What's up, everyone? Yeah quick life update because we're clearly not in Hawaii or Denmark or New Jersey anymore We are now in Mexico Playa de Carmen, Mexico. Let's get the lighting. Let's get the line.  So yeah, we're answering every question we got There's a few things we want to say Let's just sit down and talk. All right, but we got a lot to talk about but it's loud as hell up on this roof So first I need a shirt on though There we go. Thank you. All right, let's go So recovering. Yeah, that was mine. That was a wild weekend That was a wild weekend. I mean, I've said this before but I'll say it to everyone here That was the best weekend of my life Yeah, it was more like talking about the cancun mastermind self-polishing mastermind that a mecho side put together So yeah, so that's where we've been that's what we've been doing. And yeah, you might have noticed We have not uploaded it every other day Until a few days ago. We had done every other day for four or five months Yeah, not missed a single day, but now it's not because we like we missed it But we're changing the schedule and it's also not like oh, they're not they're getting lazy No, we're working harder more than we ever had. Yeah, so we just have more things to tend to though Exactly. There simply has not been time. There's not been time to To put out a video while we've been here because we also I didn't want to that's also You might have noticed we didn't answer comments like immediately like we normally do I didn't get back to facing messages It's because we wanted to like live in the moment at this publishing mastermind because there was so much value We got so so so much out of life changing speaking of the next video I'm suing the next video. It's going to be the cancun Excuse me the cancun vlog. It's gonna. It's gonna be like 30 minutes long. I see some extra footage So thank you guys.  They don't love that one.   This is our apartment I'm gonna give a quick 360 quick 360. It's it's pretty great.  So it's just a bunch of natural light coming in Wow, I'm sunburnt I'm sunburnt Yeah Check out these six chairs too like just check it It's mayhem. This is chaos. Look at me. Oh nice This is chaos, which leads me into my next point Last time we had chaos was launch day of the course When we launched audiobook income academy, it was chaos Mayhem but in the best way possible in I'm gonna let me set this up again I was gonna spin around in the chair where you did it for me audiobook income academy launched on Was it september 7th? And wow it was crazy. It was freaking crazy. Thank you to everyone so much Do you guys that signed up bot and now? Everyone who bodies in the facebook group There's that that thing is crazy. It's hard to keep all the energy has migrated to that facebook Yeah, yeah, so very concentrated just So much going on. Yeah, so many motivated people, right? So thank you for to everyone who bought day one if you're curious. We did 96 sales If you know what the price was 497 you do the math. It was a good day. It was pretty crazy So now actually one of our biggest focuses going forward is the success of our students Let me correct you that is our number one biggest focus. It is number one one of our many big focuses It's our number one priority is a success for students. So Just so you guys know It's kind of hard to disperse time energy everywhere A lot is going to be put into that. Yeah What's going to be through the facebook group drop any question I've got to answer it the course so There's been great feedback on the course Yeah No, I continue keeping going. I'm just showing one screenshot of a message that we got from monu be Another yeah, I I don't know who I don't know who we there but I remember we got another really great way Okay So and I okay, I wrote notes about the things I want to say before we started the actual q&a Let's see you move to two videos a week. Oh, yeah, and then next Just about moving to two videos a week.  This place is like amazing. We went to one island called islet mohairis I want to say something and not forget Look at that. That's how amazing that is. Are you playing the video? The video is playing right now, okay So I'm gonna let that play while I explain the next thing I was gonna say so a few videos ago We asked like if there is there any place we should move to Because we have like a month to kill the video should be done by about now. Yeah, okay good If there's any place we should move to because we have a month to spare between cancun and la which is the next place We have to be uh, and then someone recommended plial of karm and two people did and then look look where we are now We're here. So when we take recommendations, we actually take action on it So, uh, thank you for the two people that recommended plial of karm and freaking love it so far here Let's see. Oh another thing while we're moving to two videos a week We're gonna up the production quality. Yeah up the production quality. It'll go on every other day There's like there's not that much time we have to work with there'd be times like Oh, I want to edit more, but uh, you know, it's gotta be up in a few hours.  So it's crazy. So right now we're at like 12 1300 subscribers and we want to get up to 100 000 plus Okay, so we want to make videos of that quality of people with 100 000 plus Yeah, so and that's another thing we learned this weekend in cancun Is that we can do it? Yeah, is that we can do it? We can get to that level There's a lot of things that will not be included in the vlog like a lot of behind the scenes things that were like really amazing I couldn't capture because I didn't want to take away for the moment, you know Um, so I wish we like this is so genuine what we're saying I'm not trying to sell you on that. I'll tell you the next year. It's gonna be crazy. It's gonna be so much fun Can't wait for it. So most likely you're gonna be I kind of leave you can't you always It's not No, you can't say it. Okay, so we have we have to bleep that out. Okay, I'll take that out Um, I wish you could just sit here and talk about the whole cancun master argument this whole time Maybe we'll do that in several videos. Let's not do that right now. Uh, let's see Um, last day in Isaac sales biggest focus success for students And then oh one other thing or for I want to mention this about videos that we're gonna make So like we've made a lot of videos about audiobooks Um, but now everyone who bought the course which is now over a hundred people Uh, if we may continue to make audiobook videos those videos will be kind of pointless for you Because you already have everything you need in the course We can't really talk about anything new and I understand these hundred people are not the only people in the world Which is your point. That's what I'm saying. There's they're one percent, right, you know, I know but they're one percent I those I totally want to continue making audiobooks. Those were the tightest lit fam Viewers like that's the squad and I don't want to recruit more That's true. I I just I also don't want to make videos that they don't want to see because they already know well Can you please uh comments? Merch for amazon more videos on that will come credit card travel videos credit card at least Is a huge part of should we continue to make videos about audiobooks of our online business game? Yeah um Another thing just in general online business videos like the one on the roof Like the three things you need to make a lot of money I like down a lot.  You're like I actually don't know I actually didn't learn anything from that video I still like that.  Exactly. So I would never want to make those videos. I like this thing. We don't we Teach something that's actually applicable in every video Let's go on the Q&A. Let's go on the Q&A. Do you have the questions here on your laptop on my laptop? I'm just right here. Okay. All right. So, uh, we have 40 questions. We can definitely not get through all 40 in one video Definitely not I don't I I saw the questions I look I didn't look at them like my eyes you get what I'm saying So it's it's off the word spontaneously looking at them. Yeah, I don't I don't remember any of them As soon as we read them, we're gonna answer them right away. Yeah, so this is off the dome. Yeah This is probably like four videos Probably because I want to give attention to each say every single question. Yeah Every single question that was asked is going to get answered. Yes, sir. That's the rule that we follow Okay, let's get into it. So you're gonna take the the business and the personal From one person that I take two from the other so go back and forth. Well, sure Uh, we're both gonna answer them. Of course So these are chronological order the first person who ever left the hashtag ask a twin question goes first So that's the order of it. All right first one Front pat gostic You the dog you the dog Number one, uh, everyone asks two questions His first one is what's the one skill that you think is the most crucial for your success Okay, and uh, okay, so this I don't know if this is a skill, but I've we've said this multiple times four. I'll say it again.  