Modigliani and Miller assume that the cash flows associated with a firm's assets are not subject to the firm's choice of capital structure. However, the occurrence of financial distress caused by a levered firm may reduce the cash flows of the firm available for its investors. Now, let's see whether there is any impact of the financial distress cost on the firm's value. We have an example where we are using the same earlier example with certain modifications where we see that without leverage the company's worth will be in case the product goes successful 150 million. And if the product goes failure, the 80 million dollars with leverage the company's worth would be in case of product failure less than 80 million dollars. And the outstanding debt will be there to the tune of 100 million dollars. And if the product is failure and the value of the firm is less than 80 million dollars, then there will be the chance of bankruptcy. This will cause the firm to incur a financial distress cost to the tune of 20 million dollars. So the recovery from the firm's assets will be assumed at 60 million dollars. This means that financial distress cost will lower the levered firm's total value. And in this particular case, the MM1 proposition is not going to hold true. Now, we have an example to see the impact of bankruptcy cost on the firm's value under the MM1 proposition. We are assuming that with and without leverage the same payments will be there to the owners. We assume 5% as the risk-free rate and we assume that new product has equal chances of success and failure. The firm's cash flows are assumed to be unrelated to the state of the economy. This means that risk is diversifiable. So no risk premium is needed. We assume the project's betra at zero. So this means that the firm's cost of capital is equal to the risk-free rate. We have the values of equity as we have determined them earlier. The unlevered value of equity is 109.52 million dollars and this is basically the value of unlevered firm. The value of levered firm is, levered equity is 23.81 million. Now, as you determine the value of debt after the bankruptcy cost, it comes to 76.19 million. Now, if we calculate the value of levered firm, we need to add up the value of levered equity to the value of the debt and that is the total of 100 million dollars. So we see that there is a decline of 9.52 million dollars in the levered firm's value and that 9.52 million dollars is basically equal to the present value of the cost of the financial distress which is 20 million dollars and as we are seeing that the computation exists here where the present value of the financial distress cost is equal to 9.52 million dollars. So we see that the financial distress cost in the case of bankruptcy have an impact on the value of the firm's assets. Now question arises that who pays the financial distress cost? In bankruptcy, the firm's equity holders care very little about this cost. In fact, the debt holders foresee the recovery of lesser amount in the case of default. So they pay less amount to the firm as debt initially. These amounts basically equal the present value of the bankruptcy cost and this makes lesser amount to be paid as dividend to the owners of the firm. So we can conclude that in fact, this difference is the money that goes out of the pocket of the equity holders. So in fact, debt holders foresee that there may be the occurrence of some financial distress cost as a result. They pay lesser amount to the firm while issuing debt to the firm. As a result, the same amount is reduced while paying dividend to the shareholders. So ultimately, there are the equity holders who bear the cost of the financial distress. Let's see how this happens. We have an example. That example is the same we are using in our case. We have outstanding shares of 10 million. We have a planned debt issue of 100 million. The purpose is to go for share repurchase using this debt of 100 million proceeds. Risk rate is 5% and the value of unlivered firm is 109.52 million. So the initial share price using this market value is 10.952 dollars each. The value of livered firm is 100 million. So the new share price is equal to 10 dollars each. With leverage scenario, if the company is facing failure, then the debt's new value will be 76.19 million. This means that the share rate purchase will be using this debt proceed of 76.19 million. And the firm will be repurchasing its 7.619 million shares. So the outstanding shares will be 2.38 million. Now using the outstanding shares of 3.281 million, the value of livered equity will be equal to 23.81 million. And resultingly the new share price will be equal to 10 dollars each. That is the division of 23.81 million shares over the cost of 2.38 million shares which is equal to 23.81 million. Now the recapitalization cost to the shareholders is as 0.952 dollars per share and in total it comes to 9.52 million dollars. The conclusion we can derive using this example is that the debt holders bear the cost in the end and shareholders pay the present value of the cost of the financial distress upfront.


This is one on one D right I don't have the internet so I don't have the schedule make sure I'm in the right room I'm up here first Someone else the schedule said there is but so this room's double booked to look like No, I trust I'm hearing about it Yeah, the only thing is it seems like there's on the schedule there's two sessions listed for this room at this time So I don't have the printed one on me, but in people's phones Play something I don't know what's the app say? I Am going to give the first dual session at Rubicon. It's gonna be to come first. Yeah, that's true. I'm here So, all right, thank you Yeah, they're hanging out by the door there. It's not a very inclusive use of the space The session is short enough where I don't have too many bad jokes. So All right, I'm gonna get started So if you're using the app To view the schedule it seems on the app this room is double booked So if you're not here for inclusive mindsets, you should totally stay because you're only gonna benefit from it So if it's not the talk you're looking for, you know Be open to new ideas Have it come on have a seat. I'd appreciate it But thank you everyone for coming to my session I really appreciate having the chance to talk to you about this subject. It's something that I really care about And before we get started, I just want to tell you a little bit about myself. My name is Mike Miles I am from Boston, Massachusetts. I help run the Boston Drupal group there. I've been working with Drupal for about 10 years I do everything under the sun when it comes to Drupal During the day I work as the senior technical solutions manager. It's a long title for a digital Interactive agency digital marketing agency called genuine. I've been there for about nine years my Drupal tenure career Genuine we're a full-service digital agency and what we do is we make we build agile brands that stay culturally relevant We make them easier to love for for their users and we do this by leveraging our full Service capabilities that we have in-house from digital strategy to design to UX to video production And development across number of technologies not just Drupal Drupal is just a small part of what we do But it's like 99% of what I do and we have offices in Boston, Chicago, San Francisco, New York At night I run the developing up podcast which is a podcast focused on the non-technal side of being a developer So if you're a developer out there anything about your development career That's not about code is what we cover on our subjects on the podcast We just released an episode yesterday on leadership skills So check it out if you're a developer or if you're not you know share it with friend If you want to know any more about me you can find me anywhere in the internet Mike Miles 86 Since the short session I'm not going to give you the full spiel, but you can find me on Twitter on Drupal.org on YouTube Google plus I probably still have if you want to go there So I believe that everyone in this room we have one thing in common.  Yeah, everybody in the room. That's excellent like a hundred percent I don't think anyone seeks out on their day-to-day to say alright How am I gonna make someone's day worse by building something? Right, whether you're building something for your company whether you're building something for a client You're trying to see how can I build something that's gonna make a better impact on the users How am I gonna make it so users want to come back to this product website come back to our mission statement? How am I gonna make that positive impact? And this is great. This is something we all want to strive for and One of the things we do for this especially for reaching a positive impact of users is we think about Accessibility needs right we I would hope a lot of us think about accessibility needs by that I mean paying attention to vision and herring and pyramids cognitive ability mobility use amounts or a keyboard When we build our digital products, we think about these these topics and we make sure our products work for these users with these differences The issue is though humans differ on Way more subjects than this this They differ on location on gender on language on their education levels on their age a whole number of metrics that are way beyond accessibility and All these differences which are covered under the idea of inclusive design They change how we interact with the digital world. They impact how we experience the web and the products on there So they change how our users reach our content and how we can make an impact on our users So the idea of a time inclusive design is building something to make the biggest impact on the greatest number of people as possible it came from Actually building in the physical world and it's been carried into the digital world and There's a lot of ways to do inclusive design and with this short talk What I want to share with you is what I consider my four pillars for an inclusive mindset Four ideas that you can apply to any one of your projects no matter what your role is to make sure you're making a positive impact As many people as possible So I created commons 4.0 this for you. So feel free to steal it and share it out My four pillars in inclusive design or inclusive mindsets that I applied to my projects is one that no user is average That every user deserves equal access To provide understandable content for every user and that every user deserves our trust and respect Four important pillars that if we apply to our projects, it's gonna make a world of difference. Hopefully I'll prove that to you So no user is average If we were to assume that every user is average it it seems like It seems like the thing to do right you you figure out who your users are by doing user studies or tests or just making assumptions You find the middle ground you say I'm gonna build for these people that way I'm gonna reach the most number of people possible. I'm accounting for the bell curve in the middle There's this great talk though by Todd Rose Titled the myth of average. It's a TED talk and in his talk. He explains that if you design for the average You are literally designing for nobody I have a Bentley link to his talk here And if you think about the statement for a second it makes sense if you are planning for what's the average user like? How can I build for the average user? There's no one of your users in reality Who is that average person who hits all the those average marks? Everyone falls on a spectrum of the degrees you're trying to target so if we Want to build for our users we have to throw out the idea of the average user and recognize All our users have actual differences. We need to capture those from the onset of our project How do we do this? There's number of ways to do it one way that I think is very easy and simple to implement Is creating personas with limitations how many people here have heard of personas or use personas in their work? All right, great number of the room 85 90% so personas put it basically putting a story a face a name to Type of user and giving that to everyone on your project from your client to your designers to your developers and saying build for this person So to our personas we could list simple limitations that everyone has to build against for example this persona has red green color blindness such as I do and That's going to impact from your design what colors are used to emphasize things It's going to change how you approach your project It's a simple line that makes a big impact so you're building something that works for a person with something They can't control his limitation to people who don't have that Or what about has broken risk due to a skiing accident? This is like a temporary disability You want your CEO who's visiting your site to be able to make it to the