Hey guys, how are you today? I am so excited. I got another journal finished. This is a large delusions journal that I started in either late 2015 or early 2016. I don't remember. I do think this is one of the last journals I did when I was still teaching with Claudia Rossi over at Crazy Island University and I think this is the 2016 journal. I think I don't remember. I've had this sitting here so long I don't remember. How bad is that? Anyway, as you can see I decorated the cover on it before I got started and don't you just love the way I love this cover. It's actually held up pretty well. I really haven't had any problems with it. It's acquired a few new marks and paint smudges but I love the way it looks and I've had it turned back on itself a couple of times so it's really held up well. We're going to do a journal flip here and I'm going to share the journal with you. Now this page here actually, that's a mistake. I usually glue these two together because I don't really understand why those are that way. To begin with, this page here there's one in the front like this and one in the back. It doesn't really open all the way and they're really hard to work on so I usually, I guess I forgot, I usually get started by gluing this page to the inside cover. There we go. There's some great pages in here. I love, I always see 2016. So this has been sitting in my studio for almost, almost two years. How bad is that? That's a long time for me to have a journal sitting around. This one doesn't want to come out. Oh there we go. It's been in there too long. So some of these are 2016 work from classes I took. This is one from Peony and Parakeet. Some of these are classes I taught in Crazy Island University. My portion of those classes that are displayed in this book is available for purchase in my Etsy shop and this I believe is one of them. So is this one. I've forgotten now. So is that one? Yeah, that one. So there are quite a few of these in the beginning. These are actually doors that open. You can tell that needs wax on there. So that was a fun lesson. I'm so happy to get this journal done. This page ended up being the cover of the book that I wrote which is also available in the Etsy shop. I love this page. There's some really, really great pages in here. Some fun art experiments, trying different prompts from different things, different things different people suggested, inspiration from bits and pieces I cut out for collage. This copy of this picture, these two pages is available as a print download in my Etsy shop and I may scan a few more of these because there's some really great pages in here, some good work in here. If you have suggestions for certain pages that you would like to see me scan and put in the Etsy shop I can do that as long as I'll have to take a second look at it and make sure it doesn't violate anybody's copyright, you know that I haven't shown anybody else's work in there. This is a fun one. Some of these pages have lots of heavy like collage work and stuff on them so they really weigh a lot. Toward the end of the book I was really discovering that I really loved the leaving some white space, not always as I turn the page, not always but I was really loving leaving white space and working with the negative space to create an interesting composition. I was having a lot of fun with that and honestly just being free and playing there was really a lot of fun to be found in doing that. Yeah I used some bits and pieces of collage paper that I received as happy mail. This is covered in napkins in the background that I was given in happy mail experiments with a new stencil that might be coming out soon. This is one of the pages I was talking about where I was inspired by the bicycle image to create the page around it. Quite a few of these end pages were pages like that. This is one of them there's actually a piece of collage on there if you can see it besides the quote and this is one too this I could have drawn this but I had this collage image in my stash and I really wanted to create a page around it so how fun is this page? I love this one I love the composition I love what it says over here love it. There you go going forward to a new adventure so here's a journal flip of my large collage journal from 2016 and 2017. I can close it up now and put it on the shelf and go forward to the next adventure and I hope you join me don't forget to check out the video's description for any relevant links you will find a link down there to a site called Link Tree and if you click on that it will take you to a list of every single place on the internet you can possibly find me so you can follow me all over the place all right that's it for today everybody don't forget to support my channel if you can and the free content here and over in the Facebook teaching group my creative year if you'd like to join my creative year for a year of free long mix media fun and inspiration the link for that is in the link tree so go to the link tree and go join that Facebook group there's also the link to a tip jar an amazon wish list and a bunch of other stuff if you want to support me that's it for right now the most important thing is to go out have a great day and do something nice for yourself because you deserve it and I'll see you later bye guys


Hey, welcome back to Phone Phenom. I'm Cody Askins and today we're going to talk about a new cold calling script that works really well door to door or over the phone, all right? So one of the things that I always talk about is how when you are cold calling, whether that is door to door, we're going to go over specific numbers. I'm going to give you the script everything here in about the next 10 minutes or so, so stay with me, okay? Whether it's via door or whether it's via phone, this is all a numbers game, which is why we're going to actually walk through specific numbers on this video because I'm a big believer in that, okay? So let's just say, because when I go out, I think you need to be doing 25 to 50 door knocks per day when you go door to door using this script, okay? And it's a good one, all right? I've said a lot of appointments door to door or over the phone or got in immediately by using the script that I'm going to give you, okay? So I want to start out by saying that if you're door knocking like individual homes, okay? Individual homes, you may only be able to get in 25 because you got to drive different homes or if you're door knocking homes that are right in a row or if you're door knocking specific like senior type complexes, then you could door knock as many as 50 doors in a day. I have a insurance buddy that used to door knock a lot of T65, turn in 65 for Medicare, Medicare supplements and every time he went out and door knocked at least 25 doors in a day, he would make a sale from that trip of 25 door knocks where he was bringing information and trying to help someone that's turning 65 with their Medicare. Now that doesn't mean that he made a sale that day, but he always end up getting a follow up or getting in a home or setting appointment or making a sale right then from every 25 doors that he did. So if you're selling Medicare, you may want to think about that because he did that and it worked really well. I also did it years ago and it worked really well as well. I got to where I was writing 20 to 30 Medicare supplements every month from literally door knocking and cold calling without sending out information or leads, okay? If you're door knocking 50 doors, if they're in a row or if they're in a senior complex then you're able to do that. I went out with a couple other guys one Friday and we spent, this has been years ago, this probably been nine years ago, and we spent from about one o'clock till about, or probably about noon to one somewhere in there, till about almost 10 o'clock at night, door knocking. We got to about 150 doors between the three of us and we wrote six life insurance policies that day from cold door knocking because they were all in a row. It was a complex, 125 units left went to another complex and these that I'm talking about are, they call them like senior living areas or senior apartments or senior housing, a lot of smaller cities have these senior housing complex where it's like a building and they got four units to that building, it's all one level, et cetera, okay? So that's where the numbers comes in of how you can do this, all right? So let's get to the actual script of what I've done and why this new Coca-Cola script works