Thank you. My name is David Byrne. I'm a security consultant with Trustwave. We're a security and compliance consulting firm We also have a full offering of managed security services. I'm in the app pen testing group I spend most of my days attacking websites, but our group also does other types of app pen tests We do security code reviews and training for developers on secure coding techniques before Trustwave I was the security architect at Dish Network, which is how I know Eric Hi, my name is Eric Dupre. I am a member of the IT security team at Dish Network A significant portion of my responsibilities at Dish Network involve web application security Including pen testing of internally developed applications I'm also the co-chapter leader of the Denver chapter of the open web application security project, or OWASP Alright, so I'm guessing most of you know that Grindel is an open source web application security scanner Which is why you're here. I've been writing it over the last year Earlier this year Eric joined and started helping with testing, porting it to other platforms And made a really nice live boot CD that is the basis for our demonstration later in the presentation Commercial app scanners have been available for quite a while. They're pretty well established in the market Brands that I'm sure most of you are familiar with But the selection of open source automated tools has been a lot more limited Which was my main motivation in writing Grindel There are several goals that I had from the beginning. I wanted to be multi-platform So I wrote the tool in Java which obviously is available on just about every platform that's out there But I wanted to avoid the slow, clunky look and feel that you see with a lot of multi-platform GUIs So I used the standard widget toolkit which allows a single Java code base to make native GUI calls across multiple platforms So for example, this is what Grindel looks like on Windows Vista, on an XP, on a Macintosh And in a little bit you'll see what it looks like on Linux It's kind of a pet peeve in mind when I go to download a tool and then I have to download a secondary library And then maybe go to another website and download some other tool that it makes calls to So I wanted to make sure that Grindel was very simple to install It's just a single distribution or single download, no install required really The only requirement is Java 5 which has been out for four years next month I think it's safe to assume most of you have it, for some bizarre reason you're still running Java 4 It's time to upgrade I also wanted a tool that would be useful to a wide audience Anyone ranging from an IT security manager who might have a high level understanding of app security But really doesn't need to understand how to test for specific vulnerabilities But then also something that was useful to someone like myself A professional pin tester who's fully capable of performing manual tests But can benefit from some of the automation Especially areas regarding application mapping and information leakage Which can be very time intensive to test for on a manual basis But still are very accurate to test for automated Finally, Grindel is a vulnerability discovery tool, not an exploitation framework There are some tools already out there that do a good job at exploiting specific classes of web app vulnerabilities But to write a generalized platform would be an enormous undertaking, that's just not what Grindel is Before I talk much about the features of Grindel, I wanted to discuss quality a little bit When I first started working on Grindel, my dream was that it would be so beautifully perfect In how it discovered vulnerabilities that instead of releasing it publicly I was going to go out and get half a dozen jobs doing manual pin tests But instead spend all day running automated scans and just raking in the money Oddly it really hasn't worked out that way yet I still think that Grindel is a good tool But it's not the same level of quality as what you'd see on a commercial scanner There's several reasons for this The commercial tools have been available for a number of years They have large development staffs and I would imagine that they usually have multi-million dollar research and development budgets Grindel of course has none of these things Despite that I still think that it's a viable open source alternative And this is something I really struggled with when I was first writing it Because I know that there are things, even in the current version that I can improve on And there are things that I want to add to it And that will happen in time But I came to the conclusion that eventually I needed to release it Because the only way it's going to continue to improve is if it gets exposure to a wide variety of websites Both secure and insecure And the only way that's going to happen is if it's released publicly And the same thing is true for commercial tools too The more they're used, the more exposure they get, the better the tool it can become So there's a number of ways that people can help with Grindel if you're interested If someone wants to contribute code, that would be phenomenal Be ecstatic But realistically I know that that's a pretty significant investment of time that most people can't make Simply providing feedback on things like bugs, false positives, false negatives Ideas for new features is also greatly appreciated Keep in mind that I don't get paid anything for writing Grindel And I have a real job and a family that needs to take priority So I can always respond quickly to emails But I'll certainly try whenever possible Another thing is that if you're using Grindel to scan a commercial software package Or to test an open source tool Pretty much if you're scanning any kind of application that's publicly available And you find a vulnerability, let me know I'm kind of interested in collecting vulnerabilities that have been discovered by the tool One of the advantages of making Grindel open source is that There's a lot of libraries that become available that for a commercial product Would have to be either written from scratch or purchased to some part of the toolkit So just to mention a few by name that were particularly helpful The Apache HTTP components library is, in my opinion, the best Java HTTP library out there Lobo is an all Java web browser Grindel doesn't use Lobo, but a partner project called Cobra Is an HTML parsing engine and document object model implementation Grindel uses a heavily modified version of Cobra Which is useful for things like spidering, testing cross-site scripting Pretty much any time when there's a need to model real world browser behavior Along the same lines, Mozilla Rhino is the all Java version of the Firefox JavaScript engine Obviously that's used for testing cross-site scripting as well And the Nikdo, I'm guessing most of you are already familiar with Nikdo If you're not, it's a tool that's been around for a while It's based on an even older tool called Whisker And it's basically designed to identify known web vulnerabilities So for example, is the version of Apache out of date Or are you running a version of Outlook web access that's known to be vulnerable to cross-site scripting It's a collection of almost 2,500 tests Now, Nikdo itself is open source, but the database, even though it's plain text The database of tests is not However, the creator of Nikdo, Sulo, did give permission for it to be used in Grindel And there are actually some advantages to using Grindel to run Nikdo tests For those of you that use Nikdo frequently, you'll know what I mean when I say that it's prone to false positives That's almost always because a web server responds with something other than a 404 message for a file not found condition It could be with a 200 or a redirect And Nikdo tries to handle that, but it's not perfect Grindel's not perfect either, obviously, but its logical file not found tracking mechanisms Are much more sophisticated, which significantly reduces the false positive rate There's a lot of features of Grindel that we're not going to have time to discuss today And even if we did, it would be kind of boring So I just want to hit on the main features that I hopefully will wet your appetites And make you interested enough to go and download it Give you an idea of the type of things it can be capable of In addition to the automated testing modules, which I'll be discussing in just a minute There's an internal web proxies, and that serves two purposes One is that it allows a user to guide an automated scan So that as the application is interacted with, or as the website is being browsed Grindel will discover new components and start scanning them for vulnerabilities The second purpose is to act as an intercepting testing proxy Like a web scarab or burp or peros Eric will be demonstrating those features along with the request fuzzer, manual requests And also talk a little bit more about the automatic file not found profiles Upstream proxy servers are also supported Authentication isn't supported yet due to a bug in HTTP components But that will be fixed in the next version The number of HTTP requests or connections can be throttled via a few different settings That's obviously pretty important whenever you're scanning a production environment Just to be sensitive to the needs of prod Now, any kind of reasonably well written application and well provisioned environment Should be able to easily handle anything that a single instance of Grindel can throw at it But speaking from experience, trust me when I say that if you're running a scan And anything happens on that web server, you're going to be blamed for it So by throttling the number of requests and connections Hopefully you can divert blame to where it belongs Which is usually with the operation groups HTML form-based authentication is supported Which allows for a few different things One is that the spider can start exploring areas of an application that are only available via authentication Also, there is an authentication enforcement test module And in the next version there will be an authorization enforcement test module There's a lot of ways that an automated scan can be tweaked and tuned in order to improve performance Or the accuracy of the scan And you don't really have to do that If you want to just do a quick default scan But the more familiar you are with the targeted application The more familiar you are with Grindel And with web application security in general The more accurate and better results you're going to get And that's true of any tool The more knowledge you have, the better you're going to be able to use it So a few examples of some of the settings include The ability to block specific query parameters for any kind of testing You can also mark a specific query parameter for As being irrelevant from a spidering point of view You can create URL whitelists and blacklists based on regular expressions Which helps prevent the scan from leaking out into other websites Or into parts of an application that should be off limits And you can also identify known session ID names Which