Hey, what's up DevCon? This is Cedric Owens. I'm super humbled and excited to be here, and I'll be talking about basically giving a perspective of what red teaming looks like in macOS environments here in the year 2021. Some background information on myself. I'm a full-time offensive security engineer on the red team side, and I've been dedicated red teamer now for the past four or most five years. Prior to that, vast majority of my career has been on the blue team side, doing incident response, threat detection, threat hunting, both in the Intel community and in the private sector, and so even as a full-time red teamer now, I highly value collaborating with blue team just to help uplift each other's tradecraft and move the needle forward in our organizations. I personally enjoy macOS post-exploitation as an interest area of mine, that in infrastructure automation. So whenever I do have free time, I'm typically working on projects that fit into one of those two buckets. Also as an early 80s baby, I do enjoy 80s and 90s nostalgia, such as what you see here in the picture. Just reminds me a lot of my childhood, and it's even cooler now to see my kids playing with a lot of these same toys or watching these same shows, and it's just kind of cool to see the legacy of these things live on. I am on Twitter, handle etset owns, where occasionally I'll post blog posts or tools that may be of interest, so check that out if that's of interest to you. So what I plan to talk about today, first one being, why do we even care about macOS, especially in a window-centric world? Why are we even here for this talk? Overviews of common tech environments and what the tech stacks look like in organizations that are heavy Mac users. Options for macOS payloads and post exploitation and a look at how the different options you pick usually will have a pro and a con associated with it. We'll also look at other attack vectors. So things in macOS environment that become attack targets that may not themselves necessarily be macOS, but you'll find them often in macOS environments, and then we'll end off talking about detection opportunities to look at from a blue team perspective. So again, first question is macOS, why do we care? And to your point, if you're asking that question, most Fortune 500 companies today are still window shops, and you may find there that maybe 90% of their endpoints are windows, maybe five Mac, five Linux or Chromebooks. But there's a sliver of companies in the San Francisco Bay Area, your Silicon Valley companies that are basically the opposite, where you may find 80 to 90% of the endpoints being Mac, may find five to 10% or somewhere around there being windows endpoints and you may have Chromebook and Linux mixed in. So essentially it's the flip of what you'll see in your Fortune 500 environments. It makes it for an interesting environment to assess from an attacker's perspective because there's often a mentality, well, if we're not an enterprise window shop, then we're more secure. And I can understand the line of thinking there, but it really depends on how you implement your Mac slash cloud environment. In other words, if you have keys laying around that are in code rebos or other easy places for an attacker to find, you may find that even though you've migrated off of a Windows Enterprise environment, your environment can still be easily compromised. So we'll talk about that a little bit more as we go. It is a slowly growing trend that at least that I've been seeing where newer companies are adopting more of a not quote unquote, non Windows Enterprise environment. And what I've noticed is that Active Directory is typically going to be there because it usually is the best LDAP solution for enterprises. So even in these environments, you will have Active Directory, which will be used to back your authentication, but just your typical end to end enterprise rollout of Windows will be different here. And I like it too, because it allows, as a red teamer, it allows you to point out different vectors that really have nothing to do with Active Directory and compromising domain controllers, but other very interesting vectors that can still be impactful and in some cases devastating to your organization. So I think it's a very interesting environment from a red team perspective. So first, we're going to look at common tech stacks and what you might encounter in a common tech company in Silicon Valley area. First thing is there's a concept of realms or environments. And so you may have a corporate environment, a dev or stage environment, production environment. And so here's an example. We'll walk from left to right where you may have employees that remote in using an identity as a service solution. Two common I'd ask solutions are octa and one login where the employee authenticates with their username, password and a two FA token, which is usually going to be like an octa verify push or duo push to their mobile devices. Once they log in, they're now inside of their identity as a service portal and have access to a lot of different productivity applications, like email, you may have Atlassian products like JIRA, you may have Salesforce, internal Git, even custom application servers all accessible to the user based on their roles in Active Directory. Then you also on the production side, you may find a combination of cloud based production hosts and on-prem. And you may find a lot of different things there, but typically in production, you're going to find like your customer ready code and maybe even customer data that's stored here. And you're going to find things like your build hosts, your CICD pipeline. You may find some cloud hosted services and servers there. You may find HashiCorp for managing application secrets. And of course, you may have some on-prem stuff. You may have Jenkins on-prem or even in the cloud. We have some Windows servers, segment environment of Windows servers there. So a lot of different things going on here and it makes it interesting because of course, there's a lot of complexities and sometimes with more complexities comes more opportunities from an attacker perspective. Another thing to point out is on the bottom left, I have rough percentages over the different endpoints. So like I'm showing Mac OS being 80% and Windows being 15 and Google Chromebooks being 5%. It's just a rough, rough numbers there. Some organizations, you may actually find Mac being higher or closer to 90%. And the Windows population being even smaller. So it's interesting because with Mac being such a high, high percentage of endpoints in tech environments and engineers using their Macs often to either do dev work locally on a Mac or log into like a cloud hosted server or an application server or a jump box from other places that they can do their development work from there. You typically may find that there are sensitive keys, tokens, credentials, things like that that are stored on the endpoint. So really end to end this makes for a very interesting environment to assess from an attacker's perspective. Next I'm going to talk quickly about some different ways that Mac OS is deployed from an enterprise perspective. One option is like custom deployment where you hire your own team and they build out some custom solution to manage and hook into Macs and control them and push policies etc. And basically loop back into your LDAP solution. Organizations that do that custom tend to be maybe like your big five in tech. So something like your Apple or your Facebook, Google may all be custom where they have the money to resources to throw at that. But typically what I find is outside of the big five, most organizations in the Silicon Valley area, most companies there tend to use a solution that they purchase such as Jamf Pro, which is really the most common that I've encountered. But I also noticed products other products that are up and coming like Kangey. And so we're going to take a look at those. Also wanted to point out Kalem Hall and Luke Roberts and their Black Hat Black Hat talk this year did a really good talk on abusing Jamf for remote management and how an attacker can leverage that to control and compromise manage Macs and enterprise environments. So highly recommend checking that out. So there's a very high level overview of common Jamf deployments that you may see. You have typically have an admin server. If you're in an environment that uses Jamf, you can run Jamf, check JSS connection from terminal and that will return the URL to your Jamf admin server. You also have your endpoints which have the Jamf agent on them that receives the configurations for the admin server. You also have self service that runs on the endpoints and allows users to install software versions that their IT department has already vetted. So essentially they don't have to open tickets for these. They can just install them from self service. Really nifty way of doing things. Also Jamf does include the ability to have remote management where admins can remote into the screen sharing or other troubleshooting on the endpoints. And typically that is through an admin account that has SSH access into the endpoints. Oftentimes from what I've seen in enterprise macOS environments, SSH is enabled on the endpoints and the IT team will use an account that can SSH in and it has pseudo rights on the macOS host where they can perform administration. So that's a very common thing that I've seen in environments. And of course one thing to be aware of is if that is how your environment is set up, it becomes very similar to the problem on a Windows side years ago about dealing with SMB and local admin passwords and laps coming out being a solution to randomize those passwords. Well the same thing would apply here if remote management is being used. Is it a static password or is there a random password being used? And of course if it's static password then that means if you get that password you can now access any mac in the environment over SSH with pseudo rights and SSH has full disk access so it bypasses privacy protection so that could be really bad for the environment. So just something to think about there. Another thing, another aspect to look at here is if you run as a red team or you run a phishing exercise and you target Jamf admins which is usually a active directory group in your environment that limited people have access to that the organization has identified to administer Jamf and you fish them, you gain access to their active directory credentials and then you use those credentials to log into the Jamf management server, Jamf admin server. And depending on the environment like that that admin server may be behind Okta where 2FA push is required or it may not, maybe just be locally in your environment without 2FA and you can get access that way and then from there you can start to push policies and scripts to run on the endpoints and really there you almost, you essentially do have full control over your macOS environment so this is something an attack path to think about as well if you're in an enterprise mac environment. But now even when it comes to Jamf there's really so many different ways to implement Jamf there's really no