This study found that higher levels of gamma-glutamyl-transferase, GGT, variability are associated with an increased risk of osteoporotic fractures in the Korean population. This suggests that maintaining constant and stable GGT levels may help reduce the risk of osteoporotic fractures. This article was authored by Dong Yip Kim, Ji Hyun Kim, Hee Young Lee, and others.


DNS with an industrial-size digger. This has nothing to do with the CPUs of the same name. No, it doesn't. Our presenter here probably constructed something like a Binford 9000 DNS scraper, something like that. He will probably tell us a lot more about it. So a warm round of applause to Roland van Rijswijk Dij.  Good morning, everyone. Thanks for showing up early in the morning. I really appreciate it, because when I drove here this morning, I thought, oh, I have to talk in the second slot in the morning at a hacker conference. That's going to be hard. But it's great to see quite a full room. I apologize for the white background. They didn't tell me the screen would be like this, so if it's a little bit blinding, it's entirely my fault. First, a little bit of an introduction about who am I, so you know who's talking to you. I work for Surfnet, the national research and education network in the Netherlands, where I'm mostly an R&D guy, but I'm also responsible for DNS operations. Anybody in the room who doesn't know what DNS is, please wave now, and you might want to leave. Great. So I'm also a researcher at one of our universities here in the Netherlands. I work at the University of Twente, where I recently became not that kind of doctor. And I've worked in sort of network security for the past 16 years, and that's been stuff to do with networking, but also applied crypto, stuff with smart cards. You name it. And on the left, you see my big hobby, which is scuba diving, and this is kung fu diving, as you can see. So why am I wearing this loud shirt? So today, the biggest pride in the Netherlands takes place, which is in Amsterdam. And I had to choose, go there or come here. And obviously, I chose to come here, right? Because this is great. But this is a hacker conference, people. So please celebrate diversity if you're here. Right, now to the content of the talk. So I'm going to get a little bit more serious, and hopefully you'll laugh somewhere along the way. We started a research project where we wanted to measure the DNS at a large scale. And this project, we started about two and a half years ago. And then the first obvious questions is, why would you want to measure the DNS, right? Because the DNS is part of every network service. And it tells you a lot about the state of the internet, right? Because the DNS has a very important function on the internet. It translates human readable names into machine readable information. And it also does some stuff in sort of service discovery or tell you where you need to deliver mail for a domain or stuff like that. So what is in the DNS over time, and the clue here is over time, can tell you something about the evolution of the internet, something about the security of the internet, the stability. And we wanted to make sure that we get as much data as we can. And that's what this talk is going to be about. And what you can learn if you have that data. So the first obvious thing to talk about is people have been measuring the DNS for years. There are probably people in the room from the CSERT and CERT community that are aware of passive DNS. And passive DNS was thought of by a guy called Florian Weimar in 2005. And basically what he said was, why don't we record the traffic between a DNS resolver and authoritative name servers on the internet? And then we stored that data and we aggregated at the central spot. And actually, there are two huge deployments of this on the internet today. One is operated by a US company called Farsight Security. And the other, which is probably less well known, but probably just about as big, is operated by the Austrian national CERT team. And we, as in CERTnet, contribute to the second one because we don't want to contribute to something that is for a commercial company, and that's also used by certain agencies in the United States. So we did not go for passive DNS. We went for active measurements. Why did we do this? Well, passive DNS has one problem. This is that it suffers from bias. And that makes it unsuitable for the kind of work that we want to do, which is to track the state of the DNS over time. The problem with passive DNS is that it will only see information for domains that clients of the resolvers where you capture traffic are actually interested in. So that means that a domain has to be used first before it is observed by a passive DNS sensor. And if you want to track the entire state of the DNS, also less popular domains or domains that haven't been actively used yet, you won't see them in a passive DNS setup. Another issue is that you have no control over the query frequency. If a domain is less popular, you might get one data point every week. If it's very popular, you might get tons of data points that you then have to deduplicate. So it's a bit of a management nightmare as well. So we decided to go a different route. What we decided to do is to do active DNS measurements. And what we do is we send a comprehensive set of DNS queries for every name in a top-level domain once per day. And I'll tell you a little bit more about the specific queries we do so you have an idea of the kind of information that we gather. Now, we do this at skill. Our current measurement covers around 60% of the global namespace. And that has all the large generic top-level domains, such as comnet, org, and some others. But we also have quite a few country code domains, for instance, Netherlands, Sweden, Canada, but also the Russian Federation. In addition to that, we look at all the new GTL days, like useful domains like .xxx or .berlin or .freezland in the Netherlands.  In total, we measure over 200 million domain names every single day. And our challenge was, how do we do this in a responsible way? Because we mustn't overburden the global DNS, right? We want to do a measurement, not a denial of service attack. And we need to store and analyze this data efficiently, because I can tell you, this generates quite a bit of data every day. So to give you an overview of what our architecture looks like, it's built up of three components. On the left-hand side of the figure, you see our sort of collection server that collects all the zone files for the top-level domains that we measure. We have contracts with the TLD operators to get their zone files every day, sometimes up to two times a day. And we collect that stuff and put it in a database. And then we keep track of the daily changes and we keep track of the current state of the zone so that we can actually control our measurement. The middle part is probably the most important, because that is where we do the actual measurement. Now, we have set up sort of a distributed measurement system where we have one central node per top-level domain that sort of controls the measurement during the day. It hands out chunks of work to a cloud of workers. So we have a hypervisor where we have lots of little VMs running that do the measurement, and they simply ask, oh, do you have some work for me to do? And then we will send it a batch of work to do, and it will do a measurement. And then it will send off, once it's finished, a batch of domains to measure. It will send it off to a central aggregation point at the university, where we do two things. We put the measurement results onto a large storage array for long-term storage, because we want to keep track of multiple years of data. And right now, for the domains that we've been measuring for the longest time, we have about two and a half years of data. But we also have a Hadoop cluster that I'll tell you a little bit about in the next couple of slides. So what do we actually query and store? So on the left-hand side, you see all the record types that we ask for. So of course, we start with the SOA record, which should be in every DNS zone, and tells us a little bit about how the zone is configured in terms of how often is it refreshed, when was it last changed, and things like that. Obviously, we want to capture the A and Quad A records that are in there, not just for the Apex records, so the domain name itself, but also for the www label. And then we ask for the name server set, mill exchangers, text records, and we ask for some DNSSEC-specific records. So for a delegation signer record, to find out if there is a secure delegation, we ask for the DNS key. So we can track, for instance, changes in DNSSEC sign domains. And we ask for authenticated denial of existence records by sending a query for a name we know will not exist. What we store is all the records that we get back in the answer section. So on our worker VMs, we run a custom piece of software that we developed ourselves, and I'll give you a link at the end of the talk to a paper where you can read all about that. We send the query to the resolver, and then whatever comes back in the answer section of the response is what we store. So we discard all the stuff in the additional and authority sections, because we have no guarantee that the data in there makes sense. But what we want is what is in the answer section. Then because we send our queries to a resolver that runs on the measurement host, we actually get all the CNAME expansion, so we store those as well, and then we store all the DNSSEC stuff that's in there, so if we get signatures back, we store those. And finally, we record some metadata, such as we do a GUIP mapping for all the IP addresses that we get back in A and Coday records, and we try to map the IP addresses to an autonomous system. This makes it a little bit easier for us to analyze the data afterward. Since the beginning of this year, we also have a separate, what we call, infrastructure measurement, and what we do there is we take all the NS and MX records that we get back from the main measurement, and then we do an A and a Coday query for those names, and we're gonna be extending that with additional query types later this year. Right, so we measure about 11 to 12 queries per domain for 200 million domains, so you can do the math, how many queries that is. What does that mean in terms of traffic? So to give you a little bit of an idea, and this is from early on in the measurement, the traffic is a little bit more now, what we did is we run this measurement from within one of the data centers that Surfnet has a point of presence in, and the dark red and light red is all traffic generated by all users on our network. And we have over a million people on our network. The blue part is our measurement, so we generate more DNS traffic than all our more than a million users combined, so we generate quite a bit of traffic. But as you can see, it's not a lot of traffic in terms of volume, right? It's maybe 250 megabits, a little bit more now, but it's not a lot of traffic, but it is a lot of very small packets. And what we actually did, most of our traffic will go to the TLD servers because for every domain that we request, we will have to find the delegation point. So we have to talk to the TLD servers.  