donation page without using a mouse Because of this if you throw this in there you have to consider that situation Someone doesn't have a mouse doesn't have the ability to touch to navigate or Does most of their work while traveling this puts our persona in a scenario where they're very distracted They're cramped. They're uncomfortable. They have a small screen. They can only pay attention to a little bit of information that's going to drastically change how you approach your content design and How you approach your UX and what's important to the user? Three simple sentences to add that have a big impact that suddenly if you build for these differences is Going to change how you approach your project and you're going to throw an assumption that it's somebody can see the full spectrum of Color has full mobility and is in a nice lazy easy-going situation So if we use personas with limitations, it's going to help us get past that idea of average The second pillar every user deserves equal access if we believe that every user deserves equals access We have to throw out the idea that we can assume where our users are located We can assume what devices they're using and we can assume the speed they have to access our products There's this interesting statistic from it's from 2016 But in 2016 45% of internet browsing was from a desktop. That means 55% came from mobile devices or other devices This means for majority of our users. We don't know how they're accessing our Applications our websites. We don't know where they are when they're doing it or what their speed is So we can't assume they have a lot of data that they have a big screen We have to take into account how they're accessing and the differences therein So how can we change our workflow to adjust for this? Well, we can structure our markup our content our UX in a way that makes sense If we can't know the device that the person's using we can know the rules that all devices use to read data from The web and build for that one great way is using semantic markup semantic markup is the rule set around html tags and Reasons when you should use each tag. There's a small company. You might have heard of called the BBC. They run some TV stations They have open source their semantic markup Which they state from everything from an msis tag to an h1 header Everything in between when to use it and why and all their digital products follow it It's open source. You can follow it, too Using semantic markup guarantees that no matter what device is reading your content. It's gonna read it in the proper order It's gonna know that an h1 tag means a title and it is a title We can use progressive design to deliver our experiences and get back to the idea to remember that Designs on our websites are not there to make things look pretty. They're there to highlight what is important to the user So start with a very bare minimum I know the develop the designers out there are gonna hate me for saying this But do the bare minimum you can for design for highlighting what's important to the user and then as you learn about where your users are Coming from you collect real-world data as you start to analyze using tools What connections they have you can add on top of that experience add flashy design elements bigger images You know a JavaScript and you can progressively make the experience better But you start with the bare minimum that looks great for everybody And then we can prioritize what needs to be loaded Does your website need to load that third-party JavaScript library to work? Can it work without it doesn't need to have retina images? What about people who don't even load images who are using your screen readers? Is that imperative for delivering your message if it's not figure out a way to prioritize it how it's being loaded on the page So the most important things load first third pillar to provide understandable content to every user if We agree to provide understandable content to every user we have to all Admit to a fundamental truth of the internet to us our projects. We love the code. We love the algorithms We do we love the design the UX We want to show them off to our friends. We come to conferences to tell everybody look at the clever thing I did but to our users they only care about one thing and that's information They only come to our products our websites for content content is king as it always has been So if we want to make a positive impact on as many people as possible It it stands for reason that we want to write our content that is understandable by as many people as possible Some ways we can do this is make sure all the content we write is clear and direct When we can we want to avoid Jargon and use simple phrasing don't use 300 words when you can use two words What's the simplest way to say something that gets your message across? We should pay attention to our font our spacing and our line length for font If you're using a serif font for people who have dyslexic issues or on small screens Those serifs are going to run together where it's going to be hard to read if your letter spacing is really tiny Where it's going to run together. It's going to be hard for them to understand what you're trying to Say to them. So you stand serif fonts with some basic line spacing That makes it easy to read from far away from a small device for someone who Has a hard time reading words That was really a bad way to say that sentence And then line length it's interesting people on the internet.  It's in an F pattern. What this means is Someone comes to your website. They read the first line of texts. They read the second line of texts They read half of the third line quarter the fourth line quarter the fifth line. They start to scan So we're cramming as much content as we can on a page There's a great deal of there's a great chance that people are going to start to miss what's important Again, this goes back to simple phrasing in line length. What's the minimum we can say to get our point across? And finally we can be meaningful with our content. We can use tools to check the readability score So readability, it's not the education level someone has but it's about the amount of mental effort It takes to understand what is being presented There are algorithms that will check readability scores for you and the ideal one nowadays is What's considered a sixth grade reading level that provides content that is? Complex enough that experienced users or native speakers will not get bored with the content But simple enough so that those who are not native speakers are not used to material will not get discouraged and we'll be able to understand it It's almost like the less they have to think about it the more they're going to absorb the less We're going to give them mental fatigue one of the tools I like to use for readability and I do it from everything from my tweets to my emails to client communications to the Content if I have to write it for websites is hemmingwayapp.com There's many other tools that you can use but hemming way up is great online resource put your content in there It's going to highlight complex sentences hard to read sentences It's going to highlight phrases that could be done simply or more simply And it's going to not catch everything for you, but it's going to give you an idea how complicated How much energy does my content take to understand can I simplify it? And then pillar number four to provide every user with trust and respect just as with the last pillar we had to Acknowledge that content is the most important to the users What's most important to us is our users information, but we also have to understand that it's their information They own it they control it. We're just usually asking for that data to view it So if we want that Information we have to give the users a reason why they can trust us with the data because trust is really hard to get on the Internet nowadays and we have to respect who they are So one of the ways I got interested in inclusive design was actually from this talk called inclusive design Excluding no gender by Sarah Lahren who's a UX developer out of Sweden. I want to I want to say And what Sarah Lahren talks in her talk One of the statements is the easiest way to do inclusive design is stop asking about gender and The great idea behind this if you abstract it is thinking about what information do you need to collect and why? So what Sarah does and when she has a client and she sees a form on their website that's asking gender question She stops them and says why are you collecting this data? What do you do with it? Most of the time they say well, we've always collected it Well, then it's doing nothing for you and it's potentially putting up a barrier to users whose information you want to collect and use On top of that if you're asking for gender You're probably just going to do a binary. Are you male or female people identified differently? Why would you? Assume what they are when you can have them tell you by using an open text field or additional options So going beyond this it's about being responsible with the data that we want to collect and having reasons Why we want to do it so every time your client wants to collect information every time your company wants to put up a form and Gather data about a user ask yourself. Do we have a reason for collecting it? Whether we're getting it actively from the user or passively through cookies or other metrics if you don't have a reason don't collect it Wait until you have a reason then collect it because again Especially with forms if there's a lot of form fields where you're gonna tell me about yourself I want to ask only information I need so I don't throw up a bunch of barriers to stop you from giving me that information We have to explain how we're gonna protect the data. There's a lot of reasons to do this Again trust is hard to earn on the internet. So if you want users to provide you accurate information Tell them how you're gonna protect their information actually protect it It's important to do make sure you're doing it in a responsible way and Then finally remember users data it belongs to them You're just asking to peek at it. So you have to make sure you're giving users access to control their information This is great for you because the more you can give users access to control their data The more accurate they're gonna make it you can take that all the way back to pillar one and learn more and more about your user base And build for their needs and make a positive impact on top of that, you know, it's going to become Standard that you give users complete control their data. How many people here have heard of GDPR there's been talks about Yeah, about 75% of the room. Look it up May 25th. I want to say late May It has a big impact especially for Europe but in America too if you have European visitors and you're collecting information You have to know about GDPR and give them control about of their data It only helps you Get accurate information. So this is a this was a short session. So this is a Real quick overview of these four pillars that no user is average. So don't treat them as average Treat them for their differences. Every user deserves equal access Don't make assumptions about how users are accessing your products But try to plan for the differences and how they access that data Provide understandable content to every user. How can you say things that's simply as possible? And then every user deserves our trust and respect How can you prove to users that you need their information and that you trust them to give you accurate information and they can control it? How many people here feel like they could agree to doing one of these pillars on their next or their current project? Raise your hand Good everybody in the room.  