one way to do it. So we're just going to look at a few examples. First example is probably the simplest where macOS hosts are bound directly to AD and in that case you can run a different DSCL or LDAP search commands to pull AD information directly from the domain controllers just as you can on the windows side like for example with net user commands like that. You can do the same here and tools such as MacHound which is a macOS port of Bloodhound or Cody Thomas's Bifrost which does curve roast manipulation those tools would work and apply in this environment since the host the macOS hosts are bound directly to Active Directory and Conquerium directly. Another example is via access via a tool called Nomad where in this case macOS hosts are not bound directly to AD so if you try to query Active Directory from these hosts you won't be able to reach it directly that way and essentially the user logs in locally with a local account and then they do network authentication for access to resources which is where Nomad comes in and that Nomad then performs curve roast authentication on their behalf and so and this if this setup is how your environment is configured then there are files that you can read from that you might find interesting on an assessment such as like different P lists that I have mentioned here also things like K-List, KCC, Cody Thomas's Bifrost tool that does curve roast manipulation those tools would still work since curve roast is still happening from your end point so something to think about there. Another example same setup or similar setup here where your macOS end points do not have direct access to Active Directory to query domain controllers directly in this case they have Jamf Connect on them and Jamf Connect is synced through Akta and Akta does the syncing with Active Directory when it comes to authentication and so like a federated model there and what's interesting here is like just in this example Active Directory controllers are domain controllers are walled off by like firewall rules or VPN access maybe a specific VPN profile that you need so again if you try to query directly this would not work but if this were how your environment is set up there still are some interesting P lists and files on the system that you could pull from to learn more about the host and the environment that you're in such as what's here the two files highlighted above. So as I mentioned AD is still present in macOS environments but it just looks a little bit different from what you see in your enterprise windows environments and I enjoy because it gives me a chance to focus on something else outside of Active Directory and of course when you're and these types of environments are heavy Mac and cloud implementations so a lot of interesting things to look at so let's talk about that. First we can talk about initial access in this case targeting our targeting our identity as a service portal so the two most common are octa and one login tool that that is pretty popular here is Evil Jinx 2 by Kubogretzky and what it does is you point it to a target login portal it clones that portal and as you basically send out a link to the fake portal and as people log into the fake octa or fake one login portal it captures the username password and then authenticates it to the actual site and does the same thing for your 2FA token so then the attacker is able to grab the token for octa or from one login and port it into their browser using a plugin like edit this cookie and now you're the compromised user and what's so interesting about this attack path is once you're inside of someone's identity as a service portal you have access to a ton of different productivity apps so you got slack think about the credentials configuration files secrets things that people have shared in the slack that may be pinned in different channels think about gmail or google drive people may email themselves passwords so they don't forget or or sensitive information you can you have access to search all of that imagine like your confluence your JIRA tickets things that that may have interesting data there or wiki all sorts of juicy information there and as a red teamer you may opt to take this path and essentially meet your objectives without ever even needing to land access on a macOS endpoint so this is definitely worth running in your environment from both a red and a blue team perspective and one of the big wins for from the blue team side is allowing basically running through your procedures to see if you have this ability into this attack path and if you do do you have the ability to revoke compromised tokens because in this case password resets are great but if you don't revoke the compromised token you're not going to be able to boot out the attacker so a good way to test your detection and response procedures so I mentioned a lot of interesting data in your productivity portals and there are some tools that people have written to actually automate this if you're using this from a red team attack perspective one being a colleague of mine Antonio Piazza he wrote a few different what I call thief tools of gd gder and conf thief to simulate or speed up downloading sensitive files from those platforms also a colleague of mine Brad Richardson over at credit karma wrote a tool called slackhound that does a similar thing if you find a slack token on a host you just feed it and it uses api calls and things that are nature to pull down data as well as a slack pirate so a lot of different and interesting attack paths on this vector so now we talked about identity as a service briefly I'm going to pivot over to the macOS side of the house and talk about some of the basics around macOS from a security perspective I'd like to break it into three different areas prevention detection and removal gatekeeper on the prevention side is essentially the engine that or already the I guess you say service with this policy D is behind it as the engine that evaluates certain file types like application bundles star packages macos etc it looks for files that have a calm dot apple dot quarantine attribute appended to them which the operating operating system appends for any files downloaded from the internet so if a file is of the of the types that gatekeeper evaluates such as macos apps install packages etc and it has that quarantine attribute and gatekeeper enforcement kicks in it checks to see if it's signed and if it's notarized and if not it will block it from running if it does it still does a pop up but what's what's of interest here is that even for non signed non notarized like app packages and stars maco monaries etc the user can still right click open and click through one other prompt to run it despite gatekeeper on the detection side you have x protect which is also part of gatekeeper and it's really more of the malware definitions and blacklisting that I guess you can say comes from like apple intel from where we're real world malware resources or malware sources that they have analyzed and then you have the malware removal tool MRT dot app and that does the remediation from a red team perspective the prevention side of it really is the hardest hurdle to overcome x protect and MRT dot app usually are not much fact usually not big factors for red teamers because we tend to write our own stuff for macOS since it's kind of a niche space and since x protect and MRT dot app tend to look at existing samples for their intel usually when you write your own stuff those those two aspects become less of a factor it's just really gatekeeper that becomes the the pain and headache from a red team perspective other things to think about is the concept of TCC or privacy protection so and that essentially you have certain folders or certain places on disk that TCC protects so you have things like the user's desktop documents downloads all sorts of other places on the system that TCC protects what's of interest though are things that are not protected so the home directory itself and within the home directory certain other sub directories like a dot ssh or dot aws directory both of those would contain credentials and the ability if they're captured to to provide lateral movement a temp directory is also not protected which is why malware typically is dropped there so just something to think about because again if TCC is enforced a pop-up will show to the user what they can allow or deny if like that directories requested before not protected folders there's no notification to the user and access is not prevented at all by TCC if it's not protected by TCC the evil bit and regi did an excellent black hat talk this year around 20 different ways to bypass TCC so definitely check that out they'll dig way more into what TCC is and different methods for bypassing so check that out from an initial access perspective on mac a lot of different options here and they all have different pros and cons you have your maco binaries which are checked by gatekeeper but you typically need a delivery method because most of the time your macos are not going to be double click friendly i mean there are some tricks you can do but just generally speaking you'll you'll use your maco as a second stage payload apps are checked by gatekeeper they're pretty remote friendly because again they're they're packages and they're double clicked usually and so um they are remote friendly but they are checked by gatekeeper star packages are also checked and remote friendly uh that allow users to double click you got a weaponized pdfs uh shell script trickeration which we'll talk about later uh essentially that is a bug that i found in gatekeeper this year and reported to apple and work with them to get it fixed um you also have your scripting languages that are not checked by gatekeeper things like such as jxa which is javascript for automation kody thomas did an excellent job a couple years back of highlighting how powerful jxa is on mac and how it's essentially like an apple script alternative um and some it's kind of interesting because sometimes i'll view jxa as like the replacement for apple script but they're both still around and they're probably both be around for a while of course python is not checked by gatekeeper however mac or apple will remove python from base macOS installs at some point in the future we don't know when but from an attacker's perspective it's just something to keep in mind if you're heavily relying on python uh office macros are not checked by gatekeeper but it is sandbox meaning uh it will be if you gain access remotely via office macro you only have access to certain parts of the disk and certain binaries etc so a lot of different options here got apple script browser browser extensions uh one thing i wanted to point out was that on mac os a dunefist leopid wrote a really neat tool called mystical that is a payload generator for several of these types of payloads where you can provide information that would generate the payload for you i also wanted to point out mythic by kody thomas at specker ops is what i consider at this stage to be the king of mac os command and control because of its innovative use of jxa and has a lot of other cool features with how