obviously helps with the session management testing So again, this isn't a complete list of all the test modules that Grindel has But it's just kind of the highlights Things I think are a little more interesting There are several spidering modules The HTML tag requester is a traditional spider basically It will look for tags with a source or href attribute value Which tags are tested can be configurable by the user And then the URL that points at is requested Now there's a certain amount of risk associated with this The RFC 2016, if you want to look it up Explicitly states that a get method Which is which used to request source or href attribute Should only be used to request data Should never modify data back on the server Despite that, it's not uncommon to find web apps That will use a get to modify data Google found this out the hard way When they released their desktop caching engine a few years ago And fairly quickly they started receiving complaints Because the prefetching logic of the caching engine Was going out and requesting URLs of applications that users were logged into And it was modifying data In some cases even deleting data on those apps Last year I was speaking with someone That works on one of the best known commercial app scanning tools And I asked him how they handled this And at the time I didn't really mention that I was working on an open source scanner Which I feel a little bad about now But it's the type of information that I'm pretty sure They would openly get to any potential customer His answer was basically a very polite too bad And I agree with him that he had several points One was that it's impossible to anticipate Every kind of bad application design for an automated tool There's just too many ways that you can screw something up And if you're scanning an application That's really fragile and poorly designed There's no way that you should be doing it in a production environment If you're doing it in tests Then you should be able to recover fairly easily From any kind of problem like this And if you come across something like this After an automated scan Then you're going to know the application is poorly designed So you can go back and change this Something that he didn't mention is that At least in my opinion A developer who's going to make this kind of mistake Using a get to modify data Is extremely unlikely to protect the same query Against cross-site request forgery Which is a much, much bigger issue Than simply modifying some data On a web server via automated scan So there's a couple of ways that this can be avoided One is that you can use a URL blacklist To prevent the scan from visiting parts Of the website that are problematic But that requires a fairly in-depth Knowledge of the application And can be time consuming A better option is just to ditch the spider completely And use the internal proxy server to guide the scan So that when you get to a page that says something like Click here to delete the database Don't click there And Grindel is only going to test areas of the application That you're actively requesting It's not going to go out and start testing Just URLs that are only in an HTML response Unless you enable the spider The form baseline module Can basically try to guess how an HTML form Should be filled out And then submit it to the server There's actually even more risk associated with this one Because a form can generate a post message And posts can legitimately modify data on a server However, the module allows you to select Which methods are used And so if you want to play it safe Just don't enable post Search engine recon can be pretty useful It's not uncommon when I'm performing a pen test To an authenticated pen test To come up against the website I'm basically just seeing the login page Maybe some help pages or something like that Basically very little to test But when I go to a search engine I find that some other website Has linked to content on the site that I'm testing A search engine has picked that up And then indexed it Which obviously allows it to be tested This test module will query Google, Live, and Yahoo It'll also throttle the request So that you don't get blocked For sending too many queries at once File enumeration is pretty straightforward It's basically a brute force attempt To guess at common directory or file names Now this is a good example of a module That can take a while to run There's really no way around that It's just the nature of file enumeration It's a brute force attempt And when you look at the configuration page For the module, it will say This module takes a while to run Only enable it if you know you have time to wait So the lesson is Don't just randomly start clicking on things Make sure you understand what the impact is Of the modules that you're running Usually I'll only enable something On file enumeration If I'm having a lot of problems Finding content on a website Or if maybe I have a lot of time Left on an engagement I want to go back and just double check That there's nothing hidden Or unusual that I could have found There's a number of session management test modules One of them will test the session ID strength So we'll look for repeated session ID values Coming back from the server Either in the cookie value Or in a query parameter value We'll also check the level of entropy Or randomness between values That come from the server And obviously report on it If there's an insufficient amount Session ID should never be stored in a URL For a number of reasons So there's a module that we'll test for that And report it Session fixation is a vulnerability That allows an attacker to trick a user Into using a session ID that's known to the attacker There's a number of ways this can happen There's a module that we'll test for the common ones The authentication enforcement module I mentioned briefly earlier It's marked as experimental Because it's not as accurate as I would like to see it Basically it will look for transactions That are sent, requests that are sent authenticated And a similar request was never sent unauthenticated The session IDs are stripped out Either from the cookies or from a query parameter And the request is re-sent And if the two responses appear to be the same Then it's assumed that authentication bypass is possible Now that's not always a problem It could be just a cascading stylesheet Or something like that But there's always a possibility That sensitive information is leaked Even in obscure format So it's something that needs to be manually checked In order to confirm whether it's important or not There are two cross-site scripting modules One of them is for testing query parameters Which is where you usually see cross-site scripting And others for testing file names Some web platforms Web lodging in particular Had a problem with this for a while Will repeat the file name verbatim Inside of a file not found message And if the file name contains JavaScript Then it's executed by the browser Both of the modules use essentially the same technique For testing cross-site scripting It will seed the input mechanism Whether it's a file name or an input parameter With a random token And if the token is observed in the response From the server, then the context is identified It could be an HTTP header value It could be an HTML tag attribute value Or tag attribute name It could be inside of an HTML comment block There's over a dozen different contexts In all that can be identified Now technically this isn't part of the Cross-site scripting module It's underlying functionality Once an output context is identified It's tagged as an input output flow That can be tested for a number of different modules For example, caricature and line-viewed injection By knowing what the output context is The cross-site scripting module Knows how to escape from it So for example, if it's in a text area block It knows that any attacks Need to be preceded by a closed text area tag There are a number of formats that a Sorry, backing up real quick Before an actual attack is sent A series of requests containing characters That are commonly used in cross-site scripting attacks But that may be filtered as sent So for example, greater than less than Single quote, double quote, and so on Any attacks that contain filtered characters Are obviously not sent Which significantly improves the testing efficiency There are a number of formats that attacks Can be sent in Basically there are just ways to try And evade cross-site scripting filters Could be unusual ways of inserting Executable content into a document Could be different encoding formats That might bypass the filters When a response is received The HTML is parsed into the document object model And every piece of executable content is run So for example, event handlers On click, on load, on error are all executed Script blocks are executed Some simple and I would say Rather naive cross-site scripting filters Will look for specific text strings Such as methods or functions Like alert or maybe document.cookie To filter on. Now it's a really bad way Of protecting against cross-site scripting An experienced penetration tester Is going to be able to quickly recognize That it was the attack failed simply Because of a rather simple filter It's a little more difficult for an automated tool So Grendel uses a fake method Called testXSS, which is an extension To the document object model that he uses Whenever testXSS is called The test modules know that the cross-site Scripting attack was successful There's a similar mechanism that's used for Intercepting external script file references Using a script tag and a source attribute So using that technique as opposed to something Like regular expressions can significantly Improve the accuracy of it because Since it's acting as a browser It's a very low possibility for false positives There are two SQL injection modules One of them is error-based Simple way of testing for SQL injection Throw a single quote onto the end And look for an error message in the response It doesn't always mean that There's SQL injection possible But nine times out of ten there will be And at the very least there's some sort of Information leakage from the error message Grendel has a collection of regular expressions That match patterns of error messages From all the common databases Even db2 and access are in there And also database drivers like JDBC or LEDB The SQL Tetologies module is marked as experimental Again, because the accuracy isn't quite What I would like it to be Testing for SQL injection using Tetologies Is well beyond the scope of this presentation But basically from an automated point of view You have to answer the question Does response A look more like response B Or response C? Something that's very easy for a human to do Humans are going to be able to read the text And understand it A human will be able to pick up on subtle visual cues That would be difficult for a program to identify So there are some techniques that I'm working on That will significantly improve this In terms of being able to score the difference Between two different responses