Oh, I'm trying to motivate you mindset mindset like you can't really apply Uh, apply that to anything that answer But it's having a good the right mindset. I know what is the right mindset I was gonna say mindset if we're gonna be more sensitive. I'd say your confidence Yeah, my mindset is like the number one part of that but I feel like I can talk to someone and within 30 seconds I can see if they're made out to be a successful entrepreneur or not based off the things they say There are some things someone says like I can tell your head's not in the right place And actually the easiest way to tell is based on questions. They ask you Like, uh, it's question if you've asked this question, that's okay But you should probably take a step back and analyze things is like Hey guys, how fast can I make to $5,000 a month? Yeah, how much what's the least amount of money I can invest to make $1,000 a month? What's the best way to make money online things like this Because when you're asking questions just about money Try and just get This question that can't even be a it's you need specifics. That doesn't make sense anymore, but All right question number two mindset mindset mindset Which podcast question number two which podcast slash youtube show would you love to be on? How about like youtube channel? Yeah, youtube channel microsteals, I'm trying to get a microsteal microsteals youtube channel and We might get we might get on it in the next few months and not not going to spoil anything But we might get on it in the next few months. That would that would be my dream, right? Yeah, yeah, microsteals if you don't know who he is. I mean wait.  But if we got to another level Gary v I like what your head said. I wasn't even thinking that. No, Gary. Gary. That's my number one. Yeah, his podcast his podcast Gary's podcast 100% without a doubt which remind What is that? What does it remind me?  Oh, that's right. That's right. That's right Yeah, he said you guys we got a lot of Gary v in us and that I was like, yes. I mean, I I agree. We're both That type of dudes. We're both that type of dudes. Okay Next question may have to be 10 parts fucking. That's what it is I'd rather give more attention to every question.  I've seen the comment section a few times sweet name though. Mars bars are amazing Okay, I'm they're good, but compared to a chocolate bar. They're not that great. Okay. I see what you mean Because you're comparing you feel like snickers All right, so the business the business question here raises. How many acx books do you think I can make with? $1,750. Okay, great. What would you predict that would make? Okay No, no, no, that's a legit question. Yeah, so I see where he's coming from That's different because you don't know. Yeah. It's not like how what can I do? With this amount of money to make so much more. You know, yeah That's a proper question So so how many books do you think I can make with uh 17 so it depends the kind of audiobook you're gonna make Let me let me take this one. I just want to take everyone right so When it comes with writing narrating covers all things included like if we're going for a high quality audiobook 500 bucks is Approximately what we spend on one audiobook what I was saying depends what kind of audiobook you're gonna make you could right make your own You could do a short story and then you can do the long ones But let's talk about the long ones because those are the ones that make the most money So then 500 per audiobook 500 per audiobook that means with 1750 You could get three three audiobooks with 250 left over and then with those three audiobooks you can create a bundle as well Cost nothing. We need a cover for like five bucks And then you can either make a two book or three book bundle and then with that 250 dollars I would write my own and then have a narrator for that money So then you got four two bottles two bundles you get six audiobooks So the answer to that question is six six audiobooks And what would you predict that would make as you know that's like Depends on as you know that could like has a huge variance over a thousand months. Yeah over a thousand absolutely Absolutely over a thousand bucks a month if you know what you're doing If you get the course and you follow through with it, then yes over a thousand months more question. Oh, I love this question I love this question. Okay What is your favorite car?  Yeah, because we haven't really talked about this. Normally it would be Lambo, right? Yeah Yeah, I have I don't if you saw the the message I said, uh, McLaren McLaren I saw you wrote that. Yeah, uh fair car McLaren. Look, I'm gonna put up.  I'm not looking at it. I'm sure I'm telling you I'm gonna take that one away and that one away, but I gotta do this top tricks Yeah, I guarantee I will be driving this within five years What's yours? I mean like a Lamborghini Aventador. Yeah, that's the news.  Yeah, man. Okay, Lamborghini for me. Nice Okay, three questions it was two and one that's why so next question from ooh our girl our girl Our girl life with Tatiana You're awesome. Love all your sweet comments who love you Uh, her first question is is it highly important to market audiobooks or do they do good with limited marketing? So 99% actually 100% of your uh Of your sales is coming from organic ranking Organic so you don't pay for anything. So if that counts as marketing, that's not marketing So no, you're not marketing it really once it's out. The only thing you need to do is collect some reviews I guess that counts as marketing to some people. So but it's just gonna be about ranking high for your keywords That that's your marketing for you Seriously, I guess that's simple. There's no more now. I'm sure there are more things you can do We don't know about them and we don't use ourselves. Yeah, so you don't need to do it, right? So Uh, her second question is how much is you to course? So she's How much is your course? Our course is I thought oh, okay. She hasn't gotten the course yet. The course is she did.   I'm okay. I thought so. I thought so. Sorry The course is 997, which is actually the highest priced course in the publishing industry that i'm aware of at least um The first day there was 50% off it was 497, but now that's done and it's uh the full 997 We had a lot of discussions about what the price should be. Yeah But we know the value of it. So that's why we price it. Uh, what we did. Yes Next question from hashtag Yuri Bruce Love you're in the course as well. I love Yuri Bruce Two questions here Approximately, how much will the course cost? We just answered it.  Oh, okay, okay? Yeah, we know we've actually been wanting to talk about cryptos on our channel But the cryptos has tanked massively. So we kind of like uh, maybe there's not a lot of hype around it If you don't want to hear I want to be so transparent. I'm telling you what I've invested Yeah, we'll probably know what it's out.  