it's built and how it's managed so definitely check that out from a red and blue perspective quickly going to jump into some different examples so the first example being installer packages and i'm going to briefly talk about script only because they're the most common and pretty simple example here but you have a pre install and a post install script and both require the shebang at the top and exit at the end in order to run successfully they run as child processes of the installer packages so whatever scripts you have running and it runs elevated as root from an attacker's perspective which is a nice plus because any install package that a user detonates and to install they end up authenticating and usually in macOS environments the user is local admin so when they authenticate that installs with elevated or root access on a host as i mentioned before it is checked install packages are checked by gatekeeper but they can right click and open and that's a common technique that's used in the in the wild with real world malware samples so patrick wortel and objective c have a lot of good examples of like real world malware samples for mac os and you can look through their mac malware reports of 2020 and 2019 etc and look for different examples for how these types of things are done like an images included and the user is instructed to right click and press open in order to run a non signed non notarized installer package here's an example a pre install script so we talked about pre install and post install this is example on a pre install site that essentially just pulls down a unsigned a non notarized maco binary writes it to the temp folder and sets the executable bit on the bottom is an example with us being remote these days and so many employees being from home this is an example of how you could add a guard row in there to check for the host name to ensure that it's not running on someone's personal machine but on a corporate machine if it's found to be running on a personal machine it will exit if not then it will perform the the pull down of the payload and set the executable bit and here's an example of a post install script where it just runs the maco binary background it so once you have that set up you can just run this package build command here to generate the package hosted get it to the user they detonated they authenticate basically double click and authenticate through the installation and it detonates in the background and as you can see at the bottom here this is my mythic a screenshot of my mythic c2 server and the payload detonated as root level access another example you have app bundles or app packages where you have the app the name of it with content slash macOS and then a maco binary at the bottom and so to do this a very simple way you could go into xcode create a new project my example i'm using swift here and then you would design a window with buttons icons text etc for a user to interact with once you have that designed and ready to go you go into info.plist for any app transport security so app transport security are restrictions on apple to limit the types of outbound connections that app packages can make so if you're trying to talk out to like a non-https server so just playing at http there's a certain entries you have to put in there to allow that and even if you're talking to an ssl server it does not like self sign certificates so you actually have to get a valid sign certificate for that to work and then of course you set your sandbox accordingly or the settings there that you need and you can add code like here below that uses a dispatcher and again this is swift as a background task to execute a jxa payload that's hosted on a server and here's an example of the window that you could design for the user to interact with and as you can see it can be very convincing and the user clicks update now then the mythic command and control server receives a callback from the user so again app packages are checked by gatekeeper but as you can see here as i mentioned same with install packages same with here you can right click and open so here's an example from the slayer which is a common mac os malware family that's been around for a while of a simple image to social engineer the user into right clicking and opening to run an unsigned unsigned non-notarized app package of course you have Microsoft Office macros they still work they've been around for a while and even today when you i like to do tests with macros where i just will attach it and see let the the email systems antivirus filter scan it and see if it detects it as malicious and one thing i've noticed is that simple strain concatenation is usually enough to get it around those filters so if you're taking like the word exec doing e plus x plus e plus c for example that will get around a lot of the filters we'll look an example a little bit later for that no gatekeeper concerns but as i mentioned earlier it is sandbox meaning you have limited disk access and limited functions or or binaries that are available to you you can still access things such as like osa script curl screen capture python so still a lot of potential there and adam chester who's currently at trusted sec did a blog post a couple years back where he looked at entitlements that office products had and he found that they had one entitlement to drive to drop files outside of the sandbox if the file name was propended with a till day dollar sign so really good research and that technique still works where you can drop files on disk outside of the macula sandbox using that technique a colleague of mine met off bat who's also the credit karma he recently published a sandbox escape where essentially you create a z s h e d v file that executes a payload you zip it in for that zip file you prepend the till day dollar sign in front of it you drop it to the user's home directory you add it as a login item and then on reboot when the user restarts the login item extracts the zip file drops the z s h e d file to the user's home directory and then when the user opens a terminal you have non sandbox call back to your server so definitely check it out a very informative blog post and does still work some example office macro generators from mac os mac fish has been around for a while and honestly that's where I learned I took a lot of my cues of how to write macro generators from mac fish it's got a lot of cool options where you can generate office macros that use python or curl or osa script or combinations of them I also wrote a couple macro generators as well for mythic that uses curl and osa script and I did my own for maxi 2 which is a command and control tool that I wrote for mac os that leverages python I did highlight python and red because again python will be eventually taken off of base mac os install so just I like to highlight it in red so you can be prepared when that happens which is why things like switching to jxa for example is a good option because that that will be around for a while also when it comes to office macros auto open um subroutine is is useful so that when the document is double clicked the uh the office macro can be executed and here's an example here of how I concatenated like the word python and word exec and you see long strings of base 64 characters or I guess in this case hex characters excuse me long strings of hex characters and what those do is in this payload that I've written I basically read from a I read the actual payload from a file read it into a long hex string and now it's just breaking that hex string into smaller chunks so now I'm going to quickly talk about cve 2021 30657 this was the bug I reported to apple this year that was a gatekeeper bypass around the march time frame and where the kind of where the idea for this came from was started thinking about well here's the typical structure of app bundles on mac os you have the app name you have the content directory mac os directory and then there's a maco inside of that so when you double click an app bundle the maco inside of it is what executes and it just has all these other wrappers around it like info.plist etc so I started thinking like what if we put something else here something that's not checked by gatekeeper because macos are checked which is why when you download an app from the internet and try to try to execute a gatekeeper will pop up like if you just try to normally normally run it but in this case what if we put something like bash or python in place of the maco binary since neither of those scripting languages are checked by gatekeeper so I did that that's kind of what led to the bug I found that it worked and it did bypass gatekeeper and I reported this to apple march I believe of this year and they fixed it in short order in big sir 11.3 and in catalina updates from the apple security bounty website they have a section there for user installed applications and access to sensitive data hundred thousand dollars are a really big bounty payment but they have a very you see the two asterisks there next to the first line I wanted to highlight that because apple has a very narrow definition of what they consider sensitive data and in my opinion it's much more consumer focused versus enterprise focused because they they only consider contacts mail messages notes photos or location data to be sensitive sensitive information which makes sense from an individual consumer perspective but when you're starting to look at max in an enterprise like what we're talking about here macos environments where organizations have thousands of users that are using max and they're doing development and engineering work sensitive data on the host this definition certainly should be expanded and in my case my app detonated got remote access and then I was able to access sensitive data which is things like ssh keys aws keys uh azure gcp keys uh other files and the user's home directory the user's uh shell history that contains sensitive information depending on like what they've done so a lot of different pieces of sensitive information that this payload had access to but because of apple's very restricted and limited definition kind of consumer individual consumer focused definition of sensitive data are seeded tiny bounty payment in this case nowhere near that hundred thousand there so just wanted to point that out for researchers if you're submitting things to apple to just be aware of that and the reality is apple may say that this is the the small breadth of sensitive data we care about but from an attacker's perspective like you may have a bypass and you're able to get things that are outside of that window of of apple in terms of like their definition of sensitive data but it's of it's still sensitive data and so that can happen in your case as well where you receive a small bounty payment so just wanted to give you a heads up with that some interesting things about this payload so I mentioned it does bypass gatekeeper and app transport security that we talked about earlier where the system restricts like what websites an app can talk to or what types of protocols you can talk over those things don't apply also you'll have access to non-tcc folders so you'll