I'm gonna make this as simple as possible I'm gonna remove all the words. I don't need to have in there. No average equal access Understandable content trust and respect That what it boils down to If we can do these four things, what are we gonna do? But the thing we agreed to at the very beginning of this talk We're gonna make a positive impact on as many people as possible. We're gonna make the web better We're gonna make Drupal better. We're gonna make the world better Now I save some time because I have a bunch of resources for everybody here This presentation I've bitly links For for all these links. I have this presentation. It's annotated because I know you're not gonna hear me speak with my lovely speaking voice So every slide is annotated so that you can read the ideas behind it I have a bitly link to the left of that for IDX full This presentation is actually a 60 minute presentation that I cut in half for for a Drupal con So you can view the full presentation there. It has a lot more details and examples The myth of average I mentioned by Todd Rose. It's a TED talk. Check it out. It is a real eye-opener He he explains how assuming average helps the US Air Force back in the 50s or not assuming average Inclusive design excluding no gender by Sarah Leran. That was that talk on The simple way to do inclusive design is not asked about gender really eye-opening talk The BBC semantic guidelines for your use Check it out. Make sure you're using your HTML the way it's meant to be used And then if you haven't read this book in your UX developer Inclusive design patterns at IDX patterns a really great book to read It tells you how to do carousels in an inclusive way which one I hate carousels But if you have to do them do them excessively do them inclusively So with that I want to thank you for taking time for this short session If you have questions, we have some time you can come up to the mic or I can repeat for you But if you want to take afterwards you can find me on Twitter and Mike miles 86 I'll be around the conference for the rest of the conference and again my podcast if you want to check it out It's developing up comm so a round of applause and then five minutes for questions And I'll keep the resources link up there for for anybody who wants to copy them now Any questions Yeah, hi there. So first of all great talk. Thank you I was wondering what sort of strategies you use if you ever run into clients who are a little bit resistant to Accessibility or especially paying for it any ways you kind of get them on board with the overall concept Yeah, so in terms of accessibility the question was, you know, how do you get clients to who are hesitant to pay for it? great line to tell your clients is Developers are cheaper than lawyers so A good a great example of this there's been a couple over the years, but I think it was in 2009 target they were getting sued by the Association for the Blind American Association for the Blind and Because they didn't have captions on their images and they're like hey, this is acceptable. We can't understand what's on this page You got fix it targets like nah, I'm not gonna do that They got taken to court it cost them millions of dollars They had to pay the court they lost the court case they had to pay the court fees and they had to pay to have their website updated So that's a big example, but if you're having users who are going to be accessible Or you want to reach accessible users, you know It's cheaper to pay the extra developers to do it now then to pay lawyers later to fix it for you That could be hard for your clients to swallow But you can also say you know if you're building something to promote a product Wouldn't you want the maximum number of people to see this product to increase your revenue stream? It only helps you so my go-to line is developers are cheaper than lawyers We can also sit in awkward silence Four minutes if you want You're also free to leave you don't have to sit here But thank you if you any more questions, please please come on. Thank you


Look, it works on a mobile device. Many of you have been asking about things that work on your mobile phone. Well, here is one. It is called EPIC.GG. And it is brand new. It is in beta, and it is built by an old friend of mine who I am helping now introduce to you Freedom Family, so you can give it a shot and tell us what you think down there in the comments below. The website is EPIC.GG, and I created my own profile here. I encourage you to do the same. What is it? It is, oh, that's rapid tags. It is for Overwatch players to help you find people to play Overwatch with. It is free. It is not a native mobile app yet, but it works quite well in mobile browsers. I will let you hear directly from the person who built this in a minute. But first, I want to mention rapid tags. How many of you know what it is? You just type in your video title here, like Minecraft Rocks. And you get relevant tags that you can use in your videos. This is a free service. Just go to www.rapidtags.io and type in your video titles. Click that I to see the video where I featured rapid tags that is made by one of you from the Freedom Family. I want to feature more projects like this. So if you have some amazing projects that you think can help everyone grow, send us links down there in the comments below. And be sure to use the hashtag AskGeorge. Now, let's hear from the creator of EPICGG. Roll it! Hello, ladies and gentlemen. This is the Terran baseball contrary to popular belief still alive and kicking. I just wanted to tell you that I created an Overwatch tool to help players find new friends to play with. It's called EPIC.GG. Over there, you can create your personal Overwatch coding card complete with your most important information and a highlight clip of your best plays. Your unique link allows you to share this easily on Facebook, on Reddit or in any other area where you may be looking for people to play some Overwatch with. To give you an idea, this is my own personal profile. Heck, you're all invited to add me in-game so we can play some games together. The tool is currently in beta, so of course I'm happy to receive any kind of feedback that you guys may have. I hope you like it. Please do try it out and see you in-game. TGB out for now. Thank you, TGB. How many of you remember the Terran baseball from the good old TGN days? Tell me in the comments below. And let us know what you think of EPIC.GG. In the last video where I introduced hashtag AskGeorge, so many of you asked amazing questions using that hashtag that I realize I'm gonna have to make an entire video series just to answer all of your questions properly. But let's get started with a few highlights with Dark Lord Vids. AskGeorge, will the partners ever be able to buy a freedom shirt? Actually, George needs a haircut. You can buy a freedom shirt right now. Just go to www.freedom.tm, www.freedom.tm slash. Shop, not ship. That will redirect you to the Zazzle store, which we set up a long time ago. But here you can actually buy freedom shirts made by Zazzle. Now, they're not cheap, and that's why we don't really promote this is because we wanna set up a store which these shirts are like $9.99 or less. But for those of you who really want one, you can get one right now. Atlas shared his YouTube story as a 15-year-old YouTuber with over 700 subscribers. Well done. We ask all of you to share your YouTube story in this video. Click that I, that says double your subscribers, because that's what one person did by sharing his YouTube story, and I encourage all of you to do the same. G-Gaming321 said, hashtag askGeorge. I know you used to do shout-outs for small channels which did help them out and will allow the channels to be recognized. Will you do it? Will you allow us to find channels which will lead them to gain an audience and new content? Thanks for reading. We did have a small channel spotlight in the past.  How many of you were fans of the Baldi Brothers? Or before that, the small channel spotlights that I used to do? Tell me in the comments below. It's just George said, I would love for a group of people at Freedom or UK to try and make a webisode series. So something like a drama that everyone could enjoy, like their own show from Freedom. For example, I had the idea of a show which follows a man, a woman, as they train, join teams, progress, get into dilemmas within their eSports teams and we watch their journey from small time players into tournaments and so on. It's a great idea. Do any of you already create webisodes? Send us a link to your webisode down there in the comments below. We'd love to see it. Hail Kira wrote, I think it's a great idea to create TV schedule on YouTube. If you don't know, YouTube Live Gaming now does scheduled programming. They have regular scheduled live streams of very popular YouTube gamers and you can check that out at gaming.youtube.com. I'd love it if you check out my latest VR music video using position music. Let's have a look. Here it is. Oh wow. How many of you have used that VR headset? I've never used it. To see the full video, click the link down there in the description Linker Gaming asked an important question. I joined Freedom. Welcome to the Freedom family. Bet this has been asked a million times but how do I use this partnership to grow? It has, but because you're new you haven't heard any of the answers yet. Here we go. Head on over to youtube.com slash freedom slash about and that will take you to this page where you see all the main benefits of Freedom. Now these are not all the benefits but this will get you started. No lock and forever contract. No PayPal fees. We pay all the PayPal fees from our pockets. We have a GFX team that helps you get professional graphics. We have a community team whose motto is no comment left behind. Have you noticed all your comments down there? Get a reply? That's because of the beautiful community team that works tirelessly to make sure no comment is left behind. We have professional music to help you grow. Check out positionmusic.com, epidemicsound.com and audiomicro.com and sign in with your shiny Freedom account. You don't have to create an account. You don't have to pay for it.  No one else gets Position Music except you, the Freedom family. Does that make you feel special? Transparency, we offer you our full earnings report so you see nothing is hidden. We will launch a stock option program to help you grow towards our own IPO, which we hope to do in a few years. And did you know we raised 60 million US dollars? Click that I if you haven't heard about that exciting announcement yet because it's real and it's going to make a big difference once we start spending that money to help you grow. You should also check out the links down there in the description below that take you to our Discord chat server where you can meet Freedom family members and get your questions answered in real time and find people to collaborate with. Also, go to our community forums at www.community.tm. Click forums and introduce yourself. There is a section for that where you can get to meet a lot of new people and grow your audience. I hope this answers your question, Linker Gaming, to your satisfaction. Hayden Jones wrote, Hey George, I like a lot of what ABM Gaming is doing for the Freedom family and I want to know how I can get higher ranked into the Freedom team, but I still haven't been picked up have my other channel to be used. If you're looking to get your other channel partnered, just go to your shiny Freedom dashboard, click add channel and then link your channel. Then you will get reviewed like everybody else is being reviewed and your channel once accepted will be partnered in the Freedom family. But if you just want to get started in the community team, keep being active down there in the comments below and tell people, especially ABM, that you want to get involved and they will reach out to you. That nerd with the hair, different nerd. Asked, does it have to be a question? No, it doesn't. The point of ask George is you think your comment deserves a spotlight because other people will benefit from seeing it in video and reading it in the comments. So anything goes, suggestions, observations, whatever you like, it doesn't have to be a question. And guys, there are hundreds more of these ask George comments and I have to address these in a better way because I don't want to leave any comment behind, especially if you've taken the time to use the hashtag ask George like I've asked you to. So I need to find a better way and if you have any suggestions, tell me in the comments below. Who am I? I am George Sunpai, Papa George and many other names. You, the beautiful freedom family have given me. I am George, CEO and founder of this beautiful family called Freedom. And I actually have the shirt that says Freedom today. If you like this video, click the like button down there so I know what kind of content you enjoy and subscribe to Freedom Central, this channel behind me. It is the home of the George show. I am George and you've been watching. Click that I to partner with Freedom and join the Freedom family so we can all grow together. You get many perks, like position music, you also get epidemic sound, a lot of other access to royalty free videos, sponsorships and many things to help you grow. Just click the links down there in the description below to get involved in our community, our forums, our Discord chat servers, meet our graphics team, meet our community team, all of that on Discord and the forums. What are you waiting for? Get started. And we will grow together as a family because this is the Freedom family. You are part of it, we are all part of it and we're all growing together. To get more George, click that big F that will subscribe you to Freedom Central, home of the George show. Click the Freedom family plus one video to see I'm having a new baby number four and the $60 million video to see the $60 million coming to Freedom to help you grow.