No first. Let's talk. So I have invested what it's not an answer question I'll just say I've invested about 25. Oh my god. It's so low. I've invested about 25 or 30 thousand bucks, right? And at its peak which was in what like april Yeah, um my 20 was starting at 25,000 was like 68 thousand dollars my my portfolio was at like 75 thousand dollars That's a fuckload of money. Look what is that now? So we start I put it in this is a sucker cost now This is a sunk cost I this like I don't even Count this in my net worth or anything So yeah, I put it in like 20 to 25 thousand dollars. It went up to over 70. This is what it's at now Hope you see it 11,000 11 thousand dollars So if you want to look You can see what I'm holding and how much of each I'm actually I'm actually holding more than this but not much more one chain And the parado doesn't count but one chain and pun the x or those are two big ones Yeah, man a tiny bit of bitcoin. So we bought one chain at a little over two bucks Let's not talk about that forever went up to 10 now. It's under one. Okay Next Yeah, actually I want to say to show you the positive cryptocurrencies one chain the one we're in right now It peaked out at 10 dollars. It went down to 60 cents. Isn't that insane? So if you don't know our cryptos that should show you how volatile it is We bought it at like three A lot of people are rich and a lot of people go lose a lot of money. Yeah um All right, so we're through eight questions so far Okay, it's going good next question is from great beer tube the african legend I never I don't know what more to say because there's just He's just so great and so awesome. If you don't know great beer tube. He lives in um, Nigeria Right, uh, oh there we're talking about moving to africa Before like a few months. Just yeah, because like we're talking about going to africa Yeah, maybe Nigeria We're like traveling a lot like at first when we first moved to thailand for example It was really hard, you know like experience in this new culture Yeah, and I feel like something kind of my school since we're pretty experienced with like culture shock and all that We there is no culture shock. It's very easy and we were talking about the other day But I want to test my limits. Exactly. I want to be put in a come uncomfortable situation Which africa I think would do. Yeah, I have no idea what it's like So great beer tube if you're watching this Can we crash in a couch? We would get our own place, but yeah From great beer to fritz first question. Would you advise using third party platforms to pledge an unaudible Such as authors republic, etc Finally voices. He means as well Dudes of geographical reasons. No, no, what not? Let's not elaborate too much on it. No, because you could get on acx Uh, you no matter where you live in the world because you can call the irs and get a us tax ID number Yep, completely illegal everything. Okay. Next question. So no, don't use those There's a let's make we'll make a video about it. Yeah, that's in the course We'll make a youtube video about well, like if you want to you can but I don't think you should Number 10, are you guys planning on doing a denmark vlog before heading out to to cancun? No, because it would only thing you would have seen the world's most boring vlog All you would have seen is just us sitting on our computers Filming lessons talking arguing a little bit showering pooping going to the gym eating Food shopping, that's it. Yeah, it would have been crazy boring. Yeah, yeah, so Spend time. Yeah, nice So no Sorry, you wouldn't you wouldn't have enjoyed it. Uh, gravely two of you loves the vlogs, which she's gonna love the cancun All right, so our next question is It's only one question. I say after this one will be kind of short. It's 22 minutes so far. Okay. Okay. This is Carlos Carlos Carlos a last last question of part one. They're all gonna get answers. So don't worry. We're gonna change location. Hope you Carlos a Can you provide a ballpark figure of what the course will cost? It's about let's go. Yeah. Let's that's not a good way to end it Uh, oh no no no. Rest is rest is we needed to leave this for the first question of the next one Because this is from vnay kumar. It's an epic question Like suppose you pick up a girl sleep with her. How do you make sure she doesn't drop any wrong allegations? Like that could be a long Long conversation. So let's not sorry. Oh, so if that and start the next one up with that question Yeah, so that ends part one though. Yeah, all right Uh, in that case emoji emoji time. I know exactly what I emoji. I want you to drop I want you to drop that if you watch to the end if you watch to the end first of all First of all, I love you. That's insane that you do that.  I like this emoji a lot.  It's the swore the blue swore the emoji. Oh, okay drop that No, it's lit. Yeah, if you're on desktop feel the camera ready. All right. Yeah Subscribe to the channel. Let us know what kind of videos you want to see leave a like because apparently those help Yeah, and I think I'm cadmium is out if you if you really buy your article game. This is a must It's the best article course that has ever made and will ever be made. See ya


Welcome to the final part of our MOOC. If you have watched the previous parts, you are by now becoming quite the expert on ethical theories and perspectives. This means it is time to put our knowledge on ethical decision-making to work and see what it can mean in practice. In the following clips, we will be discussing several common ethical dilemmas or decisions that communication professionals of different fields may face. We will first discuss ethical issues within the field of entertainment communication, political communication, corporate communication and persuasive communication, looking at ethical issues from the three main ethical theories, consequentialism, virtue ethics and deontology. In the remaining clips, we delve further into several overarching topics, such as ethics when conducting scientific research and big data and privacy. To get you started in thinking about ethical issues from a more practical perspective, I would like to draw your attention to the merits model. Merits stands for the multidimensional ethical reasoning and inquire task sheet, and it was put forward by Patrick Lee Pleasance as a starting tool for making ethical decisions. The model helps you to focus on the values that are at stake in a given ethical dilemma, the ethical principles that can guide your decision-making and the different stakeholders and moral considerations that need to be taken into account. More specifically, the model states that we should first identify the main values that are in conflict in the dilemma, the importance of each of these values and how they are in conflict exactly. Something can be considered a value when we believe, and I quote, that a particular mode of conduct or that a particular end state of existence is personally and socially preferable to alternative modes of conduct or end states of existence. Think for instance about values such as promoting credibility, honesty, transparency, autonomy or privacy. When identifying the main values that are in conflict, explain what would happen when each value would be given priority. Then think about which value you prioritize and why, and also consider any overriding interests, such as an economic interest for example. Then consider how each of the ethical perspectives, consequentialism, virtue ethics or deontology would guide your ethical decision-making. For instance, you need to identify all potential stakeholders and think about how they would be affected by your decision. Will you cause any harm? And how can you minimize such harm? Who gains the most from your decision and who loses? This means applying a consequentialist perspective to your choice. From a more deontological perspective, you need to think about your moral obligations and duties. What responsibilities do you have and to whom are you accountable? Do you have any duties as a communication professional that may override any personal values you may have? And one very interesting question to ask yourself is, how would you feel if your decision were to be made widely public? Would you feel like a moral and virtuous person? Of course, how one prioritizes certain values differs per person and per profession. For instance, key values in journalism are the minimization of harm, seeking and reporting the truth, acting independently and being accountable, whereas some of these values may be less important in marketing or advertising. But one value that seems to be prioritized in almost any communication profession is the value of credibility. Whichever value you prioritize, you need to be aware that there is no right or wrong way to prioritize your values. The most important thing is that you are able to argue why you prioritize one value over the other. With that in mind, let's now take a look at some examples of ethical issues in practice in the next videos, starting with ethical issues in entertainment communication.


Maxwell was convicted on five of six counts, was accused of recruiting and grooming four teenagers for Epstein between 1994 and 2004. Our former boyfriend Epstein killed himself in 2019 in the Manhattan cell while awaiting trial on sex abuse charges of his own.