have the ability to grab things like ssh and aws keys etc off the host and it's very convincing so as you can see here just by copying icons over to my fake app and it's got the one drive logo and it looks looks pretty close and so it serves as a really good payload that the user can just simply double click a dmg or zip and double click the app inside of it and that's it so it's not no need to right click and do all these other things which made this a very powerful bypass and I in my tests I did both with trying a shell script at the bottom of the app bundle as well as having python at the bottom of the app bundle and in both cases they work because neither python or bash scripts are checked by gatekeeper so I was able to get a call back in both cases and here's an example just kind of walking you through what the payload looks like and I'm just showing you here that that terminal does not have full disk access it did not have any folder access as well and gatekeeper set to app store which is the most restrictive level so just wanted to show that that there's no trickeration going on in the background here is the payload that pulls down curl or uses curl to pull down the payload and runs it background it and then there's an osa script message there which is a fake prompt to the user saying thank you for installing this app so you'll see what that looks like a little bit later next I'm using this masquerade script it's a slightly modified version of a tool called apify that's been out for for years that basically took shell scripts and put them in the bottom of an app bundle structure and so that's what I did here is just ran that masquerade script and created a fake app that has the structure of an app but instead of a mako it has the shell script downloader at the bottom of the bundle now what I'm doing is taking the icon from one drive and I'm copying it over to remove the default logo in my fake app to make it look a little bit more realistic and notice that the operating system labels both of them as apps even though in my case I don't even have an info.plist there it just kind of follows the app bundle structure so now that I have my fake app with the logo what I'm doing now is copying it over to a folder and then I'm going to go into disc utility and essentially create a dmg file to host the app so that's kind of what I'm doing here I just moved the fake app over to a folder called hosting and now I'm saving it there and I'm going to give it a new name called real app so it would be saved as real app dot dmg so that's what's happening here so now that that's done you'll see real app dot dmg was dropped there so the next step will be to show that when a user basically to simulate a user downloading it from the web so I'm going to host the real app dot dmg to a local web server here using simple http server and that way I can click it download it and when I download it it will have the same quarantine attribute that a user would have if they had to download it like as part of a fishing exercise for example so I just hosted it here's me accessing it here locally and you can see there's real app dot dmg so just single click it downloads to the downloads folder and now we'll just confirm that the dmg file does have the quarantine attribute that gatekeeper checks we'll take a look at that now and as you can see it does have the com apple quarantine attribute appended to it so now we're ready to take that file that we just downloaded and detonate it and see what happens so you detonate the dmg and inside the dmg is the fake app that we created here in the demo double click that notice no gatekeeper pop-ups anywhere and as you can see you got the fake pop-up there that says thank you for installing this provisioner the fakes to be from the it team and in the background I get a callback from my mythic command and control server so again apple has fixed this but I just wanted to show you what the bypass look like when I submitted it to them other things to keep in mind from tcc a lot of this we've already talked about of what's not protected another thing to mention is ssh is often kind of touched on it earlier but in enterprise macOS environments ssh is usually running by default on the endpoints and ssh daemon it was recently pointed out in the in the um mac security community that the ssh daemon actually has full disk access so if a machine if you're on a machine and you have credentials of the user and you ssh and locally um using those that set of credentials you now can have full disk access bypass tcc so something to point out there the quarantine attribute uh using curl does not append the quarantine attribute just downloading through browsers or through um like bluetooth like sharing files one machine to the next which is airdrop things like that will append it but using curl does not so that's something to keep in mind because I use that in my gatekeeper bypass and from signing a notarization perspective you could totally sign and notarize your payload if you want in order to get around some of the controls but at my personal experience I found that it was pretty pretty painful process and when I did sign and notarize my red team payload I had about a week before uh apple retroactively found it and like um deactivated the developer account and revoked the certificate so it's just something to think about my personally believes probably not worth the time since real malware real world malware samples are you often using unsigned non notarized payloads and social engineering the right click open execution of the payload uh once you're on a host um lots of different things you can do you can again you can grab these system credentials from the host so like aws credentials gcp azure credentials you can look through uh users bash history you look for maybe sensitive files on the system sometimes users might save tokens or uh passwords file mango pdf uh did a really good blog post on cookie crimes things you can do there with um for google chrome so definitely check that out i have a link in the in the uh resources section later to that blog post um of course you can prompt the user for credentials you can do it via osa script or you can do it programmatically to not leave any command line um artifacts you can also search for other interesting files on the host and even this file here on the bottom this login data uh chrome database contains a stats table and that stats table contains the username and the login url for various sites and it's of course it's it's unencrypted and you do not need root to read it and it's not protected by tcc meaning any non sandbox payload can now read from that table which means if you already have the user's password considering oftentimes passwords are reused that table now provides usernames to try that password against for different sites also if you have root access uh you can grab a keychain database and take it offline using forensic tools like chain breaker and so you can gain root access via either install or package which we talked about that gives you root access because the user authenticates or if you get normal user access you can use you can basically prompt the user for credentials and once you get those credentials you can then uh through tools like mythic you can run elevated commands since the user if you have the username and password that user is usually root on their mac so then you can use that to run elevated commands and pull off the keychain so something to look at as well when it comes to persistence lots of different options beyond just launch agents and launch daemons which are probably the most popular for mac os the evil bit did a really good long running blog post on titled beyond good old launch agents which goes like the mac version of beyond good old run key on the window side and looks at all sorts of interesting um persistence options on mac os uh leo pit or doomfist also has a persistent jxa repo looking at jxa implementations of a lot of the techniques that the evil bit talks about in his blog post i also then took a subset of doomfist persistent jxa and did some swift implementations so i have a repo now called persistent switch so you have a lot of different resources there to play with different uh to to look into different uh persistence options and different implementations for mac os uh lots of other options here like vm vm plugin persistence sshrc persistence uh profile persistence zoria chris ross he has a really cool authorization plugin um that like he did a lot of research there so a lot of different options to look into for persistence so some other attack vectors beyond mac that you'll typically will see in a mac os environment one being the build pipeline or also known as the cicd pipeline and the way i like to describe it is this is the process that like an initial concept for code goes through from like the initial draft uh thought our concept all the way through to being customer ready and it hits various stages and checks along the way and what makes this so interesting is there's a lot of interconnections here across different hosts so if you can access one of these hosts chances are you'll get a lot of access and sometimes your build environment your your cicd process will traverse environments depending on what you have implemented in your organization and as i mentioned a lot of integrations like there may be some internal git integration and of course internal git becomes a target internally because there's 10 there tends to be more trust for your internal git and your external git meaning that since it's internal people may feel like posting or committing secrets in your code is not as damaging but ironically that's going to be one of the first places an attacker will look and attack environment is looking through git repos jinkens is often common commonly part of the build process and is usually misconfigured in some way that will allow easy access and oftentimes jinkens will contain a lot of different secrets on it given that given its role in the environment and then of course you have workstations where engineers may be doing development from their max and they have local keys stored there as well quick look at jinkens two common misconfigurations this is the first one allowing unauthenticated build jobs to be executed so if this is present in your environment you can hit the view default new job url and your jinkens host and it will bring you to a page that will allow you to run a new build job where then you can add a single step to execute a shell and you put whatever shell command you want in there could be like running a remote shell or reverse shell payload it could be catting out files on a system that are sensitive it could be querying for metadata service iam credentials if your jinkens host is in a cloud environment and so you execute it and you can see the console output there so essentially this will allow compromise and access to secrets which can then be used to pivot to other parts of the environment another misconfiguration for jinkens that's pretty common is the script console page allowing unauthenticated access so if you if this is configuring your environment you can just hit