos. Not all of them are going to get well tagged. But you can apply some tricks there and then say that I don't have to look at 800 of them. I just have to look at 200 of them. So then you can give this 200 to manually tag it. So I'm not making a very hard statement here when I say that a CNN can't do it. Of course, it can do it. And you can also apply some simple heuristics. Like you can do phase detection or so. But you're looking for, see, that's a heuristic. So you can have a very complex image, a complex kurthi, which has lots of patterns. And if you just look at a detection, you don't know whether it's a single item or multiple items. You can also have saris, which are some parts of saris are very well flowing. So you don't know whether it's a one saris or two saris. So my, sorry? Sure. Just jumping in while we still have an audience, and continue the Q&A after. So don't forget the drum session this evening at half past five, a little bit of fun in between serious stuff. And second, please don't set up your private hotspots. The IT people have said that it's interfering with the network here. It's a pretty fast connection. It's fiber. So just log on to the Hasgeek network, and you'll have fast internet. Thank you. So I have a question regarding the segmentation you did. So it was a detection problem. Or it was actually a segmentation problem where you detected the exact boundaries, and how did you achieve those segmentations? See, the segmentation problem is both to do segmentation as well as to mark each pixel with a category. So it's a segmentation as well as a classification problem. But when you have a lot of complex images, you see island of segments. It's not very easy when you have a very complex pattern to have a single segment for the upper body where or for the lower body where. Now, it's a very hard problem to combine this local information of segments and produce a single or global information. And hence, you require CNN on the top. But how did you achieve those segmentations? So there is a very nice paper, PassNet. It was released last year, I think. You can refer to that paper. That source code is also open. I wanted to get a sense of the scale of data that was required to get this classification to work. In the sense that you had mentioned that you needed 5,000 images per category to achieve a confidence interval of 88%. But how many categories were there? In a sense, can you give me a rough sense of the scale of data that was required? So we had 30 categories. As I had mentioned on my slides, these are mainly apparel items. So we had a classificate. So we had a taxonomy. And we had 30 apparel items. And for each, as I mentioned, we had 5k images. Hi. Can you tell us more about your duplication removal tool? So now, after the normalization of all the attributes, so is it just a simple group buy off those attributes? Or is it a separate ML model classification model? So in the SQ part, I had both category attributes as well as feature vector. Now there are different rules that you can come up with. A very simple rule is that you can do a feature vector based search. And if it matches exactly, you are done. But what happens is that these sellers are very smart. So they can essentially crop the same photo and then upload. They can also change the size and upload. So essentially, you can see for a few products, we have seen there are 200 duplicates. So you have all these variations. Now there you will have to have some kind of margin. So you say that if my feature vector matches between this margin, then perhaps it is a duplicate. And there you can also make use of the categories and attributes. Because most likely a seller is going to use the same text. So there the other attributes are same. It's just that the feature vector has changed because there is variation in the photo. Sorry? The text classification process. Can you explain the text classification process a little further? See, I can talk about the problem that I mentioned. So the problem is that in your text, so let's say you have 10 sentences in your paragraph. And you apply a simple text parser. And you figured out there are two categories, top and t-shirt. And you want to identify whether this text description belongs to either top or a t-shirt. And now what you are doing is for this text description, you are computing a feature vector. You also have a feature vector for both top as well as t-shirt. So now you have two pairs. One feature vector and a top feature vector, the same feature vector and feature vector for a t-shirt. And you want to compute which pair is actually semantically closer. Yeah. Hi. Hi. Where are you? Yeah. About the attribute extraction, you haven't talked about the attribute extraction. And besides that, even just for the article types, as you said, you had 30 article types. So for the themes and the attributes, also you might want to tag it along with the article types because some attributes are specific to some article types. How do you go ahead with that? And the second part, you started with an example of wedding dresses. So how do you infer that for particular dresses of wedding dress or not? So to answer your first question, it's not like you have to automate this process end to end. So for upper bodywear, you will have some attributes. So those same attributes won't apply to lower bodywear. So you can do such simple tricks. And then when eventually it boils down to identifying attribute of an image, you can take help of all these things. So that's one. And secondly, once you have these fine attributes, you can have some simple rules. So for example, if it's a check or a lining shirt. So let's say the pattern comes out to be a shirt. So it's a shirt and you have checks or lining. So most likely it is office wear. So you can encode some simple rules on the top and then attack this product as office wear. So there is no learning here. So it's very simple. You don't need to have learning when it is not required. OK, we have one last question. How do you? So yeah, I will be available here. So you can take questions. But maybe I can take the last question. How do you handle conflict between the text category output and the image category output for the same combination? Conflict. So you mean to say the text category is not matching to the image category. So there we simply assume that the text category is wrong. So that's our heuristic. Because most of the times we have observed that the text categories are not correct. So we want to give more emphasis to image because photos are the ones that users are going to see. So it makes sense to have a category extraction from the photos instead of having from the text. So whenever text and photo doesn't match, it will say we'll only refer to image. So I can take the questions offline.