so well, okay, whether it's door to door or over the phone. The script is literally when you are knocking on someone's door, okay? I like to say, hey, I'm Cody, how are you, right? And they say, well, you know, I'm great, what are you doing here, hey? I'm here to drop off the new state approved final expense information that we've helped a lot of your neighbors with. Did we get this to you yet? Right, so I like to ask the question and gain control. So by doing that and talking about the new state approved, and it is approved by the state, okay, final expense information and you can do it for anything, any product, doesn't matter, then you need to ask a question, which is, hey, did we get this information to you yet? And they say, well, no, actually, I don't think you have. Okay, great. I'm here now, I've got the information with me, just takes me a couple minutes to go over it, can I come in for a quick second, okay? And by doing that and repeating that and replicating that and trying to get in the home or trying to, I've actually done some live cold calling, literally live cold calling where you can hear me and the customer and I've done live legit cold calling live on video before over the last several years. I've done it multiple times and I've used a script before and it works really well. And it works really well in fact because it's something that can and will get you results if you use it properly, if you don't suck and if you use it often, okay? So I always talk about how I think that numbers is really important, so I'm actually giving you some numbers behind what I'm saying and what I would notice, okay? So when I would go out and I would door knock at least 150 to 250 doors in a week, here's the results that I would have because I'm sure you're very curious, right? Okay, good. I would be able to actually speak, they would answer the door, 30 to 50 people, about 20 percent, okay? Would actually answer the door. Of those, of those, I would typically get about a third, about 33 percent that would actually let me in the door, okay? Which by that would be anywhere from 10 to about 15, okay? And then from there, I would typically end up with about a 30 percent close rate, which ends up being about three to five cells. And I could literally go out, like clockwork, make about five cells a week, about a cell every single day, buy cold door knocking. And I know you can, too. There's a lot of agents that are struggling, about 92 percent of agents fail, there's more millionaires in this industry than any other industry in the world, most people don't know those things. But the reason so many people are failing is we don't get in front of enough people, we don't ask people to buy, we don't talk to enough people, we don't sit with enough people. And when you don't sit with enough people, I don't care how talented or untalented you are. If you don't sit with people and ask them to do business with you, you will not end up making sales, we don't make sales, we don't make money, we don't make money, you quit, you fail, you end up out of the business. If you don't have a lot of money and you're brand new, door knocking and cold calling, whether it's actual cold or whether it's aged leads, which we have a ton of here at Security Agent Leads, a little plug real quick, is because they don't get in front of enough people. This is a very inexpensive way to do that and I'm teaching you to you now because this is a lot of what I used to do when I made 117K in my first eight months in the business, brand new agent, 20 years old. I did it from cold calling, cold door knocking and working my warm market, which is what we teach in Prospecting 101, is the different ways to get in front of people so you can create a system, which is why I'm writing the book right now, Six Figure Cell System. So those are the numbers. Now I want to jump into if you're actually going and using it on the phone, because this is phone phenom, and we said that you could do this over the phone or door to door. When you move into the actual phone piece of it, when I'm door knocking, I will say, how are you? When I'm on the phone, I don't. Okay, let me make that very clear. Okay, also, I like to be in control, whether I'm at the door, which is why I always finish with a question every single time, whether I'm at the door or whether I'm on the phone. I like to finish with a question every single time. And you're going to get objections. I'm busy at all the time, whatever, okay? You can overcome those objections by using these three As, okay? Agree, answer, and ask. Agree, answer, and ask. You know what, I don't have much time. I'm very busy. Excellent. Let's do this. You can set a stopwatch for 60 seconds. If I'm not done in 60 seconds, you can kick me out, okay? Is that fair enough? Perfect. We'd like to sit at the couch or the table, right? Do whatever you can, but be in an agreeable state. Answer the objection, and then ask, which gets you psychologically back in control, okay? So I want you to think about that aspect. Also, when you're making calls, I like to say the person's name. I don't like to ask them. We are trained. Human nature is this Betty. You know it's Betty. You want me to answer the phone? The cold call list says Betty. Betty, great. Hey, this is Cody. Hey, getting back to you about the new state approved final expense information. Hey, did we get you this information yet? That's the script, okay? Very simple. That is the script, whether it's on the phone or door to door. The whole trick behind all this is, if there's a trick, is to get in front of enough people to succeed. Most agents don't. They fell because they do not get in front of people.  I teach a system called the triple S weekly system. Set, sit, and sell. I believe that if you're working the phone that you should set 15 appointments, sit with 10 and sell five every single week. That's what you do. And if you have a lower closing rate, maybe you sell three. But at three and 150 policies a year, you're not going to fail. Most people fail. And I want to challenge you to think I set a box. So this is why I'm giving you the new cold calling script that works so well for me, whether it's door to door. Hey, if you love the video, which I know you did, I got two things I want you to do right now. In order, number one, click subscribe right now. Click the bell. Also, obviously like this video. I've got two other videos that you would absolutely love. And I'm going to recommend one, okay? The first one is five easy phone sales tips for life insurance agents. The second one, which I actually want you to click on, is the top five mistakes that new insurance agents make. Click on it, and I'll see you there.


at Giniatech and you have a new product here? Yes, we have this product that is called NatTV Court also has brand of ITV this is a four-tuner inside. Four-tuner? Yeah and can catch the stream of for ATSC or for Satellite and real-time transcoding to the Wi-Fi and on every every smart device iPhone, iPad, Android phone and tablet run our app can receive the live TV at home. So the idea is you get one satellite in for example? Yeah. Is it just for satellite? Different Some more than for Satellite, some more than for ATSC, and some more than for PGGG2. And then it goes down here how do you split it to four? There has a four-amp inside. There's four anyways, is that standard? Yeah, it's a standard. And then it connects to there and then you connect to the router? Connect to this device, NatTV and then this device has an internet connect to the router you have. Connect to the router so that means the router will broadcast the whole house and everybody can watch how many people can watch at the same time? Four. Four people can watch four channels different channels yes at the same time yeah so how soon is this ready? This is already sold in in Europe right now we are going to make more than for China market for China market and for American market. Nice so this is ITV. ITV that is the brand. And what's the price in Europe for one of those? Oh it's around 200 euro. 200 euro and people happy with this already your first customers? You can get some you can get some information from the Amazon so a lot of reviews on that. Cool so how is it possible for you to do this? You have expertise in the tuner industry? Yeah for many years more than ten years. So you know how to optimize everything and then get the signal over to every smart device in the home? Yeah. Have the apps? Yeah. Everything works? Yeah.