the script page of your jinkens console jinkens host you'll be brought to the console and then here you can run groovy script and essentially get like reverse shell access you can cat local files query for iam metadata credentials and the metadata service so all sorts of different things you can do here as well a few other juicy targets of course internal wiki so thinking about like all the organizational information system environment information credentials that are there that can be leveraged by an attacker thinking about your internal ticketing system like imagine the environment information that can be learned there or processes and architecture information slack of course we mentioned that earlier credentials keys bpm profiles all that stuff can be found oftentimes in slack another one if you have docker in your environment if dockers configured with unauthenticated api sockets then those hosts can be hit on port 2375 or 2376 usually default ports but those hosts can be hit and shell commands can be run unauthenticated on those and potentially extract secrets out from your containers there of course we talked about internal git so a lot of different juicy targets once you're in a macOS environment outside of just macOS of course you have cloud hosted usually if you're in a macOS environment there's going to be a good amount of cloud there as well and so the entry points for cloud keys oftentimes can be phishing payloads like grabbing cloud cloud keys off a compromise endpoint maybe code internal repos for your internal git so like finding secrets that have been committed there of course your build hosts like your Jenkins as an example sometimes even build logs will write the cloud keys that it used during the build so that's a misconfiguration to check for as well and it's good I think to also test from a blue team perspective to see what your cloud visibility and detection posture is so can blue team see things like accessing secrets in the environment and using those secrets to pivot like different post exploitation examples like on the awsi like looking at secrets manager or parameter store for additional credentials which may provide access to like another environment or a higher level of access assuming into other roles so maybe like an attack I say red team has access to an aws role that role has the ability to assume into another role the role that they can assume into has higher privileges so that would be a form of privilege escalation or lateral movement to see if like blue team can see that attaching policies to users or roles all sorts of different things here that can be done and I think it's worth like running through these types of scenarios proactively or even looking at the mitre attack matrix for the cloud that they have and looking at some common like privilege escalation and lateral movement techniques for different cloud environments so other recommendations on the blue team side is definitely recommend leveraging the apple endpoint security framework it's good both from a personal standpoint so let's say you have a payload a red team or a real malware sample payload you want to understand what it does you can take Patrick Wardle's process monitor or file monitor that that he wrote and you can take it on a sandbox macOS system detonated and then you can look at the endpoint security framework logs it's almost almost like the equivalent of a sysmon for for apple or for macOS so definitely check that out and then you can look for things like suspicious command line executions persistence methodologies we talked about repos that you can use their parent child relationships so things like an office document spawning then sh for example that will be something to key in our course network detection so looking for one host accessing one or many ports on multiple hosts over a short period of time might indicate like scanning or sweeping activity course identity as a service abuse we talked about octet one login so being able to see if you have the ability to see compromised tokens and if so do you have the ability and procedures in place to revoke those tokens of course jinkens abuse so getting visibility into script console abuse or build jobs running suspicious shell commands and then within cloud itself like aws or gcp for example looking at your common post exploitation and privilege escalation methods and auditing you can even proactively audit your roles and see what like you can work with them i guess if you have a cloud security team you all can work together to see what the state of your current im roles are what roles they can assume into and look for like easy privilege escalation paths and see what can be done to reduce those paths lots of different resources here lots of cool people have done a lot of awesome work in the macOS space so this is not all inclusive but just wanted to shout out some good resources for people who are interested in delving more into these topics definitely check those out so thank you all for listening appreciated and if you have any questions feel free to reach out


What are your thoughts on modern-day abortion being an unwitting or willful sacrifice to Malik? Would a miscarriage stillborn, aborted baby go to heaven, have it not been physically born into the world? To ask another way is the soul spirit imparted to the body at conception or upon physical birth? And does the Bible address the idea of a grace period for young children and their need for salvation in order to enter heaven? Would their fate fall upon the belief of their father or mother, or are they just out of luck? Is there any biblical merit to the idea of an age of innocence for children? Well, you know, let's take the the first part about abortion being an unwitting or You know versus a willful sacrifice to Molok I don't think there's I mean there might be somebody out there who goes in for an abortion thinking that oh This is my offering to Molok, you know or to a God I basically don't think that's gonna be the case, but you know, I'm not omniscient So maybe there's somebody out there that thinks that do I think that there's a sinister, you know evil supernatural mind Somehow at some place at some point or stage Propelling the abortion narrative. Yeah, I do I do think that there's a supernatural evil Element involved in this when I say that what I mean are things like, you know The people just being taught today that the contents of a woman's womb is not human You know and that's sort of this this trigger point of justifying, you know abortion even beyond, you know This whole notion that it's my body and the woman saying it's my body when it's actually not I mean if we're talking science here, okay, let's let's try to you know do some science here The contents of the womb are genetically distinct from the woman. So therefore it is not her body She's the host, but it's not her body that's being destroyed. It's someone else's body Genetically the contents of the womb are human. That's all that it ever can and will be it won't transform into something else Genetically it is human and it's alive if you put the contents of a woman's womb on a Mars rock You'd say you had discovered Martian life and win a Nobel Prize It's living it grows Okay, it is becoming what it was intended to be it's not the same as swabbing your cheek You know to get human cells there because they will die. They won't grow into anything else So it's different than that and these are all scientific statements. They're all very straightforward very provable very well known But nevertheless people are taught The opposite so I think that whole effort again to get people to dehumanize humanity is Something that that's very sinister and evil and I think supernatural evil does have a role to play in that whole process I don't think that's a stretch at all now the whole thing about the eternal destiny of The stillborn or the miscarried the aborted baby and we can add as well, you know Babies that are born with with severe mental incapacitation That they'll never actually be able to believe, you know that that sort of thing. I put them all in in one category The best answer to this is go up to the naked Bible blog. I did an extensive series of posts on Romans 5 12 and one of them and we'll provide the link to this on on this episodes page but one of them Delts specifically with the fate of the unborn infants and other human beings who cannot believe now I'm not going to go through that whole thing The whole series on Romans 5 12, but I'll I'll basically give you the highlights Romans 5 12 says Therefore just a sin came into the world through one man and death through sin And so death spread to all men because all sinned or all sin, you know, some translations will have There you go. Well, this verse has been taken for not centuries But millennia in the history of the Christian church and this goes back to the church fathers So I'm gonna lay this at their feet This verse is used to teach the idea that all every human being after Adam inherited Adam's guilt This is the the typical articulation of the doctrine of original sin The doctrine of original sin has become sort of transformed into the doctrine of the transmission of Adam's guilt to all people Okay, the verse never says that Adam's sin The guilt was transferred to other human beings. It never says that let me read it again Therefore just as sin it came into the world through one man, and we know who that one man is it's it's Adam Okay, his sin and death through sin So when there was sin, then we have you know now death as part of the picture And I would say it's human death because the rest of the verse is about humans not animals or microbes Okay, therefore or so death spread to all men. Did you catch that? Death is what spread to all men all humans not guilt death the text says death Romans 512 is about the transmission of mortality To all humans because once Adam and Eve sin they're driven from the garden They're they're cut off from the source of life the presence of God even all that stuff Again, they are now going to die Okay, that that's what God told them that it's about death It's not about the transmission of guilt moral guilt before God now that makes a huge difference because You know if you believe that every human being inherits guilt because of Adam well then a baby that gets aborted That you know isn't in the body of Christ or is is cut off from Christ from believing in Christ Either because of death or again their mental incapacitation.  