Pokemon fans are divided. While most players are enjoying Sword and Shield, a vocal part of the fan base continues to question whether Game Freak lied in the run-up to the game's launch. The developers claimed that they were recreating models from scratch, and fans continue to debate how much this is actually reflected in the final game. Perhaps the bigger question, though, is why? Why were Game Freak unable to include all Pokemon in Sword and Shield, and why did they have such a hard time justifying their decisions in interviews? From interviews published in the November 2019 issue of Game Informer magazine, it's possible to paint a picture of a studio in crisis, as Game Freak struggled to meet the demands of developing for the Switch, and curbing their own ambition, while meeting their aggressive launch deadline. By the release of the Switch, Game Freak had become very efficient in developing brand new Pokemon titles every single year, like Clockwork. This involved reusing as many assets as possible, and keeping innovation or experimentation to a minimum. The Switch somewhat threw a wrench into the works of this well-oiled machine. With the sudden leap in graphical capabilities of the Nintendo handheld hardware, Pokemon Let's Go Pikachu and Eevee required a lot more extra artists and developers. According to Shigeru Omori, I think the biggest takeaway was how the graphics and rendering work is so different from the 3DS. Needing to staff up and figure out how we're able to get that to work really well on Switch takes more time, and we needed more resources. Game Freak nearly doubled in size in an attempt to accommodate for the challenges of releasing a home console-quality Pokemon game, but this alone wasn't enough. They still needed more time to actually settle on direction for the games, something that was in short supply considering their annual release schedule. It absolutely didn't help that whatever they made was going to be compared to Breath of the Wild. Coming at the start of the Switch's lifespan, the acclaimed Zelda title had been in development for over half a decade, and had dramatically reworked the formula for the series. Everyone was expecting the first proper Switch Pokemon title to be that same big, bombastic genre-defining game, but Game Freak had a fraction of the time in which to achieve this. Shigeru Omori said, We set out with the idea of making the ultimate, strongest, the best Pokemon game yet, being on the Nintendo Switch, the first time an all-new generation is coming to a console. It was really just kind of applying this idea of ultimate to every facet of the game. Gameplay, visuals, everything. That was really the theme for when I set out making the game, the greatest Pokemon game. In spite of the obvious danger of overextending themselves, the creative leads of Sword and Shield began unpicking the core Pokemon gameplay.  For example, the team began experimenting with giving each Pokemon five available moves instead of four, or, alternatively, reducing the number of available moves down to three. Neither of these attempts really worked. According to planning director Kazumasa Iwao, I think that hurts the balance of gameplay quite a bit. You really start seeing there are haves and have-nots in the Pokemon world, like these Pokemon are obviously way stronger than the rest of these Pokemon. We keep coming back and finding that four is the right number for the current battle system. The challenge of balance was really weighing on the developers, especially when it came to making competitive play less frustrating. Gamefreak didn't need to simply build a balanced single-player campaign. They also had to make sure that they crafted a fairly balanced metagame that wasn't inherently tedious. According to Kazumasa, traditionally in the series, you start with your starter Pokemon and then you catch a lot of Pokemon in the beginning, and those are with you throughout your whole adventure, and the player gets attached to them. But a lot of times, they get into competitive battles and they find they can't actually use those Pokemon, or they're not competitive, so they have to go out and find the exact right Pokemon, or breed them in a certain way to make sure they're viable in competitive battle. All the while as the team were experimenting, the clock was ticking. Their deadline was getting closer, and their vastly inflated staff needed guidance. So the decision was made. Gamefreak would cull the number of Pokemon that appear in the finished games. This meant that balancing the game was quicker and easier, and it meant that more polish could be put into the game's art assets. Apparently, this decision was not unanimous, and various people within Gamefreak disagreed as to which Pokemon should be included. According to Junichi, a wide variety of discussions happened, as the team attempted to narrow down the included Pokemon. They thought long and hard about which Pokemon would fit with the