This past Sunday, our churches celebrated the Feast of Pentecost. As I'm sure each one of you could tell us, the word Pentecost was used in the Septuagint to refer to the Festival of Weeks, the 50-day harvest festival that followed the Passover celebration. By the first century, BCE Pentecost was observed as a time of covenant renewal, with a special emphasis on Yahweh's giving of the law. God's gift of bountiful earth was recognized as being intertwined with God's gift of gracious instruction. For early Christians, the Passover was still the central feast day, but it was now, of course, Jesus who was regarded as the slain lamb, whose blood secures freedom from divine judgment and liberation from earthly oppressions. Pentecost was now that period of highest rejoicing following the Passover. Early Christians were instructed not even to kneel during Pentecost worship and to avoid everyday business activities if they involved deferential postures. As Tertullian put it, somewhat paradoxically perhaps, Pentecost was to be distinguished by a solemnity of exultation. Over time, this seven-week Pentecost season accumulated multiple meanings. It celebrated not only Christ's death and resurrection, but also his ascension into heaven and the sending of the Holy Spirit onto the church. And in the current calendar of the Western churches, of course Pentecost is primarily associated with the coming of the Holy Spirit. But it still concludes the Easter season, and it opens onto a long period of ordinary time known vaguely as the season after Pentecost. So you are graduating from seminary in the afterglow of the church's highest season of celebration at the beginning of the season after Pentecost. And although this season is ordinary, in the current Western calendar it slowly focuses the Pentecostal afterglow into a white-hot flame of expectation for Christ's second coming in the Pericea. This eschatological hope provides the backdrop for our winter observation of incarnation Christmas. Finally, it must be noted, and I apologize to Matt here, that tomorrow is the feast of the Holy Trinity. On this day, many Christians remember that the good news of God's unity, that we do not serve many conflicting gods, is also the good news of God's triunity, that the one God we worship is the creative and sustaining father and mother of us all, the incarnate, servant, liberator, Jesus of Nazareth, and the ever-present, ever-newing Holy Spirit. So to this point I have situated your graduation within the church's ancient way of marking time. You are graduating in the ordinary season after Pentecost, just before the feast of the Trinity, when hints of hope appear on the horizon for the consummation of Christ's reign. With these temporal markers in mind, I move to a Pentecostal trinitarian charge for you, the graduating class of 2016. First, I charge you to celebrate. Celebrate in the first class, in the first place because you have all finished all of your coursework, right? Wait, what's that? Oh, okay, celebrate because most of you have finished almost all of your coursework. But celebrate also because you have reaped the good harvest of God's ordinary gifts of intellectual and spiritual growth, the support of communities, of friends and family, economic provision and relative political peace, and an earth that in spite of everything still sustains abundant life. Celebrate because God's Spirit yet hovers over this creation, and it is good. And of course as an employee of AMBS, I am obliged to request that you celebrate responsibly, exhibiting a salinity of exaltation. Second, I charge you to renew your commitment to the way of Jesus Christ. You have learned in seminary and elsewhere that following this way involves reconciliation, reconciliation with God and with all of creation. This reconciliation requires us as God's people to abide prayerfully, worshipfully in God's Spirit to make peace among enemies and to pursue healing justice for those marginalized and afflicted by society's pursuit of wealth and power. This way is costly as it was for Jesus. It requires us to overcome our own resistance to it and others to reconciliation. Yet this is the covenant way, the way of life, the way of love. Know that as you go, Jesus is with you always to the end of the age. Renew your commitment to walk with Him. Third and finally, I charge you to rest in the Spirit who rests on you. Note that on the day of Pentecost as reported in Acts 2, the disciples gathered in Jerusalem first heard a sound like the rush of a violent wind that filled the entire house where they were sitting. The Spirit comes in power as a disturbing, disruptive, scouring wind that cannot be escaped. And yet this Spirit comes and it rests on each of those gathered. This surprising juxtaposition between violent power and expectant resting recalls the Spirit's coming upon Mary to engender the Messiah and the Spirit's descent upon Jesus at His baptism. It also reminds us of Paul's promise in Romans 8 that if the Spirit of Him who raised Jesus from the dead dwells in you, He who raised Christ from the dead will give life to your mortal bodies, also through His Spirit that dwells in you. You can rest in the Spirit because the Spirit rests on and in you. The rich life with God you desire, the healing, the freedom from sin, the power for liberating ministry, all of this is made possible because the Spirit rests upon you. So in this ordinary season after Pentecost, this indeterminate time after graduation, I charge you to celebrate God's provision to renew your commitment to Jesus' way and to rest in the Spirit. Amen. Spirit of God, strong and gentle. We come to be near you. To dwell and rest. Touch us. Liberate us. Feel us. Fill us. We rest in your silence. Receiving your strength. Your wisdom. Your holy presence. As you fill our inner beings. Renewed by the power of the Spirit within us. We turn and proclaim. Amen. Let us come before our God in prayer. Merciful God, on this day of celebration and ceremony, this occasion of so many hopeful words and so much high emotion, this liminal and holy time in the presence of your Spirit, we lift up before you, our beloved graduates. From the fullness of our own hearts, we commend these dear friends, these new leaders of the body of Christ, upheld by the wings of the Spirit, gifted with heart, mind, spirit and strength. We commend them to your mercies, oh God.  We ask that you hold them close to your heart, so tightly, so warmly, that they will never be sure whether the heartbeat they hear is theirs or your own. Guide them over the long and often rough roads they will travel. Comfort them in the lonely nights of waiting, wondering and worrying. Be present also in their joy, their laughter, their lightness of being. Be their North Star, their solid rock, their high mountain, their clearest vision. Grant, oh God, grant them long and lovely lives of service in your kingdom. And when it is time, enfold them gently into the communion of all the saints. In the name and the faith of Christ we pray. Amen. We will continue our praying by turning in hymnal a worship book to number 357. Oh Master, let me walk with thee. Please stand and remain standing. To the graduating class for the gift they are giving to the school of the benefit of future students. A hammock, a beautiful, brightly colored hammock. I can't imagine a more wonderful gift with a theme of patience and resting in the spirit. Thank you. All are invited to a reception immediately following the benediction and the recessional with graduates and faculty. The reception will be in the fellowship hall. So please join in a time of celebration and enjoying some treats together. Please receive this word of blessing. A blessing for the graduates and for all of us gathered here. May we lay aside every weight and all the sin that clings so closely. May we run with patience the race that is set before us looking to Jesus the pioneer and perfecter of our faith who for the joy that was set before him endured the cross disregarding its shame and has taken his seat at the right hand of God. Run with patience. Go out with joy. Amen.


Thank you guys, this Congress has been a real experience. This was my first one, so it's great to be here as a presenter for the very first time too. So we are both researchers from TU Munich. We are doing PhD, and this is the topic that we have been looking at for the last three years. So briefly what this talk is going to cover, we'll tell you what our motivation is, why we care about this technology, what this technology actually is. We will talk about Zen, we will show you demos, but really the three concepts that we will try to focus on in this talk is isolation, interpretation, and interposition. After we cover the basics, we will look at cloud security and how this technology applies to cloud security and discuss open problems. And this will lead the discussion into kernel code and code integrity, and that's where Tom is going to talk to you about. And then we'll have some conclusions. So really our motivation has been looking at malware, malware collection, malware analysis, and using virtualization and virtual machines to do that. We also been looking at intrusion detection and intrusion prevention. I was actually part of a DARPA cyber fast track project last year that looked at that for seven months and we created a prototype that we will actually show today. But the technology is also applicable to debugging and more importantly, stealthy debugging, using virtual machines. And of course, cloud security is a big part of that as the entire cloud is based on virtual machines, but the upcoming things are mobile security and using the ARM processors that are in your cell phones to use this technology to provide some sort of protections against malware. Which is not our motivation is to do DRM and espionage and stealth root kits, but this technology is also very applicable to that, but we are really interested in the defense side. So you heard a lot about hacking, this talk is not about hacking, this is about protection. So when you have virtual machines and you need to tell what's happening in a virtual machine or you need to control it even, the common approaches that you have today is that you install something in it, right? You have virtual box, you install virtual box tools, you have VMware, you install VMware tools, you have Zen, you install the Zen tools, which is very easy to implement and convenient. It can sometimes use shared memory or just most simply just use the network to communicate with your server outside. You can also use network monitors, snort or whatever IDS systems that you have, which is better than ingest agents which really have no isolation, right? You're running in the virtual machine, network monitors have this isolation that