And I'm optimistic that by the next release Of Grendel this will be out of the experimental phase And it still works Just because it's marked as experimental Doesn't mean that it's broken It just means that I know there are Significant changes that will be made Or at least important changes made in the next version A number of miscellaneous text Care to turn line feed injection Is very similar to cross-site scripting Except that instead of injecting into the HTML body You're injecting into the HTTP response headers Cross-site request forgery is pretty difficult To test for on an automated basis Mostly because it usually doesn't matter For example the Google search engine Is vulnerable to cross-site request forgery But nobody cares except from a forensics point of view There are a few things that I'm going to be Tweaking on this module to make it more accurate But in the end it's going to require manual Investigation to determine is this form Truly important enough to need protection From cross-site request forgery The directory traversal module is very similar In its approach to identifying vulnerabilities Is the SQL tautology module And so I expect that both of them will leave The experimental status about the same time generic fuzzing module can be pretty useful It takes a while to run But it's not like you have to sit there And watch it the whole time It takes a set of predefined strings That either could be default or user defined And appends them to the end of every Input parameter that's observed by the scan The response is checked to see if it's a 500 response code which indicates There was some kind of problem on the server In this context it usually means that there was A problem with input validation It also checks the response for platform error messages That includes the database error message Patterns that I mentioned earlier But also Grindel has a collection of patterns That match common web platforms like .NETs PHP, CoalFusion and so on There's a number of information leakage modules Just a few of them include the Platform error messages module Basically it uses the same collection of patterns That I just mentioned Except it passively applies them To each transaction The advantage is that with When you're able to identify an error message Like this, sometimes it can reveal a vulnerability But at the very least it will help to Identify the inner functionings Of a certain part of the application And sometimes those error messages Can be inside of HTML comments Which obviously is very time consuming To look at every single comment On a manual basis The robots.txt module is Well robots.txt is intended to Guide a search engine as to where Content should and should not be indexed Some people mistakenly use it as a security control To try and hide areas of a website Say like an admin interface It's about idea though because it actually reveals The existence of that interface The comment list just lists out the HTML And JavaScript comments that are identified Every once in a while you find something useful in them For example, once I found some database credentials That had been put in there during the development phase But never removed when it went to prod A couple of web server configuration tests The website tracing is possible when the trace Or track methods are enabled Which they usually are by default Proxy detection, sometimes a web server Can be misconfigured to act as a proxy server Especially with mod proxy on Apache And if that is present in a perimeter environment It can be a particularly devastating vulnerability Because the, usually allows an attacker To completely bypass perimeter firewall rules There's a number of application mapping functionality And again, this is mostly useful for A penetration tester Sort of as an automated form of reconnaissance I already mentioned input output flows Regarding testing for cross site scripting There's a module that will list Every input output flow that's detected Regardless of whether vulnerability is associated with it And that allows a tester to go back And manually check each of those flows For vulnerabilities like cross site scripting Or carriage return line feed injection There's a module that will make An offline website mirror Which is useful for manual investigation And I already mentioned NICDO So with that, Eric's going to give a Demonstration of the tool Okay So, first a few notes about the demonstration environment It's a Slack 6 based live CD The server target for our scans Is a typical lamp stack Linux, Apache, MySQL, PHP On top of that is running an older version Of the Zen cart open source Shopping cart application Circa February 2004 There's a couple reasons we chose this particular application One is that it contains a wide variety Of known security vulnerabilities And secondly because While we considered using a designed Vulnerable application Like I personally think that the Foundstone hack me series is really great We specifically chose instead to use A real world application And Zen cart is very commonly deployed On the internet was back then And is still today So the client that we're going to be using To test the intercepting proxy Or to demonstrate it is the Mozilla Firefox web browser 3.0 So let me go ahead and flip to My virtual machine This is Grindel scan And while we don't have The interest of time we're not going to go through A fully automated scan here I wanted to point out that it's very easy to do one All that's necessary is to Enter your base URL here Add it And then go into the test module selection tab There are some default tests enabled But you can change them to Whichever test you want to run And you must enable at least one spider If you want to do a fully automated scan And then just start the scan So easy enough In my case I'm going to demonstrate The intercepting proxy And performing a guided scan So I'm going to open up some settings That I previously configured And first thing to note is that It's configured to bind to local host On TCP port 8008 I've configured my web browser for the same In the test module configuration I'm going to go ahead and Configure SQL injection An error based SQL injection test As well as the cross site tracing Module And then I'm going to go ahead And start the scan And yeah So in the scan status window The first thing you'll note is that It's performing some tests for logical 404 responses And what this means is that Grendel is creating a number of requests to the server Using randomly generated file names And then a variety of platform specific File extensions The reason it's doing this is to Create known file not found conditions In each one of those platforms And based on how the server responds To the file not found condition Whether the HTTP status code is 404 Or something else We'll use that to determine how we judge the other responses Coming back from the server in the future So what it's saying here Is that the scan queues are empty But more content can be supplied through the internal proxy So what I'm going to go ahead And do is flip over to my web browser here And Open up zenkart Application And now I'm using the internal proxy And notice that there are some hidden fields shown here Normally they're hidden Now they're converted by the proxy dynamically To text fields, that's the setting And I'm going to select one of these Products I can browse through the application normally When I make a request That request is then submitted through the proxy The proxy will automatically test it For vulnerabilities According to the module parameters I've configured And in this case you can see it's already discovered A possible SQL injection vulnerability In the page I requested So we can view the details of these transactions I'm going to go into the transactions tab for that And I'm going to change the view settings To Show all the transactions Except the 404 detection ones And Let's list all those other transactions Of this one, 296 Which is my product request And this is the transaction viewer Excuse me And the request and response are shown here You can view either in parsed or in raw mode And the request or response Bodies You can view in rendered HTML Or in text or in an internal hex viewer So I'm going to go back To the transaction And this time I want to right click on the transaction And I've got some options I want to send it to the manual requester So I'm going to say send a manual request And immediately the dialogue pops up This is basically the same view Except now I can edit any of these Items in the request And then I can Hit execute To then send once I've got it the way I like it I can hit execute to send it to the server And then I can View the response here So the proxy settings tab Pretty simple It configures the behavior of the proxy There's the HTML form fields I mentioned to reveal hidden fields And internal proxy settings I can change the bind address Or the bind port or the number of threads And I can stop and restart the proxy In this interface The interception TED settings So as David mentioned Grendel scan is an intercepting proxy So I can Enable request interception here And this is a Regular expression based rule set To determine whether or not I intercept a certain request So There's an element of the request listed here under a component And then The value And then this is the regular expression part And then whether I intercept Or don't intercept the request Based on that match So what happens here is it's logically ended together Any Request where all of the intercept rules Match and know All of the intercept rules and none Of the don't intercept rules Match will be intercepted So just to demonstrate I'm going to go back To the web browser And I'm just going to request Another item here And you'll notice that Now it's popped up a request intercept dialogue And again here I can edit any of these Anything here in the either parsed Or raw mode And then I can accept the changes And it'll submit that to the web server So going back to the transactions tab I want to demonstrate the manual fuzzer Feature here So I'm going to right click on this transaction Again and send it, this time I'll set it To be used as a fuzz template And In the fuzz template This is the base for the request that I'm going to send In my fuzzer I want to change the product ID in this case I want to fuzz product ID So instead of 106 I want to use a bunch of different other values here So I'm going to replace the Value With a token which is fuzz With 2% signs on either side Like That if you can see it And that's where This is called the insertion point This is where my fuzz value is going to be inserted So Hit ok And then I'm going to define a fuzz vector In this case These are numbers so I want to use a numeric sequence Begin With 1 Go to 100 Increment 1 Ascending So fuzz criteria is the next part Here I've got it set to check against the platform error messages That David mentioned earlier Which can be useful This will define, this rule here The response code is one of the elements I can choose But basically If this component matches I'm going to display Or optionally it