game's Britain-inspired setting, and obviously decided that if they needed anything, it was a living smog cloud in a top hat. Nice. Thanks, Gamefreak! This of course led to the infamous interview in which Junichi Masuda and Shigeru Omori attempted to defend a reduced Pokedex, and inadvertently dug themselves deeper into a hole in the eyes of many commenters. In the interview, Junichi and Shigeru gave both the graphics and the gameplay as explanations for why they decided to scrap the national Pokedex. Junichi said, The number of Pokemon, counting both new Pokemon and forms of existing Pokemon, has crossed 1,000. In addition to improving the graphical quality to adapt the new hardware platform, when it comes to battles, it has become exceedingly difficult to give Pokemon new individualistic traits and balance affinities. Shigeru said, Even during the development of Pokemon Sun Moon, it was extremely difficult for us to bring along all previous Pokemon. With the move to new hardware, it became necessary to recreate models from scratch. While Gamefreak were mostly concerned about balancing the finished game, Shigeru had inadvertently created an open invitation for commenters to analyse every minute detail of Sword and Shield's presentation. Hence, the Gamefreak Lied hashtag and the endless debate over how Shigeru's words were meant to be interpreted. So Gamefreak failed to deliver on their goal of creating the ultimate Pokemon titles.  It's wise not to overextend yourself, to push yourself too far, and to hold yourself to an impossible standard. It's certainly not wise to try and reinvent yourself from the ground up, while in the midst of a stressful, time-sensitive challenge. That said, it's worth pointing out that for all the nitpicking Pokemon Sword and Shield are being subjected to by a vocal minority, most players of the game are having a very good time. Millions of people around the world are enjoying them. Perhaps that's the second part to this moral. You don't have to be perfect. You don't have to overcome all your challenges in a single instant. Sometimes, it's more than enough to simply be happy to be you, as you are today.


This year, on April 26, St. Lucia and the World celebrate World Intellectual Property Day under the theme IP and Youth Innovating for a Better Future. This important event was established by the World Intellectual Property Organization, WIPO, in 2000 to raise awareness of the role that intellectual property rights play in our daily lives, to celebrate creativity and to recognize the contribution made by creators and innovators to the development of societies across the global. The theme this year focuses on the extraordinary talent and innovation of young people around the world. St. Lucia is no exception. The youth of today offer fresh perspectives. They bring energy and positivity to the table, all in an effort to drive change and to move to a more sustainable future. It is also an opportunity for the youth to discover how IP rights can support their ambitions and help to make their dreams a reality. This can further be advanced into income generation and job creation through the use of key IP tools. St. Lucia is fortunate to have a wealth of youth talent and creativity. We see this flourishing in the music industry, graphic arts and animations, drama, sports, entrepreneurship, to name a few. These contributions should not go unnoticed. This is where the role of WIPO becomes important. WIPO seeks to support national and regional efforts to create a legal and policy environment for young inventors, creators and entrepreneurs to thrive. St. Lucia, through the registry of companies and intellectual property, will play its part in exploring the means of making the right resources available to the young people of the nation to help transform their dreams into reality. The registry has planned a number of activities to mark world IPD. These include an open day to provide information to young people on the IP registration process and the avenues available to promote their creativity, an essay competition for students of the Sir Arthur Lewis Community College, and a student creativity showcase which will recognize students of secondary schools on Ireland for their creativity and innovation. We hope to accomplish our activities through collaboration with some key government ministries, agencies and organizations such as the Ministry of Commerce, the Ministry of Creative Industries, the Ministry of Education, the Ministry of Youth Development and Sports, Exports St. Lucia, ECHO and the National Youth Council. I take this opportunity on behalf of the registry of companies and intellectual property of the Attorney General's chambers to wish all St. Lucia's a happy world intellectual property day and to encourage particularly our young people who are creators, inventors and entrepreneurs or those aspiring to get there to actively pursue their IP goals and ambitions to build a better future.