they are outside of the machine, so it's more protected against attacks from within the same VM, but at the same time you lose context. You look at the network, you see very limited information about what is actually happening within that virtual machine, especially if the traffic is encrypted. There are some steps into using live forensics on virtual machines or on physical machines even, where you can just scan the memory, which has isolation and context, but you really just have a passive view into the system. So all of these are valid approaches, but they all have their limitations. And this is where VMI really comes into play. And the basic idea behind VMI is that you look at the virtual hardware of the system and just by looking at that, you try to understand and reconstruct what is happening within. In that sense, it's very similar to deep packet inspection, where you're looking at packets and you try to reconstruct what's happening within the operating system, and you need to have some understanding of what operating system is running within that virtual machine or if you're doing deep packet inspection, which operating system segmented the packets to be able to reconstruct it. And for VMI, really the three points that we want is isolation, interpretation, and interposition, in which in isolation, I mean that you have some sort of increased resiliency against attacks. And you also have complete view of the system. You have access to everything that that system is doing. And since you are in a more privileged level of the system, you can even interpose yourself into the execution of that machine. So we're gonna look at these three things.  That makes tampering it harder because you have isolation provided by the hypervisor. Of course, that depends on how good your hypervisor is and how hard it is to break out from the virtual machine. But provided your hypervisor is secure and your hardware is good, then you have increased trust in the code is going to do what you want because it's in a protected region. By doing this, you also gain some performance because instead of having to deploy like an anti-virus software in every virtual machine that you want to protect, you can just have one anti-virus software that just protects all of your virtual machines. In that sense, you can avoid things like the anti-virus stormer, all of your anti-virus scans kicking at the same time on your virtual machines and just kale the hardware. So interpretation is a very critical thing because you really want to understand what's happening within the machine. And with VMI, we have a very heavy focus on memory because memory is really the common point of all the hardware that the system is using. But we, of course, also have access to the CPU registers, the desk and the network. So those can come in handy as well. But we're really going to be focusing on memory. The reconstruction of the state, though, even for memory is really hard and there are many problems with it and mostly because of complexity. You look into a virtual machine and it probably has Linux running or Windows running and that's a large piece of software. Trying to understand what that large piece of software is doing just by looking at the virtual hardware is hard and in the case of Windows, you don't really have access to the source code so you really have to reverse engineer a lot of the things. And even though your code is running outside of the virtual machine, the data that code is interacting with is still potentially tampered. So we have a dilemma of what data can be trust in the machine. But let's start at the beginning. So if you're looking at a memory, what you see with virtual machine introspection is physical memory. But of course, that's not what the operating system is using. It's using paging and virtual memory which has been around for a long time. And the basic idea is that the operating system sets up the page tables and the hardware walks these page tables when it needs to translate the virtual to a physical address. So it's a nice interface between hardware and software where software provides the data and the hardware actually walks it. The problem with this very basic thing already is that while we have a bunch of different paging systems, so we have the 32-bit paging and two extensions to that and then we have the 64-bit paging. So all right, so now we have to reconstruct all of these paging mechanisms and emulate it what the hardware would do. So that part is fine. That is defined in the Intel manual. That should be straightforward. Except there are three bits that the Intel manual says that are up to the operating system to decide how it uses. And Windows does actually use these bits, at least two of them, which means that we have a difference between which operating system is actually running, how these page tables look and what we can get from memory. So for example, volatility has this line when it does a translation that looks at these software-defined bits in the page table entries that says that if this, the 11th bit is set but the 10th bit isn't, then that page is present in memory. And they do that for every translation even if the guest is actually Linux, which is of course incorrect. So this is of course not a big problem because oh okay, we need to understand that we are looking at Linux and not do that but already shows that accurate reconstruction is complex and you can easily miss things. And this is still the case with volatility. There are of course other problems with memory, like if memory is paged out, then you don't have access to it directly. But we have access to the disk, so now we have to look for the swap file and reconstruct the swap file, which is again totally dependent on the operating system and how it's implemented, which just adds more complexity on top of that. So with Zen, fortunately we can avoid some of that complexity. For example, now we can inject page faults from the hypervisor to have the ingest operating system bring those memory pages back from disk, so we don't have to understand the file system and the swap file. But of course that takes time because the virtual machine has to execute to bring that back and it's only gonna be available in the next release of Zen. But it's progress. Some other problems with paging is that you need to find the page tables and the way forensics tools find the page tables in memory is by really just having a signature that they scan for. So in this code segment here, we have again volatility, which defines that four bytes there, which is the signature for scanning for page tables, but that's actually just the signature for a process. In fact, it's just part of a header for a process in memory and of course that's not very robust. With VMI, we can do a little better. We have access to the registers and we can just read out the CR3 register from the virtual machine and just use that for translation. So VMI has advantages over just raw memory forensics. After we have been able to translate virtual to physical addresses, of course we need to understand the kernel and reconstruct what the kernel sees and what the kernel does, which really requires debug information. And Microsoft gives that debug information for free, but of course the format is proprietary. It's the PDB format, which fortunately over the years has been slowly reverse engineered, but it's a pain to work with. But recently Recall, which is a fork of volatility by Google, really now nicely supports it where you take this debug information from Microsoft and just dump it into JSON files. So with Microsoft this is actually, and between those this is actually quite nice. This is very workable. With Linux, this is of course a bit more problematic because we have a ton of different kernels. So even if you're not taking into account your custom compiled kernel, even if you just have stock Ubuntu kernels, there is really no cross distro central repository that you can get these debug information from. Every distribution has its own. Maybe they do have it. For all distribution it's probably gone. So having the debug information is not as easy as on Microsoft where they just have a very nice central repository. So there is some work in that sense to have a central place where you can grab the debug information and that's a Fedora Dark server. But it's not really used. I mean, how many people have even heard of it? I don't see any hands, right? But there are at least some initiatives in that direction. Going back to scanning, so even if you have the debug information, you need to find those data structures that you care about, right? You want to find the data that you're interested in. So you need to find first the kernel and then the processes and files and whatever else you are looking for. And on Windows at least this is done by looking for pool tech headers which is essentially just a debugging header attached to memory allocations that Windows does when it allocates a file object, for example. And very similarly to the scan that we saw before, these are usually four byte signatures that you can scan for. The problem with that is that you have a lot of them and you don't know which one is valid and which one isn't because you have partial structures in memory and old structures in memory and then you just have false positives because you are scanning for four characters in memory and you're gonna have a lot of that. And really memory doesn't get reset so if you free a structure it's not like it's magically disappeared from memory, it's still gonna be there just while operating system treats it as it's not there anymore but it's really still in memory so you need to have more heuristics to validate those hits. So now you have even more complexity in trying to interpret which data is valid and which one isn't and that just makes everything more fragile. And of course people have discovered that this is fragile. So in 2012 there was a paper about one byte modification which just broke finding the page tables and then what we just give up because it can translate virtual to physical memory but this year earlier there was another talk about just adding a ton of fake signatures and then what we will throw up as well because it can't tell which one is real and then you have to go through by hand and that's really not a feasible approach. And that just really highlights that we have fundamental problems with trusting the data and we don't have a good way to validate which data structures are valid from what we find through scans. And that's where interposition becomes critical because if you know the execution flow of the system and you can trap at specific locations, you know what state the system is, system is in and then you can avoid scanning. So for example, instead of having to search for