Hello, my name is Sean Quinn. Welcome to the first edition of our exciting new podcast hitting the fairways in association with Highland Radio. I'm delighted to be joined today by Bill McCallion, captain of Dunfanny Golf Club and Pius McFadden, captain of Bunkrana Golf Club. Gentlemen, thank you very much for taking the time to join with me today to talk all things golf. You're very welcome. Thank you very much, Sean. And I have to say you're both looking very well and looking forward to going on the golf course, I would say very shortly. Very much so. What I want to do is this go back a bit because we know that on the 26th golf will be permitted again. But I want to go back into 2020 and the struggles that all clubs have had with COVID. So as captains of your respective clubs, what has been the main challenges that COVID closures you're faced?  Yeah, thanks, Sean. I think keeping players interested in golf has probably been the biggest challenge. The first lockdown was relatively short and at Dunfanny, we reached out to a lot of golfers who had never set foot in the course before, particularly sportsmen and women who couldn't get access to GAA or soccer or rugby. And like many clubs, I think we did quite well. We took in a lot of new members and the ones that we took in really got into it then whenever the course reopened again. So if you take a step back and look retrospectively at 2020 bizarrely enough, Dunfanny did quite well. But I think this last lockdown is a different kettle of fish altogether. I mean, I think the golfing fraternity, you know, to use a standard expression, the golfing fraternity is just completely scunnered now. And keeping members interested in golf, I think has been a real challenge. And that's why this podcast is such a great initiative from you guys, the Masters on at the minute, etc. So I'm really hoping and I'm sure Pius is the same, I'm really hoping that that will energize a lot of men and women, you know, to dust their clubs down again and really look forward to getting back out in the 26th. Yes, it's a point well made. And I suppose Pius, did you find the same thing that you had a lot of new golfers coming to the club? And if so, where did they come from? Yeah, we had a lot that came to the club. Most of the money came from the shopper fraternity, the GA fraternity, which the contact sports were dealt on, were taken part. So majority of the 50 and 60 new members took up golf. And then we had the main chance for golf clubs. I could see was the loss of revenue from green fees and society and come, you know, while they're still paying maintenance costs. They added pressure of four months a year where membership renew and all then taken up people didn't know what was happening when golf would recommence. And that's very slow and getting people back out of the golf. Yeah, it's an interesting point because where you brought new golfers in last year, and I as being a golfer and being on the fairways, I saw a lot of new golfers, you know, and you knew some by the swings, but you also knew by some of the scores that were coming because they were incredibly athletic and got better and better. But you have a challenge this year, Bill, because as golf reopens, it's going to reopen with other sports. So as a club in Dunfany, what are you going to do to reattract these golfers? Well, as you know, Sean, we did a special beginners rate last year and this was in primarily at both men and women. Young men primarily, not so much ladies took us up on the offer, but we have an introductory rate of 250 euros for beginners who'd never played before. And we kept that on this year. In fact, we didn't change any of our subscription rates for 2021. And I'm really pleased that many of the beginners from last year have rejoined. And I think if we can get beginners hooked for two consecutive years, then, you know, they'll stick with it. Because obviously the fair, and I'm sure Pius is the same in Bun Krana, you know, you get beginners in, they play for a few months, then their own sport kicks off again, literally, and then they leave golf again. But I'm hopeful that we'll be able to keep the majority of the new members that we got last year. That's great to hear. And it's great to see that a club has made the provisions for all that. And it's very, very, very good value for golf, I have to say. Pius, would it be fair to say that Bun Krana Golf Club have the same setup? And have you anything else extra to keep these golfers? Well, like all our clubs, like we have the large influx of members and the main focus on the club is to retain these members and try and attract more members. Our club offers very attractive, reduced rate to beginners, full member, male, paying 260. An associate member, that is 190. Unlike other clubs, this is all inclusive of GUI and insurance fees. And when you consider the price of a full member male, it is 340 euros, inclusive of GUI and insurance, you know. That's just a big good to keep these fellas on and ladies. And yeah, the same as both. Well, that's fair to say that is extremely good value for golfers. And what I'm finding and Bun Krana have in common is it's their links courses. They're played 12 years, 12 months of the year. And that's a huge benefit to any golfers out there. So financially, in a good position, it's fair to say.  Bill, would it be fair also to say then as you reopen, you will have challenges, but you're in good footing to start up golf again. Yeah, I think so. I spoke to our greenkeeper just this morning there. And unfortunately, as you know, it passed wouldn't know, but I'm stuck in Belfast. I'm a traveling captain and it's been really frustrating to try and conduct the orchestra from 120 miles away. Sean, as you know, my wife Paula, she's a very keen golfer. She's a lady captain. So between the two of us, we've been trying to steer the ship, which hasn't been easy. But our greenkeeper has done a phenomenal job and he's been sending me photographic evidence of all the stuff that he's been doing. So I've no doubt that our course will be absolutely tip top. But you know, Sean, there's nothing like a cold pint of beer after a bad round of golf. One of the big restrictions that we'll all face is not being able to do that. And who knows when that will open and then you're into a whole different challenge about trying to organise outside bar, outside catering. So that's round the corner for us as well. What's that thing you said there about a bad round of golf? I don't know that one. Listen, Quinn, I've played the odd game of golf with you. You know all about it. I was. What was that place? I was watching you when you came. So that's great. I suppose we're ready as clubs were and we need to be ready. But what about actually the golf? So tell me a little bit about Dunfan. Tell the listeners, Bill, what Dunfan has to offer the golfer as a golf course? Yeah.  And I know that that's one of the strap lines that Paul McGinley, the writer captain has used to describe Dunfanahee over the years. The scenery is just quite spectacular. And it's a relatively short links course. So you can play 18 holes and I'm in my sixties now, you know, but you can play 18 holes and not come off feeling absolutely knackered. And that maybe is not the same as some of the really tougher challenges like Balli Liffner or Russa Pena. But when the wind blows, Sean, as you know, the wind blows at Dunfanahee, it will tame even the best golfers around. So scenery absolutely spectacular right on the beach and certainly a golfing challenge that will make the best. Yeah. And it's a par 68 has a car 5 and it's also got five par 3s on it. And you're right, the weather is everything there when it's a different beast, when the weather blows. So in your perspective, what would you say is the hardest par 3 out of the five Bill? Well, there are two crackers that the seventh, which is the most scenic tee box in Ireland, I think is a long, long par 3 and most days into revealing when it's a driver. But I think the most difficult par 3, it probably in Donegal is the 17th into prevailing wind. It's every bit as challenging a hole as Calamity at Port Rush, about 200 yards off the back sticks, all out of bounds in the beach, down the right, thick, rough up to the green, maybe a bailout that is protected by a deep pot bunker and absolutely crucially a green that slopes away from you to the out of bounds. So anybody who powers the 17th hole at Dunfanahee is doing very, very well. It's a real card wrecker. As I well know, having stood on the 17th score, going well thinking, what's the speed is going to be this evening, ball out of bounds, game over and know all about us. It is a phenomenal hole. And I suppose the only thing I would look at there is the index. We probably could do something with the index on that. But tell me more about the competitions that are run within Dunfanahee, Bill. Yeah, so weekend competitions, like most clubs, the main gents club competitions run on a Sunday. On a Saturday, we have a very strong ladies section at Dunfanahee, something that we're very proud of, Sean. And the main ladies competition day is on Saturday and it coincides with a men's open competition. And then during the week, ladies have their competition on the Tuesday, gents open on a Wednesday. So there's plenty of opportunity for visitors to come to Dunfanahee and in open competitions. And then one Monday in the month, we have a seniors open, which is incredibly good value. And the only thing that limits the seniors on a Monday is the day light. It's such a popular competition to play in. So plenty of opportunity for members and visitors to come and experience the course. Yeah, I have to agree with the senior on a Monday is a very busy competition. So as a visitor, how much would it cost me for an open competition, Bill? I think the open competition is about 20 euros. It might be 15, I think, to the local clubs on a Wednesday. I think certainly our neighbours in Klokaneeli have a reduced rate because they're good neighbours down the road. I think 20 euros is the fee in a Wednesday and on a Saturday 25. Fantastic value. Absolutely superb. Pius, tell me more about Bunkrana Golf Club. So what's as a golfer keen to probably in this this year's staycation travel around and play a few courses. So what is the Bunkrana Golf Club have to offer? Bunkrana Golf Club, well, everybody has a community golf club. The golfers that go to the local community and surround the area the key is possible rates. We need those of the club to promote the game of