And now for my favorite DEF CON speaker, FX! Thank you guys. And with me here is Greg, one of my colleagues. And yeah, welcome to the annual RavdaFucking event. So I learned today from much that in marriages in the United States there's traditional gifts for every year. And for the 20th anniversary, the gift is China. So I didn't know that before. So let's get started. Oh yeah. So you will occasionally see fortune cookies. The strings on the paper slips are actually from the binaries. So let's talk about who are we, routers and stuff. Who is who are we? Most people don't know them or think they're only present in China. It's a 21 billion dollar company. They essentially make telecom networks, equipment, global services, which means they get to operate the stuff that they sold. And they make white label products.  Here's just different business units. So everything that goes into communication networks more or less can be purchased by who are we. What we're interested in here is the routing equipment. So the routing equipment is separated into like two series, the NE and the AR. Of the AR series, we actually have two types of devices to play with because they're not really easy to get. The routers are commonly also referred to as Quidway. There is another company, Huawei 3.com, or heck as we call them, who essentially make the same product and run the same software, but it is a different company. So if your vulnerability is getting or something, then make sure that you're taking this in. They also do security devices. And well, then there's interesting joint ventures. And you know that saying that A-class people hire A-class people. And B-class people, well, who are we cementing? When we look at product security, there is directly accessible from the main web page on Huawei.com. They're talking about open transparency and attitude, blah, blah, blah, work with all the governments. There is CEO recently called for a global cooperation for data protection. Yes. The reality is this. There is no externally visible product security group. So neither security focus nor Osvdb lists a vendor contact. The website of Huawei doesn't either. They've never released a single product security advisory. So nobody knows anything. The product security related patches are not visible as such. They just increment the release number. So apparently it's really someone hacks into the fix and then recompiles the code and this is your new image. That's it. So responsible disclosure, if I can't reach you, I can't tell you about your box. This is what happens. So let's talk about VRP. So the versatile routing platform is Huawei software, a general myth in the United States that they stole Cisco IOS.  I mean seriously, that's just not efficient. So what actually happened was they, according to Cisco's legal documents, they actually copied the enhanced IGRP stuff and made the CLI look like a Cisco CLI.  And since they made the CLI look like the Cisco CLI, they copy and pasted it widely from the Cisco documentation into their own. But in reality, the VRP platform is actually VxWorks, version 3 or version 5. Last year there was VRP8 coming out, but we haven't seen it yet. So the versioning, as you see, is not very clear. I really haven't figured out what the release numbers actually mean. You will also see different names for the software. So sometimes it's called VxLS or Comware. And what's really interesting, so in the UK, Huawei has a Huawei cybersecurity center, but they don't have a security contact group, right? But they have a cybersecurity center in which they build a special certified version of the software for the UK. Commonly referred to as the GCHQ VRP. So how do you talk with VRP? Pretty much like every other router, you have default CLI interfaces, web configuration, NetConf, SNMP, and then some more obscure things like the branch intelligent management system. What's interesting here is you can configure those things between Chinese and English. So by default they run on Chinese, you can configure them to be in English. However, the debug commands, and that took me actually several days to figure out, the debug commands actually only output in Chinese. So if you're a terminal, now this is actually really clever if you have a professional services group that usually operates your equipment, because now it means if you have Huawei equipment, you actually need Huawei people or speak Chinese. So yeah, business-wise that is actually really clever. The CLI comes with several levels of hidden commands. So when you log into a router, you can enter the command underscore and go into hidden command mode. And then depending on the device that you have, there's additional hidden command codes that you will find. So on the hack machine, it asks for the secret password, which turns out to be a string compare and looking for Huawei 3.0. What is it? You're interrupting my talk. I just want to make sure if you're here for the tenacious D thing, that's tenacious. The rooms switched. That's it, last announcement. And I wanted to give you an opportunity to get some beer. Thank you. Well, if you haven't figured out that this is the other talk by now, then I really suck. I want to repeat myself. This is verbatim copies from the binary. So the VRP images.  