So we reached out to them and said, oh, do you see our traffic? And is it a lot? And they said, oh, well, we hadn't noticed a huge change, but can you tell us what the IP ranges are? And then I told them and they said, yes, we can see your traffic. They said it was a non-trivial amount of traffic, but not disruptive, and they actually encouraged us to continue this type of work, so that was good. That's one box ticked. Of course, we want to do a responsible measurement. And if you're ever considering doing something like this, what we did was we obviously set up a website with clear contact and abuse information. We created sensible reverse DNS entries. And the IP block info in the right database actually tells you where to find us, right? Because what we don't want is people to start blocking us, then our measurement suffers, but more importantly, we created something that other people suffer from and we don't want this. And we have had one such instance this year where due to a company suffering a denial of service attack, our queries to them were timing out. And this was a very, very large domain name registrar, and because our queries were timing out, our servers were sort of retrying and retrying and retrying and retrying and sending them lots of traffic, and they blocked us. And they didn't block us because we were bothering them before. This was just a bad coincidence. And so we tried reaching out to them, which was a pain, and it took us two months to reach the right person in the company to get ourselves unblocked. Even though we set up all of this, they apparently didn't find our contact info, didn't think about reaching out, which is fair. I mean, what we're doing is a measurement, it's not like we're one of their customers. But what we learned from this is that, even if you do all of this, people will still block you or not be able to find you. So keep that in mind when you set up these kinds of measurements. So of course I'm a researcher, so I need to get funding for my research, right? Otherwise I can't eat. So we decided to call our project a big data project, right? Because big data gets you funding. But then we had to ask ourselves, is what we're doing actually big data? So we decided to compare it to something that is generally considered to be big data, right? The human genome is three times two to the power of nine base pairs for an individual human like myself. Actually, if you're interested in DNA, there's gonna be a talk by Bertie Hubert of PowerDNS. It's gonna be all about DNA. I think it's set for this afternoon. And we collect about a two billion DNS records per day. So we're not quite the human genome, but close. And since February 2015, we have collected over 1.7 times 10 to the power of 12. So that's 1.7 trillion in human money or 563 human genome. So that's more people than are in the room right now. But it's fewer people than are at shot. And oh, yeah, so I'm working on big data, right?  So what do we use to run this project? Well, if you do big data, the only tool chain you really wanna go to is something like Hadoop. So together with a couple of partners, SurfNet, SIDN is the registry for .nl, and the university, we bought our own Hadoop cluster, and we use all of the tool chain that's available on there. But in particular, we use a tool called Impala, which is a SQL query engine that I'll show you some examples of later on, which we use to analyze our data. And actually, because we are publicly funded, we try to make our data openly available. Unfortunately, we can't do that with all of the data we collect, but I'll tell you a little bit about the data that we do make public later on as well. And then of course, on top of that, if we want students to process the data, we run something like a Jupyter notebook so they can run their Python code straight on top of the Hadoop cluster and analyze the data. And in fact, we have collected so much data that we had to extend our little cluster, and June this year, we added another eight nodes. So we now have our nice little cluster in the data center. I really enjoyed wiring that up. So all I've told you about now is that we collect data, that we collect tons of data, but what do you do with that, right? Can you do something useful with that? And I'm gonna talk to you about four examples of things that we have done with this data that I think might be of interest to this particular crowd. And the first example is something called Snowshoe Spam. Who's familiar with the term Snowshoe Spam? Raise your hands, please. Very few people. Wow, two. That's very few people.  So you can liken it to a Snowshoe, which is one of these funny tennis records that you tie to your shoes if you want to walk into the snow. That's where the name comes from. The problem with this particular type of spam that it's hard to blacklist because they send it from lots of different IPs. They say they take, for instance, 40 or 50 IPs that are in a single prefix but then don't use all of them. So you can't blacklist the whole prefix. It's a pain blacklisting every individual IP. But what we found when we started looking at our data is that the domains that are set up for this type of spam are actually recognizable in the sense that they are anomalous if you compare them to other domains. And in particular, if you look at two examples which is an anomalous number of A records or an anomalous number of MX records, these are plots created by one of our students where he took the long tail of our data set. So domains that are already anomalous because they have more records than other domains. And then what he did is he took domains that were blacklisted and compared them to domains that are whitelisted. And he took a couple of spam blacklists such as the ones from Spamhouse but also from other organizations. And then he compared domains. And what you could see is that blacklisted domains were much more likely to have many A records. In fact, you can see that, for instance, there's a gap of seven records at the, what is it, 75 percentile? And there's a gap of 17 records at the 90 percentile. And for MX records, it's more or less the same. You can see the red graph veering off towards the right way earlier than the blue one. And basically what that says is that domains that were blacklisted because they were marked as spam are much more likely to have many MX records in them. So what we currently have is we have a master student who is almost ready, so he's finishing up writing a paper about this. His defense is actually the end of this month. And this was a collaboration between the university and surfnet. Now surfnet has a mill filtering service for our constituency, which is higher education and research in the Netherlands. And we filter about 10 to 15 million emails per day, so it's not a huge processing service, but we do see quite a bit of traffic. About 50 percent of that is considered spam. At least that's the statistics that my colleagues gave me. And what we learned is that with this research that we do, we can actually improve real-world email security. I'm gonna give you some preliminary results here. They're gonna be a little bit hard to read on the screen, but the takeaway is that basically for every domain, you see two rows and the top row is the spam score. Redder is spammer, just... So blue is probably not spam according to the mill filtering system. Red is, this has been marked as spam and every block is a single day. Now, if it's green, that means that that domain was already blacklisted. If it's purple, that means that the methodology that the student developed detected this domain as probably malicious. And what you can see is that there are, of course, control domains that the methodology of the student finds, but they're already blacklisted. So the method that he developed doesn't add very much because it was already on a blacklist, so that domain would have already been filtered.  And the bottom graph shows you how many days earlier he detects it than it appears on a blacklist. And while the majority is only a few days, we have outliers going up to over 50 days where he detects the domain as probably set up to send spam more than 50 days before it appears on a blacklist. So this is interesting and he's writing this up as a paper. So the second example I want to give you is something called crafted domains. Anybody familiar with the term? Oh, very few, okay. So everybody know what the DNS amplification is? Who doesn't? Good, I'm at the right conference. So DNS amplification is still one of the most frequently used attacks or to perform volumetric DDoS attacks. And if you're an attacker, basically you have two ways of doing this. You can either abuse a DNS-seq sign domain, which is something that's been popular over the past, say, three to four years. Because a DNS-seq sign domain, of course, has lots of signatures in it, you have keys in it, and that means your responses are gonna be large, so you can use that to perform denial amplification attacks. The other option is, of course, to craft a domain where as an attacker, you configure your domain such that you almost have a guaranteed bang for your buck. And typically what you will do is you put in a few large text records or you cram in a lot of A records that simply inflates the size of your responses when you send a query for this name. And we decided to look for these kinds of domains in our dataset. And while we didn't find hundreds of domains, we did find tens of domains and most of them were actually abused. And there's one example of such a domain on this slide here. And what the graph shows you is basically in March of 2015, all the way on the left-hand side of the graph, the domain is not large, not inflated yet, so it's not configured to perform attacks. But then, as you can see, as time progresses, they're adding lots of A records to it, which makes the response for this domain a pretty large. And how can I tell that these are not legitimate A records? Now, they're all local hosts. So they're all <IP_ADDRESS>, 2, 3, 4, 5. Why are they all different? Because a resolver can't collapse them to a single response if they're all different. Then with thanks to Christian Rosso and Johannes Krupp from the University of the Sireland in Germany, we got some data from a project called AMP-POT. And if you don't know this project, look it up, it's pretty interesting. What they did was they designed something that functions as an amplifier for lots of protocols, including DNS and NTP and other UDP protocols, and they try to become part of attack swarms. And they want to do this in order to figure out if people are performing attacks and what kind of attacks they are performing and what they are attacking. And we... So the area indicated by the arrow in the middle is actually a period over which attacks were observed that used this domain. So this domain was actually used for DNS amplification attacks. So what are some other examples we found? So attackers are pretty creative. We found one that has, and I'll show you the content of that one on the next slide, that has parts of a speech by President Obama on net neutrality.  You find that they sometimes put random garbage in there, they'll put mildly offensive language in there. They will have high numbers of A records in odd prefixes. 1.0 slash 8 is used for all sorts of research. It's not actually as far as I know, routable. And let's see, we had... Oh, it's not on this one. But we had one that also had an excerpt from the US federal budget for 2016. I have no clue why they did that. So this first one with the speech from President Obama, if you want to read it, look up the slides later on. As you see, it has lots of text. It's about net neutrality, this speech. Oh, I don't know what they attacked with it. Maybe companies that violate net neutrality, maybe they attacked Verizon with it. I don't know. But the takeaway here is that this domain was actually observed in over 8,000 attacks. So it was abused. The fact that we can find these domains in our dataset, and actually as the graph showed you, we can find them before they are abused, it gives us a window of opportunity to take action against these types of crafted domains. And it also gives you an opportunity to see if you can find the people that set up these domains. Because they'll typically register the domain which they'll need to register through a commercial company. And typically they use one of these who-is-anonymizers. But still, the more time you have that you know that this has been set up, the more time you have to find the guys that were doing this. Now, as I mentioned earlier on, why not just use DNSSEC for DDoS, right? Because many people claim that DNSSEC is just an amplification nightmare. No need to craft domains, just use what is out there. And this is actually a graph from a bit of research that I conducted during my PhD, which shows you on the left-hand side, the gray area, that's, say, a control group of normal domains, all the colored lines on the right, are DNSSEC signed domains, and on the axis is the amplification factor that you can achieve. So the takeaway here is DNSSEC is a way worse amplifier than regular DNS, so why not just use that? And actually there are people that claim that the amplification is a reason not to deploy DNSSEC. Now, I'm not going to go into detail. There are good reasons to deploy it anyway, and there are actually ways to do away with the amplification. There are ways to solve that. But hey, who needs DNSSEC if you have .tl? This is one of those new, well, it's not a new GTLD, but it's in the list of new GTLDs. It has something to do with telephony. I'm not sure what you're supposed to do with it, but people for some reason put lots of big text records in there. And this is a CDF plot for about 3,500, no, sorry, it's about almost 5,000 domains that have text records in them. And if you add all those text records together, you get a certain size if you send a query for this.  