Hello, I am Didier Stevens and I would like you to make you welcome to my network device forensics presentation, so let's start with the slides. So in this presentation here, I'm going to cover network device forensics, so network devices like switches and routers, how we can do forensics with these devices. So I'm not talking about network forensics where you capture traffic on a network, on a device, on a host, and then you try to analyze that capture file for forensic artifacts. So that's not what I'm going to do here, what I'm going to present here, the thing that I want to present here is forensics specific for network devices like switches and routers. Now this presentation comes with an article. I've written an article for the ISSA journal about network device forensics, and this article was the feature article of the December 2012 issue of the ISSA journal. So that means that that article is public to everyone, so you can download it and read it. I will give you the links later. Now imagine that you are in a situation, you are at your company, and that there will be a former employee that comes to the premises and connects one of his laptops, a rogue laptop, for you it's a rogue laptop, he connects that laptop to your network. Will you detect this? And if you don't detect it, but if you get warned about this later on, for example after a couple of days, you get some warning that tells you that this happened, for example somebody told you, will you be able to gather enough forensic evidence to see what happens to be confident to build up a good timeline of what happened? Another example I want to cover here is say that you have an edge router. So that's a router that sits between your network and the internet. And one of your competitors trojanized that edge router so that they can take over that router and inspect the traffic and have access to your network. Again here, will you be able to detect this or not? If you don't detect it, but later on you get warned about the situation, will you be able to analyze, perform a forensic analysis of this situation? So here in the talk I'm going to focus on forensic evidence that we gather with network devices and second part forensic artifacts that we find in network devices. So first of all forensic evidence gathered by network devices so your network traffic flows through your network devices so they leave pieces of information on those machines and if you can recover that information, you can have forensic artifacts to help you with your case. One of the very important aspects here is logging. If you have a professional network device, it will be capable of logging. So check if logging is enabled, if it isn't do that, enable logging. And also check if you have levels of logging and maybe you need to change the amount of logging that you get more logging information than you get by default. It's also very important not to keep those logs on the network devices themselves but to have them in a centralized place. This way it becomes much harder for criminals to re-erase their traces by removing their entries from the logs. You can do that for example with a syslog where every network device sends all its events to a syslog server. Let me show an example of information that we can use with a switch port state. So our first example, the former employee who comes in with a rogue laptop, he connects that to an RG45 cable, to a network cable. Will you be able to detect that? Well, the switch port state is one way to do this. On a Cisco switch, if a network device is connected to the switch port, so the cable is plugged into the laptop, when that happens, you will have a couple of events telling you, for example, that the state of the logical and the physical port changed from down to up and state has changed to up and it identifies which interface that is. I also want to get you on board by enabling onboard security features. So a lot of professional network devices comes with a lot of security features. And some of those security features can help you with your forensic examination. And they don't need to be installed in a blocking mode, they can just be there in the monitoring mode, but the fact that they are monitoring will help you much more with recovering artifacts. So enable onboard security features. One example here, again with Cisco iOS is DHCP snooping. So DHCP snooping does the following, on switch ports, the switch will listen in on DHCP traffic that comes in over that switch port. So that's a say, DHCP requests that come from the clients connected to that port and DHCP replies coming from the DHCP server that is also connected to the switch. So in that case here, in that configuration, you will identify one port as a trusted port and that means that this is the port where your corporate DHCP server is connected and from which it is serving client answers, so client replies. The other switches, the other switch ports are considered untrusted and that is there, every client can connect. So if you do that configuration, you enable DHCP snooping and you define your trusted port, then iOS will build up for you a list of all devices that they have connected to that switch. So you will have a MAC address, an IP address, VLAN eventually, and an interface number. This is an example here. I issued a command show IP DHCP snoop bindings and I get this input. I have the MAC address, IP address, the VLAN and the interface. So in that case of that former employee, if you would have DHCP snooping enabled on a switch to which he connected, then later on you can connect to that switch and look at all the connections that have been made and maybe identify a MAC address from an OUI, so the three first bytes, the manufacturer, the OUI, that is not one of the manufacturers you use in your company. Say that here it says all the time HP because you use HP and then, for example, you see a Dell. Then there's a strong indication that that is the MAC address of the rogue laptop. You will find its IP address and very important the interface to which it was connected. And then you can use other physical surveillance methods to find out who that rogue employee was and where he was acting. For example, you can have access control logs, physical access control logs with badges to see who came into that room with that network connection, maybe also CCTV images. And of course, don't forget to ask around people working in that room or working in neighbor rooms to see if they saw something unusual. So this was about forensic evidence that we can find with the help of network devices because they log in formation, they log in because we require them to do and we ask them to do, but also in the case of the HCP snooping, they do that logging, they build that table so that they can be able to do their work, like, for example, as a first instance, starting to implement a system like NAC, but then there is also the case where you will find real forensic artifacts on the network devices themselves. And the thing I'm talking about, for example, is a compromised configuration. So for example, you have a rotor with a routing table that is the configuration and the routing table is part of the configuration and that routing table has been compromised. It has been changed so that some of the information is sent off to another route. And this is something you will find in your configuration. But for this to work, you need to have a system that allows you to verify that a configuration has been compromised so that you can detect the changes. So the best thing to have is a system of release management and version control for your network device, configurations and firmware. Because if you have no ID, if you have no baseline, then it will be very hard to detect changes to a configuration. While if you have release management, you will have documentation, but when were configurations released and if you have a version control, you can also see how these versions changed in between versions. Another thing that you can have as an artifact on a network device is a script or could also be a compromised script. So it can be a rogue script, a script that you didn't put there, but that the attacker put in there. Or it can be a compromised script, as you say, one of your scripts that was modified to make the router behave differently. And that is also something for which you require release management and version control for force of scripts here, and that you have to do that of scripts, not of your configuration files but of your scripts, so that you can easily detect after the facts what changes were made to the script. Compromised OS. So that is the network operating system, so iOS in our six core examples that has been compromised. So that means that it has been patched, changes have been made to the operating system so that it will behave differently. This can be done in two major ways. Attackers can change the OS image, so that is the file, before it is loaded and executed into the router, or they can change the operating system directly in RAM. So they don't touch the operating system on the file system, but they patch a running operating system directly in RAM. This can, for example, be done if you find exploit, if you find a certain exploit for iOS that gives you full right privileges to the RAM, then you can modify the running operating system so that it behaves differently. If you are dealing with a compromised operating system in memory, you will have to perform a memory analysis. That's the only way to go about, to detect these things. Luckily Cisco iOS has a feature to dump the memory of routers, it's administrative command, and when the memory is written, it is sent to a TFTP server which captures the