doesn't match If this rule matches I'm going to display it In the table listed below So in this case I want to say where the Response code to my request is 200 It doesn't match And so I'll go ahead and add that And then start the fuzzer And you'll notice that it's making requests Of the web server With products ID from one And incrementing all the way up to 100 All of these have an HTTP Response code of 200 So I can view the details Of any of these transactions The same as I could before In the transaction viewer So I'm just going to double click There's my response And there's the product That happens to match this particular Product ID of nine So now that I've gone through the interface I want to show you Excuse me I want to show you a report that we've previously Run A more complete scan And here are some vulnerabilities That the scan was able to Detect in the application This one for instance Is carriage return line feed injection In any of the findings We go into the severity Of the finding You are all where it was discovered A description of the vulnerability In this case So this is carriage return line feed Injected injection We've injected %0D %0A At the end of a parameter And then A header of our choice Will appear in the output If that was successful Then we've got successful carriage return line feed injection So looks like we found it here We've got our carriage return line feed Let me look at the transaction use Just to verify that that's real And indeed there's our carriage return In our line feed And you can see that the new header Of our choice was inserted in the response So we've also got A recommendation for a mediation So how would you fix that Another example here Is SQL injection So obviously pretty high severity And As a lot of you know We just put a single quote in And The Details of this request You can see Here's our single quote %27 And then in the response I'm going to go to the end of it We can see The SQL error And this is definitely Vulnerable to SQL injection So again Impact Recommendation And a reference for finding out more About this kind of vulnerability So when comparing A Automated web scanner with a manual Penetration test Automated web scanners actually do have some advantages here The first is that The training requirements are pretty minimal Doesn't require a lot of applications Security specific knowledge To start a test Also the number of man hours Pretty few You can, even if a test takes several hours A scan takes several hours to complete The scan can be started And you can walk away and come back Usually to a finished report The Up-front cost is typically significantly lower With an automated web scanner Well not necessarily significantly lower But somewhat lower Especially the incremental cost is what I'm getting at Frequently the license You might be able to buy a one-seat license Which you can use in multiple applications As opposed to a penetration test Which is targeted at an individual application So When I mentioned some advantages You'll note that one advantage I did not list In favor of automated scanners Is accuracy And there's a good reason for that There's a specific There's a pretty significant class Of vulnerabilities that automated web scanners Just cannot find And the first of which are logic flaws So one example That's been known for a while Is if your shopping cart accepts Negative values of Or negative quantities of a product To be put into your cart And say for example I put negative 8 of a certain item Into my cart that costs $100 each I could get negative $800 Or essentially an $800 credit Into my shopping cart before I check out A application web scanner Is not going to be able to Automated web scanner is not usually going to be able to find this vulnerability Because it's not able to Understand the logic involved Or what that number really even means Another example is design flaws So If you have a password recovery question A secret question used to recover your password And the question is What was the make of your first car Now that's a really terrible question And the reason is Because there's relatively few automakers You can iterate through an entire list Relatively quickly With relatively few requests And come up with the correct answer Again automated scanner is not going to be able to Detect this, doesn't understand the English language Doesn't able to parse that kind of a question Or know it's bad Abstract information leakage So a year ago The Macworld Expo had a good example of this Where on the registration page There were coupon codes And coupon codes were worth a discount To potentially several hundred dollars Discount off of your The price of admission And so it happened That in the source code JavaScript source code to the web page There was a number of MD5 hashes Listed there And these MD5 hashes were for valid coupon codes For client side validation And it was possible to brute force Through the entire list And check against the MD5 And find out which coupon codes were valid And then submit one Obviously a serious vulnerability But a scanner is not going to be able to Detect this So we've gone over they really can't understand Application logic or data Application is functioning Whereas a human penetration tester Is typically going to be able to figure that out And understand things that the scanner would not Also Scanners generate typically Far more traffic than a manual test So if you're looking to conduct a test With stealth automated Scanners probably not your best choice I want to talk about this a little bit more Because as a pen tester it's kind of a pet peeve of mine It's easy to dismiss the kind of vulnerabilities That Eric was discussing is not very Common or something that's relegated To code that was written in the 90s That's not true We were talking a couple days ago About web app firewalls And a co-worker of mine commented on how You can't filter out stupid And you can't scan for stupid either This is a exploit from a Pen test that I did earlier this year Can you spot what I'm doing here The default is Free purchase equals no And when you change it to yes, it does exactly What you think it would In fairness This is not extremely complicated Vulnerability, something that even a novice pen Tester should be able to find A better example comes from a test That a colleague of mine did last year And what he found was that Given an employee's name He could go to different parts of an application And query information about that employee Most of those queries In order to get to the data It required some other kind of secondary information Like an employee ID number But what the tester found was that All of that information was available From somewhere else in the app So in the end he was able to walk away with The employee's home address The home phone number Social security number Employee ID number And some other sense of information He shouldn't have been able to get access to any of that With the account that he had In session hijack it was a design flaw Because each query was designed Ignoring the behavior of the rest of the application And this type of vulnerability We see all the time it's very common in applications Usually in the context of compliance I often hear discussions Or read about Whether or not an automated scan Qualifies as a pen test From a security point of view The answer is absolutely not And it's ridiculous to assert otherwise We've already talked about entire classes Of vulnerabilities that are theoretically impossible For an automated scan to discover Until we have halike intelligence in our software But beyond that There are a lot of vulnerabilities that While I can imagine a way of Writing a test module to find them It's just not going to happen Earlier this year I was doing a test And I noticed that When square brackets were appended To a specific query parameter The response from the server was subtly different Doing a little bit of research Experimenting I found out that the application was based on A somewhat obscure web platform Written in Perl And eventually I was able to write an exploit That allowed arbitrary Perl code To be executed on the web server That's a pretty significant finding And again I can imagine a way of writing A test module for it But it's a fairly obscure platform And even if you had the resources To write tests for every Or even many different Software that's used out on the internet You ended up with a tool that was so bloated And so slow no one would want to use it Just about every application That I test has something about it That makes it unique enough That some of its behavior would be missed By an automated scanner Whether it's functionality that's somewhat Non-standard and written specifically For the application Or choosing some piece of software That maybe people have heard of But isn't common enough to justify The only time that you're going to get really good Code coverage From an automated scanner Is if the Application is just plain vanilla Doesn't have anything that's very complicated And is based on a very common And simple web platform Like PHP or classic ASP And that doesn't really even Get into The accuracy aspect of scanners It's just a lot of times when Things like SQL injection and cross-excripting Is just because it's not a human My wife used to be An interpreter and a translator And she made a really good analogy comparing Automated app scanners with Automated translation software I think we've probably all used Google Or Babelfish to translate a website And it does a decent job You can usually understand what it's getting at But you never dream of using them Or even a more expensive piece of commercial software For translating something that was complicated Like a piece of literature Or a legal document or maybe even a car manual Apparently sometimes You can't even rely on it To translate a single word If you can't read this it's a sign that says Translate server error when it should read restaurant Even a Chinese English dictionary Would have gotten that one right Now that you're laughing at my jokes I'm losing my train of thought There is a legitimate use for automated scanners Otherwise I wouldn't have bothered writing Rindle I think a good example is that Say a corporate information directory Basically an internal phone book Security is important there It would be a very appealing target For persistent cross-excripting by an internal attacker It's probably used widely By most of the employees for the organization And it certainly is going to be much more trusted Than some random website out on the internet But very few organizations Are going to have the resources to perform An automated or excuse me A manual penetration test against that So by running an automated scan You get some degree of comfort that At least the simple vulnerabilities have been Identified and remediated And then any successful attack is going to require Some degree of sophistication That leaves your budget for testing Important applications like those that handle Credit card data or financial records Human resource information, things like that So I want to go