But we found people with over 54,000 bytes of text records that you can get back in a single response. Why?  Doesn't make any sense to do that, but might not be so bad because if it's over 4 kilobytes, probably the response is not going to get transmitted if you send a DNS query because it gets truncated and you have to retry over TCP. But hey, there's lots to pick from below 4 kilobytes that you can use for attacks. The nice thing about this one is that mostly what people will do if they perform an amplification attack is they'll send in any query. And there is a draft circulating in the ITF to do away with any queries because they're mostly abused for amplification attacks. But this is just the text query that I did, right? That's a legitimate query, you can't block that. So this doesn't make any sense. Oh, and it gets worse. I assume that many of you will be familiar with what is called Handlin's Maxim, which is never a tribute to malice, that which can adequately explain by stupidity. If you go through our data set, you will find the weirdest stuff in text records. We find snippets of HTML, JavaScript, Windows PowerShell code that allows you to configure your built-in DNS server. Why is that in a text record? Pem encoded X5 on end certificates. Really, you want to configure that in your web server, not put it in the DNS people. Snippets of DNS zone files, so it's sort of a self-recursion.  But we have a winner. And the winner puts their RSA private key in the DNS. And for ethical reasons, I didn't put the whole key up there. And he's not the only one. Why, people? Why? Why? Seriously? But it's, I mean, as a hobby project, at some point, I'm going to see if I can figure out whether the public key that belongs to this pops up somewhere in a certificate or a PGP or whatever.  Right. So the fun doesn't stop there because I have two more examples. And the third one of them is CEO fraud. Who here knows what CEO fraud is? Ah, that's more people. OK. Who here has received CEO fraud emails? Oh, a few people. Did you find them convincing? More or less. Yeah, that's the problem with these. So August 30 last year, about a year ago, our third team reports an incident of CEO fraud that was targeting us, surfnet. So somebody was pretending to be our CEO. And actually, this was quite a sophisticated campaign because not only had they learned the name of our managing director and were they sending us emails in correctly correct touch, which for most foreigners is quite challenging. And they registered domain names that looked like our domain name. So they went quite far. They registered something called surfnet-nl.net. And there was also one sent to my university, u20-nl.net. And the problem with CEO fraud is that these campaigns can actually be quite sophisticated. They learn quite a lot about your company. They try to figure out whether your CEO is on holiday. And they target your financial department and then ask them very helpfully, maybe I need to transfer money to this foreign company and I can't figure it out. Can you help me? Attackers wouldn't do this if it didn't work, right? But this is also quite costly for attackers because as you'll see later on in this campaign, they had to register quite a few domain names and they actually have to pay to do that. So later that day, so August 30 last year, we started getting more reports that there have been others in the surf community that were targeted with similar emails and then our third team received through one of their communication channels a longer list of domains, including more names in our community so we could reach out to these people and warn them. But then we thought, oh, okay, we have a skirt is our security community so all our constituents can talk sort of in a private area about security concerns. But we decided if we could find out more about this campaign using our open Intel platform. So what we wanted to do, and here I'm going to show you a little bit how we use Impala, is what can we find for these domains? So the first thing I did was look for what record types do we actually have in the dataset for the surfnet-nl.net domain. Who can tell me what is missing here? Wave your hand. Yeah, yeah, I heard it already. A records, quad A records. So all I have is MX records, text records, then an SOA record, but no A and quad A records. So this domain was probably set up just to send email. Okay, if it's set up to handle email, who's handling their email? So let's look up the MX address that we have in the dataset. Oh, it's outlook.com. So they are using Office 365. They probably had to pay for that, right? They have a paid account with Microsoft. Okay, so if they're using Office 365, they may have one of these Microsoft-specific tokens in there. What you see at the bottom, MSC ID and then some base 64 encoded stuff. Microsoft puts that in text records if you use their managed DNS service. Oh, and they protected their domain against email fortune, right? They were very helpful and included in SPF records so they wouldn't get marked as spam. But what's nice about this token is that that token is linked to the account, not to the specific domain of the user. So what can we do? Well, we put this token in a SQL query and we ask our system, do you know of any other domains that use the same token? And this is in the .NET dataset, so we found another 17 domains that have the same token. Okay, it's not a huge hit. So let's look in .com. Oh, we find 199 domains in .com that have this same token. So basically using our dataset, we could sort of take domains that we'd seen before and find domains that were part of the same campaign. And we scripted that and we had an input list when we collected data from various sources, the input list contained around about 860 domains and by looking them up in our dataset, we managed to find an additional almost 1,400 domains and that allowed us to warn people. And the pattern that we'd seen before was stuff where they would take the CCTV of the original domain and then put it in front and then register it in .net or .com. But we found other ones like Groupon where they substitute O's by zeros or overstappen.com where they substitute another O by a zero and there are other examples of these kinds of changes in domain names. We used this in this campaign to warn people and this had direct operational applications. And eventually we shared this list with the National Cybersecurity Center in the Netherlands as well so they could inform other people because we figured out there were banks in their notary offices. So they were targeting quite a wide range of companies in the Dutch society. Right, so now we get to the last example. Unless you've been hiding under a rock, you're aware that Dyn was attacked October last year. Who was hiding under a rock? One person, two people, okay. So for those two people, Dyn is a company that provides managed DNS services. They suffered a massive DDoS attack. There are sources that claim it was over one terabit of traffic that they had to process, but that's alleged. So there's no confirmation that that actually happened. But the main problem is they went down on their US East Coast operations. They were attacked using the Mire, Botnet, the Internet of Shit. And this affected the number of large internet brands that were their customers. So Netflix was affected, Twitter, eBay, PayPal, LinkedIn, not everybody was affected as badly as some. But for instance, PayPal went down completely on US East Coast. This is an illustration of putting all your eggs in one basket.  So what does that do with people? Well, what we did was we looked at our dataset in the aftermath of the attack and there is quite a dramatic change. The red line are customers that exclusively use Dyn services. So if you look at the NS record set for them, they will exclusively have Dyn NS records. The blue line are people that don't just have Dyn NS records, but they also have NS records for other operators. The black line is the day of the attack and as you can see, there is a dramatic change. If you read the scales on the graphs, you can see it's actually a few percent change because the scale is different on the left and on the right. But I wanted to put this in one figure so it's easier to see. In total is about 5,000 domain names where they change from exclusive use to non-exclusive use. But those 5,000 domains contained lots of big internet names such as Twitter, Netflix, PayPal, but also some other companies and this talk was called Digging in the DNS. There is a large company, manufacturer of earth-moving equipment is one of the companies that changed. We studied this a little bit more because we wanted to learn what this does to a company that provides these kinds of services such as Dyn. And we wanted to see if it cost them any customers. The top graph is the period from October 1st until December 31st of 2015. The bottom graph is the same period but then in 2016. So that's the period in which the attack takes place. At the top, you can see that there are very few people that actually leave Dyn. So their customers are quite loyal. We saw in the same period the year before the attack we saw only one big change and that was a company called Zalando. They sell shoes and other stuff, leather bags. And they had lots of typosquatting domains sort of defensive registrations of typosquatting domains. For some reason they were using Dyn for that as if somebody was going to attack their typosquatting domain. I have no clue why. But they left Dyn. Now as you can see, the day after the attack quite a few people decided to completely ditch Dyn, go away and you see a little bit of after effect after the attack. But this is not a trend that continues. So it doesn't really affect Dyn as a company. People still stay with them and actually new customers still register. So let's look at new customers. What we wanted to see if new customers are exclusive users or non-exclusive users. And the top graph is over the entire dataset until the middle of last month. Orange is new customers that are non-exclusive. Blue is new customers that are exclusive. And there is only one major event of a new customer choosing to be a non-exclusive customer. And that is the good adult content providers of Pornhub. Do I have to explain the irony of Pornhub going non-exclusive or can you do the math yourself? The aftermath of the attack is the bottom graph. And what you can see there is that we see no evidence of a significant change in behavior of new customers. So new customers still almost always decide to use Dyn exclusively rather than mixing Dyn with another operator. Okay, what about people switching from exclusive use to non-exclusive use? So blue means people switch to non-exclusive, orange means people switch to exclusive use. So they were non-exclusive and they go to exclusive. It's kind of hard to read on this screen, but there are two takeaways. There are two major events of people switching from non-exclusive use to exclusive use. And almost all of these are people fixing an error in their DNS configuration where they had a dot local NS record in their NS set and the rest was all dying. Don't ask me why. They fixed that, there's two separate events where they do that. Above the X-axis you see the blue and you can clearly see the top graph is the entire data set. You can see that after the attack, so October last year, you see a major change. You see lots of people switching to non-exclusive use. And if we zoom in a little bit, and this is the bottom graph, what you can see is that there is a real trend change. There are still people switching from exclusive to non-exclusive use today in the aftermath of the attack. So somehow people did pick up on this and they are changing their behavior. Whether or not that partly has to do with the fact that dying was acquired by Oracle, I don't know, but it might play a role. So what are the takeaways from this fourth example? Well, my goal is not to bash dine because I know people that work there, they're good people. It's a company that has existed for a long time. This can happen to even the largest providers. If you say you prevent DDoS attacks, you also paint a target on yourself, right?  