Hello and welcome to the state of blockchain security here at the blockchain village at DEFCON 28 I'm excited to share with you just a really zoomed out view of the current state of our industry We'll talk about a variety of blockchain security related events major incidents We'll gather some insights and make future predictions and most importantly. We'll talk about a lot of opportunities how to build a stronger and more trustworthy financial system So in case we have not met my name is Peter Kaczyginski I'm a blockchain security engineer at Coinbase Where I spend most of my time trying to break and secure a variety of standalone blockchain systems and smart contracts On the side I also publish a blockchain Thread intelligence newsletter where I share the latest news and Partially I will be recapping some of the major events that I cover in that newsletter And in the past I was also organizer of the capture the coin competition at DEFCON In the past I was working also as a malware reverse engineer at far I if you're a malware reversal you may have run into a few of my tools such as flair VM and fake net ng And I've also reversed a whole lot of APT malware. Then I care to remember Zooming even back out I was more on the offensive side as well for the Federal Reserve system where I was working as a Penetration tester trying to break finance 1.0 I guess everyone shares their story of how they got into crypto The revealing moment for me was just basically my past growing up in a Soviet Union and observing what hyperinflation means in the first place so it really it really Stroke a chord in me when I understood what what are the what it would the future offered by the cryptocurrencies and I take it as a personal mission to make this feel succeed by making it more secure And I hope you join me on that mission as well So what are we going to talk about? I would like to help inform educate and Identify as many opportunities for you as possible. So if you feel like this is the field for you You will be you'll know exactly where to plug in and what to pursue Within the stock we're going to talk about a variety of incidents as I mentioned from the newsletter But the key point here is that it's less about me being right I will offer some insight and opinions here But I'm even more excited to start a discussion and learn from you during the Q&A session or offline if you care to reach out I Would be highly excited to hear your thoughts on it In our presentation will begin by defining the field in the ecosystem So we'll talk what is blockchain security water? How is it different from you know any other? Security disciplines, let's say web application or IOT security. What makes it unique? We will also talk about the overall ecosystem that we're trying to protect and also think how it's getting attacked Next we're going to break down all of the Variety of the components within the blockchain security field. So we'll talk about exchange security What were the major incidents this year so far? What can we learn from it? We are going to talk about the asset security So we will discover a variety of protocol issues that are being exploited We'll talk about software getting attacked other weak points And last but definitely not least is user security We're gonna deep dive into the main point of why we're building this is for the users for people to be able to transact securely We will finish the presentation with thoughts about building this industry how to make it more mature What we can do to share the guidelines to that people can just pick up and Implement in their next projects the tools that still need to be developed as well as how we can build up our community So let's begin first by defining. What is blockchain security? I believe it's a brand-new field. It's a new discipline of Information security with a mission of securing and defending the cryptocurrency ecosystem What is cryptocurrency ecosystem? We again I mentioned users are at the core of it We have a variety of assets both layer one and layer two. So smart contracts and all of that So nodes wallets smart contracts are all within the scope of this field. Of course exchanges a variety of people choose to delegate and use centralized points of Storage and key instead of holding all the keys themselves And a variety of attacks and input security implications that that brings including what are the issues with cold hot storage? the incidents that are happening in this world and and other issues So some of the threats that we'll cover throughout the stock will talk a lot about malware Just because of my background will cover how it's affecting both the assets where they're getting back door malware attacks against users themselves the ransomware and the miners and all that good stuff as well as how it affects exchanges We'll go through fraud and scam schemes That are perpetrated against users. We'll talk about what are the losses? What can we do to defend ourselves against it make users feel a little bit more comfortable and safer? We'll talk about network attacks. So we'll dive into nitty gritty technical details of attacks against a variety of different Chains and lessons that we can learn from them we'll talk about phishing attacks against exchanges and users and Definitely about bad actors. Who are the people behind those threats? What can we learn how we can better defend ourselves against it? So let's first dive into the exchange security? Fra I mean last year if you've been paying attention in 2019 there were so many incidents when one exchange after another foot was falling down with Millions and millions of dollars lost from the hot wallet theft This year what I'm observing is something different Is that we're seeing two incidents from BlockFi and coin check where the attackers shows not necessarily to go after? the you know just grab the coins and run off instead they were content was just getting to PII data. So we're talking about emails addresses other personally identifiable information from the customers so the the first incident that I'm going to cover is BlockFi and They they were good at publishing the incident reports fairly quickly However, what they described as the reason the root cause for the attack is that one of their employees was simported Simported to access the internal portal. So this sounds like a something preventable I mean if if you're if you're defending your simp your Internal portal with with a phone with you're to using to FA that which is like some kind of SMS or a phone system It really could have been improved. It's something that could have been avoided similarly coin check reported a loss of 200 customer 200 customer pieces date PII data and again the the root cause for it was the main registrar was hacked It's something that could have been avoided by maybe picking someone more secure or Trying to find a way how to secure your registration. So it wouldn't be hijacked as easily And of course this year we have, you know, good old hot wallet theft. So the year started with Altspid with really tiny Financial loss. It was only six six seven bit coins stolen and 23 E Lawsack took credit for this compromise Unfortunately, the exchange shut down as a result But and so we don't really know as much information about what caused it What was the underlying issue? But it's just continues on the trend from last year that these things happen and this happened early in the year I believe in back in January and more recent incident was from the Kasha exchange Which reported loss of 336 bitcoins and again the reasoning that they described was that their employee was using a personal laptop to conduct Official business. So they were running OTC desk from their personal machine Which apparently got malware on it and the attacker was able to get away with the keys again something that could have been avoided So some inside some observations that we're seeing so far our exchange is getting more secure I think so we yet we're observing a decrease in the number of incidents back in 2019 It was absolutely insane where yet multiple exchanges sometimes compromised within a single week So far we're seeing four exchanges with only two of them Resulting in a direct monetary loss Speaking of damage my financial damage itself The total amount of lost was in 175 million back last year. We're almost Six months in into the year and the total losses so far only four million dollars. So the financial damage is going down What's also very interesting to see is that folks are very open about the compromises they release incident reports within 24 hours They tell you exactly who who is affected. What is what was the issue? So that response is just really good to see on the other hand as I mentioned the types of incidents They could have been really easily avoided Sim swapping that could have been locked down ahead of time the running letting people employees run Official work on Unmanaged personal laptops is just a very risky thing to do Another trend is the is the attackers going after more than just hot wall not more than just the coins themselves So I imagine that whatever PII they stole on one day Come Monday, they will turn around and try to perform Sim swapping attacks. In fact, there was a article I believe where there was an interview with the attackers where they explicitly said that well, you know what we kids We the best way for us to monetize is to actually just to start sim swapping instead of trying to sell that data or using Any other type of attack? So this is something we may see more in the future Next let's talk about the asset security specifically Security of the protocols like we're talking about the interaction between different chains and nodes and all of that Well, the best example are the Variety of 51% attacks which are been always happening will continue happening. I First we'll cover two incidents with Bitcoin Gold So the first incident was back in January 23rd and 24th So there were in fact two 51% attacks back to back it resulted in 29 block reorg which is fairly sizable and it definitely resulted in a double spin So this is unfortunate. This is something that we we observed Happening for a while any coin which is using which is as literally relatively lower hash power and And has a hash power available for sale that you can easily rent on something like nice hash He's getting 51% attack What's interesting is the second incident on July 10th is that the attacker apparently once again tried to rent out the power Some hashy power on nice hash But in this case the miner who rented out their capacity apparently figured out they're doing something bad and Was able to notify Bitcoin Gold developers. So what they did is in response to that was fascinating and potentially trend for the future is that they contacted miners in secret and Distributed modified piece of node software, which had a checkpoint that checkpoint essentially invalidated whatever New chain that the attacker was mining in secret. So what happened was once the Once the attacker actually published the reorg chain. It was not accepted by the network So they wasted all their money on on nice hash and all their efforts