files of the memory dump. It's also important to understand that such a memory dump does not really have a negative impact on the operation of the router itself on the performance unless that router was working at its maximum of capacity. Because the thing is that while the memory dump is ongoing, the router will still continue to work. And that, of course, is also a negative impact on your memory dump because that means that you are taking a memory dump and when you do that, it takes a couple of minutes. But you are actually taking a kind of rolling memory dump because when you are making a dump of the first part of the memory, there will be changes going on in the last part. And then when you end up dumping the last part, then there will be changes in the first part and those are already lost because you've already written that. So it's not a flash snapshot, an instant snapshot, it's a rolling memory dump, it takes time and while it is performing the dump, the data is written to disk but the router is still functional and so it is also changing the memory while it is being dumped. Now, until recently, you only had one option to analyze a memory dump and that was to send it to Cisco's technical assistant sensor, the TAC, the tag. So they would ask you to write a memory dump and send that to them and then they would analyze that and you would get answers to your problems. Several years ago, Felix Lindner released a tool called CIR and that tool was designed to analyze memory dumps from Cisco devices. So the thing that happened is that this tool was a closed source tool, it was written in .NET, it was a closed source tool and you could buy it from Felix company, Recuritlap, or you could upload your memory dumps to a website where this tool was running and then it would send you the analysis but of course that implies that you share your memory dump with somebody else outside of your organization and that is not always something you want to do and that is one of the reasons why I started to develop a similar tool but an open source tool which I call NAFT, NAFT, the network appliance forensic toolkit, it is written in pure Python and it can handle for the moment Cisco iOS and also generic network devices. Now the interesting thing to know is that when I was working on NAFT and tweeting about it, I got in a conversation with Felix and in the end he decided to release his CIR tool as an open source tool. So nowadays situation has changed, you have two open source tools, CIR and NAFT to perform memory dump analysis of Cisco iOS devices, CIR is in .NET C sharp if I am not mistaken and NAFT is in pure Python. Okay so now let's go into the demo of my NAFT tool, you can download it from here, I have the page for my NAFT toolkit on my blog so let's take the terminal with the command line and here I have my NAFT, so the network appliance forensic toolkit, my NAFT Python files, the NAFT dash here, NAFT minus, those are actually commands while NAFT underscore all those here NAFT underscore those are supporting modules so you don't use them directly, once you use directly here NAFT, GFE, ICD, II and IIE, so we will see what these do. I also have a couple of memory dumps in this folder here and a couple of iOS images in this folder here. So let's start with NAFT for the generic, so NAFT GFE is generic frame extraction, so this tool NAFT GFE works on the memory dump or even files of any network appliance, it will look for IPv4 frames in that file, it will look for headers that resemble an IPv4 header and then it will calculate a checksum and if the checksum matches with the checksum that is found in memory then we have found a valid IP packet and we will put it in a pcap file. Let's have a look here, the command, I'm going to store the packets that I find in the memory dump in result.pcap and inside the dumps I'm going for the core dump of my R, my router 877, the IOMEM dump, okay and as you can see here we identify 213 frames, 1 packet and there are 194 frames inside the pcap file. The reason why this is lower is that there is duplication, when we do this we only write the unique packets to the pcap file, if two packets are identical we will only write one of them. The final here, do my computer, NAFT demo, okay so here the resulting pcap file, if I open this with Wireshark you can see here that we have all those packets extracted from the memory dump, okay. Now NAFT GFE can actually extract packets from any file, it doesn't have to be a memory dump, it could also be for example a memory dump of an XP Windows machine. Let's do that, result XP.pcap and in the dumps I want the XP laptop here. So now in this dump, this is actually a dump that you can find online. Search for memory forensics, Windows XP memory dumps and you will find some of them and then you can use that as input to my NAFT tool here. So this here is a rather large dump, if I'm not mistaken 512 megabytes so it takes some time to search through that whole file. So it is done searching for IPv4, then search for RP packets and that was quick and now we have a full result. With the total of 2054 packets inside the pcap file, so that's not bad at all. Let us open that file, okay and now look for example let's filter for DNS, yeah and we see DNS to USGS Gov, that's a geological survey I don't know if I'm not mistaken, Benz Bargain.net, CNET Shopper ESPNGo.com, okay and HTTP, yeah we can see different HTTP requests here. Now here an XML file, another RSS XML, yeah, okay let's quit and then if we look inside the dump, I have this one here 500 and here I have also one from OSX which is 2 gigabytes so we can try this one, see what happens, so result OS6.pcap dumps Mac Mountain Lion. So now again the program is searching for IPv4 packets in that file, it is so looking for headers, so bytes like 45, 46, 47 and that can be the start of an IPv4 packet. Then it looks for the header, the checksum in the header and it calculates the checksum and compares it with the search checksum, if those two are equal, we assume that we have found a valid IPv4 packet in memory and we extract it. And after searching for IPv4 packets, we will be looking for R packets, those are also easy to identify. I will also work on IPv6 but that will become a bit more difficult because there is no checksum there, okay and here we have our results, well this is much less than 184, okay. So that is a demo of Naft GFE for generic frame extraction, it can extract frames and put it inside a pick up file from virtually any file, any memory dump. It doesn't know about the layout of the memory dump so it looks everywhere. Well if we are working with Cisco iOS memory dumps then we know more about the structure and for that we have another Naft command and that is iOS ICD. This program here, see iOS core dumps, ICD, this program here has a lot of options. You in fact provide it with a command and then with extra options, for example ask for the regions, for the processes, for the heap, for the frames, CW strings, check text, check text that is an interesting command that I will show you, events and history. So let's start simple with regions, ICD, I want to have the regions of the dump of my 877 router, okay. And this is the information, so the memory that is found in that router has split up over these addresses, start and end addresses and the size for text, data, BSS and heap. You can have exactly the same result when you do the corresponding iOS command on the router itself and then it will also show you the regions. But here we extract the regions from the memory core dump. Another very interesting command for Cisco iOS memory dumps is CW strings because, well let me just run it first, we'll make it more clear to you, that's it. So every Cisco iOS image and every Cisco iOS memory dump contains CW underscore strings and these strings contain information about the running software, like for example here CW version, this is the version that was running inside that memory dump, family C870, the type of image here, advanced security services, okay. And this is also something you can do just with a simple strings command, if you would do strings on dump R87 and then grep, I lost my window here again, and then do a grep for I believe it that, but what I wanted to say is do a grep for CW underscore and you will have a similar result. But here it's a bit more efficient because the command knows in which portions of memory to look for those strings, okay. And now let's have a look at the heap, the heap of that dump, okay. And this is all the heap functions that you can find that were running on that machine when the core dump was made. Heaps are pieces of memory and heap manager allocates pieces of memory for the different courses to work with. They have purposes and names, but this here doesn't show up in this simple dump. You can do the same dump again on a live Cisco machine with the CLI and then you will see the heaps and the names and their use. Now let's just issue the same command, but with another option minus R and then we resolve the names. You see that here now, instead of numbers, we have tried to replace the names of the processes like here SSH memory. So this piece of the heap, this memory chunk is used as SSH memory. Here another one for the HTTP process, IRP input. So you can find a lot of information here, but you are not limited just to view the location and size of the different regions, pieces in the heap. We can also filter them. So let's go back to the same command and now I will filter for TTY data. So now I will only see the pieces of the heap that have been assigned to a TTY data process and there they are. See that's much less, but in here, in those pieces of memory, you will find the data that we typed