And we have other examples of big providers either through mismanagement or attacks going down. I think it was early this year. Amazon S3 service went down. OVH, very large infrastructure service provider, suffered over one terabit of attack traffic, went down. But a takeaway here is that the internet was, of course, designed to be distributed. And we break that assumption by putting all our eggs in one basket and going to a few of these large providers that we outsource our services to. And this is not just outsourcing DNS to dine. This is outsourcing your email to Google or Microsoft. We are breaking that assumption. And as an internet community, this is something we need to think about. Because many of the original assumptions on which the internet was built no longer hold in today's commercial internet market. And you can have these kinds of things happening if you break these assumptions. Right. So what are we doing with this data and how are we continuing to work with this? Well, one of the things that we want to do is do more proactive threat detection, like we did with the Snowshoe Spam example and the Crafted Domain example. And we actually managed to get funding for a PhD position. And we actually already hired a student who is starting in the third quarter of this year. We are also working on another project proposal. There is a joint call for cybersecurity proposals that closes end of August. We're submitting something to that. And we hope to have another PhD position in the Netherlands that we fund with that. I have a student from the Technical University of Eindhoven finishing a project. We want to measure adoption of secure email practices, such as using Start TLS and Dane. And later this year, we're going to do some cool visualizations based on this data that we hope to put up on our website. Because, of course, we're academics, so we have a really boring HTML-only website with text. And we want some nice figures on there so people actually get a feeling for the power of this kind of data. If you are interested in data access, we share data with other academic researchers. We have to be a little bit careful because we sign contracts to get some of these TLD zones. And while we are allowed to use the data for research, we almost definitely are not allowed to use it for commercial purposes. Some of the data we have is already open access. And you can access it through our website. And we can always find the middle ground if we can't give you access to the data. We can give you access to public data sets and then run queries on your behalf once you've tuned your queries. If you want to learn more about our project, please go visit our website. We published a paper about the design of the system last year, which you can find through the URL. But you can also find a link on the website. If you're interested in how we designed the system, look up the paper and give it a read. Send me an email, find me on Twitter, find me on LinkedIn if you have any questions. That was my talk. And if you have any questions, now is the time to ask. Thank you very much, Roland. If you have questions, please line up at the microphone just a second. If you're leaving the room, please be quiet. The audience, the acoustics in the tents are really awful. If you haven't noticed, outside it's raining, so I would suggest staying and asking questions. First question, please. Yeah. Do you have a list of top-level domains where you have not the possibility to get the entire zone file? For instance, do you get also the .mil domain or any others? Which one? The .mil, US military. No, we don't get that one. But we do actually have most of .gov because that is open data. So we have .fed.us and .gov because that is published as open data because Congress forced them to do that. .mil, obviously, we don't have. And you're grinning, so you have the data. What? No. For information, maybe there are other top-level domains that will not give you the entire top-level domain. That's true. So actually, the hardest people to get data from are the country code top-level domains, the CCTLDs. Because the generic TLDs have to have a means to share their data. This is a requirement from ICANN. So most of them we can actually set up a contract with. But the CCTLDs have their own bylaws. And especially the European CCTLDs are reluctant to release their data because they say, well, it's privacy-sensitive and we can't release it under European privacy regulations. I would argue this is not true because we have data from a number of European CCTLDs. But it's mostly the CCTLDs that are actually the hardest to get data from. So if you know people at a CCTLD or you work at one and you want to give me your data, please. Let's talk later, Brad. OK. Next question, please. What's the reason you're not collecting PTR records as in reverse DNS? OK, yeah. That's a good question. So there are basically two reasons for that. A, there are already projects that do this at a large scale. For instance, the people that develop bind, so ISC, runs a yearly PTR scan. And that data doesn't change very frequently. So they run a yearly scan that they publish. Actually, right at the beginning of my talk, I told you I'm operationally responsible for a surfnet's DNS infrastructure. There are people running very, very bad PTR scans that show up in my data set because we have most of a slash 8 in IP space. These people are really annoying. And I don't want to be one of these annoying people. OK, thank you. Next question. Thank you. In your graph showing your query volume, it seemed as if you were not doing any queries at midnight. So is there a reason why you don't do 24-7 scanning? That's a very good question. I didn't actually explain that. Well observed. So we want to do a measurement for every domain once every 24 hours. That means we start our queries at midnight UTC. But we also want to finish our entire measurement before the next midnight UTC. So we leave some extra space where we're not sending queries, or we might be sending one or two batches because there were changes to the zones during the day. But actually, our query in completely stops before midnight and then restarts at midnight, which also makes us very recognizable if you're receiving traffic from us because we will start exactly at midnight UTC. OK, thank you. Next one. Yeah, thank you. So if I understood it correctly, you look at domain names just below the top level domain. So what happens if you have a host there in between, which has clients, which register domains with a host there for some malicious content, or one malicious domain which only hosts its malicious content in a subdomain? You look at those as well, or do you think there's not an important thing to look at? No, that's a good question. So you understood correctly that we only go for the second level domains under a TLD. And we ask for the double double label for A and quad A, but we don't go into third or fourth or whatever level, unless there is a C name there, in which case we will expand it and go in. What we also do is we have some measurements where we take hit lists. So they are, for instance, RBLs with longer domain names on them that we will also measure. But the trick there is that we have to have added value with the measurement that we do. We want to measure something that somebody else isn't measuring already. And these third or fourth level domains often show up in passivity in set ups. We can use those as a hit list to do a measurement on our end, but it does have to make sense. So what we're doing now is we're doing this for a few RBLs to see if we observe changes. For instance, there's a takedown or whatever we observe changes. That is interesting. But of course, we have no way to work out what exists in the namespace if we don't know what to look for. And what we definitely don't want to do is do some sort of dictionary querying or brute force, because then we're going to generate traffic volumes that are just going to be too big. Thanks. We still have a few minutes left. So if you have any further questions, please do come up to the microphone. And if you do, please move rather close to the microphone so we can understand you better. Closer, closer, closer. Closer, closer, closer. Yes. I'm not 100% filmmaker with all the intricacies of the top level domain system.  Do you see different things? Is that possible? Because you only measure from the Netherlands, which is quite safe, hopefully. It should be, yes. Should I go to the Buddha? So now, this is a good question. So I'm going to make it a little bit more general, which is why do you not measure from multiple vantage points, right? Yes. Two answers to that. Answer number one, we already generate quite a lot of traffic. So the more vantage points we set up, the more traffic we generate. Why? We want to be a little bit careful with that. Most of the there are people that claim that most of the internet is already scans and we don't want to add more to that. We did actually set up a secondary vantage point in the US to do a measurement, together with Keda at the University of California, San Diego. And one of the things that we want to do is what differences do we see? Now, obviously, you have things like CDNs that will give you a response based on your geolocation. But there is already a lot of research going into working out how these CDNs work. So that's not a goal of our measurement. And to answer your original question, what if you do this from China? Well, from China, you'll hit, of course, the Great Firewall, which will block certain domains and return you data that whatever the Chinese government puts in there. There are ethical issues with those types of measurements because where do you then do this measurement? Do we do this with our Chinese colleagues who operate the research network there? What do we expose them to if we start sending lots of queries for stuff that our government doesn't want them to query? So we tried to steer clear of that. Actually, we did another measurement last year where one of the things that we did was do a scan for open resolvers. And our scan hit the Great Firewall, and we got some responses back from that. And they send back really weird stuff.  So I have no clue what they're doing. I tried to steer clear of that for ethical reasons. Thank you. OK. He hasn't asked the question yet. If you observe records with a low TTL and change every day, do you want to scan them more than once a day to get better measurements? Yeah, that's a good question. So to answer to that, because we use a resolver in between. So the cache of the resolver will actually ensure that if something is cached for the TTL, it will expire. We can query it again. We don't store the TTL. What we want is a predictable data set. So if the TTL is short and it might change more often, then of course we could query more often. But how do you scale this? Because if there is one thing that is observable in the DNS, it's a trend in TTLs going down. There's a paper from two years ago where they had a study where they looked at TTLs observed in A and Quoday records. And this was a repeat of a study that was done in the early 2000s. And in the early 2000s, the median for TTL for A and Quoday records was about an hour. When they repeated this study two or three years ago, the median was 60 seconds. We can't feasibly send queries every 60 seconds. We have no way to make that scale. And I don't want to break the internet with my queries. We have time for one more or two more quick questions if there are quick answers. Anyone? Any takers? Come on. And close to the microphone, please. Yes, you have to bend down. Recently, I stumbled upon a Twitter user called DNSStream, who regularly informs the community when an DNS record changes or whether there's a random subdomain attack on some sort of DNS domain. Do you know who that is? Or is it probably by any chance you and your project? Oh, OK. So it's not me. I followed that account as well. And I have a hunch who it might be. So I can tell you in person, but I'm not sure. So last call for questions. We can fit another one in if anybody's interested. No? So I would say thank you very much, Roland. Please give him a warm round of applause.