over the product roadmap real quick This is not a complete list Of new features, just the highlights Version 1.1 should be out Around Thanksgiving this year You'll be able to preview the scan results Before it's completed, which is especially useful If you're doing a manual test alongside HTTP-based authentication will be supported I really wanted to have this ready in time for DEF CON It just didn't happen However, very few web apps these days Use HTTP authentication Almost all of them use HTML form-based authentication With some kind of cookie or parameter-based Session tracking on top of it Multi-part mind-coast and post-bodies Post-bodies will also be supported That's a little bit bigger of a deal Most of the time that I was writing Grindel this wasn't supported By the version of HTTP components That I was using But it is now So I need to go back and change it However, the default for posts Is URL encoding and that's far more common Usually the mind encoding is used For uploads or some kind of binary data transfer The fuzzer is going to have a number of enhancements That's the manual fuzzer that Eric was demonstrating Will be a number of new fuzz vectors You'll also be able to identify a specific response As normal and then anything that Significantly deviates from normal From the fuzzing is reported And of course you'll be able to set a threshold To determine that You'll also be able to have the fuzzer Guess at what a normal response is So that if 90% of the responses look the same That will be listed You'll be able to start a scan from the command line Which will be useful for scheduling Or for performing bulk scans from a script There'll also be a lightweight interface mode Which will be useful for users that Just want to perform an automated scan They don't really need to see all the advanced Configuration options Certainly don't need any of the manual testing Features during the scan A few of the new experimental or the test modules Authorization enforcement I know it's going to be experimental from the beginning Basically it will look for Request that were sent by user A Never by user B But then try to explicitly request the content As user B And see if the responses look the same Parameter incrementing will look for something Like product that equals 10 And then try to request equals 11 and equals 9 You'll be able to set bounds to prevent it From ballooning out of control SSL configuration Testing, do you have SSL version 2 Enabled, are you running Week SSL cipher suites Air based username enumeration Does a valid username And an invalid password result in the same Air message as an invalid username It shouldn't but oftentimes it does 1.2 will be out Late spring, early summer of next year Automated Automated AJAX navigation will be one of the Test modules for spidering Right now Grindel can't automatically crawl A site that uses AJAX or JSON Or something like that Just because the interface that's presented Is significantly different than traditional HTML You can still test those sites just fine By using the internal browser And Grindel will just start testing queries As they're sent The foundation for AJAX navigation Is already there, we have the JavaScript engine The DOM implementation is solid And that's really what's needed to Implement browser Behavior and mimic it PDF and XML report formats Will be supported As will one time passwords like RSA Secure ID, authentication domains And using client side SSL certificates for authentication You'll also be able to stop a scan Save it, exit the program, start it back up And resume the scan where you left off The website is Grindel-scan.com It'll work without the dash also The presentation materials, the tool of course And the ISO For the demonstration environment That's all, let's see, do we have any time No, we have no time for questions Room 105 is where we'll be Thank you very much


Hello and welcome back here to the channel I'm EvilRabbit We're here today to look at a new car pack that just dropped here on a set of Corsa from the Ascucco drift family the inertia Irish Pro car pack, so make sure you guys follow me and all such media all it's found in the description box below So the new car pack that did just drop during the USDA is a live stream the Irish a Nersha pro car pack from a scucco drift family I'll leave the link for the car pack down in the description box below We're going to take a look at the cars here today Dry some of them for the first part of it because we're going to doing another part to this video with some tantams with the guys so The inertia car pack does have Five amazing cars, so we're going to be taking a look at those today So let's go take a look in a set of Corsa So we do have Kevin Quinn's S15 and it's definitely a very sweet looking car We got the link ECU Livery on there as well and as well as the inertia liveries, so then we also have James Dean's FD or X7 in there, of course you have James Dean's livery on there DSD livery as well Then we have Jack Shanahan's 86 then We also have James Dean's E92 Eurofighter and then we have the 180 sx so we're going to be taking a look at these cars and driving them here for today and Try to find out where we want to drive So I'm trying to figure out what course we're going to hit up so I'm going to figure that out So you guys on grid so first car we decided to bring out is that 180 sx this car sounds so good All the backfires and all the pops of this car the car looks amazing So these cars are definitely very well put together. So it's the first car. We're driving We did decide to bring back to Aussie haven't been to Aussie in a minute. So let's take a quick look Inside as a car the modeling is amazing super clean super nice and very Very crisp and have our lights on we can see the dashboard.  Oh, I just love how this car sounds So I know some of the people that had their hands and making these cars and I just wrecked them hands and making these cars these cars are Supposed to be very Easy to drive. Oh, man. We're already sending it and first impression of it. Oh my gosh Bang that fifth gear. I Love this car sound. Oh, one of my favorite 70 cars so far and from a driving standpoint this car is So easily controllable off the rev nice and smooth Definitely having a lot of fun with it so far. It's just first real impressions of these cars Like I said, we will be hopping in tandem with some of the guys and something that for another episode on these cars I'm gonna have a couple parts series for these new inertia car pack cars big-time club ESTA Boston podium all the sponsors from ESTA on here. Oh, man. This car is loud Throwing up in first person for you Probably should have just to see back a little bit But this car is so nice and so easy and fun to drive definitely like I said very Unfamiliar too much with the right-hand drive in First person in cockpit because more comfortable on the left side of the car being my natural side of driving Well, there's a wall So I feel like this car would be way better for me if I did back the seating position up some Maybe brought it up a little bit that's Much nicer right there.  So you guys know since I work for BMW of this car. Oh Definitely hits home with the Euro and of course with James Dean Interior as James Dean does drive this car overseas.  So this is how the cars really react and Overall these cars are amazing to drive these first two that I've driven feel really comfortable very smooth on transitions Very easy to get into and just straight-up drive They are a competition style car, but they were built to be Easier to drive which you know is very good for people starting off in competitions and stuff like that that want to Good fast-paced car these cars are quick, but they're also quite quite forgiving Oh, it's so much louder outside the car Doesn't like to jump-drift too much. So that's one thing that we would probably have to adjust suspension wise Cars have dog box They do they have the same six-speed style that is in My pro s-15 so that is super nice But I say that if you guys don't know you do not have to use the clutch when shifting up gear If you do need it to get going but once you start going you can just kind of stay in throttle Bang into gear About to be out of gas in the 92 so that's gonna end this in 92 run up hole as we hit the wall like we do that car So we'll switch up to another car and maybe get some brap-braps in here. So James Dean's RX 7 a little brap-brap in here Definitely a fun sounding car. So we're gonna full send on this For this episode we'll take a look to two other cars once we get in taint and another episode with some other guys doing some tannins. Oh Oh my yep, I do like sound of this rotary This one actually had that jump pretty well. Oh No Kind of bogged down. I don't know if I'm in actual full boost. Yeah, we are Fourth gear clutch out and I think just send it I Know I sound like a broken record with this but saying these cars are super easy to drive Now this car is a little bit different being is how you have to be up in full high revs for anybody who drives the rotary lives no High RPMs or no RPMs These cars love to be abused on the limiter. I almost had that I fell out of boost Let's again another view that I have to back up a little bit to be comfortable in and of course Right-hand drive as always Having a lot of fun with these cars So definitely check them out yourself leave the link in the description box below for you guys to check them out We're out of gas Pop that in a neutral because we are out of gas So that'll do it here for this episode here on a set of Corsa And hope you guys are excited for the second part of this We'll take a look at the other cars as well as get some tannins and things of that nature So make sure you follow me and also should be knowledge found in the description box below as always That's you guys on the track No more breath rep it did