into the TTY that we saw. Now to view that data, we issue again the same command, but with another option S so that we can see the strings inside. And now here I did perform a dump of the strings that I found in the TTY data memory. This one is a very interesting one. This is the password that I used to log on to the machine. So the password is in clear text in the memory, which shouldn't be a surprise with a monolithic operating system like iOS. Here this is part of the command that I issued to write the core, write core and the name of the TFTP server. We can also look for data and grip the strings. So NAFTICD, I'm going to look, so in the heap command, I'm going to look for pieces of the memory manager that have been allocated to the init process. I will dump the strings that I find in those pieces of memory, in those blocks of memory, and then I will grab, minus j is to grab, four string cmd colon space, and that in the core dump. Okay. And you can see now here that you can see all the different commands that were executed by the consoles on that router and were still in memory. Now let's leave the heap and have a look at processes, iOS core dump processes, and these are all the processes running at the time that we took the snapshot. Other processes, IPsec processes, HTTP process here, SSL VPN process, all kinds of processes with the number, location and flags that indicate what they are up to. This is similar to the show process command you can also issue on a live Cisco router with the command line interface. The history is also very interesting enough, ICD history. Then I get a list of all the commands that were recently executed on that machine. Now this command here come from the config file. When router, Cisco iOS router launches, it executes the configuration file, so it is as if somebody was typing the configuration file to the console. So that's why it appears here. And then here later you can see that I do a dump, that I show a region, that I configure the terminal and go into line console. Those are all commands that I issued. So we have history processes. Now let's take a look at events, that's also very important. The events that we find in the dump, and here you can see all the events in the formatting as you are custom to them for Cisco. So you should be also having a syslog server where you find these events, but this is a way to extract the events that are still in memory. Now remember that you can have a compromised operating system. The operating system is compromised in RAM, so it has been modified in RAM, or it is the image that has been compromised. Now how can you figure it out if actually the RAM has been modified, so the operating system has been tampered with in RAM, but not on the flash disk? For that I also have a command, and that is the check text command. So I have an ICD, I issue the command check text. And this will compare the code that is in an image file with the code that can be found in memory. Code here is typically called text, so that's why I call this command check text. And I do this on a dump of this router, the 2610XM router, and I also provide it with the image for that router. So in images I will start with this one, this bin image, and I run the command. So now it compares the image of the disk and the image as it is written in memory to see if it finds any differences. And indeed there is a difference here, so that is not normal. If you have it provided the correct image, then this should be the same. Here you have the information of the image that is on the disk and the image that is found in the memory dump. This information comes from this CW string, the system description, and they are equivalent. They look the same and they contain the same information. There is some small formatting difference, but essentially they are equivalent. But if you look at the text from the image file and the text found in a memory dump, then there is a difference. And here we list where the difference starts and it's a small difference, it's only 48 bytes. While if you would do this with another image, with actually the original image, canary image, which was run, where they have an equivalent and text region and section are identical. So here there has been no tampering with it. And that is actually what I did here for this demo. So I have an iOS image that works with the standard canary values and canary values are values that are used in the blocks in the memory manager, in the heap, to detect when they are overwritten, but because they shouldn't be overwritten. And I have modified a version of iOS so that it uses different canary values, just as a proof of concept. And that is what I'm using here in this check text command. If I check the memory dump with the correct image file, the one which was booted, then you get an identical result and that there are no differences. But when I use a core dump of the Cisco router with a slightly modified image, only modified in total 48 bytes, then this will be detected and that is what was reported. So that is important to understand that if you have doubts on what is running, then you can make a difference with this here. We check the text tool to check if what you have in memory corresponds with what you have on disk. Now on caveat, of course, it is possible that the right dump memory, so right core, that command that creates the memory, that dump, that command has also been tampered with and that you cannot rely on it. And in that case, you have to break out of iOS, go to Homo and from there on do a memory dump. But that is much more tedious because you will have to do a memory dump as an ex-dump and then you will have to take that ex-dump and pass that ex-dump again into binary values. So that is not so easy. So that is what I can do with iOS core dumps and I have one other command that I want to show here, IiPy, that is for iOS images. So with this command you can analyze iOS images, let's go into images, this one bin, okay. And then you get a lot of information about that iOS image, the version, the family, the features and so on. The entry point, the number of sections, the embedded MD5 hash, which is here.  So the size decompressed, the compressed size and the uncompressed size, the original file name here. What I also provided as an option is that you can extract the image from that file, the ELF image, in a form that is suitable for the file to be analyzed with Ida Pro. So when you launch this command, okay. So you get again the same info. And now, look, this file here has been written to disk and it has been slightly modified. So from now on you can open that file in Ida Pro and have it disassembled and see what iOS does with all these functions in there, okay. So those are the three major functions here of my NAF tool. It is something that you will use to extract forensic evidence from memory dumps when you have to do it on your own, when you can for example not contact Cisco TAC to help you but when you have to do it on your own. And of course, like I said, it is important to have release management and version control to have a baseline so that you know what is supposed to be on the system and compare that to what is actually running on the system and from there on perform an analysis that tries to explain what new features and what new secrets are hiding in that tampered iOS image bead on flash disk or in RAM, okay.


All right. Thank you very much for coming to taking your time to come and see us. Like he said, my name is Rod Soto and he's Jose Hernandez. And we're going to talk about today about some of the research that we've been doing about trying to achieve a unified cloud security posture. So let's get started. Who am I? I am a principal research engineer Splunk. I worked with this gentleman at Prolexic Technologies, which is now Akamai. I also worked at Caspita at one point. I co-founded Hack Miami and the Pacific Hackers Meetups and Conferences. You can find it at meetup.com. And I created a command and control in all quarter CTFs. I like to do a lot of CTFs. He is Jose Hernandez. He's my peer at the Splunk research team. Worked at Prolexic as well. And we do have quite a bit of experience fighting DDoS. And one of the, I guess, the adversaries we had to fight was Anonymous and Lorsic. So let's get started pretty quick. So one of the things that we try to address with this presentation is that we obviously, in the industry, we can understand and we perceive that many enterprises, many corporations are basically struggling with achieving a unified cloud security posture. There's sort of a mix, an attempt to sort of, there's a difference between perimeter security and the way we're going to expose this. There's perimeter security. There's cloud security. So you just can, even though you can try, for example, but for example, active directory logs with maybe Stackdriver, that may not make a lot of sense. But we're going to give you the tools that we actually use. The tool that we actually, that you're going to see today is the cloud security suite. We did some modifications to make it sim friendly. And you're going to see basically some examples of EOK and Splunkle course. So the reason why we're looking at this is because the cloud has become prevalent. At times, there's a blurry line, a blurry line when it comes to liability, right? Because at the end of the day, the cloud provider has his limits. And many times, we're not aware of it. And I will touch on it. The cloud adoption is expanding. Cloud security is not an exact translation on inside the perimeter. You're going to see that in a minute. Every provider has a set of technologies, feature security items. And even though there are several cloud security