golf. Not just to the elite, the course. It's a nine hole course played twice. The Bunkrana Golf Club has been in existence at least since 1890. It was formerly known as Bunkrana Municipal Golf Club, but the committees in the process at the minute and going into the history. The golf was played there in the early 1800s, which would make the club the oldest nine hole links golf in Ireland. There are approximately 260 members, 165 males, 40 ladies, 30 student members in about 25 juveniles. Pius, can I just ask you a question there? You mentioned that it's a nine hole course and haven't played it last year. I know it's right beside the sea as well and the scenery is fantastic. Do you have challenges with the fact that it's a busy day, a nine hole course? How do you deal with that? Once we have a time source, we let a certain few out, and then we have a gap in the time sheet where once they come around, they're able to get out and away, and then you're able to bring new ones in again then. So you stall the times over. So it's fair to say it doesn't restrict you then on bringing maximum numbers in a day to the course? No, no, it wouldn't restrict us. And what would be the, is the front nine harder than the back nine? I remember a par five being a lot longer on the second nine, I remember that. But actually the longest par five in the way, the planting way, the fourth team is 600 yards. So that's right up along the water. That'd be a drive in a nine iron for Bill then, would it? On that good day, on that good day. And since it's opens, you do opens as well. And societies, you welcome them, be fair to say. What would you charge for a visitor to come along for a game of golf in the day? An open competition would normally around 10 Euro for an open competition. Our competitions are mainly Saturday and Sunday. We run some competition we run during the week. But now with the COVID not just getting back to open, we'll have to run some competitions during the week when we're allowed to do so at the minute. I don't think we're going to be allowed to run competitions. And it'll probably be only two balls that will be allowed on the course. Yeah, that looks to be the direction from the moment at the moment. If we get to in May towards mid-May, we may have a chance. But I think at this stage, golfers will just be so glad to get on the fairways, whether it's a two ball and competitions will come. Bill, I want to move on to Dumfany. They've made national press recently in recognition of a group of very talented young golfers. Tell me more about this. Well, I think the first thing to say, Sean, is the captain. All the credit for how well these guys have done. And that for those of you who don't know me, that is tongue so firmly in cheek. We have an incredible group of young guys in the past, actually, the dominant junior golfers, it has to be said, were young women. Paula Grant, who's had the world stage recently. And two of the chambers girls, for example. So our young girls in the past have done incredibly well. But the ones who've hit the headlines of late are four young fellas whose talent is just unbelievable. Young fella Luke Kelly, he's now 17. He's the Ireland under 17 champion last year. And he's now got a scholarship to go to Michigan on a golf scholarship to the US. And Darcy Hogg, I think Darcy's off plus one now. He's the Irish under 16 champion. And honest to God, Sean, if he nine stones, so gone wet after a big Christmas dinner, you know, that's about the height of it.  So incredible. And then young James T. Sweeney, as opposed to James Sweeney, our older member, James T. He's never off the practice ground.  But great credit to our golf club for sure. Yeah, it's very exciting. And I'm lucky that I've actually seen these young guys in action. And young James T. Sweeney, he does put in the work. He's there every single day. And it's always the short game. It's the chip in the pot and he just works and works and works. And you know what? Whatever comes out of that and what they get, they will absolutely deserve. And it's great. Great to get, I suppose, a bit of a press from a club that juveniles are so important to the future. And I applaud everybody involved there. Pius, what about Bunkrana? Have you up and coming stars there? Yeah, we've got one juvenile called Tieren and Bradley. He's only 10.  He's been to America. He's been down the country plenty. There's one more competition. And if he continues his development, we could have another young superstar in our hands. We actually have a lad down with us, Oliver Doherty, who is actually a special Olympic gold medalist as well. At the present moment of time in the club, Oliver plays off three. That's fantastic. I have to say now, I must read more on that young guy because we may even have a chat with him one day on the show. So the future's looking bright, which is great. And it is the future. The club is all about members and numbers and youth. And so I applaud what's happening at both clubs. So I want to move forward just a little bit known as Bill said that the Masters is on and we're all getting excited about getting back to play. Pius, what are you looking forward to most about getting back on the fairways? Getting back on the fairways to me and looking forward to meeting all the people here and all the great fairways.  My own four ball and friends and friends of mine who goes out behind us and the banter and the crack. It's fantastic. I'm not really looking forward. I'm looking forward to seeing all the people at the club. And the work we've done at our club at the Olympic is that we're doing drainage. We've got a lot of down there. And the second day of the club, Francine and Rory and the treasurer, Gary McGarland, I have to compliment them two fellas with the work they have done during the while. Well, Gary hasn't been about so much, but I can't thank them two fellas. You know, we're doing Dorco. It's fantastic. So there'll be no excuses when you hit the first drive 25 yards Pius. The only thing is up the first number you come back again. There's two new bunkers. We added two new because we're watching where you were able to put your ball. I don't believe in bunkers. Don't believe in them. I'm going to put the same kind of question to yourself that you're as a captain. Sometimes it's seen that you don't have time to play golf. Would that be the case for yourself? Are you a competitive goal for how often do you play a week? Yeah, well, I think the first comment is a really interesting one because I think what a lot of members don't appreciate, and I'm sure Pius will be in the same position. There is such a lot of stuff that still has to be done, you know, in the background and you will know too, Sean, the amount of effort that committee has put in that is just not seen.  You know, we don't have to do it and we do it for the love of the game. And the other thing, I mean, Pius just took the words right out of my mouth. What I'm looking forward to is the crack.  And for me, that's what amateur golf is all about. And whether you're six over or 26 over at the end of the round, to me that I play competitive golf, Sean, you know, I like to win my five euros just like anyone else at the end of the game. But, you know, at the end of the day, it was the banter and it's going in for a cold pint afterwards. That's what amateur golf to me is all about. And I'm really looking forward to it now.   What's the best score you've had around on Fanny? Well, I've been around level par a couple of times. It's never broken par. So this year, Sean, you just, you keep an eye out, boy. I'll have you cut before you can do that. I'm taking lessons, Sean. I'm taking lessons. And I was going to say, my coach, there's a fella called Peter Martin in Belgium. That's Michael Maywell. He's a fantastic guy. So he said, you have to give me a plug. He is an absolutely first-rate guy. He's played in our program a few times. So it's like going back to school.   That's not a good shot. All right, that's not a good shot. I'm fortunate enough. I've Michael McGeady, who's coming on very shortly, who's been helping my game over the years. There's another thing I've got here, Bill. You actually joined a lookout of Club Black in 2020. Now, Pius, now, it wasn't the pensioners' club, OK? It was actually there. It was the whole-in-one club. So tell me more about that. Well, I did. So the toughest three in Dunn-Fanagy, the 17th, we mentioned, and I got a whole-in-one at the 17th. So middle to five iron, and I didn't even see it drop, Sean, such as the contour of the green. But luckily enough, there were four guys walking off the 18th fairway. And I knew it was going to be close, but when I heard their whooping and cheering, I knew that I had aced my five iron at the 17th. And if you keep me on long enough, Pius, I'll tell you about the 15 that I had at the 17th the year before. Oh! But we're not talking about that, Sean. I actually wish I'd asked you about that one instead of the whole-in-one. However, I believe, Pius, you're in that club as well. It already tells me. Somebody told you this? Yeah, I heard that you did. Did you have a whole-in-one last year? I had a whole-in-one last year at the 18th, and I didn't see it. Well, I didn't see it, because when I hit the shot, the pitching wedge, I turned around, having the batter with one of my pals, and seen nothing. Unbelievable. The people at the clubhouse were roaring and cheering. I was wondering what they were cheering about. Never had a whole-in-one until that. That's my very first whole-in-one. I was delighted. Haven't been there yet. It didn't cost me a bad shot. The bar was closed. The pubs were closed. That'll be my lucky note. Eventually, if I ever do it, it'll be on a captain's day, and it'll cost me an absolute fortune. That'll just be mine. What was that, Bill?  