I'm an American Chinese paper artist born and raised in Hong Kong and now living in New Jersey. I became an artist during the pandemic. I was stuck at home and there was just pile of cardboard boxes and I wanted to make something get me away from the negative news. So one thing after the other, I ran out of room, I need to shift medium and then I started making paper art. I was invited to a solo exhibition and I was like, oh my god, I can do this and so I took it more seriously and really think about what kind of art that I want to make and the audience, who do I want to speak to, what kind of subject matter that I would like to make and tell people who I am and where I come from as an artist. Being born in Hong Kong and given the situation like this now that China took over and Hong Kong is not the same Hong Kong that I know anymore so I like to use the art to tell people how Hong Kong is like. I don't have one word for it but if people can start accepting different voices to allow different voices, I think there will be less conflict. We all created equally. It's very, very simple if we treat others like how you treat your family.


Welcome to this discovery session, a session of immersive storytelling, and you're all in for a tremendous treat when it comes to storytelling, with a fantastic storyteller and a fantastic story to share with you. I am Magdalena Skipper, Editor-in-Chief of Nature, which is a multidisciplinary scientific journal, and it's my real pleasure to be introducing and then conducting a conversation and taking in your question with Fabiola Genotti. So just a word about the structure of the session. Fabiola will guide us, introduce us through the theme of our meeting here today for about 15 minutes, so half of the time that we have here together. And then we will open up for questions from you. The story is indeed fascinating. We will hear about the insights into the nature of the universe, and of course this in itself is fundamentally fascinating. What's also fascinating is how to learn how those insights are generated and by extension from that process, how that process in itself informs other disciplines, our other sectors and areas of discovery. So we will hear about the influence that the process of learning about the nature of the universe, the influence that it has on, for example, the medical field, environmental monitoring, food safety, there are many others that Fabiola will talk about. And then of course there was a fundamental aspect to the collaborative nature of the discovery that we will hear about. So before I hand over to Fabiola, let me introduce Fabiola herself. So she is director general of CERN and has been so since the beginning of 2016. She's the first woman in this role and the only person who's been reelected to lead CERN for a second mandate of five years. By training, she's a sub-nuclear physicist, that's a PhD degree she holds from University of Milano. And in her work as a researcher, she, one of the things she led was this Atlas experiment which uses large Hadron collider. And while you may not be familiar with the Atlas experiment itself, you are almost certainly familiar with probably its most famous discovery and that's the Hades boson, the so-called God particle, you probably remember that term, had that's how it was reported back in the day. And believe it or not, that was just over 10 years ago. And in fact last summer, there was a wonderful celebration in 10 years. So of course, the announcement was made and indeed led by Fabiola back in 2012. Last year in the summer, there was a 10th anniversary celebration. In fact, in nature, we celebrated it by publishing follow-up research and also celebrating the history itself. Fabiola holds a number of distinctions, awards and honorary degrees. I will just mention two points because I think they're really worthy of mentioning. She's been included among top 100 most inspirational women by the Guardian newspaper and top 100 most influential women by Forbes also. So here we have an inspirational woman and an accomplished physicist to tell us about the mysteries of the universe, the insights into it and how those influence other fields as well, Fabiola. Thank you very much Magdalena, thanks. Thanks a lot. Thanks Magdalena for this very nice introduction and also thank you for the opportunity to describe the science we do at CERN. So what is CERN? CERN is the largest laboratory in the world for particle physics and particle physics is the most fundamental of all sciences because it studies the smallest constituents of matter and of the universe, constituents that cannot be cut into smaller pieces and therefore they are called elementary particles. CERN is based in Switzerland, in Geneva, close to the border with France and here you can see an aerial view of the region with the lake here and Switzerland on the bottom part of the screen and France on the top part and the ring, the circle you see indicates the location of the Large Hadron Collider. It's the most powerful accelerator humanity has ever built. It's a 27 kilometer ring 100 meter underground where we accelerate two beams of protons in the two opposite directions of the of the ring and then we bring them into collisions at four points. But what is an elementary particle and what is its size? So let's start from something that we know, a human here. Okay this is a human here. So the size is 100 microns, so one tenth of a millimeter, a micron is one millionths of a meter and then if you go down deeper into the structure of metals, we find cells of course, and then going deeper and deeper we find virus structure, fibrils and proteins for instance, here we go keratin and then if we go down and deeper we found atoms. In the case of air we have nitrogen, sulfur, oxygen and carbon. Now atoms are not elementary particles, they are made of substructure, they are made of a central nucleus surrounded by a cloud of electrons. Electrons are elementary particles whereas the nucleus is not. It's made of substructures and these substructures are called neutrons and protons. They have a size of one fermi, a fermi is 10 to the minus 15 meter. Neutrons and protons are not elementary particles, they are made of substructures and these substructures are called the quarks. The quarks are elementary particles as far as we know today, so electrons and quarks are the fundamental constituent of matter, they are elementary particles and all the matter we are made of, all us human being is made of electrons and quarks. When I say all human beings, I mean everyone, so even the VIP here in Davos, even the head of states, everyone is made of electrons and quarks. So science and external exploration with the large electron colliders allows us to study matters at the level of its fundamental constituent, the quarks. So on physical scales of 10 to the minus 18 meters or smaller, so a billion of a billion of a meter. So in some sense accelerators can be compared to big microscopes. The smaller the structure you want to study, the more the energy you need because you need a very high resolution power. So if to study human cells, you can just use a microscope in the lab, if you want really to study matter at the most fundamental level, you need to use big accelerators with a lot of energy and we will see how this is done. At the same time, this study of the very, very, very small allows us to study the very, very big, so the structure and evolution of the universe. Today we know with high precision that the universe has been at origin from a big explosion some 13.8 billion years ago. At the beginning it was very hot and very dense and it was essentially gas of elementary particles and it expanded and cooled down and then the elementary particles started to get together. First the quarks to form neutrons and protons, then neutrons and protons to form nuclei, nuclei with electrons to form atoms, atoms to form molecules and then up to the macro structure that we see here, stars, planets, galaxies and of course us, the human beings and our hair. So this is the reverse movie of what I showed before. So the large electron collider allows us to probe the universe at times corresponding to 10 to the minus 12 seconds after the big bang, one millionth of a millionth of a second. So what does this mean? It means that the energy that we produce in the collisions of the two proton beams corresponds to the temperature that the universe had at this time and the temperature was 100,000 billion times the temperature in this room. So we are able, so these numbers are quite impressive, we are able to reproduce in the lab in control condition, we are able to reproduce the phenomena that characterized the very primordial, the very early universe. So the elementary particles that were there, the interactions, the various phenomena that took place. To do that we need three big classes of instruments. We need particle accelerators, we need particle detectors and we need powerful computers. So let's start from the accelerators and here we are back again to, quick again, yes to the ring. So as I said at the beginning we inject two protons in the two proton beams in the two opposite directions and we accelerate them at the largest possible energies. The limit only comes from the technology, the technology superconductive magnets that are needed to provide a very strong field to keep the beams on the circular trajectory. And these two beams collide in four experiments, so these are four giant instruments, underground instruments, when I say giant I mean a cathedral, take half Notre Dame and put it underground. And the goal and the purpose of these experiments is to detect the product of the collisions. So we have these high energy beams colliding, the movie should go on, yes, colliding in these big underground instruments and they produce thousands of particles and the task of the detector is to measure each single, every single particle produced in the collision, identify those particles, measure their energy, reconstruct their trajectories and give us a picture, an image of the collision event. So if accelerators can be compared to giant microscope, particle detectors can be compared to digital cameras that take pictures of the collisions. But you know it's very special in high tech cameras because the two particle beams collide 40 million times a second. So these detectors must be fast enough to look and to take picture of this of the events and then discard those that are not useful or interesting and then save to storage only those that can be, that are, that deserve further study. So from this you can, for instance, deduce if you produce a X boson, a W, a Z particle and then study, you know, the constituent of metals with very high precision. All this will not be possible without the contribution of scientists from all over the world. So CERN attracts some 16,000 people, technicians, scientists, engineers, physicists from all over the world. More than 110 nationalities are represented. We also have scientists coming from under privileged countries, so in this case our mission is capacity building, and some of the scientists actually come from countries that are not the best friends of each other, actually countries that are in conflict and they work together at CERN, animated by the same passion for knowledge. Computing is also extremely impressive because we have a distributed population across the world, so we need distributed computing. So at the time of the conception of the LHC, CERN and its partner developed what is called the LHC computing grid. So a grid of