Bitcoin Gold published their Report about what happened what they did to defend the network This is this is concerning in and well in this is interesting also in two ways on one side It's great that the they were able to catch it but this was only done because one of the nice hash miners was Vigilant enough to be able to notify them. So this could have been just as easily missed Depending on how you view those networks introducing checkpoints into your protocol secretly communicating with miners It depends on your specific looks and decentralization that may be considered by some as Something that we don't want to see but it's it worked in this case And we'll in fact see later on when we talk about work coin It is once again something that repeated where developers of node software were communicating with Miners in order to seek help secure the network Another interesting trend about this particular attack that the rework was massive. It was 1300 blocks reorg So the attackers are willing to spend and invest significant funds into their attacks in fact The most recent incident which is still ongoing is starting August 1st Is a massive 3500 block reorg the first of two Where an attacker apparently spent more than 200k on nice hash to rent capacity in order to double spend an exchange So in this I in the slide. I'm only listing the first incident. There was in fact yet another reorg attempt Successful reorg attack on 51 on the ethereum plastic network with another massive 4000 block reorg So some of the insights in this is that these types of tech will continue any coin which is which has easily rentable GPU capacity That you can rent on nice hash or something that you can repurpose from another coin They they are They will be attacked. They're they're under a risk of getting attacked What's another interesting observation with bitcoin gold gold did with working with miners and kind of trolling the attackers by Not not saying ever to everyone was like, hey, we're we know there's an attacker and they're about to release their Their secret chain any time now they actually waited for the attacker to waste their capacity and their funds to until they Until they found out like wow, okay. This was all wasted effort So what I covered before were traditional 51 attacks against proof of work networks What's interesting happening on the blockchain networks Today are is that there's a trend towards shifting into a proof of stake consensus algorithms so What I'll cover are two different coins so steemit incident and the ethereum incident and explain how they're potentially trend setting and Something that we may see more in the future rather than just more and more 51 attacks So on the steemit side I guess just just summarize incident uh just in sun from tron purchased the steemit coin There was a disagreement over how to manage uh vast assets of frozen funds that were initially pre-mined since the beginning of steemit The way that this disagreement was addressed was not through negotiation and trying to find some kind of agreement but in fact it was On the tron side They decided to attack the coin By taking over its Delegated proof of staking algorithm So if you're familiar with proof of stake algorithm, uh, the more coins you have You can take those coins. You can lock them up somehow to give you some voting power. So you can This is what's called staking in order to produce blocks or vote for whatever Unchained actions. So some coins use governance for that in the delegated proof of stake systems, uh, you don't You don't vote for blocks yourselves directly Something for example in e2.0.  So this is the system used in steemit eos and other coins So what happened in this particular incident is that tron? Colluded with a number of large exchanges, which were holding Vast amounts of steemit coin in order to gain the controlling package of the asset Once they got that they were able to vote in Uh, a controlling set of validators which allowed them to basically control the network They were empowered to set. What are the consensus rules? Once they gained that right they were able to push an updated note software which unfros Through a basically a hard fork unfros those funds which were from the initial pre-mine Which absolutely gave Tron a controlling Package of of the asset in the system where no one could really challenge them And they were able to hold on to their power indefinitely Taking the ethics aside their their arguments On both sides that you know, why did this have to break down into a technical attack? When something that could have been agreed upon just by Dialogue what's interesting about this? This is the first case of a proof of stake attack And we could see how it played out What was the way that it played out is was very quickly between the time that tron was able to get the controlling package of steemit coins to pushing their own set of validators to pushing a hard fork to unfreeze funds to taking those funds and Yeah, you know multiplying how many how much voting power they have it didn't take months or even weeks it took hours So it was a highly coordinated attack. It was executed very precisely and effectively Um, so this was a fascinating example on the ethereum side We are again ethereum is something that has massive hash power So we're not going to see fit highly unlikely We're going to see 51 attacks, but there's still a variety of things that people do For such as a mempool manipulation When uh, when there was a black swan event when the price of ethereum went crashed And a bunch of maker dow auctions were starting to get liquidated There was apparently a mempool attack where they try to cause a high degree of congestion so that Some individuals were able to create a number of liquidation bids For nothing at zero zero bid liquidations and be able to win them because they essentially did not have any competition Because the network was congested. This is this is very interesting approach. We've seen mempool attacks before but this is interesting how we are um, manipulating the underlying protocol underlying ethereum network in order to attack Higher level smart contracts and defy projects as well So some network security insights from what we've seen is that steemit That opens up a new era of proof of stake attacks and governance attacks Instead of being worried that someone will buy up a whole bunch of miners or mining capacity Hash power capacity on nice hash now the power is in the exchanges the exchanges control the most coins Exchanges colluding together may decide to attack a A chain So this is something that we have to be on a lookout for now Attackers are getting more creative as well. So mempool manipulation in order to attack a defy project Is is something interesting that that we will likely see as well Let's switch gears a little bit and instead of talking about asset security on the protocol side Let's talk about the underlying software itself in the end. It's it's all abstract It all works in the cloud But what's actually working the actual logic and code that runs is in node software itself Nodes are complex Pieces of software and they inevitable that they will have bugs and vulnerabilities So a few interesting incidents that I want to cover So far this year Two of them happen on the test net. So I'll start from left to right So the salana network, there were no issues in the protocol itself So the design I believe it uses a bft like system Um The issue was in the implementation. There was a flaw. There was a vulnerability in the way that it's failed to The node software failed to validate transactions, which essentially allowed somebody to print 500 million salana coins On the on the main net project so the tender mint, this is the underlying consensus library used by projects like cosmos and others Uh at the now service vulnerability Was discovered which essentially allowed someone to uh hold the entire network And again, this was done not because of some flaw in the product protocol. It was because of uh notes failing to validate Especially crafted blocks Uh, the last example is the inflation bug those are particularly dangerous because the effect the entire ecosystem Luckily, this one was discovered again on the test net where nine billion file coins were minted This was patched Uh and did not affect the main net But you can see like the the vulnerability. There are only three examples that i'm listening here, but Uh the vulnerabilities in node software can have severe implications for for the market On the wallet side again Any piece of software will have vulnerabilities Monero wallet failed to validate specially crafted Uh transaction coin based transactions to be specific Which resulted in it appearing as if you were you received more of Monero than was actually sent This is something similar to if you recall there were a whole bunch of exchanges compromised with the ripple There was a special flag which is basically telling you how much you are Vouching to send as opposed to how much you actually are going to send. So there's a potential for Exchanges or individual wallet owners to incorrectly credit Whoever is sending them funds Lightning network, it's still very much alpha system. So it continues to have vulnerabilities discovered and patched There's a lot of there are a lot of papers getting published So this is actually a good sign that people are looking into it and finding flaws early on No arch and wallet that was an interesting bug that was responsibly disclosed by open zeppelin and effectively patched by the arch and folks is that It allowed it allowed users to basically create a kind of recovery mechanism using specialized guardian nodes and In rare occasions when such nodes were not properly defined It allowed anyone to take over those wallets Once again, this was patched but an example of vulnerabilities and wallets What's more interesting are not the vulnerabilities that are discovered and patched This is normal What's more interesting are intentional backdoors that are introduced in both wallets and node software So the first incident i'm going to cover it happened in the trinity wallets in the way that We've seen we've seen backdoor wallets for a while last year I talked a lot about the election wallets getting backdoor The way that they've the way they attack the trinity wall was not directly not going by after the main repository itself instead, they were going after the Third party dependency So the third party dependency on which trinity wallet was relying to was patched to steal users keys That was included in the main repository And any user downloading and using this was heading had had this asset stolen Raven coin Incident was even more dishes On july 4th an inflation bug was discovered and an emergency patch was issued to a variety of nodes and and distributed to miners And this is something that initially Maybe it was just a vulnerability every once in a while you discover those things Until the point they realized that the bug was intentionally introduced it was introduced back early in the year in january By an account, which was a throwaway get up account The patch appeared to be very innocent looking Commits which allowed you to be more verbose about the type of errors that you're getting so it's snuck by Um The the core maintainers eyes.  