So if you're Chinese and you want to give me VRP images, that would be highly appreciated. We couldn't find a legal way to get them off the website. So we solved it the American way. Like, can we throw enough money at it? So the problem goes away and simply barred routers because they come with software. And they come with a default FTP service and you just FTP in and there's a file called system and that's the image. There's also an HTTP.zip, which contains the web content and stuff. So when you look at the images, they're very similar. You know, the headers are between 30 bytes and six kilobytes. But what you find after that is ARG. Anyone from the 90s remember ARG, the packer? So this is actually, they actually use ARG. We've also seen a 7-zip file. So essentially what's in there is one binary that they unpack. The default services are pretty plenty on those platforms. So we're looking at SSH by default open, HTTP, web management, FTP. You also often see Telnet open, X25 over TCP and H323. What can possibly go wrong? And apparently it is a very recent concept at Huawei that a configuration allows you to turn off a default service. So from what we hear, this was introduced last year. So if you have a default service, you have have it. Code quality. We were considering to leave this slide empty. So the smallest box that they make, the AR18, has on the image 10,730 calls to sprint F. The next bigger box has 16,420. So the number of calls to sprint F seems to be a linear function over the box price. You find lots of re-implementation of string copy and similar. They've wrote their own SSH server. Brave. Especially if you actually have to blackmail open SSH client to talk to this thing, because it uses two small RSA modellers. And for exploitability, the Nile page is not just mapped. It's read, write, execute mapped. So let's look at some of the internals. So this is the web UI. Everyone who speaks Chinese has a good time. Everyone else not. So they use session IDs. The session IDs are 32-bit, which is 4-byte. One of the 4-bytes is static. One of the 4-bytes is ignored. One of the 4-bytes is the concurrency session. And the rest is counting up. So if someone is already logged into the router, a very short code script gives you full administrative access to the machine. That's how it looks like. So you're getting the config, and you can change it and upload it again. So since they have web management, I'm glad you like that. So since they have web management, they actually also need a web server, right? So the web server tries to figure out whether a piece of content that is requested actually requires one of those complicated session IDs. So instead of looking into the HTTP.zip, which would actually tell them where that is, they actually have hard-coded substring comparisons. And if anything matches, they copy it into a buffer. That buffer is too small, and that buffer is on the stack. So any of those will work. And you essentially directly overwrite pre-authentication the instruction pointer. So this is essentially how much you control.  So what do we do? We look for a jump target.  Image Bay is head zero bytes, ROM is mapped. For now, we just stay image dependent, and we simply use a move to counter register and then branch to counter register sequence from existing code. So we pivot back to the stack. And then, of course, we need code to execute. And I need the beer. So instead of having a complicated shell code, we actually use features. So VRP comes with a pair of functions that you can call and you can pass string to it, which will then put onto the CLI fully authenticated as administrator. So there's absolutely no privilege separation whatsoever. The address is, in this example, image dependent, but a short fat German hacker presented an alternative method a couple of years back here at DevCon for Cisco. So we actually took one of our existing Cisco shell codes and copied it pretty much verbatim over, and it actually works. So the strategy for the exploit here is to get around the HTTP limitations with spaces and stuff, we encode the commands and decode them in place and then run a command sequence like you see here, and we end it with a ping to ourself, so we know that everything worked fine. And this is all shell code you need for that. So the left side is the decoder. The right side is the execution. Pretty similar to OSX PowerPC shell code. Very basic. And this is the result you essentially get, you know, remote management power scripts that allow you to log into routers and configure them. Now it's Greg and the heap. All right. Hi, everyone. So after all this like sprint of stack overflows that we identified, we wanted to show you some heap stuff and I had a pretty hard time finding a heap overflow between all this like static sprint of stack overflow. We actually managed to find one inside the BIMS client which is like a default service on the device. BIMS is some proprietary protocol based on HTTP. The real use case is probably not so important because the bug is like just right in the beginning. So when they connect to an HTTP server and parse the response, then they look for the content length. So they call some sub-function to find the content length, store the content length and then go ahead and malloc so many bytes plus one. And then they go like, well, we already received some stuff. Let's copy it there. So they just mem copy all the stuff they already received into this buffer that like you can specify basically the size of. So this is like a pretty basic heap overflow. Of course unauthenticated and all that. So the way to trigger it is pretty easy. You just specify some small content length, send way more data than you specified in the content length field and then it crashes somewhere like in some weird location telling you, I don't know, the router just starts malfunctioning. So in order to really exploit that we need to have a look at the memory allocator of the system and this is what we're going to cover right now. Due to time constraints we're just going to cover the basics here and this is why we will only look at malloc. We'll not show that this assembly are free and all that kind of stuff. So at some point in time you'll probably have to trust my hand waving there. If you need to know any details then please feel free to catch us later on and we can chat about that stuff. So here we go. This is the relevant parts of malloc. What they do there is they have to request a block size in R31 and compare it with some values and