the KD bug structure which forensics tools use to map out some basic structures, we can just use the VCP registers and we can automatically find the kernel and since we use the debug data, we don't have to use the in-memory debug data, we can just use the one that we pre-generated and then we have complete map of the kernel. Furthermore, the heap allocations that we use before with forensics tools to find files and whatnot can be trapped automatically when the kernel actually allocates something on the heap. And what's great is there is actually native support built into Xen so you don't have to custom patch some weird hypervisor, you can just use what's already provided. And this is great because this was actually designed for debugging but it's really unknown and there is not many documentation on it and if you try to even read the Xen API, it's not gonna tell you much. So you really need to look at some sample codes that are hidden within the Xen source but it's there. So let's look at what I'm actually talking about. So this is not a live demo, I pre-recorded it but for all intents and purposes, this will be good. So I'm running on Xen 4.4 and I have two VMs running, DOM 0 and Windows 7, 32-bit. And I can list all the processes that are running on the system. This is very similar to how forensics tools do it so that works and you can see that I see more processes running than what task manager tells us in Windows. There are the kernel modules which show up for ntoskernel.exe so you can tell what's loaded in memory for that machine but these are all using the kernel internal data structures which you may not trust necessarily. So now what we see here is actually the live execution of the Windows kernel where I trapped all internal system functions that result from system calls. So these are not the system calls themselves that I'm catching but the functions that are being called from the system calls. As you can see, there's a lot of things happening within Windows even if I'm not doing anything. So it's impossible to see what's happening so I just dump it into a screen lock so I can grab through the live output. So these are actually the functions that are being called if you can catch some of them but I mean I'm not doing anything and there is a ton of them being called all the time but this gets you an idea that you can actually jump into the execution of the system and see what's going on and if any of these functions you have a deeper interest in, you can actually look at them and for example, one of the functions I'm trapping is the heap allocation function where I can check what structure, structures Windows is actually requesting to be allocated and heap allocations of course are very much in the fast path of the system so if I just move the mouse around you see a ton of IO structures being constantly allocated on the system and that's just by moving the mouse. Now if you have deeper interest in some of those structures that are being allocated we can do that as well. So for example, if I want to check what files are being accessed by Windows I can do that just by watching what objects are allocated on the heap and I just clicked on some random personalization and these are all the files that been those accesses in the background that I'm not even doing it I think this is just still loading, right? It's still going, all right. So if you want to debug an operating system this is really great because you have full understanding of what it's doing and just to show you that this is actually what's happening I just created a document here on the desktop and as you can see there is still a lot of things happening so I don't even necessarily see the file that I created so actually I'm just gonna capture that screen log to see if the file was actually in there that I created and yes it's there and it's actually test.txt.txt because Windows automatically adds the extension for me so I did not know that. So the way this work is actually using four types of events on Zen. Unfortunately this is for Intel only but that's good enough. The first type is move to CR register events. So this is, there are three control registers the operating system uses to define various features. The CR three is of course holds the page table address that is used for the current executing processes virtual to physical translation. CR zero and CR four holds various options can be used to flush TLB and we can trap every time those registers change so we have an understanding when a new process gets scheduled in the operating system so that's great. The second most important one that I used here is debugging break points. So these are just really the debugging break points that you would use if you run GDB or only debug which is the in free instruction hex CC opcode and you can just write that anywhere in the kernel code pages and it will trap and you can actually configure the virtual machine to trap into the hypervisor when such a break point happens so that's pretty great. The other event type is via the EPT violations which is the extended page tables where we actually have a whole other set of page tables that are maintained by the hypervisor that maps what memory is allocated for that virtual machine and before EPT this was done via the shadow page tables but now with the EPT this is all managed by the hardware but the good thing is that you can set different permissions in the EPT tables than what the operating system sets in the virtual machine so you can actually trap various accesses read, write or execute instruction fetches from memory. And then the fourth one which is also critical is the monitor trap flag single stepping which is an invisible single stepping feature built into inter processors now where you can actually single step a virtual machine without having anything within that machine knowing that it's being single stepped. Well there is a bunch of other features that Intel now allows you to trap on but these are basically the four ones that Zen currently supports but as you can see this is already pretty cool like you can do a lot of with these four types. As I said using the Zen API is really not very nice and it's kind of hard to actually wrap your head around how things go together but fortunately you don't have to so the way I implemented this system is using LibVMI which is a hypervisor agnostic C library that we have been working with and actually extending heavily which is a wrapper API around Zen, KVM or even if you have a raw file dumps you can do introspection on and it supports all the paging that is out there plus I recently added ARM support to it so you can actually do introspection on Android devices for example but for now it's basically Windows and Linux it has a Python interface and really the idea here is that you write code once using LibVMI and then if you switch the hypervisor underneath it's not gonna matter as long as the drivers are set up properly within LibVMI and then you write code once and it's good to go. You can use it to read and write into memory and it has wrapper around Zen events so it's actually intuitive on how you need to do like single stepping and setting up things and it's open source so it's LGPL so we are free to use it with any project that you want to implement. So a little bit more details about how the actual tracing happened that we just saw is I injected a break point into the xallocate pull with tag which is the heap allocation function but of course when that function is called the memory is still not allocated we need to catch when that function finished so we need to extract the return address from the stack, trap that as well when the return address is hit then we can actually extract the address where the memory got allocated. The trick here is that there can be actually a bunch of different threads calling this function and while you are in this function it can be context which so you need to keep track of all the colors of which ones are actually active that when it's returns you know that okay this was the structure that I was actually waiting for and then you know where that structure is allocated but it's of course at that point is just a memory address it's the structure is not initialized or anything so now you have to really watch that memory region as it's first like being zeroed out and then slowly updated as the operating system fills in all the headers and the information that we really care about so for example here we would care about the access type to the file and the file name so we just set up the EPT traps to monitor as that page is being updated but then of course this traps the entire page that that structure is on so you're gonna have unrelated write events so there is even more logic in there and that adds overhead but as you could see it was quite responsive you could move the mouse around and interact with the virtual machine so it's not too bad. What's really cool about though about heap tracing is that some basic kernel rootkit mechanisms can be really side step. So for example, direct kernel object manipulation which has been around for 10 years is the idea that you can break the integrity of kernel data structures without actually affecting the execution of the system where you would have for example a process in this case in the middle that doesn't want to be found by task manager or by the user and what it would do is unhook itself from that process list that I actually showed you in the beginning where I listed the running processes and that's just the link list so if you just switch the pointers out the structure will be still in memory but you won't be able to find it through the link list but of course now with heap tracing we know exactly where every structure is allocated without having to walk the link list so who cares if it's unhooked from here I know exactly where in memory that process structure was allocated and that increases the trust in the data and furthermore I can do some type of cross validation to see like okay I know this structure get allocated at this address but it's not showing up in the link list well that's probably some rootkit so let's look at another demo here are all the running processes and of course I have paint running I cut down the output so we can actually see what's happening here and what I'm trying to show you here is that you can really catch any event that you want so in this time I wanted to catch when the file gets deleted but before it actually got deleted and what I did is I actually fired up volatility and dumped that file from memory before the operating system was actually able to erase it so now it's in the temp folder and there you go it's actually extracted into the control domain so you really have full access to that virtual machine and you can