Well, there's no verse for that God loves cute babies. So therefore they're in heaven, you know, it's it's bluster. It's contrived It's made up or they'll say well God will make sure that that you don't remember You know the the death of your stillborn child and and you won't remember that it's in hell now Well, again, there's no verse for that But there are lots of verses that talk about or are evidence for the fact that we will remember You know our lives and relationships here in this life in the next life Again, these are contrived answers because people are trapped By a flawed view of Romans 5 12 I've also talked on the blog about how this really impacts Jesus. Jesus is a descendant of Adam He is the son of Adam. He's the son of David, you know who they were he's human So where does Jesus get off in not inheriting Adam's guilt everybody? Oh the virgin birth the virgin birth Well, I got news for you Mary was human Okay, she was a descendant from Adam to where is the verse that says the sin nature or Adamic guilt flows through Okay, only men There is no such verse. These are theological inventions Okay, it also doesn't work to say well, you know, Jesus, you know Was just kind of put into the womb by God plopped in there Well, that's nice then Paul gets to be wrong and Romans 1 3 where he says that Christ is Descended from David according to the flesh Okay, Jesus is either human a descendant of Adam or he's not either the genealogies are correct or they're not or their lies Okay, they're not lies. They are real. They mean something But if you're gonna take the traditional view of Romans 512 Jesus Inherited Adam's guilt now the Catholic Church saw this problem very clearly And so this is why they invented the doctrine that Mary was sinless There's no verse that says that But that gets Mary off the hook and therefore it gets Jesus off the hook in that thinking that that theological approach Again, these are contrivances because of the way the church fathers specifically You know, I guess Augustine, but he's he's not the only one But because of the way they influence the history of the church to think about Romans 512 what I'm saying is look at the verse It never refers to guilt at all It's a mortality problem now again my view and you can go read read the I'd say read the whole series of posts because you know, if I'm getting if I'm gonna get emails now Well, Mike, what about where it says that all have sinned and come sure the glory of God And what all those things are true Okay, the biblical view is that guilt isn't transmitted to people by what someone else does Including Adam. Okay, we become guilty before God when we sin and every human being is Going to sin. There is no avoidance of sinning Every human being will sin the only exception of this was Jesus because he also happened to be God Okay, not no other human being can say that so all humans if they're allowed to live Will sin against God and we'll become guilty before God. That's why every human being needs Christ Now again, if we think about this a little bit more we have situations, you know You have to define. Okay. Well, what what is sin, you know, does it involve? You know the the act of the human will you know, do you do you know have to knowingly rebel against God? I would say yeah, you do, you know People would would bring up sin language in the Old Testament like in Leviticus Hey, go listen to our Leviticus series on podcasts the quote-unquote sins there are about moral and you know Not moral impurity, but ritual impurity It's just you people get confused by the language of a lot of Old Testament verses that really don't apply to moral Transgressions at all to have a moral transgression. You have to have an act of the will and an infant That's two days old is not going is not morally willfully rebelling against the revelation of God in some area It's just not doing that. So there there is You know a biblical theological argument to be made for innocence Okay But the Aborted fetus never sinned And the child that's one or two days old and then dies doesn't sin You know the the the child again who is severely, you know, mentally incapacitated can't exercise You know the will to rebel knowingly against God. I'm saying they're innocent. There is that category Now they don't go to heaven because They're sinless or innocent as though they're good enough. Okay, that is no one goes to heaven on The basis of any merit of their own at all Period zero So what about the fate of the unborn? Well, we have to ask ourselves. Why do people go to hell? Why do they not have everlasting life and the answer to that is well, they've become guilty before God and Nothing has you know, they weren't able to participate in the means by which that they are forgiven and You know joined to Christ. Okay. Well Why do people need Christ?  I think with me here again. I'm just summarizing a very long series of posts here Everyone at the last day will be raised Both the saved and the unsaved but and you read the end of the book of Revelation other passages This is crystal clear Everybody gets raised some, you know to eternal life some to damnation. Okay Everybody gets raised. Well of those that get get raised. Why do Certain again experienced damnation. They don't have everlasting life. The reason is because they were guilty before God They've committed some offense against God and that hasn't been taken care of okay. We understand that clearly But if that isn't the case if you're raised at the last day and You are not guilty before God By definition using biblical language here.  That is the only reason anyone is raised at all Again, these are I'm just throwing together a bunch of biblical statements here It's because of the resurrection.  That is that's the fate of the unborn. So, yeah, there is this idea of innocence We aren't given a number and I don't think we can be given a number as far as the age You know, you have to examine what what does God view as rebellion against him that would incur guilt before him Again, there's no silver bullet answer to that all that I'm saying is that Romans 5 12 Which is the reason the question even comes up, you know that that this whole idea of Guilt being transmitted To every human being on the basis of Romans 5 12 that that is the proof text for the doctrine Then there are other verses and look don't you're not don't think you're gonna surprise me with them in email I know all of them. I've commented on all of them in the series on Romans 5 12 Either in the posts or comments to the posts. I'm not missing something here. Okay, this is this is something that I Again, it sounds crazy, but I think the church has fundamentally misunderstood and it really has some tragic consequences for People's life circumstances and not only that it gets you into real theological trouble with Jesus You know being a descendant of Adam You know other than those things it's it's okay. You know the traditional is okay You know, it's it's really it's not okay. It's a misunderstanding That that produces this this question and what I'm saying is You don't need to worry about Romans 5 12 Putting aborted babies in danger of damnation in hell. They are not guilty before God The verse never says they are Psalm 51 in sin my mother can you know concede me well? Yeah, we know that the act of intercourse isn't a sin But how about we we do the just like we do in Genesis 1 26 the bet of predication and we'll have a grime or spasm here How about we take the? predigatory view of the preposition bet there okay as Sin or better you could translate the same word in the verse as a sinner My mother can see me. That's absolutely true every human being Will sin if they if they're allowed to live they will sin Invariably inevitably they will sin So Psalm 51 is perfectly consistent with what I'm saying here again I've been down the road and back on all these verses If I get emails, I'm gonna I'm just gonna give you a link to the series on Romans 5 12 But it's an important issue. It's an important doctrine. These are important questions So that's the quick version of how I would approach that but to really again get a better Articulation of it read, you know the link that will provide and I would I would recommend reading the whole series


In the 21st century, information and communication technologies, or ICTs, have continuously revolutionized our society, providing connections and interactions at speeds never before dreamed of. While the effects of the ICT boom have made a tremendously positive impact on development, one major group has been largely barred from enjoying their benefits, women. There are more opportunities in this field than any other sector, and therefore we want to make sure that girls and women are equal to men and exercising their roles in the information and communication technology sector. We have seen that less and less girls are taking up careers in the information and communication technology field, and we believe that they should be encouraged to take up careers in this field because there's many avenues for opportunity. The International Telecommunications Union celebrated Girls and ICT Day on Thursday by hosting an event where experts in the field of telecommunications, mostly women, spoke about their roads to success. These women encouraged more girls to get involved with technology at a young age and urged them not to be discouraged by challenges that they face in cracking into this almost homogenously male field. These technologies have an incredible capacity to improve each and every one of our lives, no matter what our core competencies are, no matter where we are, no matter what we do. This has worked for women and girls as much as it is for men and boys. Despite the remarkable durability of tech jobs in the face of financial uncertainty, women continue to be woefully underrepresented in the field. They hold only 15% of technology management jobs and just 11% of strategy and planning positions. Even more troublingly, women's participation in the field could be on the decline. 37% of computer science degrees in the 1980s went to women. Today that number is below 20%. Balancing these numbers and getting at or close to parity with men will result into stronger, healthier societies for both sexes. Women are not participating in this great new technology as much as they should. Even though in many countries today girls go to school more, they go to university more, they're better students than boys, they don't necessarily go into technical and engineering and scientific fields. To change these unsavory statistics, the ideas discussed at this meeting will have to be played out in the real world. One is why Hamadun Turay, the Secretary General of ITU, announced the launching of a new program that will help girls get involved with new technologies called Tech for Girls. We are actively seeking partners to come forward and make the Tech Needs Girls campaign a success, not just a campaign, but as a way of making the world a better place. On a day filled with inspiring stories and striking moments, the highlight came in the form of a presentation by Joanne O'Reardon, a young girl who, due to an exceedingly rare ailment called Total Amelia Syndrome, was born without limbs. Joanne shared her story and her optimism and serves as living proof of the incredible power of technology to improve lives. My aim is for girls that are like the same age as me and who have the same problem as maybe storaging or anything else, so maybe they could turn to the same software that I use and hopefully track that down and figure out a way that it can work for everyone. For girls like Joanne, technology holds the promise of a better life and a better future. The launch of ITU's Tech Needs Girls campaign is a reminder of this fact and of the transformative power of information and communication technologies. Reporting from New York, I'm Connor Sheratz for SouthSouth News.