I know, every penny will be counted, trust me. Talking about just people laughing and cheering, and golf, you both alluded to it. It's the crack that you have. It's the enjoyment. Yeah, the result is good, but it's all about the crack and camaraderie. Bill, you're bound to have a wee funny story for me, have you? Well, before COVID, so it must have been over a year ago now, I was playing the second with a group of guys that I regularly play with, and as I said earlier on, the crack with these guys is mighty. Second at Dunfanah, he's a par three, so knocked it onto the green, took my putter out, and walked off the green, couldn't see my bag and the trolley anywhere, Sean, and looked around. This is really, really bizarre. Walked over to the stream, found the green, and there were the two wheels upside down, and I just bought a new set of clubs about a month before that, so the whole bloody bag, oops, we're live on video, my whole blooming bag, new clubs, the whole shit match upside down with the wheels spinning round, and obviously the bag at this stage, Sean, was completely filled with water, so my very good friend, the fella called Cairn McTaggart, just got the trousers off, he's now down to the boxer shorts, shoes and socks off, so he's now, and this is honest to goodness, he's now waist deep in the stream at the second, retrieving my brand new golf clubs, Soak and Wet, so that cost me a couple of pounds of power for that day. That's good friends for you. I don't know if I had to take my trousers off and got your new clubs there, I'm not sure I'd gone that far for you. No, you never know. Why is it, are we funny to tell me? How am I, but I was only saying, you probably would have shot at that, I mean money in these bags. Yeah, there were five in there and might have gone in there. That's true. Well, one of my cases, it didn't happen out in the course exactly. As I talked about the two four balls, we have all messers and there are two lads in particular, one from my group and one from the other group and they're steady messing stuff and shoes and stuff like this, but anyway one of the lads was going to America for two weeks holidays and my comrade, he decides that he would get into his locker and got his golf bag out and empty the bin and the golf bag. So I remember the lads away for two weeks so when he got back we were out in the course and he was complaining about the smell of the seers, everything what really smell was coming out of his bag and he dumped everything from the bin and the lads got back but it was all taking a good heart, it was all taking a good heart but I'm sure there's reprisals to come for this So that's what I can look forward to when I pay me ten euros and come and play in an open competition in Bunkrana That's the type of characters we have over here That's fantastic great story We're going to be joined now as well by Michael McGeady who's going to come in Michael's a teaching and playing professional at a Evolve golf coaching Michael you're very welcome Thanks very much guys for having me Hi Michael I brought Michael in for a couple of reasons I returned to golf to let people understand it's not a case to jump out the car and go and hit a golf ball but I also wanted to be a referee because I'm going to test the captains in a quick fire question here So I hope you're ready now you're not you haven't been expecting this so here we go I'm on the first tee and I hit my first ball out of bounds which could happen to quite a lot of people when they go back to golf I reload and I hit the ball down the fairway but it lands in the bunker so I'm not too happy My next shot goes straight on into the hazard I take a clean and drop and I chip it to three feet but I missed the pot How many shots have I taken? Nine What do you have Michael? Oh was I included in this as well? Yeah I go for nine You go for nine? I actually have eight I actually wasn't really paying that much attention That wasn't good Sorry I think you are just going to try and go one higher than Bill there Pius were you? That's not cool yeah The answer is eight I took eight You may have counted one, two extra within there You just got to be careful Even the captain can get things wrong Michael can I come to you as a teaching professional in evolve golf coaching People are going to come back to golf You may not have had a golf ball in a number of months it would be fair to say What would your advice be to them to start as opposed to get the swing starting going Can they do things in the back garden What's your advice? Yeah Well like most people I'm sure a lot of people have been sitting at home and not getting the same physical exercise as they would have been used to getting So I suppose Obviously getting out for walks is great Getting out for walks and getting a little bit of general exercise but when it comes to the physical movement like hitting the golf shot there's a lot of things that happen correctly and in the right sequence as we all know because golf is a very difficult game So I suppose getting back on the golf some of the most important things I would say that would be first and foremost would be trying to sync up that hand-eye coordination again and like you said Sean starting chipping a few golf balls really just starting off slowly just trying to feel the rhythm of that golf swing and trying to tighten the shot so you're getting that good hand-eye coordination and then as we move up under the fuller golf swing then like I certainly have experienced this myself after coming back the first after the first lockdown was my range of movement flexibility had completely just gone completely not that I have a fantastic range of movement but whatever I did have it was really compromised with not hitting a lot of golf shots just because we purely couldn't hit the shots and we couldn't get out of the golf course so yeah for people starting back my plan again started slow in the shambles here now in the masters I'm thinking you're going to stand up in the first tee and completely annihilate the golf shot you'll probably do more harm than good so started slowly get the body warmed up correctly do some exercises to try and feel like you're warming up the important muscles which would be the back, the shoulders, the wrists, the arms and from that then just try and get out there and enjoy the game I know with some of the boys that I play with now they're out the car, grab the bag on the first tee and some of them don't even have a golf ball they may have to borrow a golf ball so give us as a professional golfer Michael give us just a rundown of what do you do before you go and play that's a great observation there because I have a lot of plans that come to me they come out of the golf out of the car straight onto the first tee and they have a nightmare in the first few rolls until their bodies sort of at least warmed up a little bit now not all the plans but a good majority of them would do that so when it comes to playing tournament golf I like to get to the tee or not to the tee so I do the golf course roughly about an hour before I'm playing now that hour will involve getting the golf bag ready getting my shoes on going hunting a few putts few chips, few longer shots and then just finishing off by just getting the tee maybe five minutes before I do play now the average club golfer might have that hour to spare going to the golf course because they're already out in the golf course for sometimes anything from four hours to six hours so it's just an extra hour to grab it onto their day but there's things that they can be doing before they do play like those stretches I was talking about just a ten minutes before their tee time just to try and get there and give themselves a bit of a general warm up before they go and play it's great advice Michael I have to say I remember a number of years ago I sat before I wanted to play I sat in those massage chairs I actually sat on one of them as a Scotsman I put a Euro in it broke my heart but it was amazing that I actually went on the first tee and my whole body was just it felt relaxed and I played a phenomenal round of golf from that day I'm not saying I'll always do it but because sometimes I'm that man that grabs the clubs and jumps onto the first tee but I do try to get there a half an hour earlier to have a little bit of a stretch and it does make a difference especially on the first tee because golf is all about what's in the head isn't it it's not always about what's in the swing yeah the head is a big part of golf and certainly the better your golf swing gets the more repetitive it is I think that's when the head really becomes more you know you start to use your head an awful lot more in the game then as a teaching pro and somebody comes along do you actually help them with that can you help them with that with the the head side of the mental side of it yeah well I wouldn't be a qualified mindset colleges but I work with an awful lot of mindset colleges sports psychology and I I'm a bit of a storyteller I like telling stories from previous experiences and I can certainly relate to players in the situation that they're in and then from that from that point of view then I'll tell them what I've done and how it helped me and certainly like I've had good feedback from it like you know so but I wouldn't say that I'm a qualified psychologist by any means but I can certainly relate to players like I've had every shot that you can imagine from the perfect tee shot then the muddle to the shank chip shot that everybody dressed to the duff shot into the bumper and it's overcoming those fears and overcoming them thoughts and replacing them with positive thoughts I think key yeah I couldn't agree more and I have to say now I've played with quite a few sports psychologists who are not really that well qualified but I do try and help you out when they're on the course and it's sometimes it can come you're loud because you know exactly what I mean by that as tell me a little bit more about Evolve coaching then where are you based? We're based at Leverkinny driving range we teach out of there and also we do a little bit of on course teaching as well at Northwest Golf Club but generally out of Northwest and like we've got a Facebook page there if anybody's looking they sort of contact us book lessons and stuff like that hopefully we'll be getting back to Shumkin in Normality now from the 26th of April so looking forward to getting back to Shumkin in Normality and getting back playing a wee bit myself as well I think the play inside of it is for me it's sorely missed as well because I enjoy competing I enjoy getting out there and playing in the Pro Am circuit I just love competing while I can still play relatively decent golf and I think that's to be fair to say that is the part we're all looking forward to is being able just to get the clubs out get on the first tee hit the ball and have a bit of crack again and the competitive part will come again I think we're all just so looking forward to getting the first stage and that little bit of freedom because I don't know about you guys but I don't think I can paint any more walls I don't really want to cut any more grass I don't want to be out jumping in the car half past seven, eight