initiatives, it's still an ongoing effort. So what you're going to see today is an ongoing effort. Some of these categories that you're going to see today may change in the future or may include another. But it's definitely what we agreed that was the most comprehensive one as of now. And of course, we chose the CS security suite because it basically helps you assess the three major vendors. Of course, there's OpenStack. And we're not going to show anything about OpenStack, but definitely we believe you could probably fit it in the categories that you're going to see today. So this is just an example of how prevalent the cloud is becoming. Like I said, they manageinary, which is not really that imaginary when it comes for you and your responsibilities. Obviously, the responsibilities change depending on the cloud service provided module, if it's infrastructure as a service, there's a platform as a service, or it's a software as a service. So as you can see, basically, you go up to physical security, and then once you get on application security, and most, for example, of the type of services, you are responsible for it, right? The imaginary line is not that imaginary. What you have, what you see here is basically AWS. They do actually come up from and tell you this is why you are responsible for. Sometimes what we, the challenge that we face here is that when you are presented with this number of services, challenges, putting together all these locks, I'll give you an example, GCP has over 200 or more that I counted the roles for security. So when you're dealing with stuff that basically is incredibly challenging for a single operator to put together, we had to use either a criteria that groups many of this single items, and some sort of automation that will provide us a view when we're trying to assess security. And that's what we're going to, that's what you're going to see today. So here's the Azure, for example, so I try to show all the three providers. This is something that you, if you are using any of these providers, I suggest you that you really review and sort of establish an inventory and identification of where your line is, right? What is their responsibility? What's your responsibility? So obviously, this is part of reinforcing our point of view. We have this major cloud attacks from the Sony, the Fappening, the Cloud Hopper, the Ashley Madison, just being said that there were suicides about it, Equifax, HBO, IB, largely stolen, Mario, Kubernetes. And of course, we just had the recent one, which is Capital One, which was an inside, a rogue inside. So here's an example of what can happen. And here's an example of some of the challenges that we are facing when we deal with cloud providers at times, even though they, for example, certain vendors seem to be very secure. Then we have a case like that rogue insider comes in and exposes all this information or steals this information. It's not known yet what, if that data was shared either in the dark web or if it was sold. I use, when I started researching this, I looked at the cloud security alliance, which is called the Three Shares 12, which is basically includes data breaches, insufficient identity, insecure interfaces, system vulnerabilities, account hijacking, malicious insiders, which is the sample we're just talking about, advanced persistent threat, which is nation-state or highly organized crime, data loss, lack of diligence. I've used on the various or use of cloud services, denial of service, and shared technology vulnerabilities. This has to do usually with multi-tenancy. We actually saw that when we were working at the company that basically seized 30% of the internet, a very famous airline who was, they lost an airplane. Don Lemon said there was a black hole that took that airplane. Well, that brought a lot of resentment. So guess what? Somebody wanted to hack that airline. And the administrator had the same passwords and many other panels. So we were affected at that point. This one attack vector of many people you don't realize that multi-tenancy and third body will affect you for sure. So here's some of the main targets of the cloud attacks. ATO, which is account takeover, key excretion, phishing, you can attack obviously the provider, AC AWS, UCP, you can attack the admins because once you get admin access in any of these consoles, it's pretty much having domain admin. You can use the cloud resources for things like crypto mining or DDoS for rent, data, everybody's life, private work information is in the cloud, I mean, it's getting there pretty much. And we're still not counting what I will call the AI leaks, which I'm sure they will come soon. We're already getting little trips of it, you know, like we have operators listening to Siri, Alexa, so we don't know yet. We don't know how this is stored. We know it's in the cloud, but I would caution that we need to be prepared for those type of leaks and they will probably be devastating. So be careful what you said at home if you have one of these devices. Third bodies, like I said before, co-tenants, multi-tenancy and attacks that affect the identity provider. So here's also an expansion of the attack surface, what I call the DevOps attack surface, the CI-CD pipeline, source code repository, BitBucket, GitHub, as VNS3 buckets, CI-CD platform, we know about Jenkins vulnerabilities, for example, CircleCI, Travis CI, container repositories, we've seen some of those recently, Docker, Begrin, the provider, depending what the Kubernetes flavor or OpenStack in infrastructure as code. So basically, vulnerabilities of use of exploitation of things such as Terraform, Ansible, Chef or CloudFormation. So if we were to reduce this, right, in general view, this is pretty much how you will look at the attack surface segments. You have the internet, right, or the internet. You have some sort of a web service, API, HTTP service. Behind that, there's a compute backend that's usually distributed. Behind that, there's usually what I call a cloud LAN or a cloud WAN. And then usually in that backend, you're going to have the big database engine. So you have SQL, SQL storage, block, object or file type of storage. So can we create a common criteria for cloud security? The answer is yes. And we're about to show that. These are the categories that we decided to settle for at this point. So basically, there's six categories, Network, which is the standard access, VLAN, V1, VPN, and routing, security, which obviously includes the CIA, confidentiality, integrity availability. Although in the cloud, there's heavy emphasis in the AIM portion, encryption and firewalls. Then you have compute. In compute, we had artifacts, such as virtual machines, containers, apps, microservices. And then we have databases, which can be SQL or not SQL. Storage, which basically buckets in file type of storage, as I just commented. And then management. So it could be Kubernetes flavor, logging setup and management access. So here's some of the examples of things that we put together. For AWS, for example, in compute, you can see that we include EC2, Lambda, Elastic Beanstalk, ECS. In Azure, we put there the machines, load balancers, app services, disks, Kubernetes, and GCP. We included instances, disks, snapshots, images, zones, Kubernetes. The reason why we put this is because we're about to show you the example, how it looks together with the checks. And then you can get very granular. So it will make sense in just a few seconds. So here's another example of management, the things that we were able to encompass the three vendors, the storage, security. And again, this is an ongoing effort. Many of these vendors, they are adding stuff or they're changing it or they're eliminating it. So it's hard. In the sense of we can say that this is written in stone, this is variable, this is ongoing. But as of now, it gives us that unified posture when we're looking at the three major vendors. Then we have the network part. Sure, if you want to take a picture of it. And then the databases. And then finally, we found a open source tool called Cloud Security Suite, which is a one-stop tool for auditing the security posture of these three vendors. The vendor checks are different. Different because of the service or difference, infrastructure, the name of the services. Jose is going to talk a little bit about how difficult it can be to normalize this data. Because basically, I'll give you an example. For example, GCP, yeah, the output is JSON. But the way they output the JSON, the AIM is not nearly equal to the nomenclature that Azure or AWS may have. So that presents a challenge for a security operator. That presents a challenge when we're trying to normalize the data. We were able to do that. And we're going to show an example. We actually modify the code. We modify the code to make it SIM-friendly. With this, you are going to be able to output and then pipe it to either an EOK or Splunk. You're about to see the examples of how the categories look together and how you can deeply research and look at it from the operator's perspective. And then obviously, if you want to go and dig deeper into this, obviously, you have to do that in your analytics or preference. Obviously, we worked for Splunk. We did quite a bit of work in Splunk. But we also show you, actually show you even the configuration file on Elk. So you can do it too. So some of the things that I wanted to share about this, the original project was modified. Are you ready to jump? Okay. Let me get you, Jose, now. Yeah. Rod, thank you. Thank you for giving us that basis of why this is important for us. And again, just a quick resum rake up here. We're trying to distill down all these checks, the CS