How's it, how's it guys? Today's episode is brought to you by Frames Magazine. We need to talk about lenses and specifically what is the best lens for you?  It's more than likely that you thought about, well, I want to take some portraits, so I need to find a portrait lens. One of those long telephoto, do you know the 85s or one of the fives? Or I want to do some wide angle photography landscapes. And you saw primarily about the type of image that you were going to photograph and let that dictate where you went initially in choosing that lens. And then you saw things about build quality and f-stops and all those other technical aspects because lenses are expensive, so I appreciate, you know, you want to think about build quality. But we're overlooking the real aspect of a lens that you should be thinking about before you buy one. Have you ever considered the camera to be an extension of yourself?  A lot of that comes down to something that John Mayovitz talks about. What's your personality like? Do you want to compress and flatten everything? Use a telephoto. You want to bring things far away, near? Use a telephoto. But if you want to plunge into the stream of the street, if you want to swim in there and be like a fish moving through the crowd, you need a lens that matches your vision. I love that, that idea that you have this symbiosis between the camera and the lens and yourself that the way the camera is seeing the world is fitting your personality. No doubt when you think about your own personality and the lenses that you are drawn towards that feel natural, then you can see how this makes sense. This personality is being conveyed through the camera and it works backwards as well. When you look at a lot of great photographers, especially street photographers, they seem to just have this almost natural instinct to just see a photograph and pick up the camera and it's there. And that's because they are seeing the world in the same way that the lens is seeing it. If you photograph on a 24mm prime or a 50mm, some sort of prime lens for a protracted length of time, you start to see the world naturally like this. But this is only one part of the equation when it comes to choosing the right lens for you. Recently, I was talking about sharpness in photography on the lens and I'll link to that video at the end. And there's some photographs here of animals which I simply adore. They are by a photographer called Peter L. Pedro Cox. They're just wonderful. Such a good example also of photographs that do require a sharp lens. That this is when that detail is put to good use. This looks like a crazy chicken again. There seems to be a theme when we talk about images on frames that there are animals that abuse me. I don't know what it is. Who knows?  Wack, whack. That's a wonderful thing. It's also wonderful to page through the magazine and see these gorgeous black and white photographs. I love these. These are also, you know, using a lens to isolate, to make the viewer feel that this is like a flat idea that has become a graphic thing, that has gone away from this idea of trying to make a three-dimensional image and it feels somewhat flat. And that's not a disservice to the image. These photographs by Minerva de Veil are absolutely beautiful. So I would encourage you, if you are interested in Frames Magazine, to click on the link in the description box below and there's a 10% discount for you. I left you earlier a little bit on a tenterhook. Didn't I say there was another aspect towards the lenses that you really need to, you know, take into consideration to really impress the most important person in photography. Now, you may not be familiar with the name Roger Deakins, but I am pretty sure you have seen one of his films at some point. The man is a legend and he is, as I mentioned earlier, a criminally underrated resource for photographers. His cinematography has challenged and broken you ground. Think that one shot, take, in the film, 1917. Now he gives us the second part of what we need to make sure that we are choosing the right lens for ourselves. Well, I've got a very strong feeling about lenses and personally, I'm sitting here talking to you and you are filming me from over there on a shoulder and probably a single where I'd rarely do that because I think, you know, the camera was to be, to me, I would shoot singles inside here unless it's through a particular fact and then I'd drop back off and be more observational with a shoulder in. I mean, I think it's a totally different effect to an audience looking at somebody on the end of a 100 millimeter lens as opposed to somebody that's being shot on a 27 close to or 21. So here we are, 32 millimeter or 30 millimeter. It's on a zoom, so sometimes you can't tell what the millimeter is. Anyway, but it's different, right? You know, it's a sense of presence. You're right there with somebody as opposed to being, I think psychologically it's a totally different effect. I mean, it's just the same as your relationship in real life to somebody. I'm sitting this close to you. I'm not seeing you from over there on a long lens, you know, so I don't think we take that into account as much as we should really. That is one of the most important things you're going to hear about photography this year. I guarantee you, right? That is so important to take into consideration that the lens choice that you are going to use is going to influence how the viewer interprets your photograph because the viewer is the most important person in photography. As far as I'm concerned, because they are the ones who decide if your photograph is a success or a failure. How often have you taken photos and you've shown them to somebody? And you've been really impressive. You go, wow, I really, I like this image. And people just kind of go, that's because we haven't done enough as photographers to make them go, wow, to put into their heads a feeling. It's obviously open to individual taste, but the more ability that we have to move emotionally, the viewer, by using our lens choice is correct. By using a lens that fits our personality and it also is conveying the right message. Then we start to be able to have more strings to pull that's like a puppet master kind of thing in making a person interpret your photograph in a certain way. When you look at the cover of this copy of frames, this is a, I think, beautiful image, but it is completely flat. It has no sense of depth to it. And that's why it works because it doesn't have a sense of depth to it. It has a very graphic kind of feel and it makes it feel cold. Makes it feel emotionally cold, despite the fact that there is that red there. This is a photographer who I will touch on in the next episode because it was lying here and I just thought you weren't gonna show it, but it is good. So you need to kind of think about what it is that you want to convey with your photograph. And if you want to find out more about sharpness, if you want to find out more about what I was thinking about sharpness in lenses, check out this video over here. Thank you ever so much and I'll see you again soon.


World Health Day held every year on April 7th marks the anniversary of the founding of the World Health Organization and each year focuses on a specific public health concern. In addition to focusing on the journey to achieving health for all, which is this year's theme, WHO will observe its 75th anniversary under the theme 75 years of improving public health. In 1948, countries of the world came together and founded WHO to promote health, keep the world safe and serve the vulnerable so everyone everywhere can attain the highest level of health and well-being. WHO's 75th anniversary year is an opportunity to look back at public health successes that have improved the quality of life during the last seven decades. It is also an opportunity to motivate action to tackle the health challenges of today and tomorrow. The theme for this year Health for All, Strengthening Primary Health Care to Build Resilient Systems is timely, relevant and significant for us in St. Lucia. According to WHO, health is defined as a state of complete physical, mental and social well-being and not merely the absence of disease and infirmity. This encompasses the holistic view of wellness. The most cost-effective process of maintaining optimum health in populations is through the primary health care approach. This is accessible, affordable, quality health services that cover a range of prevention, wellness and treatment of common conditions. Ideally, long-term relationships are maintained between patients and health care providers within communities to maintain wellness and treat a wide range of health-related issues. Some of the very important aspects include universal health care, the essential public health functions, health equity, mental health and chronic non-communicable diseases. On a national level, the results from the 2019 Behavior Risk Fast Factor Survey carried out in St. Lucia indicated that chronic non-communicable diseases related deaths were significantly high at 82%. These health conditions are preventable and related to our lifestyles. The survey indicated that 83.2% of the population do not meet the WHO requirement of servings of fruits and vegetables consumed per day. We note higher levels of salt consumption in younger individuals aged 18 to 44 years. St. Lucia's current alcohol consumption rate is one of the highest compared to other Caribbean countries and across genders. Of concern is the significant increase in women drinkers from 2012 to 2019. To back or use remains high at 25.2%. On a positive and encouraging note, physical activity has increased both on a national level and an individual level. As on average, persons spent more time engaging in physical activity in 2019 as compared to 2012. This data calls for urgent collective action by individuals, the Ministry of Health, all health-related stakeholders, public and private, and regional and international agencies to improve the health status of the country. During the management of the COVID-19 pandemic, generally health care services were diverted to reduce the impact of this serious respiratory disease on the population. This led to reduced access to regular health services, reduced screening among at-risk and healthy population, and delayed management of patients with chronic diseases. The childhood immunization program was also affected. This now puts St. Lucia and the region at risk for the introduction of vaccine-preventable diseases that were previously eliminated. In light of this, deliberate efforts were made during 2022 to facilitate the integration of COVID-19 case management into our regular health services and priority placed on the other health programs, in particular the primary health care programs. The Ministry of Health is committed to the development of programs, working with multiple stakeholders at various levels to reverse the trends noted. One such policy is the universal health care with a phased approach. This will serve to ensure accessible, affordable quality health care for all. The primary health care system is presently being strengthened through the Health System Strengthening Project. This will provide support with equipment, supplies, and training. Improvement to hospital care is also being managed. In an effort to foster healthy lifestyles in an immediate, yes, sustainable way, the Ministry of Health has instituted St. Lucia Moves, which includes increased physical activity in all settings, including workplaces, healthy eating habits, and attempts at screening the entire population to facilitate early diagnosis and care. All organizations are invited to participate. As we acknowledge and recognize World Health Day on April 7, 2023, let this serve as an individual call to action towards better health. This translates to healthy lifestyles, including healthy diets with fruits and vegetables, increased physical activity, reduced alcohol consumption, avoid tobacco use and smoking, effective stress management, and ensure regular wellness checks at the nearest wellness center or private physician to include screening for non-communicable diseases. The Ministry of Health is committed to working towards the provision of quality accessible health care. I urge you to take personal responsibility in relation to your health.