There was a script running that was slowly minting RV end coins So a total 300 million RV end coins were minted Over time and unfortunately also sold on exchanges. So this was a successful Inflation bug that was maliciously introduced and exploited Uh, these are particularly scary and I'm sure we'll we'll see this again and again because they attack the whole ecosystem rather than individual user or piece of software So some insights on node and wallet software security Vulnerabilities are still very rare. We only talked about four flaws here and one was introduced intentionally The question and challenge to you. Do we really have enough eyes looking at nodes? looking for the vulnerabilities and Be able to patch them. There are bug bounties which are available But I wonder if there are enough participants and enough folks which are really Pushing the limits of how secure that software is Raven coins stealth commit and trinity supply chain threats. This will likely happen again Attackers are highly motivated. There's a direct financial profit in attacking these pieces of software So this will likely repeat So switching gears a little bit on the layer two issues, which is smart contracts That's even more concerning. There were I mean, I'm listing here 10 incidents There was one more that happened in the last few days, which is not included here As d5 projects are getting more and more popular The vulnerability. This is complex software, which once again has a lot of different vulnerabilities Which are constantly getting discovered I'm not going to cover all of these just it would take a whole hour on its own But I'll focus on just three of these So we'll start left to right The first incident that basically opened the year was the bzx d5 project back in february And the way that it started out was there was a margin trading vulnerability that was exploited 1 million worth of ETH was stolen What was interesting about this particular incident is that the use the attack or use flash loans in order to amplify the attack flash loans is basically A mechanism where you can borrow x amount of an asset And return it back to the initial point All within the same transaction So you're paying non-existent or minimal fees for doing that and allows you to execute an attack in between Since you have all these assets available to you in order to execute the attack So this kind of defeats a kind of a paradigm that we had before where we think that if we If it's if it costs so much money to attack something that is highly that it makes it more less likely That someone will actually execute the attack but with flash loans the attackers have really minimal risk To basically the transaction reverting then so be it they don't lose anything And they they can return those funds and whatever they loaned and They don't really lose anything, but if they win then they win big. So in this case, they won 1 million dollars worth of ETH Um, and we start seeing this flash loans approach happen again and again throughout the year From this point on Another incident which is interesting to note is the balancer project. So again 500k was drained from multi token pulls This one is interesting because it wasn't the vulnerability in the balancer Smart contract itself It was in the way that one complex project was interacting with another complex project in this case the developers could not predict that you could use deflacering tokens which Change the logic to the attackers advantage So when on its own like in all of their testing with traditional token systems Then it's it works as expected So this is something that is well known in the traditional computer security practice and something that needs to be applied to defi projects as well another gotcha in this one is that The vulnerability was reported in a bug bounty report. So the good news is bug bounties work I think a lot of the projects in a defi space do have bug bounties It's just it's very hard to triage those things very hard to find the ones which are Real examples of an attack and or which ones are not as good quality So this is this is something to keep in mind when running your own bug bounties Now the last example and again, this is something that example here repeated in other incidents is a bank or project where Developers were notified That they had a vulnerability. So they learned there was an issue and the way that they approached to To protect their users is by attacking their own coin their own smart contract With the same ways that an attacker would is just that with a purpose of actually preserving user funds But what was interesting here is that arbitrage bots apparently their piece of software constantly monitoring the ethereum network seeing that if there is some large large activity happening and it starts automatically replaying it trying to Art make a arbitrage opportunities exploit arbitrage opportunities there picked up on developers trying to Secure users funds and we're automatically able to exploit the project in the same way that the developers were doing it So it's fascinating to see those automated piece software that just piggyback of Existing attacks So some insights on the leitu smart contract security This is going to be the year of defi hacks both in the the amount lost The number of vulnerabilities discovered unfortunately The the the number of incidents is on the rise So it will likely continue seeing that this year The bug bounty Programs they work and developers are catching bugs early, which is a good sign And i'll explain you why in a bit when we talk about tooling and guidelines But the interesting trend to use by bancor is that we often have to hack ourselves to secure funds complex code will continue having bugs and complex interactions between different projects are also something that we need to think about as this is the whole point of defi is that you're You're creating links between vast smart contract projects out there So i promise to talk about user security and we had a few major incidents that we're going to cover shortly from twitter and so on But this is this is uh It's not sometimes it's not as exciting of a field to look at but just as critical as any other uh discipline So we're going to talk about cryptocurrency malware variety of scam And fraud schemes as well as just talk a little bit like who are the bad actors who is doing that who are the new players in this arena now so first let's talk about the Uh crypto mining malware, and this is how i got into partially into cryptocurrencies is that essentially for a year i was reversing nothing but uh ransomware and crypto mining samples For on the crypto mining side. It was always the monero folks. They are Setting up their miners xm rig into anything that can possibly run xm rig So if they could run in a toasters, they probably would run in a toasters Uh, so far this year. It's not as bad as uh, you know Russian scientists running nuclear stations Mining on nuclear stations But still five u super computers were hacked in order to run monero miners We had multiple issues with docker where attackers were scanning vulnerable api Endpoints to take over existing docker images or just publishing their own backdoor Docker images on the docker hub, which would also Mine monero in the background and of course there's just never-ending stream of windows desktop malware one example is lucifer, which is just it's an arsenal of um There was a whole exploit built into it which can self propagate attack other windows machines and spread on its own So on the ransomware side It seems like this this is an ongoing threat. I'm not sure yet if the If the trend is going down yet, but uh, so far we had ucsf, which was attacked for 100 bitcoin or so travelx earlier this year 285 um Just a few days ago. We learned that cannon was attacked with ransomware by I believe the maze crew We don't know they're they're known to ask for bitcoin as a compensation As a ransom. So we'll find out when when the When the incident concludes and of course it seems like every city in florida is getting ransomware on their on their machines So an example of city of riviera had to pay 65 bitcoins to get their systems back online Yeah, so this sucks. This is unfortunate. This is this is a thread that we have to worry about especially on systems like ucsf in the time of covet, but This is something we'll continue seeing the narrow miners will hack anything available to them to get to install the crypto mining malware Ransomware appears to be on the decline, but it's too early to say we're still only halfway through the year to to establish a trend crypto giveaways Well, I mean we all talked about the twitter hack which was absolutely epic. I don't want to steal victor's Keynote presentation tomorrow, but he'll dive into more details, but just to summarize 130 Accounts were hijacked on twitter from exchanges to celebrities to corporate accounts The way that we're hijacked is that the attackers were able to basically get access to the internal tools through social engineering of twitter employees And that's kind of fascinating like the best thing they could think of doing it was Was running a btc giveaway scam? So on one side, this is really bad on the other side. It could have been much worse Elon musk is getting no break from From youtube scammers. So anytime you see a space x Feed there's likely going to be send btc notes everywhere. So sorry elon mlm scams are Still continue on as before. So we started with the bit connect and Moved on to four billion enterprise of plus token and now the latest and greatest is chinese police just busted Woe token scammers who managed to get one billion dollars worth of crypto from 700 000 victims What's more interesting is Not just the the existing scams or the ones that I covered before but the trends of what are we going to see? attackers experimenting with which may Become something more prevalent So one example is the maker dal fishing attack and that is a that's the first example of a web3 fishing scam.  