more than 150 computing centers distributed across the world and connected by very fast links and networks, providing a storage capacity of two exabytes and something like one million processing cores. Now this instrument, detectors, accelerators and computers are extremely sophisticated. For instance, in the case of computing, the LHC computing grid has paved the way to the cloud. So really instrument developed and that are based on very cutting edge technologies that in some cases are really pioneering technologies. These technologies are transferred to society to the benefit of everyday life, and they are transferred free of charge because the funding conversion convention of CERN, which was signed by the member states back in 1954, states that everything we do, the results of our research, the technologies we develop are available to everybody free of charge. This is what we call today open science, but already there, 70 years ago, that was already present in the founding convention of CERN. So I will give you some example. Everybody knows that the World Wide Web was invented at CERN by Tim Berners-Lee at the time he was working as CERN employee, but other examples are for instance accelerators that are used to treat cancer using proton, ion and electron beams, which for some tumors are more effective than the conventional radiotherapy and also in particular because they do not have side effects, they do not create problems to the healthy tissues. Superconducting materials have the possibility of wide application. The image was too fast, I cannot go back in a moment, but the previous image showed radiation dosimeter onboard the International Space Station. And here we can see here is a high resolution 3D color image of a medical image made with CERN electronics. So several decades of exploration at CERN and in other laboratories for particle physics across the world allowed us to discover several elementary particles that are shown here and understand their properties in detail and their interactions. The last one to be found is the X boson, which was discovered at CERN 10 years ago, as Magdalena correctly said, very special particles without which atoms or which we are all made will not exist as stable systems, so we will simply not be here. However, these particles and these interactions only explain the so-called visible universe, which is 5% of what is out there. The rest 95% is made of formal matter that we don't know, and we call them actually dark matter and dark energy. Dark indicates on one end our ignorance and on the other hand the fact that they do not interact with our instruments, so we don't see them. And I would like to conclude with a beautiful image of the sky. Whilst what really strikes us in this image is, of course, are the stars, the galaxies, the bright objects, actually the most fascinating, the most intriguing part is the dark. The dark is today mysterious. We don't understand the dark universe, and that's a focus of scientific exploration today and tomorrow. Thank you. Thank you. Thank you very much. That was terrific. And a couple of reflections, if I may, and then I start off with a question. I hope you have began to formulate questions of your own. Really striking couple of reflections as you were speaking. The first one is that fundamental unity of us all, and of course it's not just the VPs and the politicians at Davos, it's all matter around us. So that fundamental uniting basis to not just life but everything that exists on this planet and of course in the universe. And the second thing, just now what you said here about the fundamental discoveries, the fundamental research such as this, teach us how to look at problems and what it is that may be interesting. Exactly as Fabiola said, at first glance it seems all the shiny things are really interesting. And of course they are interesting. Exactly. More important is what's in between in part because that's the most mysterious aspect. And so let me start with the first question and please get yourselves ready. So I rather suspect that the image you're showing here is from the James Webb telescope, right? We've of course seen so many images already over the last few months, last month of the year. You illustrated very beautifully how recreating these very early moments in the history of the universe sheds light on that history. How does it compare the information that we're getting from a really powerful telescope like James Webb and the information that we get from experiments at So thanks for a very good question. So I showed a very complex image showing a picture of the evolution of the universe and they're showing on the two ends, the telescopes and the accelerators. So the two type of instruments are complementary. Telescopes try to look at the structure and evolution of the universe by looking at the macro objects, star galaxies, etc. And by looking at the farthest object, they allow us to go back in time. Accelerators are able to go back to primordial, more primordial epochs at times where light was trapped by the very dense early universe and could not escape. So it could never come to us. And so that's so accelerator can go farther back in time. And of course the information that comes from both is combined, can be and is combined and can give us a more complete understanding. Of course, as I said, there is still a lot to be understood. Dark universe, dark matter, dark energy, there are different interpretations for instance for the nature of dark matter. And so by combining also the information from telescope and particle accelerator and other experimental endeavour like big detector underground that look for instance the dark matter coming from the intergalactic halo and interacting with the detector itself, we can try to get the full picture in the right picture. Thank you. Any questions from the audience or comments? Please go ahead. There's a microphone coming to you. Ten years ago after you discovered the first Higgs boson particle, what is the next aim or goal of CERN? Thanks. Thanks. Well, it's too, you know, the goal of CERN is to address the goal of all scientific endeavours is to address the outstanding question. So the discovery of the Higgs boson allowed us to answer one of those questions, the origin of the masses of the elementary particle which is absolutely essential to understand why atoms are stable system and why we are here. The Higgs boson itself, it's a very special and very peculiar particle. It's part of this standard model of particle physics. I showed one slide without going into the details, but if you look at the details of the theory, all the problems in the standard model which describes very well the elementary particles and their interaction originates in terms related to the Higgs boson. We don't understand its mass. We don't understand fully the weight in couples. We don't understand the vacuum that is related also to the Higgs boson. So there are many, many questions that are related to it. Besides the Higgs boson itself, of course, what I said, dark matter for instance, if dark matter happens to be made of particles that have masses at the level of from a 100 gV to a few tV, it can be produced in proton-proton collision at CERN. If it's made of something different like primordial black holes, then other instruments are more suitable to or are suitable to detect it. So we will continue to address these open questions and I can tell you which one will be answered first. This is in the ends of nature, but of course it's very fascinating that we have those interesting questions, but also that we have learned with time what are the right questions to ask. You are next, I think. Just wait a second for the microphone. Thank you. Doctor, it's so fascinating and seems to me that there is such a big advancement and there is a disconnection sometimes between all this advancement and what kids are learning in school. And they still are being taught the very basics of the atoms and the electrons and the protons and not so much of what really is happening with the scientists like you have discovered. So the question is how could we help the scientists to actually take all these learnings and teachings to the younger kids and the younger generation that will come after you and hopefully advance beyond what you have achieved. Thank you. It's a very good question. It's true and now if you look at the textbooks at school, in some cases you find the standard model and maybe in some cases you find the expose on, but in most of them you don't. You find many classical mechanics, very little quantum mechanics, not even in the simplest term. I think it's very important that we scientists continue to communicate and to educate the younger generation. I would like to mention maybe a project that we are realizing at CERN, it's called the Science Gateway. We are building a new building complex where we will have of course exhibition and many interactive activities for the general public, but we will also have labs for kids starting at the age of five all the way up to 16 until they go to a university or so where the kids can come and do experiments with their own hands and understand what being a scientist means and this means having a question and a problem to solve, building the instruments, making the measures and share the results with their peers or the other kids at school and in their case with other scientists in our case. So I think if you all scientists in all our labs or research infrastructure try really to attract the public, we also have at CERN like in many other laboratories programs for the high school teachers that come and spend some time with us. This is also an important message because they get an update on modern physics and they can then make pressure so that you know the textbook and their teaching at school is up to date. There was a question in the middle and then at the front. Thank you for the presentation. Do you use artificial intelligence in a meaningful way in your research or if not are you planning to do? We do. We do and actually CERN is really very much on the front line for developing on machine learning and AI techniques of course because the problem that we have to solve is extremely complex when you look at these collisions of proton beams, you produce thousands of particles and so sometimes the signal that comes in the presence of particles that are produced very rarely like the expose on the expose is not produced so often. You need to extract very tiny signal from a large number of data so very complex analysis techniques and very complex algorithm and there is exactly where AI can help so really we are really using this and because our requirements are extremely stringent this is also CERN is also very often a test bed for companies developing AI or developing technologies on quantum now that can be used for more advanced algorithms and so yes. Is there a question here in the front row? Can we go with the front first please? Just here. Michael Leander from Denmark. First of all it's fascinating what you're telling and I'm still struggling by understanding that the most important is the darkness here so my question is when we come back in 10 years time do you expect that we will see more dots on this photo and then another question on the more political thing is you talked about open science which is also fascinating but how is that affected by the global geopolitical war between China and USA for example it's threatened this open science. So starting with the first question which is easier. I can't tell you if in 10 