reconstruct everything that's happening within and even extract files that were in this example closed and deleted but I was able to extract it from memory because Windows doesn't actually delete it right away and this is very handy when you're dealing with malware because a lot of the time what happens is that you have write caching enabled on the disk so when you actually say save this file Windows doesn't actually save it to the disk right away just queues it up and waits for a while to have writes buffered off and then writes it to disk so even if I would look at the disk after I save the file I might not even find it because it's still in memory and for malware this is actually usually the case because you have temporary files that the malware dropper extracts and then loads into memory and then cleans up after himself and you really need to catch the delete events otherwise that memory region can get recycled so for example what I was doing first is I was just running some malware samples and pausing the VM and I saw some files that were interesting and then I tried to go there with volatility and dump that file but of course the memory already got recycled so there is really a very short time frame where you can actually catch these files so interposition is really critical if you want to do malware analysis let's look at another demo demos are fun so this time I have a Windows 7 64 bit there is some debug information about it but it's 64 bit Windows 7 and there are all the processes running and as you can see there is task manager 2364 and what I'm gonna show you in this demo is how you can actually take full control of that virtual machine not just extract files and monitor passively what's happening so for example what I'm gonna do here is actually hijack the task manager to start up calculator for me within the virtual machine which is quite great because I didn't have to install any custom software within that virtual machine to take control of that I just need any process that is executing within that virtual machine and I can do whatever I want no passwords, ask, no username really you have full control right that's what being in a more privileged level of the system actually means and yes you can fire up command.exe and pass whatever arguments you want to it and as you can see I actually get the return value as well so I know what the PID of that process that got created is so if you want to execute some function within that virtual machine you can actually extract the output of that and then you can just pipe this together so you have like an external shell for that virtual machine effectively so now what I'm gonna do is actually just fire up internet explorer and send it to some website of my choice and there we go the virtual machine just happily does that and it's pretty much instantaneous so I really can control what that virtual machine is doing so if you're like a sysadmin this is great you can install software within that virtual machine close processes really whatever you want so all the demos that I showed you are actually part of a malware analysis system that I built for my PhD which is as I said built on Xenlit VMI volatility and recall and it's released for free for you so all of these demos and tools are now yours to play with and again the important thing here is that for malware analysis you really don't want to have anything identifiable within the virtual machine that you are running in because that's what malware usually looks for so if you have no ingest agents you don't have any ingest artifacts that malware can look for and then you have a more stealthy environment to do your analysis in and of course you can extract all the temporal files that you would otherwise miss and the open office just crashed doesn't really like embedded demos another tool that I wanted to bring your attention to which is really just fresh out of the oven is debugger integration so as I said all of the features built into Xenver really designed for debugging so why not use some of your favorite debuggers in this case GDB so this should be online by now I haven't actually had a chance to test it but this has just been released so this allows for stealthy debugging using the hypervisor and you can really debug the operating system so if you are developing a kernel driver or whatever this is really handy and of course we can add VIN debugger integration which is coming next so go check this one out too so let's go back to isolation real quick so now what we did actually is we moved a lot of the security stack out of the virtual machine and we can do a lot of that but what that really just achieves is just moving the target exploit is getting harder because you have hypervisor based isolation but of course now you're running in a more privileged part of the system so if you actually manage to break out but using some vulnerability potentially in the security tool then you have a bigger reward and it's not like it doesn't happen I mean there was just a couple of weeks ago a month ago local privilege escalation in OS like which is a host based intrusion detection system so it's kind of naive to think that our system wouldn't have any vulnerabilities so why not separate the security stack into also deep privileged virtual machines and Zen has some features to achieve that and that's the Zen security modules and what that allows is to really desegregate the trusted computing base that you use with Zen so you don't have to put the security stack within DOM zero as I did in the demos here but you can actually create a virtual machine that has control over a set of domains that you want to protect or just maybe a single domain that you want to protect without affecting anything else on the system the way it works is it creates a wrapper around hypercalls and has a policy to define how the interaction between domains can happen this is actually a piece of software that has been contributed and maintained by the NSA and Zen and they have a bad reputation but in this sense they actually do some positive work as well because without their work it would not be possible to do this as I said what it does is actually a wrapper around hypercalls and then you have the Flask policy engine where you define which virtual machine can do what hypercall and what the target is or that hypercall is and in that sense it's very similar to SEO Linux you can use the same tools to define your policy how to allow and check policy and it's disabled by default but I mean that's you can recompile Zen and then have this but really it's only usable from Zen 4.3 and Linux 3.8 so that was actually my first patch to Linux in 3.8 when we were actually testing an early version of this system that was not merged into Zen yet and we discovered that the Linux kernel actually did some access control checks itself to see if it is DOM 0 or not and if it wasn't DOM 0 it would deny issuing the hypercalls that we needed to do this type of security of course if you have access M defining what is allowed and what isn't you don't need the kernel to tell you that and furthermore that's really an arbitrary check if you have the rights to do insert kernel modules within your kernel then having a security check there is really not going to get you much so my patch was really just removing that surplus check and now with these tools we can actually start thinking about cloud security so we have a mechanism to have different security policy for different users of that cloud and the idea would be is that we start monitoring a virtual machine before it goes live so we have some sort of baseline of integrity that okay this is my base API hasn't been released on the net so I start monitoring and we can see if some critical data structures get hijacked or maybe even the code if there are any inline hooks being injected we can detect that and we can really just limit what we are trusting in the data to stuff that is bind by the hardware because if malware changes those structures the most that they can achieve is dosing the system so they probably won't touch it if they have some better use of that machine but we are back at what data can be really trust in the system so for example with the events that I showed you with EPT violations there is already some limitations in what the hardware tells us and there are corner cases so for example read, modify, write instructions which in one instruction read from memory and then write back to memory which is usually used for mutexes and concurrency stuff the Intel manual says that well it's really implementation specific whether it says the read bit so these will always set the write bit but whether it says the read bit it's well we don't know what happens so that's not really cool we actually patched that in ZEM 4.5 which will be released next month but there are ambiguous it is and there is a lot of ambiguity it is like that in the Intel manual so we actually wrote a paper about collecting all of these and these are just really some of what the limitations are a bigger limitation is really the tagged translation look aside buffer which was introduced in 2008 both by Intel and AMD which essentially caches the translation of virtual to physical addresses into a cache that you cannot query it's really just for the hardware to speed the translation up and now if you have a tagged TLB that means that the page tables don't necessarily represent what translation the guest actually uses so what we do with VMI is we look at the page tables in memory and we emulate what the hardware does but we don't have access to this cache which is a problem because with tagged TLB the cached entries survive a VM exit VM entry so these are actually persistent TLB entries and that means that the root could potentially can mock with the page tables in the guest without actually crashing the guest and we would have no idea what it's doing because it can set up the page table to point into some benign code region and when we try to see what code is actually running we see that oh it's calculator it's no problem but what machine is actually executing is something totally different of course there's some limitations to that so depending on what hypervisor and guest operating system you're running so for example Zen always assigns a new tag whenever the guest schedules a new process so you would have to do some malicious modifications to the page to essentially every time a new process is scheduled so okay we might be able to detect that and Windows 7 surprisingly is actually pretty good against this because it always flushes the global pages like very regularly but if you're running Linux on KVM well this is a more realistic problem but if you think about cloud security for a moment here there is really no need to move everything