So this is something that was reported early in the year and Something potentially we'll see in the future The justin sun sun A deep fake scam that was fascinating someone essentially recorded a video of justin sun Making doing some kind of an investor scam trying to get people to send money to this unknown entity And they play that video on a skype call complete with Justin cuffing and it looks very real and also very fake and strange at the same time They fake this passport to show for some reason If you if you want to search that on youtube, it's a fascinating video to watch We're still it's still not something that was successful But it's kind of fascinating that scammers that you've been exploring deep fakes for for that purpose The last example is is the trust wallet scam. So We see just a barrage of backdoor fake wallet software everywhere on If you search on google if you search in the app stores What's interesting about this case is not the wallet itself. It's how it was addressed, which is a security researcher Was able to actually attack the infrastructure a fairly broken infrastructure on the attacker side to start recovering the funds and this is an interesting trend of basically folks taking things into their own hands to help users So a quick note about the bad actors. So we already talked about the individual attackers. So the twitter folks, you know Three were already arrested one in florida one uk So we'll call them lone wolf type attackers Inside a thread such as kasha employee who got malware in their machine and was Unfortunately result in funds loss Um, let's talk about apts. So we're we're familiar with the lazarus group. So that's the north korean apt And a whole variety of financial ransomware groups who basically attack anything with financial gain What's interesting this year is the crypticor apt, which is our very own dedicated cryptocurrency exchange um advanced persistent threat So with a bull market, um, maybe happening and sometime in the future In the renewed interest, I will see uh, we're probably going to see more dedicated groups like this as this becomes highly profitable enterprise So some insights One is that users are taking things into their own hands So we have was who's suing youtube for being too slow at taking down the giveaway scams We have michael terpens suing at&t to Basically compensate him for the for allowing the sim swap to happen in the first place We have researchers like harry denly reverse hacking scammers to get users funds back Well, it does sound good on one hand that you know, people are really pushing their their fighting back against the scammers I really wish the industry was more mature and we had enough tools on one side, but also user education and guidelines and other security controls available That not as many people would get compromised in the first place MLM schemes are incredibly profitable. So this year out of all cryptocurrency scams Uh, basically 99 of the take was the low token one billion dollar scam Um in the past plus token with their four billion dollar take I think controlled a whole one percent of the total bitcoin supply So these things are incredibly profitable and will definitely continue Uh an interesting trend that exchanges are proactively blocking bad addresses to protect their users So there's always debate of centralized storage versus decentralized storage that's something that That was interesting to observe This year is that exchanges like coinbase. They were basically blacklisting the The attacker addresses immediately to save their internal customers funds Um, this is something that could be decentralized as well. If you're looking for a project to be able to Um alert users of of doing some kind of unsafe action And I believe a few projects like my crypto are in fact doing that already Scammers are getting more creative so, you know the web 3 fishing sites and the Deep fake scams. This is fascinating to see. I'm not sure which how profitable there are yet But if they do become profitable at one point, we'll see a very rapid rise of them so to summarize The state of blockchain security Insights that we've seen so far We talked about the exchange security Um, the number of hacks and financial damage is decreasing. That's great Um on the other side existing incidents could have been easily prevented Attackers are going after more than just coins. They're going after pii. They're getting creative On the asset side low hash rate gpu mind about proof of work coins are getting 51 percent attack We'll continue getting 51 percent attacked Uh, there was a first example of a proof of stake attack and it was very efficiently executed Um, we're not finding nearly enough node wall vulnerabilities I think there's an opportunity there to for independent security researchers to really start looking at that Nasty backdoors and supply chain attacks against nodes and wallets Again, if you can backdoor node, you can attack the whole coin as the whole ecosystem You don't have to go after individual people and you can take Basically the whole asset down. So this is highly dangerous highly critical to start looking at D5 vulnerabilities are unfortunately on the rise and so are the attacks as the the whole ecosystem is becoming more popular on the user side I don't see any new threats which are suddenly popped up. Um, it's just a consistent threat from miners ransomware fake software Um and scammers are still sticking to giveaway scams and mlm schemes They're getting more creative here and there, but They I mean the the giveaway scams unfortunately still work So an opportunity here is to work on more user education to see if we can Make users a little bit more secure So we've seen what the issues are we've seen what the problems are here and there I dropped some ideas of what you can do to contribute to the field make it more secure But really we can look at it more holistically and think of of the blockchain security as just a standalone industry That we can build up together we can grow in terms of maturity education projects and so on So something some ideas that i'm going to cover of what we can do is we can talk about the guidelines of tools How we can develop those we can talk about growing the community And specifically you what is it that you can do today to start applying and contributing to this field So on the guidelines of tools side there a few Amazing projects that are available. So on the consensus diligent folks there they keep on publishing A variety of software to test smart contracts. They publish the swc smart contracts weakness classification Registry where you have a listing of top all abilities Give you build understanding like what they are how to prevent them Trail of bits folks. They are publishing tools one after another. They have the slither echidna they published a document this basically summarizing findings from All of their smart contract security assessments. What are the trends? What are the top issues to look out for? Open zeppelin essentially defined the field of how to write secure smart contracts. I'm seeing A lot of the newer projects. They're just basically verbatim adopting open zeppelin open zeppelin templates And they're very secure as a result Other projects like securing they published the smart contract security verification standard ncc group publish an owasp style list top 10 list back in 2018 but unfortunately It wasn't really maintained for a while. So it would be interesting for them to Give new life to this project another one is the cryptocurrency security standard and this one is interesting because If you notice all the previous things that I mentioned, they have to do with smart contracts and ethereum This is the only standard and project out there Which attempts to talk about more about the how to securely generate keys how to securely store keys in the cold storage I would love to see this project growing and having a larger impact On on the security of exchanges and nodes and wallets and so on Guidelines and tools are important if we are to grow this industry we need to have a large collections Really available for anyone who wants to contribute to this field to be able to Quickly learn from the mistakes of the past on the smart contract side. I think we're pretty solid We have great tooling. We have methodology We have a variety of companies and consultants who are available to test your smart contracts So even though the there are a lot of defi issues which are getting discovered But there is enough tools and folks that are experts in this field that can address this trend very quickly On the other hand, we're missing Core guidelines core methodology and practically no tools to address standalone blockchains How if if someone wants to build a new project What is a what is a good resource that they can read? And learn about the failings of the past and how they can Learn and correct whatever future designs of their building No configuration operation Nodes are at the core of any blockchain project if if nodes at some point start having more and more vulnerabilities discovered Then this brings down everything that is built on top of them hot and cold storage security key management protocol design wallet design innovations in blockchain forensics and also user security how to educate users and give them simple guides on how to avoid Scams how to give them tools to quickly protect them against going to bad websites like google browser style Like this is dangerous. Don't send to this address One thing that I will be covering later in a separate talk on attacking defending blockchain nodes Is i'm trying to create an oas top 10 style listing of what you can do to secure your node infrastructure um, but I invite all of you to Pick out any one of those items in the list or if you imagine that you have more things to to contribute to this field And start writing documentation start writing tools. There's there's an entire field available that you can develop and work with On the community side. Well, here we are at the blockchain village There are three other conferences which are also available that you can attend hopefully virtually throughout the year But I I wonder if there should be more. I imagine that as the community grows and this field grows. We're going to see more and more of these We have our own competitions. So we have this year. I believe victor is hosting a Blockchain investigation competition last year. We had to capture the coin and chain heist There are some challenges which are ongoing such as open zeppelin's excellent ethernet So this is great On the knowledge sharing side We have a variety of resources. So you can go on telegram reddit This court here for def con and you can talk about blockchain security Some newsletters that are also working on distributing disseminating knowledge. So the one that i'm writing is blockchain threat intelligence Where I try to cover what every every piece of news that is related to this field Not just related to smart contracts, but just holistically exchange security malware user scams and all of that Consensus diligence, they're running an excellent smart contract security newsletter. So if you want to raise your focus on ethereum and layer 2 security This is this is the resource to subscribe to immediately We even have our own shitty movies. So we have crypto where we have You know ml officer hunting down and investigating blockchains to bring down russian mafia and the money playing I'm not sure exactly what's happening there. I think the plot is they're hacking crypto on a Plane, which is a fortress and a casino Point is we have our movies. We have our media this we made it officially. This is great So some community insights We're still a very small but growing community with unique computations gatherings chat rooms challenges tools projects and so on Our community should and will continue growing What's exciting to see is blockchain security or block sec becoming a career option Even today you can look on the internet and you can find jobs to do smart contract security testing if you want to You can do blockchain security engineering so building projects security projects Uh cryptocurrency forensic analysis is is going to be even more in demand after the twitter hack more people will try to Exercise this new skill set So this will i'm hoping this will grow in the future The point is i want to invite you i want to invite you to contribute to this field Uh, so if you enjoy learning about the nitty gritty technical details consensus make it into the smart contracts Great join blocks that contribute to this field. There's plenty of things to explore and do here If you're a security professional and you're just tired of finding yet another xss or spl injection bug You want to find some cool new things which are Just not fully explored yet. Basically be able to define the field. Great join block sec There are plenty of bugs that need to be found and passed by you Are you investigator who is trying to hunt down the fraud service wants to understand like how the hell do we track down Fraud and bad guys on on the blockchain. Great join block sec. There are plenty of blockchain analytics companies out there There's there's growing a body of investigators who are now capable of doing those tasks Join them. This is this is very interesting Uh, finally if you're a developer and you're just looking for an exciting new project And you really want to make an impact on the open financial system Making that system more secure contributing it to to be more trustworthy by the people using it Is a good way to to help bring it about so with that Join block sec and thank you very much for your time