years from now we will we can you know put a name on the particles or the forces or whatever that can explain the dark universe this I can't tell you. I hope so at least for part of it dark matter which is maybe a little bit easier some quotes to solve it depends on really what nature has put out there of course but I can tell you that dark matter and dark energy are the objective of extremely broad class of scientific endeavors not only accelerator physics but also telescope and other studies and of course gravitational waves detection and study comes in so what we call multi-messenger astronomy so we are doing huge progress in the in the technologies and in our way of exploring the universe with very complementary instruments so I think that we we can get nice results I hope soon but I can't tell you when concerning open science for the time being you know the game of the rule at CERN is that what we do is open science and we have collaborators from the US we have collaborators from China and this has never been questioned it's a it's a value of CERN is a mission of CERN. If I may follow up on this I think you start you opened up with the second part of your question a really really interesting issue here about open science but also collaboration more broadly so this this openness information exchange I always think much of this research and indeed what you talked about in the context of CERN happens in an academic context but of course there's a research that happens in the private sector and relevant to this but also other disciplines and there is a I think an opportunity a real opportunity to consider how in an open collaborative way there may be exchange of of data and information in this sort of pre-competitive space yeah so right good point Magdalena so first of all um it's true that it's much easier to be open in an academic world in our case for instance we do not develop many technologies that have a potential dual use so you know it's so security issues are not so important and also also limiting on constraining in our case so it's much easier in the in the purely academic world than in in a private sector or at the level of government or activities that I have a link direct link with government security etc however it's also true that there are other fields where global sharing of data is not practice is not you know some medical fields for instance this was came up at the time of vaccine for instance so I think it's important that we try to to push for for open science for for data sharing and information of information of sharing of information because open science is as many virtuos first it boosts science itself because the more you change with other scientists the faster science goes second it maximizes the impact of science on society and third also is a very powerful means of reducing the inequities across the world because of course if everybody has access to science education and technology of course for free free of charge then of course you reduce the gap which today unfortunately is widening with the with the technology have a such a disruptive evolution disruptive in a positive sense and being extremely you know growing very fast the gap widens exactly and the impact on society you can also extend it into thinking in terms of trust in science right and and that of course is something that absolutely we the science community research community is very concerned with you mentioned vaccines we saw that exactly which can of course can help to fix the this real or perceived mistrust in in science through again open science and sharing technology and showing the impact of science but also through communication transparent communication this what I was mentioning before exactly other questions I think there was a question then there's a question here now thank you very much I'm the Italian ambassador to the United Nations in Geneva including to CERN Giannarezzo Cornado I want to congratulate you for hosting this event and congratulate the director of Habida Gianotti for her presentation she's quite unique because she can explain very complicated issues to people who are not specialists and I believe there are very few people like Professor Giannotti capable to do that I have a lot of admiration for her I have a question on the universe thanks to the accelerator we are capable to study the origin of the universe you believe it will also be possible to predict the future evolution of the universe and to understand whether the universe after having had an origin will also have an end thank you so what we know I can answer I can answer by maybe elaborating a little bit on this concept of dark energy actually we have here in the room of Brian Schmidt the Nobel laureate who is the person who has understood within the group of Berkeley also that the universe is expanding today at an accelerated pace so you can imagine the initial explosion of the universe at the big bank and then explosion the universe expand and then and then course down I can imagine that at some point because of the gravity so the various masses formed because of the gravity then the various masses tend to implode and the universe at some point will implode and we go back to say the very initial state but we have discovered that something thinks about five billion years ago or so the universe started to expand again at an accelerated pace and we this we don't understand we think that there is a form of energy pressure so the scalar energy scalar force pressure that pushes the universe apart every single points away from each other and counterbalance the gravitational attraction so we are accelerating now at at at at an accelerated we are in accelerating expansion phase this is what we can tell today we have run out of time for any further questions I'm actually delighted to see how many questions that have been Fabiola that's credited to your ability to tell the story in this very very engaging way a couple of final comments I really want to emphasize for you that incredible fascination and hunger for understanding of the very fundamental properties of of matter and the universe around us and how that fundamental interest in getting to the bottom of everything that was around us and within us unites us all and you talked about collaboration among scientists from parts of the world who don't come together don't convene and not don't have a seat at the same table in really any other in any other situation and that's one power of science which I think we don't talk about glue enough absolutely it's a glue thank you very much thank you very much thank you


Mae'r preachnog o'ch gonduno gwisio i'r tourists o'r cyfle i wybodd y gallan adael? Rydym yn meddwl i ddweud y ganddoedd. Felly mae'n gwell profi a'r bwysig gydiannit. Mae'n ganddoedd o byddiogi i ddweudio gyda'r gynnal yma. Mae adael i'r busau o'ch preffingu pwysig i'r llwydeddiadau yn wych yn cael eu gymhxwyr. Mae ddweudio'r busau i ddweud enghraifft a'r baell o gydych chi'n sefydig! Llan i'w gallu ddeuam nhon golygu, felly mae'n golygu ddefnyddio gwahanol yn dweud, a mae'n dweud hwnna gwaith yng nghydfynol, a oed yn gwlad o'r ddechrau, a'u oed yn medri gwell, mae hynny'n medri chael ag27 ynghylch, felly mae'n gwneud i'r gweld rhaid i gael.ol fel hwnnas dim, fel hynny'n medri chael bobl yma同yn i'r ynnugau a'u cynnig oed yn gweithnos. Byddai chysylltiadol yn fel wir yn medri'n medri'n medri sy'n weithio yn medri'n medri'n medri cyffredigodol. ..yna'r hyn o'r ffordd o'r hyn ymlaen. Mewn negadwyd y fardd yn ddefnyddio i ymddorol, ac profitoedd y ffordd iawn. Mae wir wedi'u walk yn siarad. Felly mae'r wych yn bwysig. Mae yna'r ffordd iawn i chi'r hyn, fel hyn yn ei wneud i wneud y ffordd iawn, fel eich byddai byddai ar gweef y byddai'u llawd. Felly'r bwysig i chi'n rhaid i fod yn rhyw galw i'r hyn ymddi'r hyn. Dyma'r gweithio'r ffordd o'r cyd-igwetiddio'r ffordd ac mae'n cael ei wneud am ychydig o'r ysgolig oherwydd ymddug yn hynny. Mae'n gweithio'r caradwy, mae'n gweithio'r dweud a'n gyfweld i'r hynny'n gwneud. Mae'n rhoi'r gweithio'r gweithio'r gweithio'r pwysig a'i'r bwysig i'r gweithio'r gweithio'r bwysig i'r gweithio'r gweithio. Ac roedden ni'n bwysig o'r ddychwynig ac yn ysgolion. Yn mynd i'w ddysgu'r ddarparu, bo'r ddechrau sy'n gweithio arall, yn rhan o'r ddechrau ddysgu sy'n cael ei wneud. So mae'r ddysgu sy'n meddwl o'r ddysgu sy'n eu cyffredin. Dyma'r ddweud o'r ddysgu, mae'n ddysgu'r ddysgu. Nid yw, mae'n ddiddur oherwydd hynny, mae'n ddysgu'r ddysgu, sy'n ddysgu'r ddysgu'r ddysgu'r ddysgu. Felly, rydw i'n cael ei rhagor, a y gallu bod yn gwrs dda gennym iawn yn dweud bod canu'n amdano. A dyna'n ei ddefnyddol o'r societies, dyna'n gennym iawnressive, ond mynd arall'n mynd yn fwy i gwmpas. Felly, mae'n gwybod ymlaen i'r amlwg o'r model yn y game, ond y cyfle fod y gallwn ei wneud yn flwyenedau, gennym y cyfle gwasanaeth a'r bwysig. Felly, mae'n olygr yn meddwl o'r cyflwydd, wrth gwrs, o'i'n gwaith o beth o casiddau'u gwahanol yn gweithio? Is that probably the only missing piece of the jigsaw tonight? Yeah, a little bit. But you have to understand, it's difficult when the opposition are playing like they are. Sometimes it's very difficult to have a calm head and understand that you don't have to just help the ball on. Just have the calmness and recognise that there are opportunities to play. The few and far between because constantly the ball is coming back. But if we could have just recognised when we could have played those initial first pass balls, then we could go out a couple of times. But it's difficult because they're constantly just putting the ball back and things are bouncing around. And sometimes you just got to clear your lines and we're going to crystallise the guys for that. At times that's what was needed. I guess I mentioned at the start to come here a team playing full of confidence on great form and nullify them in a way to stop them from threatening us. Absolutely, for the most part they've got to shell balls into your box. We're going to have to defend. Can't always get any pressure out on the ball because they hit them in so early. So it's difficult. But we're up to the challenge and cleared when we had to and got our heads on things and blocked things and got out quickly in wider areas. You can see how they've done okay because a lot of other teams would have gone under. We didn't tonight. I thought we showed really good resilience and great courage. Three-day abuse tonight, starting to bed these guys into the team. I guess with a bit of a gap as well now in fixtures. Yeah, early days, early days. Some aspects of a play obviously we haven't touched on with the guys and a certain situation where if we'd have had the ability to work a little bit more with them we could have exploited. But that's just what we have to work on things. We have to remind guys of. I thought in terms of debuts, I thought all three of them did really well. They'll be better next time out as well. Brought in a lot of experience, a lot of good energy as well. Good leadership as well, which was important. So please, please with everybody's performance. Just a word finally on does fans a shot of 1500 and a choose now? Brilliant. Not too many go mouth opportunities to get excited about but I think they recognized it was difficult tonight. We had to make sure we didn't concede and I think everybody saw a really committed performance tonight. So it's a difficult place to come as we said. It's a good point on the road. Lower qualities that we'll need to show from out to the end of the season. We've shown again so we're pleased with that.