Okay guys so today I will showcase you how you can earn unlimited parkour XP the easy way How's it going guys? My name's DP Jane if you do enjoy the video leaving a like really helps out and if you like what you see I want to see more be sure to subscribe Okay, so there are a few guys on YouTube Well quite similar to this this one's slightly different at the same time though This one will see you earning tons and tons more XP to a point. It's definitely the best method I've seen so far So credit to my pal call me sonny for bringing this method to my attention a fellow dude on my discord So to make the very most at this method you want to get your hands on a knight runner potion This is included in the ultimate digital pack But interestingly guys this can be duped and passed on to other players who don't have the ultimate Digital pack like yours truly. I never had this version Now if you don't have any of these go ahead and join my discord There are a few people who are willing to give these out. So yes my discord is linked down below I mean this method can be done without the XP boosters and you still earn great XP But obviously you earn double that when you've got one of these applied Okay So you want to go ahead and make sure it's night time then come to this spot on the map right Yeah, right next to this safe house now this method requires you to Basically jump from one side of a roof to the other the best method in doing this style guys is having a park or skill tree perk of far Jump active. This makes things just way way easier. So once you are ready to go This is what you need to do obviously activate that XP booster Then jump down into the street here grab the attention of this screamer mole fall So I chase happens because when I chase is active guys if you didn't know you earn additional XP Then jump back upon to the platform where this method takes place and just keep jumping back and forth from these platforms It is as simple as that Obviously using the railing and his slight wall to jump back from one side to the other so you can get that fire jump Perk to actually activate. It just makes things super super easy Now you can go as long as you like taking that chase up to a level 4 But as soon as it gets a little too heated for you run to the safe house So you maintain and keep what an XP you have earned. I'd say around that level 3 chase Halfway point through that in which you need to start thinking about what you're doing here You can then do this and repeat guys as long as you like the XP booster stops working within the day and doesn't run Down in daytime so you can skip back to nighttime if you want and rinse repeat the process people and there We have it a simple method in earning unlimited Parkour XP to a point 50 a hundred K even more It's that simple again, cut it to my power call me stony for bringing this to my attention and giving me the initial XP Booster on that note the end of the video has arrived if you enjoyed it leaving a like really helps out if you're new around here I want to see more be sure to subscribe and hopefully people I will see you on that next one


For those of us that kind of ride with a chair seat, check your saddle. And something to think about. If I'm going to go on a long trail ride, I'm going to pick a saddle accordingly. So I might pick a Western saddle, trail saddle. If I'm going to pony a horse, I might pick a Western saddle because I want that weight displacement. I want to spread my weight out a little bit. But if I'm going to ride my horse in the arena, if I'm going to work on aiding and some soft feel sort of exercises and be riding for less than an hour, much of the time I pick a dressage saddle. But I pick a saddle that allows my leg to be underneath me.  So you're up over your feet.


Hello. Greetings. Good morning. We'll get started at five after. Meeting notes are in zoom chat. Helen, you're invited places. Good morning, everybody. Morning. Trust you haven't been up to anything too. Untoward while I've been on holiday. No. Okay. Update on the. Best practice categories. I think was the. The main thing. I may repeat that today. Just. Let more people see. I'm going to add it to the agenda. It's a little apps. All right. Hi, Ben. Ronnie. Okay. The last. Yeah. As I told you, I would come the week after. Yeah, great. So, I'm just going to read it out. I'm just going to. Welcome. Usually get started about five after. That's cool. There's a link to the meeting. That's folks can add your names. Any topic you'd like to chat about. Right. We might be a minute early, but I think it's worth getting moving. So welcome everybody to the regular. And I'm out of touch because again, I've been away on holiday for a couple of weeks. So I haven't been in, been to the last couple of meetings, but I'm just catching up with what we have in the agenda. I see we have a long list of events of which the first is actually starting tomorrow. Just in case anyone's going. Well, firstly is anyone going and secondly, is anyone got any specific session recommendations? That it would be worth attending? Oh, it's done. Silence. Have we got any attendees at all? I did participate in a panel. That's that first one there. That's the NFA panel discussion. There's some folks from. Service providers and vendors and stuff on the panel. Kind of looking forward in the future kind of questions as well as talking about working with various standards and how to do integrations and stuff. There's some, I guess, related talks about all the different topics. So. All right. Beyond that. We have. Yeah, so. That's the. Yeah, the Chinese coupon effectively. I don't think we've got very many people from the Asian side of the world with us this morning. We're not exactly set up very well for timing on that anyway, but. Again, any. Recommendations. I see we've got one mentioned in there, which is an edge computing. Discussion, which actually proved quite interesting, I would think. So, yeah, mobile world Congress, obviously, about the biggest event of the year. I don't know what papers anyone might have filed or, or, you know, requested there, but obviously that can be quite difficult to get anything with anything accepted simply because it is such a large event. I see we have a European. Open networking edge summit, which will be nice. Although God knows whether and how, how actual physical attendance will work out for that. You never know. And then we're off into the distance. Although that coupon deadline, I recognize is what four weeks out, I guess at this point. So if we want to actually get anything, anything into Kube County, you then now would be a good moment to get it sorted. I'll mention the. I think the European community is talking about a face to face meeting. I think probably in coordination with mobile Congress. I'm not sure. Okay. That's got good and bad things with it, trying to find anywhere within 50 miles of Barcelona to stay. Yeah. It's also a long time to be traveling if you want to do both. Both. Oh yeah. Yeah. Yeah, that'll be interesting. So you've got your ear to the ground on that side of thing. You can keep us up to date then. Yes, I will do that. Sounds good. Okay. Reviewing the open pull request is going to be really, really easy because we don't have any open pull requests. So I think we're doing very well at the moment.  Which Taylor leaves you to your best practice category updates. All right. Folks in my screen. Yeah. Yeah. We see. All right. So this is what. We have now. The one category that's. I guess not showing on the working group. It is in the test suite. It is a resilience. We just haven't ever done a pull request to add it. After getting feedback for a while. On the different categories and. Where best practices could go. Testing. The different concerns and. I guess focus on. Areas. That would be relevant to what we're focusing right now. We've looked at making some updates and. Possibly. The idea was to shrink it down a little bit. With some of the overlap, but not the ones that were still. Talked about a lot. So here is. I can move forward. Let's see. This is where we're looking to go right now. So from this 10. Down to seven. The configuration life cycle would be one where. It's somewhat split up. And merging. With others. It's such a large area that you could put a whole lot of things. Under it. So. The configuration is now, which may get a new name. The idea is to focus on the declarative configuration aspects. For best practices, whether that's API's or. The deployment configuration or. Tying in with whatever else there. And some of the parts of life cycle. Or you look at best practices or tests that already exist. And there's already. I don't know what the total number is. I think it's over 30 something tests that are. Live in the test suite. Would get merged over into different places like. This compatibility and solubility and upgrade ability. Which used to be insulation upgrade. So there's some things that were around configuration that. Have gone into here. The scaling category. It goes into. Resilience, reliability, resilience and availability. Although I think there may be some that. Are tied over here. Potentially, but it's shrinking it down into. A little bit smaller. So you can see these. Resilience compatibility got merged. There was a hardware support. That's tying into wherever it makes sense over here. So maybe under compatibility or maybe configuration. We