Suite, the tools doing into common categories. And with the end goal of being able to audit in one common language, all these cloud providers, right? And to dig deeper, a bit deeper, and I'm just going to go back one slide if you don't mind, CS Suite today uses under the hood a set of tools that are actually cloud auditing tools. And each of them are kind of a bit more specific for what the audit that they're trying to do. For example, G Scout, it's only a tool that audits GCP. Meanwhile, Scout 2 is an AWS tool, Prouler only audits AWS, and so on and so forth. But what we really liked about CS Suite as a project was it brought all these tools together and generated one common report. The thing with CS Suite for us, and again, I think I'm just recanting this for a second, was CS Suite is built to generate a report, not necessarily an audit log for a SIM or something similar like that. And so I'll go back to Rod's point, there's some modification that was made in order to support that function. But for the most part, CS Suite is really straightforward to get started with. You just need really read privileges or an API, a service API token and something like GCP or Azure in order to scan for that to go better with your cloud provider. And again, the one thing to watch out for is your visibility into the scans may vary based on the rights you have on those keys, especially if your cloud deployment is segmented, you got to account for that when you're setting up your keys. So this is what CS Suite looks like when you run it, of what a report basically generates a kind of shape of report. In this case, I believe this one is for Azure. So it's giving you the results sets for security center, what checks, what things failed for the storage accounts, logging, so on and so forth. And you get this, we also get this for things like Azure. So this is, for example, sorry, for GCP, this is the GCP benchmarks. Did you leave a network open mistakenly or maybe it wasn't mistaken, but it'll still report, you know, you have all traffic coming into this specific instance. Do you really want this publicly open or not? There's another example for AWS. Again, there are individually different reports, but they're looking at all the checks for that specific cloud provider. Now, before I jump into what the data looks like, I really want to walk everyone through some of the challenges into getting this set up on your own. And again, just to highlight potential like gotchas and hopefully you can get through them really fast and especially after this talk. So like one thing to watch out first is logging in any cloud provider costs money. Watch out for that. Like just make sure you get a budget calculator before you start turning everything on because your bill is going to rank up really fast. And it requires time for setup. And what I mean by time for setup, for example, in GCP is not just a matter of like, you know, I click a button and I'm logging everything. But you know, you need to walk through configuration in there. There, you know, you need to have a platform that can, in that cloud provider, you need to have the inner workings to index and stream the data into some sort of sim, right? So something to account for that's not native in cloud providers. So you need an architecture for streaming and storage and some analysis framework, right? In this case, we're using Splunk and Elk as examples, but you're also going to need some sort of analysis framework to analyze the logs coming out of those cloud providers. Good saving grace years, most providers are using JSON as output. The bad thing about that is to Rod's point earlier, they're not normalized. So we have to normalize a lot of that coming in. If you were tomorrow training on logging for a cloud provider, this is roughly what the architecture would look like.  And this is best practice, right? And what I mean by message bus is in AWS world is SQS and GCP roles is PubSub and Azure, they have this whole own logging thing called Azure log integration. And optionally, you may or may not want to, so each of the services are generating their own logs into a message bus. And then you may or may not store that into a storage bucket for retention. And again, may or may not, it depends on a lot of things, costs or what you're going to do, whether you need it to store it or not. And then you're going to have some sort of agent pick that up from either the storage bucket or the actual message bus itself and send it to your actual indexing system, like your analysis engine. And CS Suite sits somewhere in the same place where the agent would sit to pull stuff off, but instead of pulling data out, it's scanning for what's incorrect in that cloud provider, what's not really up to part security-wise. Again, big values of integrating popular systems is you get knowledge objects out of it, right? So you get like fuels extracted out of it. You can do a proactive alerting when a check fails or a bunch of checks fails. You can do automation around, like for example, if something is failing, you can quarantine it immediately with something like a Phantom, for example, in the Splunk world, store-based applications. Let's dig now into the reports. Elk. Elk is really, to get the events to work with, to bring CS Suite events into Elk, it's pretty straightforward. You just File Beat Config, and there's nothing real unique here in this File Beat Config, besides the fact that I'm telling you there's JSON, so JSON keys on the root. And here's what the data looks like. Again, pretty much you get different things like category fields that natively, for example, CS Suite doesn't give you, and the categories are broken down again, like what Rod just explained, which is management, service, compute, storage, et cetera, et cetera. The name of the check. So in this case, in the picture, we're saying, sure, log metric filter and alarm access for management console. Sign in, right? So like, are you logging, do you have a filter for logging, for logging management logins? Oh, that's a tongue twister. And this is just an example. And clearly, because again, this is already logged in, right here, I'm showing you just a quick, really dirty graph of like other checks that failed, or in this case, they set us warning for all the cloud providers for us, and then they broke in, it looks like most of it was management, and some of it was the security, under the security category. I want to show you what Splunk looks like really quickly now. And again, this is the same data set. It's all JSON, or CSV outputs JSON, and we're just bringing it into one provider in the next way. Again, you'll see here in the Splunk side of the house, it's a bit more of a more, I guess, known as a more complex search, just because I added things like, you know, what does, you have like a service field, like who the service provider was, if you want to break it down. Here's a good like a view of like what the different checks for Azure would look like, like that you'll get back, right? So like manual extensions, like a VM does not have the, you know, the data that's encrypted, the retention policy is not set, so on and so forth. Here's a quick dashboard we threw together for Splunk, of like all the checks we were running across. We set up three different dev clouds, made them purposely vulnerable, right? And then so we've set a cron job to run CSV, put the logs and then index that to us, and we built this dashboard with that. And again, just trying to give you a flavor of what data you can get out of it. But things like, you know, hey, roughly there's about 100 and something individual checks for each cloud provider. And so you get, okay, what checks are passing, which ones are failing, clearly you want the red to be zero. At some point, if you have like a sock and you're working the sock and you're working this down, each of these are essentially should be a ticket to either make a change or to remediate, right? You know, breaking down my category, but which provider is failing the most, in this case, Azure is I think our worst perpetrator in this case. And under this, you get a very, very good detailed table of like, who, you know, which category, what provider, what the specific check was. And basically the value in this case was what's actually failing, like in this case, for example, the EC2 audit failed list of servers, which are not associated with IAM instance profile, blah, blah, blah, blah, blah, right? And it's giving you all the instances that for us, we're not associated with a standard profile that we spun up, right? I'm going to be completely transparent with you guys. The first time we ran this against our own development clouds, we found stuff that we didn't know we had left open. That was almost like a stamp of validation, like this stuff kind of works. The beauty, and again, I think I couldn't speak highly enough, the beauty of CSC is the fact that it encompasses so many checks that it, I'll give you, I'll give you another, again, another like story, like recently, I spun up Cloudsploit, if you never use it, it does something very similar to this. And I ran it against all of this same dev clouds, and I got the exact same result checks that Cloudsploit gives me almost by the name, right? It's very thorough. It's where I'm getting it, and it's free. And you can run it operationally 24-7. Like I mentioned earlier, it's very like in Splunk or Elk, right? Elk, you can use Watcher, it's Splunk, you can use just to save as an alert to invoke some sort of automation to either remediate it immediately or send an alert or create a ticket. So again, it's easy to take this and then put it into your SOC and operationalize it ideally. That's all. Thank you.