Realizing the importance of having effective cyber laws, Pakistan has in the last two decades developed and promulgated several cybercrime laws. We have already seen earlier that in 2002 came electronic transaction ordinance. Then in 2007 arrived electronic or cybercrime laws. And then finally the most current ones are Prevention of Electronic Crime Act, PICA 2016. Just pinning the importance of having effective cyber laws in order to combat cybercrimes I am very tempted to share a quotation from National Research Council USA given by them in year 1991 while they say that the modern thief can steal more with a computer than with a gun. And tomorrow's terrorist may be able to do more damage with a keyboard than with a bomb. So for major financial frauds, for major terrorist activities, and several others, cybercrime has the potential of creating havoc or causing menace even way beyond our imagination. And the only way to actually prevent a large range of cybercrime or in order to regulate cybercrime, the root is to have effective cyber laws. Pakistan realizing this need of the hour came in 2016 with PICA. Before we look at into the details of PICA, let's first again revisit the importance of having cyber laws. Cyber laws are required in order to prevent, in order to deter, in order to monitor and regular cybercrime. Cybercrimes are often international nature, in particular the financial frauds, whether it is extracting large sums of money out of bank accounts or whether it is this very small amount of financial theft out of individuals bank account but done repeatedly so that over time it becomes a larger theft. So usually financial crimes are often international nature. Further, cyber laws have an important role in representing and defining the norms of the cyber society. Cyber laws help in giving the right to enter into legally enforceable digital contracts which it wouldn't be possible to do in their absence. Then cyber laws help in maintaining and owning the cyber property. They help in carrying on online business which has increasingly become the backbone of several economies. Cyber laws further provide legal reorganization for electronic documents and digital signature. The most recent cyber laws promulgated in Pakistan are PICA 2016 and they make provisions for a persecution of several cyber crimes which are increasingly increasing with the utilization of internet and computer and its related technologies. Now we are just going to look at some of, not all but just some examples of the crimes which are covered under PICA 2016 and the punishments for those offenses. For instance, for any unauthorized access to an information system or data, this particular crime is punishable with an imprisonment of you know of maximum three months or a fine which may be up to 50,000 rupees and both these punishments could also be awarded together. Then for the crime of unauthorized copying or transmission of data, there could be an imprisonment of up to six months or there could be a fine of you know 100,000 rupees and both these punishments can also be given together. Looking at a few other examples, for the crime of interference with information system or data, there can be an imprisonment which can extend to two years as well as a fine which can be up to 500,000 rupees and again both punishments can also be awarded together. Then for the crime of an unauthorized access to critical infrastructure systems and data, there can be an imprisonment which may extend up to three years or a fine up to one million rupees and like previous ones, both these punishments can also be awarded together. Moving on, for an unauthorized copying or transmission of critical infrastructure data, there can be an imprisonment which may extend up to five years as well as a fine which can be up to five million rupees. For an interference with critical information for critical infrastructural information system or data, you know it can be punished with an imprisonment of seven years and a fine of 10 million rupees. Then another kind of a cyber crime which is glorification of an offence, an example of this could be that it is possible that that offence did not take place in the cyber space. For instance, a person may have committed a murder or may have committed rape in the physical world but they are actually using the cyber world in order to glorify it. So glorification of an offence which is you know in many cases perhaps a bigger offence than the offence itself is you know likely to be punished with an imprisonment of a term which can extend up to seven years or a fine which can extend up to 10 million rupees. And again, both these punishments can also be given together at the same time.  Hate speech is a preparation or dissemination of any information through any information system or device that can you know that is likely to advance interface sectarian or racial hit. Now hate speech is something which can promote or it can you know cause violence or it can you know be life threatening to an individual or a group of people.  Then cyber terrorism itself it has its own punishments but recruitment, funding and planning of terrorism which is preparation and dissemination of information through any information system or device that invites or motivates to fund or recruit people for terrorism or plans for terrorism is also punishable with an imprisonment up to seven years as well as a fine. Then as I am just quoting some of the examples of offences and punishments, now there are several offences and punishments. For instance cyber bullying, for instance cyber stalking which are covered under Pika another very noteworthy and worth mentioning a crime which is punishable under Pika 2016 is child pornography. Now what is child pornography? Well it is that whoever intentionally produces, offers or makes available, distributes or transmits to an information system or procures for himself or for another person or without lawful justification possesses material in an information system that depicts a minor engaged in a sexually explicit conduct or a person appearing to be a minor engaged in a sexually explicit conduct or realistic images representing a minor engaged in a sexually explicit conduct or it discloses the identity of a minor. Now such crimes which would fall under the umbrella of child pornography are punishable under Pika by up to seven years or a fine of five million rupees. Now as you know cases related to you know child security have sprung up in our country in recent times it is a relief that you know any dissemination of production or use of child pornography is covered under Pika 2016 along with a set of several, several others cyber crimes. Then spoofing which you know may seem to be which may not seem to be a cyber crime to several people because of lack of ignorance you know but spoofing is also punishable with a term which may extend up to three years as well as a fine of five hundred thousand rupees for the convenience of the audience if I may shed light on what spoofing is. Spoofing is that whoever with this honest intention establishes a website that sends any information with a counterfeit source intended to be believed by the recipient. Now this includes you know for instance there are times many of us might have experienced that in our social media account or in our email we receive a request from a friend or from an acquaintance or from a co-worker saying that they have run into an emergency and they would require a certain financial help but that's a typical case of spoofing and where we out of a good will may be immediately attempted to transfer some money or help a friend or a co-worker who is in such dire need. Now summarizing PICA promulgated in 2016 also on the very very positive side has or promises or offers international cooperation that means that the federal government upon receipt of a request through the designated agency under this act extends such cooperation to any foreign government 24-7 network any foreign agency or any international organizational agency for the purpose of investigations or proceedings concerning offenses related to information system. This international cooperation coming under PICA 2016 actually protects us and organizations from any kind of international cybercrime as well.


I'm telling you now, this is a warning, public service announcement, PSA, PSA, your boys back on creatine and things about to get for Ignasty in here. You're either coming or we're coming.  If I'm coming, you're coming. And if I'm coming, you're coming. And if we're coming, you're coming. I know that last clip may have been a little aggressive, but restock on the cozy staples, very few in stock, but there's a couple sizes, a couple items. So 3sb.co, check it out, very, very limited, just a couple of things to be found in the manufacturing. So a couple, couple items restock, check it out. It looks like your camera has pews. Yeah, you got no pews.  Yeah. By design? Yeah. It's been for that to work for 10 years and it hasn't worked. No, it works. You have more dates than all of us. That's a wanted man right there, and I ain't talking about that with you, I. That's a wanted piece of fine Japanese wagyu meat. Because we're filming in case there's a beautiful woman that maybe wants to marry me, it'll be more like this.


My name is Kirthina. So my question is, what comes to your mind when you think of Kerala? I feel genuine affection for the people of Kerala. No matter how much affection I give, I get more back. How do you think that the Bharat Jodo Yatra would influence the B Black Rose India? The idea is to bring people of India together. It's very important for India to be in harmony and peace if we want to be successful. How do you compare the education system in India and abroad with the education and what is getting done? I think a lot of work needs to be done in our education system.  It is wasted. One day I decided to go and sit in my nephew's class and I was shocked that the exact same thing that I was being taught 25 years ago, the same thing he's being taught today, no change at all. Even if you're teaching the same thing, you should be teaching it in a different way. There should be some evolution in the way you're teaching. Our India, which focus more on our culture, recently people hesitate to learn dance or learn music just because they don't have any good job opportunities. So what is your vision about this? People feel that success can only come through one or two avenues. I'm sure if you went to your parents and said, you know, I want to do a career in dance, they would be very concerned. The problem is that our society does not reward many of the other occupations. So we have to make that change in mindset because you can be successful in any field you want. You are indeed my own boy in Hadeep Har. So with that in mind, I have a letter with me right now. Can I give it to you? Please, please, come. Thank you so much. In your school life. I was quite a naughty student. I was, I used to misbehave a lot. I used to also play football. So many of my memorable moments were while I was playing football. It's always my dream. So I'm really, really happy. Such an amazing person. He has a very clear-cut view of what India should be. He interacts with us very friendly. As a student for me, he'll improve our education system. If he becomes a Prime Minister, he will be a good audience to all the citizens' problems and the issues.


Argentina has reached 70,000 deaths in the midst of a second outbreak worsened by a slow vaccination process. A report by the Health Ministry reported 70,253 deaths and over 3 million infections were 2.93 recovered patients since the beginning of the pandemic. Now Argentina started a strict lockdown at the beginning of March 2020 to mitigate the effect of COVID-19 which has been eased over the month but has recently become more restrictive due to the emergence of the disease. The report stated intensive care bed occupancy is at about 70.1% nationwide and 76.5% for Buenos Aires and its surroundings.