o'clock on a Saturday morning and a Sunday if I get away with it and hitting the beautiful fairways that we have in Donegal Bill I hope and Pius did you pick up any tips there? Absolutely, yeah, yeah, yeah when you get to our limbering up is very important I completely agree Mike Tell Peter I said hello You can give me straightened up too Mike, I'm cat-handed That could take a few shows now in fairness Pius that might take a wee bit longer This is only a pilot so A few people coming on holding the golf club cat-handed left hand below right leg so it's quite it's quite common like a hurling back ring maybe is it? Sorry? Is it a hurling back ring? No, no, no Normally you get a lot of hurlers coming on holding it right in the wrong way or left below right Never played a hurling me like Played it myself when I was younger like a Nazi I used to hold it and then my dad got me to switch my grip around very very sharp so then it helped me it helped me get better at golf anyway Well, I think I'm past the point to ask you pensioner I actually recommend Pius that if you change your hands single figures on the way A lot of hope There's probably more hope if we're having another podcast I'd say then you've been a single handicapper Gentlemen I'm going to bring it to a close now and I want to thank you that this is something that we look forward to moving within Highland Radio Michael has agreed that he'll come on on a regular basis with me as well It's great to have the first guests so for that Bill Bill McCallion of Dumfany Golf Club Thank you Pius McFadden of O'Connor Golf Club I thank you and from me Sean Quinn Thank you for all who will eventually come in and listen keep safe and more importantly keep the ball in play Thank you very much Thank you guys


5G hacking just got a lot more interesting by Karsten Nol. So 5G has seen quite some evolutions, at least through telecom, through every of the generations, the 2G, 3G, 4G, and now 5G. And it's changing from an old-school monolithical system to a very open model. And openness and open models is something that we dearly love, at least I do. And now the hacking potential and a lot more interfaces are coming about, and we can actually have some quite new interactions with this. And I know that from myself, from a previous employer, being a telecom company, that it's very interesting to listen here and also see the new technology emerge. Now Karsten Nol, we know from all kinds of CCC talks, cool ones even. And every talk here was actually cool. I call it education to myself. And as a security researcher and cryptographer, he's now also the chief scientist for SR Labs in Berlin. And take it away, please a big applause for Karsten Nol. Thank you. And thanks for entertaining everyone for 10 minutes. I've never seen a Herald work harder. Good to see you all again. Three years of everybody staying at home, hacking on their own things, it's about time to start sharing knowledge again. That's what I'm here for today. We'll be talking about hacking in and taking down critical infrastructure. The irony that this talk was delayed by 10 minutes by the electricity going down isn't lost on me. We'll make the best out of the remaining time. We're talking about OpenRAN today as a case study, basically, of technology developments that are happening in basically every industry. People are going into the cloud. They have virtualizing things. Processes get more and more automated. And nowhere is that shift clearer than in the telco industry. And OpenRAN is a great example of that. So we'll be touching on a lot of technology that you encounter in your industries as well. I'm just particularly fond of telco hacking. So at the end of this presentation, you'll know what OpenRAN is. And the technology is involved around virtualization and automation. You'll know how to find security issues in them. And if you happen to be in the business of building telco networks, or for that matter, any kind of cloud network, you'll take away some advice on how to make those infrastructures more secure. Why am I talking about this? Well, I've experienced telco, basically, from both sides. I've been a hacker of critical infrastructures for well over a decade now. And around halfway through that journey, I've been asked to help secure telco networks. So I've seen both the attacking and the defending side of it. And I can tell you, while hacking telco networks might seem difficult sometimes, defending them is even harder. So if you're up for a challenge, try that sometime. But why anyway are we still talking about telco security? It's been literally 13 years since I was standing here and trying to get all of you to help me compute A51 rainbow tables. Anybody remember that? OK, yeah. That's exactly 13 years ago, this conference. And then you all came together, and we computed those tables. We then released them that year in December at the Chaos Congress. And ever since then, people know that 2G is insecure. And nobody has ever found similar weaknesses in the other protocols. So are we done when we done 13 years ago? Well, it turns out telco networks are more complex than just singular standards, right? The reality is always more complex than the standards written in theory. But let's start at the positives. Let's see what has actually happened in telco network evolution. So with the introduction of 5G, pretty much all the hacking vectors that were identified in previous generations were closed. And not just hacking vectors, also privacy features were added. For instance, 5G is the first standard where the IMSI, basically your identity, isn't submitted in clear text over the air anymore. So it took almost 30 years of network standardization for people to understand that it's a better idea to send identities in clear text.  But it's a step in the right direction. And there's many others. I won't go into the details here because, of course, you all are only interested in how networks are broken, not how they have been fixed. But overall, of course, we have made good progress. Or the people writing these standards, I should say, have made good progress so that today we can just stick up an antenna and intercept a 5G conversation like we did 13 years ago at the Chaos Congress against 2G. But even though these network generations have gotten more and more secure on paper, we anyway or other researchers have been able to find vulnerabilities in each of those standards, usually digging a little bit deeper, going to less obvious places. And we want to continue that today with 5G and, again, using OpenRAN as a case study. What I'll show you now over the next 20, 25 minutes have the building blocks towards 4 Hex that I'll illustrate. Spying on people's communication, extracting their private data from a mobile network, becoming an admin in that mobile network, controlling all the infrastructure, and ultimately taking down a mobile network. These are not single Hex anymore, like what we discussed, let's say, around 2G, but rather serious of building blocks. So I'll have to do a little bit of a build up to what's that. They are also not easily done within less than one minute for the 2G stuff. We're talking about weeks here, weeks of somebody penetrating a network and moving deeper and deeper and deeper until they can finally take down a network. But I'm sure you can imagine many organizations that would be willing to spend several weeks to then either ransom somebody or do other criminal activities for purely strategic purposes. We're talking state-sponsored actors. So it takes weeks to break into a 5G network. And while that might seem like a long time compared to what hackers usually show at conferences like this, it's definitely worthwhile for too many people in the world for this to be ignored. So why are networks still vulnerable? Of course, they are built from many different technologies, some of them newer, like let's say the 5G standards, some of them older, but still mandatory. If you're building a 5G network from scratch today, you would still have to connect it to an ancient technology called SS7, for instance. Won't be talking much about SS7 today, but there's, of course, previous research from years ago that still today applies to virtually all networks in the world because of the network effect. If you want to be part of this global community, if you want to exchange text messages, if you want to support global roaming, you have to support SS7. Maybe a little bit more. Avangardia supporting diameter, well, tough luck. It has the same security vulnerabilities. So mobile networks are just complex beasts. And today, we're going to talk about none of this stuff, but look one level below to the IT infrastructure. Every telco network, of course, needs to be built on something, right? It's not just software. And this used to be proprietary boxes that you would source from some Scandinavian vendor, or let's say from China. Then with 4G, this moved all onto Linux. Everything became IP in mobile networks. So it already felt a lot more familiar to a pentester or a red team testing mobile networks. And with 5G now, we're going even further down to basically cloudify these networks. And today, we're going to talk about exactly that development, where networks become much more virtualized and much more automated. So all the hacking I'll be talking about today is going to be from the IT domain that mobile networks are built on, right? Very important. We're not going to mess with any of these standards because they're not the weakest link of mobile networks anymore, as far as I can tell, OK? A bit of nomenclature to get that out of the way. So today, we're talking about open-ran. What's open-ran? First of all, ran. What's ran? Radio access network is one of three parts that make up a mobile network. Just the radio access network, which is basically 90% of the mobile network, actually. It's the antenna. It's a cable that connects the antenna to some local switching center, another cable to something more regional, another cable to connect us to a big central data center. And that central data center is then considered the network core. So that's separate. And then different network cores are connected through interconnect, for instance, to connect different companies or different countries, right? But almost everything that you consider as a mobile network is the radio access network part, basically the country-wide infrastructure, right? And even though it's 90% of a mobile network, at least, it hasn't received much attention. So I certainly haven't