I feel like we're in a pretty good spot. I think the last week, especially guys, it's been time. It's been time to hop out of here. And obviously, I mean, the biggest thing is really just making sure our starters got that last start to continue to build up from a pitch count standpoint and finish off spring training in that way. But I feel like our position players are regulars, especially because by and large, they all were playing early in camp. I felt like they were built up and ready to go probably 10 days ago or so. So yeah, I feel like we're ready to go. And I know everyone's really excited to get to New York. I've gotten built up here now these last few weeks as well. Now, but as I said, when it happened, it was a game changer for me immediately. And it's remained that way. I feel good. And excited along with the guys to get this thing going. I feel like his catching has gone well. I feel like his work has been really good. These last week, 10 days hasn't swung the bad grade. I feel like his timing's been a little bit off. So he's been racking up some strikeouts. But I also feel like even today with a double play to strikeout, I felt like he was getting off some better swings, better timing, getting into some better positions. And for him, it's a matter of getting into a good solid hitting position. And if he can do that, the results will follow. Aaron, let me just follow up. Do you feel at times you guys are trying to talk yourself into him? Because there is talent there as opposed to that talent actually ever coming together at one time? I don't think talk it in. I mean, there's no question. There's been peaks and valleys there, obviously. But there's been real peaks there. And this is an all-star catcher a couple of different times. We've seen the progress he's made behind the scenes defensively. So we know what he's capable of. So certainly, we're betting on that upside and bringing that out of him. So now we get to go find out and hopefully he can go out and start putting last season behind him. I'm not going to really say that. I think you guys all who cover us every single day know who's very much in that mix. And we'll have a decision here to make in the next, obviously, couple of days as we weigh everything and just try and put ourselves in the best position to start the season optimizing us as best as we can. So those will be conversations I can see in the next couple of days. I think internally, you can certainly understand who those guys might be. Not sure exactly what my message will be opening day. That'll happen, well, I guess I'll probably do it on the workout day. But it'll be in line with who we are, who I am, and how we want to approach things. We understand that we're all like-minded and that we want to be a championship team. We understand there's a lot of baseball to be played to hopefully have that opportunity to play for that at the end of the year. And so I just want us to be in the right mindset as we get ready to take on the grueling challenge of 162 game season. I feel confident that we're cut out for it and ready for it. And I feel like we've prepared properly in spring training to be ready for that. But now it's about following through and living that out consistently. It's easy to talk about, but it's another thing to go live it each and every day about how we want to approach each and every day of the season. And that'll be the continuing message. Hungry. We understand we're a talented team, but we also understand we haven't done anything yet. We hope that we've started to lay a foundation to be a championship club. It's a lot of guys that have obviously, in a lot of cases, been here now a few years and have experienced a lot of highs, playoff success, playoff failures, disappointing ends to the season. We've gone through a lot together as a team. We've added people to the mix that we feel like can be ingredients to help us get over the hump. But I would say this team, and I felt this way the last couple of years, is a very hungry group. We won't want to kick that door in in the worst kind of way. And I think the fans will see that, hopefully, with how we play the game.


We're still on the congress, he's now on the move to Augustine. They were having gunshots at the Akipala's ground in Arbelkuta, venue of the Parallel Congress of the Camp Lalees to Senator Biokulea Monson after hoodlums earlier today stormed the premises. The hoodlums stormed the palace at about 10.30 in the morning, shots sporadically into the air to disperse APC members. That was shortly before the commencement of the Parallel State Congress. Party members camped for safety amid pandemonium. 10 people sustained injuries before security agencies on the ground sustained no more, say. Meanwhile, some party storewoods and press interviews reacted to the incident. Take a listen. But what you're saying is we don't want to violate the constitution of the party. Those who the council recognize as accredited members to vote, they are people that are here. And this symbolizes democracy and integrity. It shows a social where people are not confident and sign of panic. If you feel you have what it takes then they should consider what they are doing and allow us to do what we're doing. So for them to come here to try to disrupt it, there's a height of responsibility on their part. But that's okay. We can't expect anything more from them. Well, no, no, no. You know, it's not politics. If there's no drama, you cannot enjoy it. So I was not in today. It was also me, me and my friends trying to create distractions. But to me today is a very happy day for the party.  But my tip is that A.P.C. being a very big party. All manner of interests will be at play. As it is, there are several interests that are supposed to be accommodated within the party. And the way I'm looking at it, as time goes on, everything will be brought under umbrella. Hello, hope you enjoyed the news. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.


Hi, it's Doug Belishor MoodleNet lead here at Moodle I just want to show you a demo of what we've been working on this week during a MoodleNet design sprint here in London without Landish Martin Douga Amos flew in as well. So here's what we've been working on Let's imagine that you're a teacher and you've been messing about with MoodleNet You joined last week and you're you're now going about your business of planning some lessons So here you are at Google and you're searching for teaching the Bolshevik revolution and you get your search results Here they are and one of them is MoodleNet. Great. Well, I already know what this is So I'm going to go there and since last time MoodleNet has updated its privacy policy So you read that in-depth click I agree and then here we are the Bolshevik revolution great Well, you can see this is a collection a collection of resources and it says Finally a good collection of multimedia resources about the Russian revolution from the workers perspective You can see that there's some contributors here. So it's a collection which is being made by by people Oh, great. I can add it to my Moodle. So I can add this to my Moodle course And I can also add my own resources collection. It looks like so let's have a look what's in it GCC history the Russian revolution. So this is a website activehistory.co.uk That's got some resources interactive exercises for GCC history And you can see here that some people have commented saying that there's a bit two minutes in which really brings this to life great so there's kind of conversations and and comments happening from some of my colleagues and What else is in here? Well, let's have a scroll down Russian revolution in 10 minutes. Oh, this is a YouTube video again There's other people who are commenting on this. This is great This is exactly what I want for my teaching. So loads of resources here Oh, and there's related collections as well other things that I might find useful This is fantastic and this is something which the red group has collected So a community has curated this particular collection of resources So let's find out a bit more about the red group this renegade group of historians have a shared interest in all things relating to the Russian Revolutions of 1917 well that sounds like a lot like me So I'm going to join this community and I can do that because this isn't one where I have to apply I can just join and then sign up straight away. So here I am I'm now a member of the red group I can join in the discussions and I can start helping them curate resources Excellent. Okay. Well, let's see what's going on. I'm going to go to my profile. Here we are This is me Jeremy and I was added to Moodle net by Andrea LeBlanc last week my good friend Andrea And I've started filling out my profile on my Twitter ID I'm going to probably add my LinkedIn profile later on and you can see I'm now a member of three communities I'm a history teacher. So I'm a member of these three groups I've started tag adding tags or interests things that I'm interested in so that Moodle net can suggest things that I might be interested in. That's exactly what I want So I can make sure I've got good resources and good people I can lean on in my in my teaching and learn So now I'm going to go and just see what's been happening in the week that I since I joined Moodle net So here's some update. This is kind of a highly personalized feed of things which are useful to me So I can see that Andrea is now also joined the red group. She must have seen that I joined it There's new communities People have added resources in there red gents accepted my request to join that red group and my Moodle net profile is 78% complete. So what I'm going to have to do is to make sure I complete that I'm going to have a look at communities I can also search and here are my communities a really Educator friendly focused place where I can find resources and have discussions about my teaching and learning So this prototype was built this week and during this design sprint And I'm really interested all of us at Moodle are interested in finding out what you think of this It's just a starter for 10 and we're going to iterate towards it So tell us what you think get in touch and the canonical URL for everything to do with Moodle net is Moodle.com forward slash Moodle net