energy we actually use for cooling and refrigeration.  The more we cool, the warmer the planet gets, the warmer the planet gets, the more we have to cool. And this is due to the reason that we use a 150-year-old technology called gas compression. So we all know freon, HCFCs, very bad for the ozone depletion. They were replaced by other chemicals, HCFCs now also being phased down, and we're going back to the refrigerants we used a hundred years before, and they are toxic, explosive, or you have to compress them very hard. The second thing is we have reached the efficiency limit. We're not getting any more energy efficient with the current tech. And there are not many solutions out there to change the paradigm here. Of course, there's one. And this is magnetic cooling. We have a special alloy which heats up when you magnetize it. It cools down when you demagnetize it. And you can see here that it has little porous like pores, so you can actually push something through this metal. So when it's hot, we can take away the heat for room temperature applications. We use water. And when it's then cold, we can actually cool down water and make this usable. Which means we don't have a gas. It cannot leak into the atmosphere. It's not explosive. It's not toxic. You could even drink the water. I wouldn't do it, but it would be safe. And we can actually increase the energy efficiency by up to 40%. So for that, we use a permanent magnet for the room temperature application. The first application is very straightforward. It's going to be a fridge for supermarkets and beverage manufacturers. With our higher energy efficiency and the easier technology, we can cut costs for operators because less on the energy bill but also less on the maintenance bill. And it's going to be a plug-in unit. So you can put it anywhere. So you don't have to deal with limits in explosive refrigerants. And it's an interchangeable cabinet. So we can really build a circular product to reuse the permanent magnets because it's perfectly usable also in 1,000 years. And we can actually use recycled material from wind turbines and MRI scanners. The interesting thing is this material effect also works at very low temperatures. So we also have a different part of the company dealing with hydrogen. So we all know that we need hydrogen in order to decarbonize heavy industry. But the question is how do we get the hydrogen to Europe or to remote islands like Japan, for example? So what we do is we make also the hydrogen liquefaction more energy efficient with this. The system looks a little bit different. So we don't have a permanent magnet, but we use actually a superconducting magnet. And it's actually quite similar to an MRI scanner. So we are part of a large research consortium including also one of our seed investors, NG. And we are building first European hydrogen liquefaction plant with this technology. So this is not fantasy. It's already there. So we have already built a beverage cooler, what you see here was supposed to be a video. So you can actually get already magnetically cool drinks in our lab. We built this unit 50 times and we are already sold it to a couple of companies including Coca-Cola, for example. So we have 40 people, very technical, we have material scientists, chemists, physicists, mechanical engineers, you name it. We also got some traction. So we just closed our seed round. I'm happy to talk to anyone about the future of cooling. And what would be really nice is to also help us with our current challenges. So I'm asking is we need to build up not only our product, but actually a whole ecosystem on the supply side. So anyone involved with magnetic colloid materials or at least specialized alloys or actually in the business of permanent magnets to put them to a second life, this would be awesome. And also of course, if you have a supermarket around. So thank you very much.


What's up, everybody? Jason here for jazzybiscasebrakes.com, 2021, Flawless Collegiate Football, one box break. Picker team's number seven just sold out. This is a random number block, though, that helps out at the break with the Chicago Bears, Miami Dolphins, Los Angeles Chargers, Detroit Lions, Green Bay Packers, Indianapolis Coast, Las Vegas Raiders, Los Angeles Rands, Pittsburgh Steelers, and the Tennessee Titans.  Random number block style. And again, 10 total spots, everybody gets a random number from 0-3-9, and we go by the first number on the left side of the serial number dash. There's your examples there. Any one-on-ones go to spot one. Any redemptions go to spot zero. And we're doing a free spot giveaway in the random number blocks today. So here's a dice roll. Here's a customer name. We only sold nine spots. We're going to use the dice roller here to give away the one spot in the break. We'll paste it in here, and then we'll use the same dice roller to do the names and the numbers. So let's roll the dice. We got our sauce. A boom. One out of four, five times. Good luck. One, two, three, four, five. Boom. Learned a four or five times. Joshua, congratulations, man. Boom. Free spot for you. I'll put you right there now. And it was a five, one, two, three, four, five. Boom, five times. Joshua down a mark. There you go. Five times, one, two, three, four, five. Boom, five times, three down a zero. So Joshua, you have three. Mark with five. Shane with two. Matthew with six. Drew, you have one. Any one-on-ones. Matthew with nine. Joshua with seven. Chad with four. Matthew with eight. So again, guys, these are the ten teams that are part of the R&B. That's just for the shipping team to know which teams they are. But again, everybody gets a piece of them. And good luck to everybody in the next video. Break will be coming up next, jaspyscasebreaks.com.


Have you heard of the Situation Room? It's a conference room in the White House where some of the most important and top secret meetings take place.  And where White House staff met after President Ronald Reagan was shot in 1981. Some intense stuff, right? Well, some students got to experience what it's like in the Situation Room during an emergency. A simulation that's part of a program put on by the Reagan Library. And Ariel Hickson was there to see it all go down. So the really cool thing about the Situation Room experience is that there's two separate simulations going on at the same time. One outside in the press corps and one in here in the secret bunker. Yes, that would be a good choice. Here's the scenario. The president has been shot. Was he killed? Is he going to be able to survive? Who's now in charge? What would you do? Every minute counts. How do you're adrenaline pumping? You wanted to solve this, solve that, figure everything out. Have you made a decision yet? There are two simulations running at the same time. The media. So who's the secretary of treasury? And politicians. No chair response. Who make their biggest decisions here. In the Situation Room. This might feel like the real thing, but don't worry, it's just a game. Or is it? When you come and participate in the Situation Room experience, you are in the White House Situation Room. This is not a replica. This is actually the room from the White House that was taken out in 2006. In the Situation Room experience, students are thrown into the stress and chaos our country endured 36 years ago during the assassination attempt of President Ronald Reagan. Don't say he's stable though, because I might be wrong. It's an eye-opening simulation. Trust but verify. Because instead of opening up a book to learn about the event. We have decided to keep all government involvement out of the New York Stock Exchange. These students relive it. I do believe that it does give you a different perspective of the Situation Room as a whole. And they do it all surrounded by history. I think having the actual Situation Room here makes History real for them. They can sit here at the table where six presidents conducted foreign policy and then, you know, walk in those shoes. Is that the decision we're making? Each group has two and a half hours to handle the national emergency. The decision-making process can be very challenging when you're under pressure and you're working with limited information. As more information trickles in, each media outlet does a live report laying out their facts to the public. But sometimes not all the info is correct. How stressful was that? It was intense to the point where I was like, okay, are you sure this is true? We have to make sure the facts are correct because we almost ended up posting something that was not correct. We don't have any information as of right now. It's a two-way street. The media has to be well informed about reporting the facts, and the Situation Room has to choose what information can be released to the public. That was the most stressful part, was just the lack of communication towards the end especially. Rose, we've got to send para troopers. Each choice they make changes the course of the game. Is the U.S. getting involved in Ukraine? And in the end, students walk out experiencing history firsthand. Do you think that this simulation helped you understand what would happen in the Situation Room more than actually reading it in the books? By far because I've actually been able to read about it in textbooks and being here, nothing could have prepared me for actually just doing it. I've learned more here today than I would have by what I've read in the past. Ariel Hickson, Channel One News. Talk about a true hands-on learning experience. Plus, Ariel has all the behind-the-scenes from the Situation Room. You can check it out on ChannelOne.com.