looked at anything ran related since 13 years ago, the 2G stuff, because I considered it's secure, and it's basically just cables, right? And that was true for most of these 13 years, up until now. With 5G and OpenRAN, there's big changes underway, where the radio access network gets a lot, I guess people call it, smarter, right? So a lot more complex. There's much more technology put into the ran. And that's why, after many years of neglecting it, we revisited it and found really interesting stuff, right? So that's ran. So what is OpenRAN? OpenRAN is basically a movement, you could say, loosely defined as combining three things, only two of which are really relevant for our discussion today. The third thing is that mobile networks are now built on commodity hardware to make them cheaper, right? So instead of getting a box from Scandinavia or China that combines hardware and software, you get your own hardware, and then you put whatever vendor software on it, right? Not so relevant for us. What's more relevant for the security discussion is that everything is virtualized, or I guess containerized is the more appropriate term. We're talking Kubernetes here most of the time. And processes are automated to a very high, in fact, scary degree, right? So that's OpenRAN. Basically, these three things put together, and it's extremely popular among telcos right now, because it's cheaper. The commodity hardware part is what they find interesting. Of course, we find the other two a lot more interesting. So in summary, the changes between kind of how mobile networks used to be built and how they're being built right now. A mobile network used to be built. Okay, you start with an antenna. That part hasn't changed. The future will still have antennas in mobile network. Just everything after that changes. So it used to be you connect this antenna to one of those proprietary boxes, appliances, you could say, that you get from, let's say, Scandinavia. And you connect them throughout the entire country. Somebody manually locks into each of these boxes, configures them, and then basically you have your network that will stay virtually the same for the next, say, 15 to 20 years, until it's replaced by another network generation, right? There's sometimes upgrades that the vendor will ship to you, maybe once a year, at most twice a year. And then you manually install these upgrades on each of the boxes and that's it. It's very static networks with very little interference, right? Now switch over to OpenRAN or really any future mobile network, I would imagine. Instead of getting appliances, again, shipments of software, and you have to install them in your own cloud environment. And it's not gonna be just a few cloud environments. Because of 5G's latency requirements, there'll be, in a country like Germany, several hundred data centers, okay? So in several hundred places, you install Kubernetes clouds, and then on each of those Kubernetes clouds, you have to put dozens of Docker containers, right? Just the complexity of that, the sheer numbers involved, do not allow for anybody to do this manually one by one anymore, right? It needs to be automated to hold deployment. And once it's automated, people think of this as a great benefit, because now we can keep changing the network pretty dynamically. So instead of having people lock into boxes once a year and changing a little bit, now you have scripts running all the time that try to optimize the network, that keep reconfiguring everything. So it's kind of a living organism, almost style network, that is self-optimizing. And to me, that's very scary, right? Knowing that it continuously changes. How are you gonna test it and say, okay, for the next few years, I know it's secure?  So security testing becomes a lot more complex, right? Now, maybe silver lining, at least we remove the human error source from operations, right?  But of course, we introduced another, maybe more serious human error source in that many developers are now involved. That through some magical CI CD pipelines, create and push down these scripts. And that's what we wanna focus on today. These two developments, that everything gets virtualized and that everything gets automated, okay? And again, I'm using this as a case study to illustrate developments that you encounter in other industries as well, just nowhere else as quickly as a step function as in the Telco industry, right? Of course, any kind of cloud environment would be built similarly. So let's start with virtualization hacking, or again, to be more specific, containerization hacking. I'm not talking about VMware virtual machines, I'm talking about very scalable cloud scale virtualization. And as I said, Telcos have several hundred clouds distributed throughout the country to host all kinds of functionality. And in theory, because all of everything is virtualized, you actually have a possible security upside. Because once everything is, the software is virtualized, it's nicely segregated, the networks become software defined. So you can basically, through configuration settings, create any kind of segregation that you want on the network level, on the hardware level. Most deployments that we have seen do not make much use of this very fine-grained configurability, and in fact, go the opposite way, creating new areas in which devices share resources, right? And in mobile networks, of course, availability is very important. You need your network to be up, right? And if you have different functional components, share the same hardware, if one of them overloads the system, so to speak, the others can suffer as well, right? So with virtualization, the jury is a little bit out. Is this a security gain or loss? But certainly, if you configure it badly, it's definitely a loss. And now we're gonna look at the cases in which we find these environments to be badly configured. So the assumption is that there are different pieces of software all running in the same cloud, right? Could be an Amazon cloud, could be Google cloud, or in our case, a Telco cloud, and some of them are trusted and really secure and very critical. Other ones are maybe test instance, somebody trying something out, something unimportant, different security levels, okay? Now, the big question is, if something less secure gets hacked, can a hacker break out of that environment and influence something more secure? So can I either hack the Kubernetes underneath or influence some neighboring Docker containers? And it turns out that there's multiple paths for doing this kind of container breakout. And here I'm listing the ones that we find most commonly in Telco environments, right? There's probably other ones, but these are the ones that we encounter and actual assessments. So the way to read this is, on the left you have a property capability basically that you can assign to a Kubernetes as a pot or Docker container. And the dark red ones are the ones that we find all the time. They're kind of pseudo defaults, not really defaults where people love to set those settings. And then the lighter shaded ones, we don't find them quite as often, but still enough to be concerned, right? And so you start from one of these capabilities. The middle then says how the hacker would abuse it. On the right-hand side says the outcome. Could be in a mobile network, anything from running your own code, kind of crypto-minor style. It's probably the least concern to accessing data. So ransomware, of course, would be a relevant threat here. To ultimately, this is certainly the worst for mobile networks taking down the systems, right? Basically disconnecting people from their critical infrastructure. And just to take the first two, perhaps as an example. So if those capabilities are set, how does a hacker do this? So the first two here, privilege container and susetment. So if ISO of those capabilities are assigned to the Docker container, that basically means that from inside the Docker, you can communicate with the Linux kernel of the host machine, right? In less constrained ways than a non-privileged container. And I mean, the Linux hackers in the room, of course, already have a hundred ideas how to abuse this, right? And it's a long list. I'll just give you two examples here. You can abuse a kernel feature around C-groups. C-groups is basically a way to handle processes. You don't have to use it. It's just easier if you execute multiple processes, basically, as one batch. Kubernetes definitely uses this. So if you're inside a Docker container on Kubernetes, you know that the host machine uses C-groups, right? That's important to know. And basically there's a kernel feature where you can tell the kernel, please let me know when a C-group completes. And I wanna execute a little bit of code at the end, right? With root-level permissions. And basically, you see it here. This is basically a PS with root privileges. You can execute any code you want, right? So you just notify the kernel to please execute this snipplet of code at the end of a C-group and you basically have root-level access, right? Very straightforward. And yeah, no surprise, right? However, people don't think about it like this when their sign is privileged to attribute to their containers most of the time. Another way is if you have access to the host PID namespace. Again, that's given if either of those properties is set. You can basically just enter the part of the namespace that gives it the equivalent to root shell, right? So really very straightforward exploits. And these are just two of the examples. The other ones on the list are maybe a little bit more interesting because they're less intuitive. So if you don't have a privileged container, but still this host PID namespace access, this is very commonly found, you can't really access those processes running on the host machine, but you can kill them. And if you can kill everything that's running in the Kubernetes on top of you, you can take down the mobile network, of course, right? Obvious, right? So if you're building Kubernetes environments, look how often the host PID is set for your containers. You'd be surprised, right? And then if you combine the host PID with another benign looking capability, the speed trace, you can not just see those processes, but you can inject code into the process. In any process running on your host, again, that's root level access, right? That's basically root shell equivalent. Two benign looking things are combined to basically full exploit. Access to the file system is pretty dangerous