Our next speaker is Mikhail Kroll from City University of London who will be discussing shard scheduler, object placement and migration in sharded account based blockchains. Thank you, I'll present shard scheduler. This is the 20 work with owners edge Alberto Mustafa and the 10. For the outline will start with some blockchain and sharding then the well defined the problem of transactions in sharded blockchains I'll present our system and we'll finish with some evaluation. So as you probably know at this point blockchain is well a chain of block inside those blocks we have some transactions. The blockchain is maintained by some miners miners receive transactions from from users, they verify them they order them they pack them in the blocks and put them on top of the blockchain. With those transactions or with the blockchain generally maintain some state. So we have an initial state defined by the Genesis block and then every single transactions modify the state. State is a state of a set of objects with two main data models for for blockchains so either account based where we keep track of balances of users. Or a UTXO model where we keep track of coins who owns them and whether they were spent or not. So in this talk I'll focus on the account based model. The blockchain is great but it has some limitation issues so performance issues so as we all know there is a problem with the low throughput, and also high user perceived latency. And this is because of this global consensus so every single minor has to agree on the common state so it to disseminate transaction blocks to everyone, we have to store every single blocks and every single minor has to validate every transaction. That's why sharding was proposed as one of the solution to this problem in sharding we basically split our our blockchain into groups, so that every single chart has its own chain of blocks, it's on miners, it's on transactions and holds a subset of of state. And the hope here is that if one chain can support a specific amount of transactions if you add more chains we can can hopefully scale the blockchain almost arbitrarily. Quite often we also have with the shard blockchain is what we call the beacon chart of the reference chart, this is just a shard that is responsible for coordination of the entire system. This beacon chart will usually store the block headers of every single block being produced by every single chart for synchronization, but also will be responsible for assignment of minors to the shards says we had also during the previous talk. In the blockchain at this assumption of the honest majority of the miners, but then we have to assume, we have to also make sure that in every single chart, we have honest majority as well. So usually the big the beacon chart chart will generate some randomness and based on this randomness will assign minors to the shards in an unpredictable way. The beacon chart will periodically migrate minors across shards to compensate for minor joining and leaving the network. So if you consider transactions in the account based model, let's start with some simple transactions to have Alice here willing to pay Bob a specific amount of money in the account based model if you want to implement it will first of all need to decrease the balance of Alice, then we'll have to increase the balance of Bob by the same amount, and also make sure that this whole operation is atomic because we don't want to make the money disappear or create new money out of thin air. Now if you want to perform the same transaction in a sharded blockchain, if Alice and Bob are in the same chart, this is easy, we just need one transaction we put it in the chart where they're located, and it's done exactly as with the single train However, when now Alice wants to send something to Charlie who is in different chart that's slightly more complicated because now we need one transaction in shard one to decrease the balance of Alice. Another one initial to to increase the balance of Charlie, and also we need some synchronization between two shots to make sure everything is atomic. And it gets even more complicated with the smart contracts because now if you have if you consider this smart contract here we have a simple procedure we have a list of users to pay we have an amount we want to pay every single user. And the function just iterates for the users, if a user has less than 10 coins we just pay them some money. And again, if now all the users from this list are in the same chart, this is easy, we need a single transaction, a call calling the contract and it's done. On the other hand, if we have, let's say 100 users spread across 50 charts. Now we need at least one transaction in every single chart tool to update the balances, and also some global coordination between all those charts and all the minors that are involved in those charts. So the bottom line is here that the cross chart transactions are costly, it can get even significantly more, more expensive if we have smart contracts. So that makes object placements in sharded environment very important question so how do we assign objects to to shard because they can, they can that can determine the final performance of the of the blockchain. And currently we use a half the base approach. So what we do we basically divide the whole half space among among the charts, and then based on the account ID, we just assign them to the charts. This works well, this is simple it's verifiable because everyone can just take an account ID, hash it and determine to which are the specific account belongs. And this is a good long time balance, because if now we assign accounts to charts. Randomly, we might assume a long time uniform load distribution. On the other hand we have some classic problems from distributed systems so we have no data locality, we might have two accounts that communicate very often but are in different charts, and then generate a lot of cross-chart transactions. And also we cannot adapt to any short term load spikes because we just cannot move the accounts. In fact, we were, we are asking whether we can migrate accounts on the fly across charts to improve the performance and eliminate those problems. So our system is basically a system that observes the interactions between the accounts, and the load balance across all the charts, and then output some account migration recommendation so suggesting, for instance that this account should be migrated to this chart at this point of time. So that we enhance the state of every single account with what we call an alignment vector. An alignment vector basically tells us how many transactions with every single chart each account had. In this case, we see that Alice had three transactions with chart one, one transaction with chart two and zero transactions with chart three. Now, when Alice sends a transaction to Charlie in chart two will increase her alignment towards chart two will buy one and also for Charlie will do the same but with chart one. On top of that, we enhance the be contained with some load statistics, so that we have information about the load of every single chart in the network. It can be expressed either as a total size of transactions as in Bitcoin, or complexity as expressed in gas for for Ethereum. Now having those information chart should learn when it encounters across our transactions. First of all, we extract the list of every single chart that is that is involved in this transaction, and then based on the load statistic that we have on the be contained, we choose the main chart for this transaction which will be the least loaded chart across all the charts that are involved in this transaction. And for every account being modified by the by this transaction, but not being in the main chart, we ask the question whether it should be migrated to the main chart. And we answer this question by observing the alignment vector that we introduced before. The high level idea here is that if there is a strong alignment from an account towards its chart where it's currently located, we are not likely to move it because it suggests that there is a strong community within the chart and we don't want to break it. And if the alignment is not that strong and also the account has alignment towards other charts were more likely to move the account for load balance. So if the simple mechanism we achieve load balancing because well the main chart is chose based on the is the least loaded chart across all the involved charts. We preserve existing communities using the alignment vector. And also we minimize the number of migrations because we consider a migration only during a cross chart transaction, which means that will never, for instance, move an inactive account. We also introduce a migration threshold, just to prevent accounts flip flopping from one chart to another. Okay, so now we have those migrations. We know that they will improve the performance so the question is how do we enforce those. And for multiple reasons that we listen the paper, and we decided that miners should be the ones enforcing those decisions as a part of the consensus protocol. We can do it because all the decisions are based on only on on time data data and can be verifiable but everyone by everyone in the network. So basically enforcing those migrations is a part of transaction processing a transaction is considered valid, only if it also contains the requested migrations of the accounts. Now there's still a problem because if you consider this case we have Alice again sending a transaction to Charlie in a different chart. And let's assume that the chart scheduler recommendation is to move Alice from chart one to chart two.  And if you move away some accounts well potentially you will end less in the longer time so you don't want to do this. This is problematic because even if you made the enforcing the demigration as a part of the consensus now the miners are not incentivized to follow the consensus, because they can just add more money by by doing something different. So that's why we also propose a new economic model for the shattered block chains basically to fix this problem and to align the rewards that every single minor gets with the well being of the entire blockchain rather than focusing on the on the chart they're currently assigned to. And for this we use this mechanism of migration of miners. So you may recall from from the beginning that miners are being migrated by this beacon chart across across charts over time to compensate for any network dynamics. So what we do for every single epoch we calculate the total amount of fees that were collected by every single chart. So in this case we see that chart one collected 100 coins in epoch one. We calculate the participation of every single user so for which part of this money each minor was responsible responsible for. So here our minor was responsible for 20% of this of this amount. At this point the miners will not cash this amount, but we wait until this minor is migrated in the next epoch. Again, this is unpredictable. So our minor goes to start to. And at this point it will cost 20% so it's participation from before, but of the amount gathered by this chart by this new chart in the previous epoch. So 50 here. And because this those rotations are unpredictable. We prove in the paper that this motivates users to follow the migrations that we that we implemented and care about the the throughput of the entire blockchain rather than focusing on a specific chart. So just a few results to to finish, we implemented the whole system as a Python simulator at the beginning we compare it against half the base approach. So what you've seen before and Mattis Mattis is the graph partition algorithm so we fed all the future transactions, as a graph of interactions between accounts. And then we told Mattis try to split those accounts into charts in an optimal way so we keep all the communities but also try to perform some load balance. But even with this, we observe the chart should work and improve the throughput by more than three, three times for for stick six charts. This is because all the previous approaches they have a fixed association so they cannot adapt for new communities being created or disbanded or for some short time load spikes with the higher throughput we also lower the the average latency by up to 70% We also implemented chart should learn on top of train space train space is a sharded environment for with the support of smart contracts. We implemented our system on top of that and place it on Amazon AWS and again we observed much higher throughput and also reduce the user perceived latency. To conclude, chart should there is a migration recommendation system that is fully deterministic based uniquely on on train data and can maybe part of the consensus protocol. Although operations are very likely so we don't introduce any significant overhead on top of regular transaction processing. We also propose a new economic system that binds the rewards of every single minute the throughput of the entire blockchain rather than focusing on a specific chart, which basically incentivize honest node to remain honest and follow the consensus protocol. For the performance we observe up to three times throughput increase and up to 70% user perceived latency reduction. And I think this is it. Thank you.


What is a pick-your-team group break? In PYT Breaks, you choose the team you want to receive. The prices of each team vary and reflect the possible value of hits for each team. Please refer to the break description to see which cards will be shipped. All of our breaks are streamed on YouTube and Twitch. We also break on Fanatics Live. You can re-watch your breaks by finding the live video and clicking on your break name. You will be directed to your break to enjoy. Stay informed. Sign up to receive our newsletter on the home page of latensportscards.com And check out our all-new rewards program where you can earn points towards purchases, discounts, and member exclusive experiences. Follow us on socials and Fanatics Live.