think these. This list is going to be easier to talk about. From a best practice standpoint. We did keep security separate. Because it seems, even though it could go into. Every part of. The. Process. From initial design all the way through. The production. Operation management. Right now it's such a. Big focus. That we've kept it separate. We can always change this again in the future if it makes sense, but this is the. The direction we're headed right now. I'll stop there and I guess get any feedback. I know that some of the names and words could change. So this is mainly from the. Testing that you're recategorizing. Is that what you're saying that that's what made you. Has made you rethink the categories, right? Yes. So the, the test suited. I guess it still has, because it hasn't changed it. 10 categories. The CNF working group categories has nine. It doesn't have the resilience yet. So the test suite. Is looking at merging and making it a little bit easier to see where the different tests are. There's a lot of information that would be related. I guess documentation related to each test about why is this tested? That's why is it important? It's related to a best practice. What is it doing? And that sort of thing. But tying those all together into. A set of categories where people can look and find them and understand what they're about. It's as important, I think, is. The best practice categories. And I think it was. Yeah. That would be. That would have been Robbie. Who did this originally, like a, this was kind of an initial structure. For the best practice. We haven't put anything in here yet. I guess we could update it to. Have the. The non-root that'd be under the security. We don't have that listed here, but. Yeah. But that would be related. To the test categories and try to. Have them in sync with the best practice categories. Okay. Well. I. Think the easiest way to do that would be for you to try and probe them. Propose a poll request for the document that you just had on screen. Since that's the major place where the categories are used. And we can see if we like the results of it. Sounds good. I mean, that this is still open to debate on both sides. That if we had some suggestions on how those categories could be done slightly differently, we could go back to. The. Testing group and talk with them about. Alternatives as well. Absolutely. We want to hear what makes sense. To for different folks. So from a. Service provider. To a different perspective. Consuming CNS. Integrating between multiple parties. And the platform and everything else. What are the concerns and what type of. Attributes or behavior at the highest level. Like reliability, resilience, availability, right? Or a state. This is about handle, handle state. And then. Speak to a service provider and do these. Do we need to adjust? Maybe just descriptions. And then from the. Creator site. What things are relevant right now that are. When adopting cloud native practices, what's. Something that's relevant to keep in mind. And if there's feedback on that, whether it's, let's make sure and describe it. Robbie put in some stuff here that they get these started. That's fine. Or if there's like different names or wordings, like configuration, I was mentioning. Maybe. That may need to say declarative configuration. You know, some other thing we've adjusted state, I think three times or four times trying to. Get it. What's okay there. But yeah, love to hear any feedback that folks have. Including now, if anyone has anything. Yeah. Hi, this is run me. I think it's a good list. The only thing I'm kind of concerned about is. How it will be used by. Let's say I'm a CNF developer. So does that mean I need to read the set of best practices cover to cover before I even attempt to design my CNF or. Or can we come up with some kind of a flow chart or cookbook or. Like a step by step saying, okay, start here. Look at those best practices first, then as you start implementing look at those. I mean, I'm not sure it can be done. I'm saying it would be nice if we can do something like that. I might give it some more thought and come up with some initial proposal for it, but I don't know what other folks think if something like that would be necessary or is it possible to create something like that in addition to this set of categories. I guess it's my personal view on it. I think it's a good idea. I would hesitate to say someone needs to start in the one specific place. Before they get gone. If there's a lot of it's going to be based on.  So your approach can be very different and you may have, you know, different things within. So I think we do this first. And I'd say probably the first thing that the only thing I'd say is it's good if you try to figure out who your end users are, and then work backwards from their needs to how you're going to do it as far as the best practices goes. When we're saying like cloud native best practices for networking applications, which is what we're talking about right now. I would say you look for those whenever you're building out your application. That would be my approach. Someone else may say I'm going to go learn the best practices and know them before I start. But again, I think that parts personal preference. But if you do, if you have like some type of. And other documentation or workflow or anything that you think that would be welcome to anybody. For getting started. Use cases, user stories, any documentation that helps people build. Applications is going to be a good thing. Yeah, I see your point and I'm still a little bit concerned about how do we help people not to miss any of the best practices or overlook things and discover them too late in the game. As I said, I'm not sure I have a very good solution for that. I had this kind of walk through flow chart, whatever checklist, I don't know, I'll give it some more thought. And if I can come up with a good idea, I'll share it with the group. And for me, it would be easier to start with a specific problem and work backwards. So if I'm trying to create an application that needs to handle state like a some type of, I'll just say database for not having a better word. And my, there's a core part of the application that needs to store data. And I need to keep track of it. And I need that to be resilient, redundant and everything else. Well, then I could start looking at what are practices for running something that's storing data on a Kubernetes platform, if that's your target, and what are the best practices on that. And then I'd work my way backwards from there. So identifying the problem and then starting to look. And if you have like an area that you're passionate about, then I think you're going to have a better time than if we say here is the practice to look at for some, some area that I never touch, but happy to see whatever you're thinking. I'd like to see it flow chart. Yeah. So as I said, I'll give it some more thought and try to put something. And I guess outside of like anything with regard to best practices, you need to publish. I think for people to be able to find them. So that would be one thing. So if anybody wants to help. On publishing best practices based on your experience. Then please. Just jump right in or reach out to, you know, one of us. And Ian or myself or anyone else that's actively. Working on these and we can try to. Start drafting and get some out. So we'll have to have that. But other than the work here, like as far as a tool, if you're building. If you're creating applications and you're wanting to try to follow best practices, the CNF test suite is specifically designed to help with that. Like it's. We're trying to create it as a tool. To help a developer to catch things. So there's a lot of stuff that. Is on the call as part of. Cubescape project and that's a. A security focus tool. And there's direct integration into the. Test suite that uses Cubescape. And that can do scanning for various. Vulnerabilities are. Essentially best practices. Somewhere around the NSA Kubernetes hardening guide. And we have stuff from. Litmus chaos. For doing resilience type testing.  So some of these are. More on the implementation side. Versus the documentation. That the working group does documenting a lot of content to have a deeper understanding. But if you're. If you've had any experience with test driven. Development. Then the test suite can be a good. A good tool in your toolbox. For helping to check things as you're moving along. And I think you might have been speaking and I've been. If you wanted to respond and go ahead. No, I haven't been speaking. I was listening along with that. I think it would be, I mean, this is personal. It's not a meeting issue, but I think I. Have kind of lost touch how to apply the test kit that we you've got. And exactly how it would help. So I suspect I've got some personal research to do on that side of things. Other than that. I believe this was the last topic on the, on the list and unless anyone's been doing updates, which I. Just check for. Yeah. We're basically. We have nothing else to talk about at this point. So anyone else got anything else they'd like to raise today. Okay. Well, in that case, you get half an hour back. Thank you everybody for your time. Have a think about what you'd like to talk about next week, what wants to go on the agenda. And I'll see you again in a week's time. Cheers. Have a good one. Bye. Thanks.