as well. I mean, obviously, if you have right access to the file system, you can just override configuration files. You can add your SSH key, whatnot, but even read only access to the host's file system. Virtually always when we encounter at this game over, because you can find tokens. So tokens are, yeah, as the name would suggest, just strings that are used to access Kubernetes infrastructure. They're found in all kinds of configuration files. So reading them is enough to then access Kubernetes infrastructure. Also very popular finding passwords. A bunch of the utilities that you use to administer environments like this, they take a username and a password as command line arguments. So where do you find it? In Bash history, right? So if you read only access to the file system, often there's a password that you need to go forward, right? The last one is the one that surprised me the most. I don't know if everybody can see it from here. It's basically network access, right? The reason it surprised me the most is, of course, I'm old school. I know virtual machines more than Docker containers, right? And in a virtual machine, if you give it network access, that's not usually considered a security risk, right? I mean, how could you run a virtual machine without network access? It's basically a separate computer popping up on the same network, right? In Docker, it's not like that. If you've signed a host network attribute, it's sharing the same network interface, right? So imagine you have some services tied to local host and local host only, right? If you're sharing a network interface, the guest can now access your local host. And it used to be that even the Kubernetes API, the API to basically configure anything in Kubernetes, was often bound to local host and didn't have authentication switched on, right? So that's game over right there. At least authentication is now switched on in more recent versions, but depending on how old your Kubernetes environment is, this is a big concern. But at the very least, I mean, given that this interface is shared between host and guest now, the guest can TCP dump everything that's coming in and out of the host, right? So that by itself is already a problem unless they use SSL for everything. But now guess how they build Kubernetes classes, right? They say, oh, everything that happens within a Kubernetes cluster is trusted. It never goes over physical cable. We don't need SSL, right? Everything unencrypted. So giving network level access to a guest usually means the host gets hacked, right? So just a whole collection of things that can go wrong. And again, this is just the stuff that we see in real assessments. There's more stuff that can go wrong in theory. So that was a part on virtualization hacking. Let's talk about automation and the implications of basically this development. That instead of having people typing in configuration like old school Linux sysadmin type, right? You have some scripts and an uncountable number of scripts that are created by all kinds of developers that are pushed through all kinds of CRCD tools, right? So what's the implication of that for security? Well, of course that some threads that we had before are amplified, some new threads are introduced and then I guess a third category would be self that should never happen happens anyway because it's becoming so complex now. Let me give you one example of each of those categories. The threat that was already there that's being amplified is phishing or social engineering in general, right? So instead of five Linux sysadmin types, you now can phish hundreds of people across various companies that are all somehow contributing code into the configuration of this mobile network, right? If you get to phish any one of them, there's a good chance that ultimately you can adversely affect a mobile network, right? So that threat is amplified. Threads that are completely new, it's a whole ecosystem of basically software development tools that are now part of the operation of your mobile network, right? Somebody somewhere commits something to GitHub, it goes through all kinds of CRCD, it becomes packaged somewhere, it gets downloaded into an image, that image gets deployed through another CRCD. Any part of that chain gets hacked, your mobile network is at risk, right?  What am I doing wrong? And they're leaking internal secrets, right? Hundreds of people involved, one of them will do that for sure, right? But you see how the attack service now becomes really hard to capture, right? Like there's hundreds of people across different companies using all of these tools, all of this in theory would need to be tested now to know whether or not your network is secure. So kind of the pentesting that we used to do doesn't apply anymore. You don't even know what the scope is, right? So instead of course, this needs to be tested through ratting. Everybody knows what ratting is, right? So basically an open invitation to hack a company any way you want, and then explain them how you did it so they can learn from it. And then there's iterations where based on what you find, they get better, and then it's a little bit harder next time or a little bit more fun if you ask my team. And then it's these iterations, right? And what I'll show you next is kind of the best off of the ratting that we've done. So we do dozens of rattings, but a handful of them against 5G telcos. So what have we found in actual 5G telcos that allowed us to achieve all of these hacking goals that I listed in the beginning? And I should say this is the best off kind of a mash-up of different. So one network that's affected by all of these, I wouldn't disclose client information like this, but it's kind of a collage. So the first hacking journey starts from the internet and we find some developer put up a website, something unauthenticated, they're just playing around with something. They probably mean to take it down a day or so later. They know it's probably not secure, which is why it's completely isolated in the network, okay? We get to hack it and it's basically that end, right? This has no access to anything on the internal network, it's just some boring website. However, it's running in a Docker container on the Kubernetes. So if any of those capabilities we looked at earlier is set, we break out of the Docker container and now we're on the Kubernetes layer, right? And sure enough, of course, one of these capabilities was set, so we did break out. And now we're in the Kubernetes layer, which means we're not constrained anymore. The Kubernetes has access to everything that any of the container needs access to, right? So these Kubernetes environments, it's very hard to kind of DMZ them away, right? So we can, we start looking on the internal network, third step, very slowly, right? There's always a blue team that's looking on what's happening on the network. So you do this space out over days, if not weeks. You find different servers, you find different APIs. In fact, you'll find hundreds of APIs. Mobile networks today, a lot of what they do is microservice-based, right? So just just APIs everywhere. And mistakes are being made. So completely by accident, I believe, one of these APIs, if you send wrong stuff to them, it sends you back debug information and in the debug information, there's the credentials of one of the developers. Who knows, right? Mistakes are being made. Those credentials, they allow us to access some systems, not necessarily production system in the sense of mobile network. We're still on the IT side, right? Where the websites live. But there's kind of a data lake equivalent, right? Inelastic search, that includes a lot of information to do statistical analysis. And sure enough, we find the customer text messages in there, right? So this is a multi-week hacking journey to basically achieve the equivalent that in 2G took one minute, right? Sticking up an antenna, capturing the text messages around it. However, now we get the text messages of an entire country, right? So maybe it's worth spending a few weeks on this, certainly for somebody who wants to break two-factor authentication or any of the things that are attached to text messaging today, right? So that's one hacking journey. And you see how none of this actually targeted telco standards, right? It doesn't even matter that this is a 5G network. What matters is that this is a highly virtualized network with lots of automation fragments floating around. And the same will be true for the other hacking journey. So second one. So it shares some of the same steps. So I'm not gonna repeat those. But then basically once we're on the internal network, we look around more and more and more. Of course, we find development fragments, right? In this case, a GitLab. Somebody has basically a shadow file equivalent. So hash passwords that they deploy as part of some configuration update. Who knows, right? One of these passwords is Crackable. We crack it and that password now gives us access to wherever this configuration shadow file was deployed to, right? I mean, that's the whole point, right? Including the database that has all the registration information of all of the customers of this telco, right? So bank accounts, addresses and whatnot, right? Again, we didn't touch anything telco specific to be able to break in very, very thoroughly. Third and last hacking journey. This one is finally getting into the telco domain. So again, we reuse some of the building blocks, especially this credential we found earlier. But we also need one other bit of information. And that is a description of an internal API, which usually an API isn't self-explanatory, right? So you've somehow need to understand how to communicate with these APIs. And in this particular case, this was shared on the internet. And you can argue whether this is a security issue because believers in open source software, of course, say the source code can be opened, that's not a security issue, as long as your credentials are protected. I'm not so sure if this many eyes make bugs go away. Argument applies to software that's really only used in one or two companies. Because you post it on internet, people don't start looking for bugs in it. It's just the hacker will use that information. So some level of obscurity sometimes helps in protecting APIs in an event. This was on the internet leak. We already have the access, so we can finally access something in the Telco network, in the RAN network, right? In fact, not just one, this intelligent controller is kind of an optimization piece of software that's deployed in each one of these hundreds of data centers, okay? So we can access a software component in hundreds of different dockers deployed in hundreds of different Kubernetes. And sure enough, again, they didn't configure the docker sufficiently, so we can break out into all of these hundreds of Kubernetes environments and basically take down the entire mobile network, right? So you see how few steps are actually required to take control of an entire network, or then take it down. Do as the whole network. And again, none of this is Telco specific. And in fact, if this went a presentation on Telco networks, you could explain something very similar about most of the private cloud environments that companies are building. Basically, everybody is working on something similar right now. So let's talk a little bit about how to build those infrastructures better. Telco, Open RAN, whatever infrastructure you have, right? Obviously, configure your Kubernetes better or not your Kubernetes itself. The pods and the docker containers running in your Kubernetes, Kubernetes gives you all of these different configuration settings, make good use of them and be considerate and acknowledge that it's not virtual machines running in VMware anymore, that are much tighter mesh together.  