depending on the block size they store some small integer constants in R5 and then later on if R5 is different from zero they will call some helper function which I called malloc worker and this helper function will actually use R5 as an index into some table. We're going to see that on the next slide. So malloc worker will first try to determine the free list that is actually to be used to give back chunks of the requested size. So this is a binning memory allocator which is pretty common. So they use this small value in R5 to find the right free list. They take the free list and then we'll try to put off the first chunk from the free list and to return it. However, there are some sanity checks which they probably introduced because it was crashing anyway all the time and they wanted to debug it or so. So they have some sanity checks there and those sanity checks are basically each heapplunk has to start with a hard-coded value of OX, EF, EF, EF, EF. Then at offset four each chunk has to contain a pointer to some memory allocator structure and this structure is going to be important later on and at offset 14 hex this structure contains some string or integer constant which reads exclamation mark PGH. This is why we're going to call this the PGH structure but it's just basically some heap management infrastructure that is placed inside each chunk. And when all this is done like when all the sanity checks are passed and then it just takes the first block, puts it off the free list and returns it. And in order to take it off the free list it will do like the classical pointer exchange that many of you might know from old school DL malloc or whatever. So what we learn so far about the heap is the following. Like in the setup that most of you probably know a heap chunk like has a header part that is not visible to the user actually and like the real user data. And inside the header we have the fixed value that we have seen already. We have the pointer to the management structure and then some other stuff that is not so important here. And then it continues with the user data part which is actually like the pointer that malloc returns you and like if the chunk is in use then obviously the user data contains the user data. If the chunk is free the allocator will place some meter data inside the user part of the chunk which is also pretty common. So it will start with a value of 0x bet 0, bet 0 just like as a marker and then it will place two pointers. One pointer to the next free chunk in the list and one pointer to the previous free chunk in the list. So it's a doubly linked list and this list is stored inside the user data portion of free chunks. Okay, so as we mentioned the allocator uses different bins for chunks of different sizes and so each like bin has its own free list. And this PGA structure that we have seen before actually contains a pointer to the respective free list. So this is what the structure is used for. So when like we call free, free will go ahead look at the block, look at the pointer to the PGA structure find the free list and then insert the chunk into that free list. And malloc basically does a similar thing. So malloc will take the first element of the free list and use this classical pointer exchange that we have also on the slides here. So it will go like pref next is this next and next pref is this pref. So that like the this chunk basically falls out of the list. And as we see those both operations enable us to do some arbitrary memory override if we control the values there. Like if we control the pref next and this next pointer then we have an arbitrary memory right here. So this is like the most old school malloc attack that you can probably imagine. We use the pointer exchange to write like arbitrary data to arbitrary memory. However to do that we need to override the meter data of a free chunk. So that's the difference to like DL malloc. And this is why we have like a couple of pre-conditions here that we need to fulfill in order to like reliably exploit heap corruptions. So let's look at those pre-conditions. Let's first assume that we have a very basic setup. For instance let's assume the device just freshly booted and the memory is all clean. And then let's just assume we have the following sequence of allocations. First we allocate some 512 bytes buffer. We do that again. Free the second one, free the first one. So the free list is going to look like this on the slides. The first element in the free list is A followed by B and the pointers are all intact like A points to B and B points back to A. And yeah that's like the regular way the free list would look like after that. Let's further on assume that the chunks A and B like directly follow each other in memory. Like there is no third chunk between them. Always keep that in mind because that's like an important thing if you overwrite those chunks. If there was some chunk in between and we would like write more bytes in order to reach the chunk that we actually want to overflow. Okay but like to make it simple let's just stick with this setup here. Okay so this is what the attack is going to look like. We have our free list that we already detailed on in the last slide. And up to now it's like perfectly in order and it's all fine. So the first thing we're going to do is we are allocating 512 bytes again and then the free list is going to look like this like the second part of the list. And keep in mind like in memory B directly comes after A. So now we overflow the A buffer that means we write data into the meter data part of the B buffer. So now we have a modified free list that contains B as the first element still but B has corrupted next and pref pointers. So instead of the next pointer we now provide some value that we want to write into memory. And instead of the pref pointer we provide a pointer to a memory location that we want to override. Okay