Welcome back it is Thursday that means acting analysis for animators and today I want to take another look at ER and it's going to be as always the Carter show. That's right in all of my ER clips Carter is everywhere because he covers so much in terms of acting in lip-sync and pantomime and prop interaction so much good stuff but instead of talking let's show it and in this case you have these two doctors doing a very complicated procedure and this is all about Carter checking and reacting to what they're saying and there are so many things that you can apply taking this shot so he makes a little joke right and you can see how Carter reacts to that joke with a little bounciness but he keeps looking because he really wants Benton's approval he wants to look at is this doctor also laughing is this appropriate to laugh and what I'm taking out of this is that A I mean you can have something where they're doing something very serious and you can have a character laughing maybe in an inappropriate way maybe these characters are stopping what they're doing looking back and again it's all about this character that way you also have interesting framing where this character is in the middle taking up all the focus there or you can take something where they're actually talking about something really really boring or this could be some boring secondary action or this could be parents I don't know the baby and diapers and this character is trying to do something and maybe you know you can be gross and there's pee coming up oh it's probably yellow as well and this is why this character is laughing anyway you can continue on but there are many many ways where you can take interesting dialogue that they're talking and have this character react to this or you can use really boring dialogue because you kind of ran out of dialogue maybe you have a clip but it's not that interesting so maybe you can use that clip but it's all about a background character listening and reacting to what those two or one character is or saying but you know what I mean right and this continues on with this sequence right he looks over and he looks over and you can have this thing go right there as he goes down he's on his toes to check so there's a lot of mimicking and this continues on where he actually tells Benton that he's lucky to have Carter and look and look at Carter's reaction was he says yeah I guess sometimes I'm lucky you know it's not that bad you can see oh oh it talks about me oh yeah oh good I'm happy happy what I love with two is that they have a mask I mean he has to do everything through eyes and body language and this could be something again that you could take this could be uh I don't know maybe they're painters and they gotta have masks with paints and again because of that it's all about the eyes and body pantomime but I love his little reaction there and he continues on where actually he asks Benton if he wants to finish this procedure but what I love about this is watch his face so watch him nodding do you want to continue and he even starts in this shot in the background he is already saying yes because he wants him to be successful to do this as well and you can see he he is already nodding and going yeah yeah come on come on do it and yes he does it and they're all excited and he tells him come on Carter get in and help me out but I love this I love that you can take a conversation again between two characters that seem to be the main characters but it's all about this and it could be again him reacting or anticipating and he's already kind of anticipating what he is going to do next up is a fantastic sequence and it's basically just one long shot it isn't the cut with a close-up and a close-up but other than that I mean this could have been all filmed in one take and there's so much to unpack here so basically there are little things everywhere so you have this main character in a specific pose obviously you want to start with a strong pose that kind of gives us the whole idea of the shot it's almost like you're what I talked before in the previous clip your default pose your default pose shouldn't be your t-pose character almost done and that's it no your character is in a specific state of mind emotional state of mind or whatever it is and that is your beginning pose and this could be whatever it is right but think about if I pause on this frame in my shot does this body language already tell us what the character is feeling of course there is hopefully going to be a change within your shot where that body language and the post changes but at the very beginning if you start the shot is the pose of one character multiple characters are the pose of all those characters telling us what is going on in the scene in terms of emotional state or whatever it is right so again I love that it starts like this and then you have this intro am with Carter just scaring Benton but he is doing something that's potentially illegal his checking documents he's not supposed to so you can see his scramble and he's immediately covering this and then kind of yeah okay I'm gonna get busy and he says I'm sorry that I scared you like you know I wasn't scared but he is so focused on this that whenever Carter talks Benton is not really looking so he goes off hey I did this this this and this for you am I you know okay to go home and he does this awesome Benton with like yeah whatever whatever and it's his kind of half almost off skin gesture stuff that I love where the focus is here but it's not you know it's still silhouetted it's still clear but it's just something that an actor did that you happen just to kind of catch in there in your framing but again look at this there's no eye contact but he he wants to focus on this he doesn't care what he is doing now he apologizes for something he did before and this is the only time he actually looks because I mean they do like each other and you know he wants to acknowledge this yeah no it's fine but you can see the constant moving in the chair that and the shoulders this is content yeah yeah whatever whatever I want to continue on but he does ask him at the end hey did you do this and he says yes he did but he lied and he knows that he lies and the watch Benton here is yeah yeah waiting waiting yeah I knew this and I love this I love that it says this up and down yeah I'm waiting one two three in that reaction yeah I knew he didn't do this and he tells him yeah I know I call them and he has that quick little look does he actually look at him I think he does right here and then it says awesome wave off I love that gesture looks down yeah I'm done with you but what's also cool with this is that you have him tells him yeah yeah yeah and then he goes oh yeah yeah I did this and again you can push this where you make it clear that he is potentially lying right then you have this big exit and now it's the patient knowing he's gonna come back and I love this that he could go back with maybe it can go out sorry with um maybe he's angry like of course I did this and then the contrast comes in right away with a very no I'm sorry I did not do this so him exiting and coming back in is a big opportunity for contrast where he knows okay yes I'm sorry I didn't do this and then you can again play off between these two because he knows that he didn't do this anyway there's a lot of stuff now even then I love the ending because you might think boom that's the end but even though it's pretend that's the end of the lip sync you can still have this so Benton doesn't want to be disturbed does this extra thing closes this and it gets back in this is also interesting from a bottom mechanics point of view you have a chair with wheels the way gets in there right it doesn't have to get up you can wheels himself over so if you have extra sound in your in your lip sync that's just you know adding the ambient stuff of I don't maybe there's a window there's stuff happening outside you can continue this shot and add one more thing that tells us something about the character but also breaks it up from just being like this right this is basically how he's always in the shot and by having him do this you do break the spatial relationship there's more usage of space you change the silhouette it gives a bit more full body almost you don't see the legs but again different types of mechanics rolling you get up and kind of lean over so again this could be something for contrast you're stuck with this character sitting for lip sync but at the end you're adding this with some interesting new movement that still tells us something about the character and last one is again Carter and Benton as they go out and Carter is presenting there's something that is pretty common this is something that you can check on your own if you are in a group of people you can observe other people but sometimes you will do this as well when I learn about this sometimes I catch myself doing this and what is this it's that if a person you're talking to is in a specific pose in this case they're crossing arms and you agree with that person there's a big chance that you will actually mimic that pose so you're probably if someone is standing or sitting and then start to cross their legs and you're watching this person you might even cross their legs and mimic that same pose this is something that is common that you can observe going back to the shot you can see Benton does this all the time he has his arms crossed and Carter really wants to be like him he wants his approval and I like even the setup of this it's almost like a mirror they're both profile and you can see they're doing the same thing I'm assuming that that was intentional I could be completely wrong as always with anything that I say here I'm reading into this but anyway I like the setup and I like that it shows this that if the camera changes around to be framed like this for this moment where they want to be or he wants to be again just like Benton and this continues on throughout the whole shot where they continue crossed and crossed but also like again the setup of the camera turning giving us now a front view and a profile view and giving us the option for this character to exit this way and the character to exit this way just a bit more dynamic in terms of camera language there but it's not tacking something you need to do but I do like this I do like that idea of this character miming this character and it presented like that to really be a visual mirror boom you survived another er acting analysis and again I have so much more but as always I'm going to do this maybe once a month or every two months I don't want to flood this whole channel with just er stuff but I do have a specific playlist just before er but anyway as always this is a longer clip and if you watch this whole thing till the very end I do appreciate it and if you haven't subscribed yet subscribe and hit the bell button because I do upload almost every day exit weekends so if you don't want to miss any of this stuff subscribe and hit that bell button also if you feel like this is helpful and you want me to help you with your shots in terms of what I talk about in terms of body mechanics or this in terms of acting analysis stuff you can sign up for my workshops my workshops are open all the info is in the FAQ and email as well so if you want to join just let me know and you can sign up but that's it that's it for another er and I will see you in my next clip probably tomorrow