This is more a take-home list in case you are working on any technology like this. Now, for mobile networks more generally, we've been giving kind of these generic pieces of advice for years now. And again, this traverses Telco networks. All of these are easily set. And in fact, in our community here, we always wonder why do networks not do this by default, right? The whole security by design. I mean, I don't know who coined that term, but it's definitely older than my interest in security. So people 20, 30 years ago would have used that concept. And yet today, it's not yet found everywhere. And I wanted to just alert you to the complexity of acting even on simple advice with two examples to conclude what I'm presenting today. The first example of where the reality is just much more complicated than you would imagine is patching on hardening, right? Kind of the base security processes. If you don't patch yourself, you don't harden your stuff. You might just as well not do any security at all. It's really absolute baseline. And why do mobile networks not get hardened? I mean, for different reasons, in kind of the closed architectures that were deployed up until today, and these open, including open-run architectures that are running on clouds. So traditionally, I mean, there's really no excuse why they don't patch, other than the way that they deploy these networks where they say once we deploy it, we don't touch it anymore. The vendor in China, in Sweden, wherever, they first have to go through months-long test procedures before they can say that a new release is ready and can be deployed. I mean, if the test procedure takes several months and then deployment takes several months, you might just as well not be patching. I mean, you're months behind on the patching, right? So usually you get security patches about once a year. These are standard Linux boxes that are one-year outdated. Every CVE in the world applies to them, right? So it's just an ecosystem breakdown. The way that these things are procured just doesn't allow for patching. That excuse goes away in these cloud environments, right? In a cloud, you control everything. You, in fact, you're changing stuff so often you might just as well redeploy it with new patches. Netflix had an interesting strategy around it. Netflix had basically, in each of their virtual machines or Docker containers, they have a self-destruct timer that runs out at 72 hours. So each Docker destroys itself after 72 hours, then it's rebuilt from a CRCD pipeline and the CRCD pipeline, of course, has all the latest patches built in. So Netflix doesn't have patch management. They only have, basically, suicide of virtual machines, right? But now the complication in mobile networks is who would be able to pull together your patches because each of those dockers is in an individually stripped-down version of Linux? So nobody even knows what packages you would have to apply and how. This is not coming from RedTed or Debian. This is just a custom Linux. And if you run your own custom Linux, you are responsible for patch management and there's dozens of vendors involved. And of course, they don't run Linux distros for business, so patching is just so hard in telcos. And I mean, it breaks my heart, right? Years later, still very little progress. Similar, and this is the final example that I'll leave you with, standard security tools like an EDR system, right? We do a lot of red teaming and when we encounter an EDR, it usually sets us back about a week. Takes like a week to find a way to circumvent it. It's a good slowdown measure for hackers, right? Do we encounter them in mobile networks? No, well, for basically the same reasons because the old-school network vendors do not really allow you to deploy anything on the Linux boxes and they don't come with an EDR, so there is no EDR. Sometimes you can force us onto there. If you sign it, if the EDR breaks the availability of the network, you're actually responsible. So we have seen cases where this is done, but only if it was forced against the vendor in the Kubernetes Docker environment. Again, some question. These are stripped-down versions of Linux. No EDR system will work on this out of the box. These are basically embedded Linux, you could call it, right? EDR just isn't made for that, right? So we're basically in a situation now where telco networks have become cloud environments, but where the standard security processes like patching, hardening, and the standard security tools like EDR do not readily apply there, right? Big protection gap. And I hope you all consider this a challenge, right? Either to become more of a telco hacker. No matter what part of hacking you're coming from, I'm sure you saw some commonality today where basically telco networks have grown into your area of expertise. But also if you're building networks and if you're securing networks, I'd really like to invite you to consider securing telco networks in the future. We all rely on them for our digital lifestyles, right? So it's important to keep those networks secure, like we're already keeping cloud infrastructure secure, right? Yeah, and with that, at the end, I'm always left to miss. Thank you for sitting here and this hot tent with me and bringing back so many good memories to the series of conferences. I'll be around if you have any questions on telco, on cloud, on red teaming. Our red team is in Berlin, so if you ever want to do some project with us, love to do that. And yeah, now over to your questions, please. Thank you. Thank you, Karsten. We have a few minutes for questions. If you have a question, please walk over to the microphone in the middle. There are two microphones in the middle. Please line up. First question, here you go. First of all, thanks a lot. We've had similar situations with industrial devices, with medical devices, and stuff that should be expected, like pack management and everything. That was clearly not a given. And we've seen some certification efforts and some initiatives that were going to the right direction. So I guess my question boils down to do you see a way out, whether through incentives or just we're waiting for a doomsday scenario, how do you see things evolving? Very good question. So certainly, both the industry and different governments are pushing towards more security. The government's more than the industry, very much based on a checklist approach where they say, we want you to prove that your network is secure at one point in time. What happens after that, we're not so concerned with. So certification is good and meaningful to introduce a guideline or baseline rather. I just haven't seen the one certification that would address problems like these. I'm seeing certifications more around you have to prove that you're not from China. That's basically a big part of the certification. Now basically, protecting yourself from political influence, I mean, yeah, that might be important. I don't care. I mean, I wanted this to be secure from hackers from anywhere in the world, not just from China. Other parts of the certification lets you prove that your cryptography is configured correctly, those things. Great, but cryptography hasn't been a problem. Basically, since 3G, people haven't broken the cryptography anymore. So yeah, I wouldn't hold my breath for a certification to solve this. I think it'd be individual companies going forward saying we have an IT history and we make our telco networks as secure as our T-networks. All big telcos have cloud environments, and they make their cloud environments more secure than the telco environments. And that, to me, is a weird situation. Next question, please. Hello. I may have slightly misunderstood this, but what does open-ran mean? Are there open-source platforms or freely available platforms that we can run ourselves if we want to experiment with this kind of thing? Yeah, that's an excellent question. And I think the naming is very unfortunate in open-ran. So basically, what summarizes open-ran is a push from the telcos against the telco vendors to say, we're not going to buy your hardware anymore. We install our own hardware, and you need to ship our software. That's an umbrella. The interface between hardware and software need to be open so that different pieces of software fit on different vendors' hardware in its openness. It does not include open-source. It does not even include open standards. So it's very different from what this community would call open, but baby steps in the right direction. Thank you. Good question. Thank you for your talk. So quick question. So does the lawfully intercept components also run in Kubernetes? Oh, that's a very good question. No, so far not. But that's just because those vendors, they're behind the curve. I'm sure the few vendors, I'm not going to name them, but it's basically monopolies per country. They just say, why do we need to change? We have a monopoly market. You build our appliance into your network no matter how. And they might use just SS7 for that. A quick other yes or no question. Next question, because we have really no time. I'll be around later. Just find me later. So I just wanted to understand how it is moving to cloud infrastructure, the mobile telecom infrastructure. Yeah, I mean, if you have to deploy stuff in hundreds of places around the country and you already know that it's going to change every week, cloud is the only answer, logical answer. So basically, cloudifying telco networks is a consequence of 5G's desire to have low latency. Let's say your car wants to signal to the car behind you that you're breaking. You don't have time to send that signal off to telco network, send it to some central location, get the signal back, get it sent to that other car. The crash will have happened, right? We're looking at single digit milliseconds delays from car to car. And that only happens if each little region, each city basically has their own cloud environment. That's why everything in telcos in the future will be cloud. I hope that answers your question. And we're out of time. No. Sorry. It's actually exactly 10.4, so we have to move over and make space for the next talk, which is also a very interesting talk about how we moved out of the pandemic. But first, please have a great thanks for Karsten.