so this is pretty much the basic heap overflow stuff. Okay in order to do all that we need to take care that the memory layout is alright in that. So we need to have two consecutive chunks and we need also to have a pointer that is like heap management structure and we of course need to know like what value do we want to write where. Okay so we're going to cover each of these items. Fortunately influencing like the heap layout is pretty easy because in like this very bug we can specify the size of the buffer that the system is going to allocate. So we pick 512 bytes that's not used so frequently in the rest of the system and fortunately we can control even more of the heap by opening TCP connections to the device because for each TCP connection the device will like malloc a 512 byte buffer. So yeah this is a useful primitive to make the free list look like we want to make it look like right. And let's then cover like the addresses that we need to know. We need to know the address of one of these PPH structures or at least we need to know the address of something that looks like a PPH structure. We need to know the address of this important piece of memory that we want to override and we need to know where in memory our shellcode is placed. We can basically solve the first and the last problem by just using heap spraying and thereby making it even more unreliable and it probably already is. So we will just go on and heap spray the system and then we know that at some like high memory address we'll have our stuff ready like the fake PPH structure and of course the buffer that holds the shellcode. Heap spraying here is pretty easy because we control the size of the buffer it allocates so we just go ahead and tell it you know what please allocate like, I don't know, 10 max of memory and then we send exactly that amount of data like not overflowing anything. We wait for a second connection and then we trigger the bug. So all wallets are still in memory. For other services you will probably need to come with another approach but then again it's pretty service dependent and yeah. Next question is what do we actually want to overwrite? And this is like a pretty interesting question because of course we could now go ahead and like pick some function pointer in the image but that again like would be image dependent and there is some pretty interesting thing we can do. The interrupt handlers of the system reside at low memory addresses like starting at 100 hex and as I've already mentioned this page is mapped read write executable. So we can just overwrite the exception handlers in order to gain control of the program flow later on. Pretty much like back in the days the exception handlers reside at fixed addresses and here they start at 100 hex. However here we don't have this like vector table thingy that you might remember from Intel. Instead each exception handler like is basically a blob of code that the CPU is going to execute as soon as like the interrupt arrives. Are we going to overwrite the exception handler at 300 hex because this is the handler for invalid memory access. And this is quite some fortunate thing because let me put it this way at least my exploits will most likely bring the system to an inconsistent state at some point in time and this is most likely going to end up in an invalid memory access. And this is great because then we just control like the control flow of the program like we hydrate the exception handler. So as soon as the system access invalid memory we gain control and we can fix it up and like clean all the stuff hopefully like keep the router running. So this is like we could say this is the SEH exploitation of Huawei devices. Yeah kind of. So what you need to do you overwrite the exception handler and inside your shell code you will like first need to clean the heap structures like you can basically nuke off elements from the free list and that stuff to like repair what you did wrong. Then do whatever you want to do like basically use the shell code that FX already provided to execute shell commands and finally you properly exit from the interrupt handler read the CPU documentation for that. That's pretty straightforward actually. And I guess there is not much more to say except for like showing the exploit running so SFX exploits this one also will notify us with a ping when it's done so what we see here we like start TCP dump start the exploit and we actually see making device two connections the first connection we use for heap spraying like we send our data wait for it to be placed in memory and when the device makes the second connection then we actually trigger the vulnerability and the last two lines we actually see that the device pings us which indicates our shell code like actually worked. That's pretty much it from my side so I will hand over to FX again now. So first of all many thanks to Nick Pharr for this tremendously large and great giga-meister that he got me. So what about the larger machines right we talked about AR machines if you've seen the movie Ice Age they had like three melons we have three routers we're working on getting the bigger ones but we have no idea how they look like so far right so just if anyone else now we're actually almost at the end so wanted to give you like something to bring home to your managers what we're looking at here is 90 style box and 90 style exploitation zero operating system hardening at all and a zero page that is map read write and execute no security advisories and no security releases so that's our verdict you essentially get what you pay for sorry and before anyone asks the same question did we find any backdoors if you provide the people that operate the devices and you have buffer overflows and every single service on the device nobody needs a backdoor this is plausible deniability and with that I would like to conclude and thank you for coming