Good evening. I'd like to invite you all to take a look at this slide and think about what these numbers might have in common. I promise not to quiz you nor is this a mathematical question. More so reflect on what you believe to be the theme or statistic behind the numbers. I give you about five seconds to reflect. These numbers happen to reflect some key figures and statistics about the current state of black college student mental health. Let me break it down for you. 70%. 70% of black college students said that access to mental health services have been harder to visit an experience as a result of the pandemic. With 51% of black students saying that they felt overwhelmed their first semester of college. With 40% of college students saying that in this past year alone, they've oftentimes felt too anxious to function or even get out of bed. 15. 15 minutes is the amount of time asked of college students to either sit in silence or receive an electric shock. College students chose electrocution. And second. A 2018 suicide was the second leading cause of death for people between the ages of 10 and 24. Before I move on, I do want to hold space to share a resource that's free if you or someone you know has had thoughts of self harm. Please seek help. When we're at them as graduate students interested in participating in the King talks to reflect on the theme. This is America. I immediately thought of the mental emotional and physical health crisis myself and other black college students are experiencing. However, even in the midst of this crisis. I did want to share some images that speak to my own joy within my journey on black excellence, which black excellence I also define as being the acknowledgement of centuries of exploitation, oppression and abuse to have the audacity and the ability to rise and and it looks like my slides won't be able to show you everything, but these pictures behind me are actually a gift from my grandma. She definitely is a true definition of black excellence. And this picture that I have right here on my laptop is of my son Isaiah, lifting him up and raising him to be proud and know of his heritage is the definition and embodiment of black excellence. And even in the midst of the joy that initial crisis that I was speaking of that the statistics showed, it's exhausting to think that students are in the midst of a nationwide racial reckoning and social justice movement, and to also be navigating the academic pressures of deadlines exams, micro Russians racism, familial responsibilities work study or other jobs. Black students are still achieving and accomplishing beyond their ancestors wildest dreams under this beacon of black excellence. However, with the hashtag and social media highlight reels don't often show shout out to relive the bar is that physical mental and emotional exhaustion that goes hand in hand with said excellence. And by all means people within the black community should continue and will continue to strive for excellence. But in the state of our nation, especially when you are high achieving minority student at a predominantly white institution, exhaustion is all too common. So I want to use this platform today to equip you with the tools to achieve and maintain that excellence, while curbing the feelings of exhaustion. Tip number one, every student needs mentors and a therapist. I encourage you to seek out and network with your peers professors, folks doing work in spaces that you enjoy or want to be in. I had a light bulb moment in one of my classes this semester, when my professor Dr Wilson Wilson introduced us to the concept of having multiple mentors.  I significantly remember one conversation with an adjunct lecturer, who I just sat there and sobbed in her office, but it was the most empowering conversation about purpose and passion and values. Only was I there for her, but she was there for me.  Personally, I was exhausted when I went through some of my darkest days in the middle of my first master's degree, working sometimes 12 or 16 hour midnight shift at the hospital, while also navigating through her divorce and trying to raise my son. So when I found myself in therapy after going through that divorce that dropped me at rock bottom were really hard. It felt like I had failed. But I learned through therapy this work, this rebuild of my life meant that I was worth working on. And central student government here on campus has funding available platforms online to help students find identity based providers. Like nourish for self identified women of color, a committee that I have been a part of for the past four years that hold an uplift space for these women students staff and faculty to come together and build this community. And my brothers is a community for self identified men of color. So please seek out that network for tip number two. I would be remiss as a yoga teacher. If I didn't encourage you to incorporate five minutes of movement, mindfulness or meditation into your day every day. I'm sure we all know we live in this toxic productivity culture. I mean we are always on the go, going from class to work to the library to a student or meeting to the gym back to class her work, not to mention finding time to eat sleep. I mean what's a hobby see friends. We aren't present. We're rushing an experience and an opportunity to enjoy these years of growth and development mindfully. One of my favorite podcasts because anyone who knows me knows that I listen to podcasts all the time. And she said something one day that just shook me to my core. She said we can choose to work at a pace that doesn't pull us apart. We, not our parents, not our partner, not our kids, not our coworkers. You have the power to choose that pace. So the idea is to start with five minutes of any of these in your day and eventually be doing all three for five 1015 minutes and I guarantee you will feel different. So advice isn't meant to treat or diagnose clinical depression or anxiety.  So when you train it with meditation, slow breathing, where you focus on your inhales and your exhales. Matter of fact, let's practice right now. At home, I invite you to place one hand on your chest and the other palm in the center of your belly. Now close your eyes and turn inward. And as you inhale, noticing how the air is cool. Pause at the top and slowly exhale, noticing how your body heats that air. If you haven't done some already, you can open your eyes. I encourage you to pause like that at any time. Other ways to incorporate tip two is by using mindfulness to complete tasks or being present. For example, when the last time you actually ate a meal and you weren't scrolling through social media on your phone. I'm also talking to myself. And I was actually on my SoulCycle bike at home when an instructor shouted at me that mindfulness isn't about controlling your thoughts. It's about not letting your thoughts control you. And when I say incorporate five minutes of movement into your day. This doesn't mean midnight shopping for your own SoulCycle bike. So five minutes of movement could be stretching in the morning before you get out of bed. Or for those of you who are watching in our real beginners, you know, no shade to that. We all start from somewhere. Even just dancing to a song, just moving. And I recognize that these all sound small and perhaps inconsequential, but no cat. They add up when you do them together and a little more each day. Pitchers just expressing all that. Tip number three. Say no. That's it. That's a slide. Joking.  Now, full disclosure. I know I got friends and family watching shaking their head in me right now. But I'm gonna call it out. This is a concept I know I still struggle with. But when I saw this reframed as self harm against myself when I over commit or over exert myself. Saying yes to everything, even if it's really cool and exciting. I pause because thinking about it in that context really reframes it for me. And healthy minds and national survey based out of you of M recently collected data that speaks to the added exhaustion students of color feel unvisibly being at the forefront of the social justice movement. And I bring up that statistic to name that just because you may be the only black or personal color in your class or place of work does not mean you have to participate or lead out DI or anti racism efforts, especially. And this part's important. If it means doing so without monetary or other forms of compensation. And this article after article of black women shouldering the brunt of this hard but necessary work without pay working longer hours in addition to their regular duties. Hell I was one of them at one point. But I will tell you this right now for the record. I will never do that again for free. It's important to acknowledge that these steps, I have not perfected, nor by any means are they tools that can be perfected, or were they outright eliminate exhaustion from black excellence. My hope is instead that a perfecting these habits. You can be gentle with yourself as you form new ways of coping. I would encourage you to reframe these tools through a lens of mastery, meaning perfection isn't the goal, but confidence autonomy, knowing you have the power and control to tap into these strategies at any time that you'll get better at them over time. I repeat, you can choose to work at a pace that does not pull you apart. Black excellence is exhausting. But it doesn't have to be. Thank you.