out from the virtual machine so with malware analysis there was a reason you don't want to have any artifacts within the guest that it can detect and shut down really quickly but with cloud security we want the malware to stop executing as fast as it wants we don't want it to stay alive so maybe it's enough to have some sort of securing guest agent that we can protect from the hypervisor level but it would have better performance and better visibility into the system because it's running in the same context as the virtual machine so the tech TLB problem doesn't exist for in-guest agents so we can do some sort of hybrid approach potentially and this is actually where the hardware is heading so in the upcoming Intel CPUs there is gonna be this extension called Intel VE or stands for virtualization exceptions where you can actually trap the EPT violations within the guest so you don't have to trap out all the time into the hypervisor so you would have really better performance and then you can do some sort of protection of that code that's running within the system and as I showed you, you can really control what that system is doing so you can not just control the code but you can also control the data so you really can achieve securing guest agents another approach would be for cloud security is to really just reduce the size of the guest operating system there is really no reason you need a full Linux stack in your operating system that just serves Apache so there are some works in that direction so just in this Congress we saw Mirage was but there is also NetBSD ROM kernels and OSV which really just try to achieve that reduces a virtual machine into a process and then just use the hypervisor as your scheduler just kind of ironic if you think about it because processes back in the day when they were introduced they were called virtual machines and now we would have virtual machines becoming processes again so we are kind of going in a loop here but also we could try to secure the ingest kernel because what we have actually been discussing thus far were the blacklist approach we look at what malicious changes happen to the system and we try to deny that but that of course places the burn on the defender to enumerate all the possible things that could go wrong well good luck trying to do that so now I'm going to handle where to Tom to talk about the white list approach which might be a better alternative yeah so if you want to verify the integrity of the system which we have to to run our ingest agents in we have to see what the kernel is in the system and whether it's changed by malware or not so what we propose is a white list approach that would allow verified changes within the system to the kernel so for that we need to validate and see all the changes in the system that we want to allow so code integrity basically is assumed to be an easy thing you have the code which from your binary from your kernel you hash that and you compare the hashes if it's matched then the kernel is or the kernel's integrity is there but actually Linux employs runtime patching or runtime self-code patching to have performance optimizations within the system so for that if you run a Linux kernel you now have to differentiate between legitimate and malicious changes to your software so there are two kinds of changes that are done by the Linux kernel so for the one thing there are the easy low-time patching things the easiest thing is the relocations which or alternative instructions which are architecture specific so dependent on the CPU the system is running or on the dependent on the hypervisor the system is running there are different instructions patched into the code of the system so depending on the hypervisor for example some function can be implemented that way or another so but you can say yeah low-time patching can be handled by loading the kernel in a secure environment on the same architecture maybe and creating a hash and we still have no problem but on the other hand we also have runtime patching employed by the kernel which is for example employed for hardware hot-plugging but this has to be validated and verified continuously as the system is going on so I want to show you two examples where this is actually applied in the current Linux kernels so for example SMP logs is one of those mechanisms so currently if you have virtualization on a system and you need scalability the number of actual CPUs that are allocated to the virtual machine may change during runtime so this gives a problem because if you have a signal-threaded operating system and you have logs then you don't have to ensure atomicity of that log because you have only one CPU anyway this changes if you have multiple CPUs because then you really need atomic operations and for performance reason if only one CPU is present in the system the Linux kernel does not use those atomic operations but instead what he does is when another CPU comes to the system he automatically patches all these locations in its code to atomic operations which are slower than but required in that place and also this mechanism can also be used to replace entire functions within the Linux kernel it's currently not used as that but the mechanisms basically there and another thing where runtime patching occurs in the Linux kernel for example is a mechanism called jump labels which is equally for performance reasons so you have some things, some checks in the Linux kernel that will be unlikely passed so other than just checking constantly now is it an unlikely case is it now an unlikely case you just patch out the jump to a certain code snippets out of there but once those functionalities are enabled for example by a user or by any hardware mechanism or whatever the Linux kernel just patches the jumps into the code to the function that should be executed and with that we have the additional problem that we don't have only like two possibilities yeah the patches or the jump is there or the jump is not there but the location where the jump points to also has to point to a location which is consistent with the entire system state and here you have like the perfect thing for something return your oriented programming where you just need to have an arbitrary jump within your code so these are mechanisms that we have to defend against and to verify that we already heard yeah we have simple approaches like locking the kernel yeah the easiest thing with the hash based approaches as I said is deny all changes to the kernel code and runtime but here we have the problem that we completely disable all of this legitimate patching approaches and yeah on the other hand you also can say yeah well most of the code is static but just a couple of locations might change but here you have an equal problem yeah the number of hashes that you have to maintain for every location that might change is a very large number so you have to maintain very many hashes and also the Linux kernel in its current form has a problem that for some code pages both code and data reside on the same executable page so the kernel for its code pages uses large pages which are basically two megabyte pages that are used for kernel code but on the last page there is still some spare memory that would either be wasted or the Linux kernel gives that to user space applications if they allocate some memory so here we also have the problem that we don't know really is this code, is this data, what is to verify, what should be on that page so this is also a problem for hashing the kernel so what we propose here is a trap and violate approach using VMI so we know patching only happens to predefined locations so from the binary we can derive which patching mechanisms are there and where or at which offset in the binary the code will be patched and also with which values under which circumstances and for that we can now retrace those patching mechanisms and understand what they really mean and also see their system state that it's consistent and also this fixes another problem because the code patching is not an atomic operation like for example if you patch entire functions this cannot be done at once so there's always between the two good states a bad state in between which is also good because it leads from one to the other so you have to have a system which is aware of all those intermediate states and can handle them appropriately so we propose to trap right events to kernel code and when the kernel code is changed you can validate that the change is not malicious and that does provide the integrity of the running Linux kernel so this basically now was about the integrity of the code and with that I went to conclude and as a summary to say VMI supports a wide spectrum of applications they are from malware detection to cloud environments and VMI gives us the three isolation, interpretation and interposition but depending on what you want to do with VMI it depends on which of those three features you want to have the most so the pure VMI as in isolation is not required for all of those use cases so you have to see whether you want to have an ingest agent which you can secure or if you want to have very intrusive mechanisms which make the execution of the virtual machine maybe slow so you can have like the more in depth view the less performance or trade between those but as we said the hardware support for all of these mechanisms is continuously improving and gets better there the tools that we showed you today are open source you can look at the websites libvmi.com, dragoof.com and you can find us libvmi on freenote and our contacts respectively after that I just want to say thank you to all of the names here on that slide without those it wouldn't be possible and conclude our talk and be ready for all your questions so if you have questions please line up on the microphones and if you absolutely must leave the room do it quietly number one I have a question on the runtime batching does your code work with the function tracer in terms of dynamic F trace and also with the upcoming kernel feature kpatch or kcraft with the F trace feature it works currently with a function tracer with a function replacement it does not currently work I have not implemented that yet and also for the tools are open source that last part is still to be published but this will happen in the near future okay thanks number three four four is me okay one question you showed this tool for this tracing of the memory states so you mentioned that it's only supported under x86 right now other plans to support ARM Xen as well at some point of time yes I am actually been working I was hoping to get that into Xen 4.5 but unfortunately the freeze window closed just too early so it's going to be available in Xen 4.6 okay because there is this octa core ARM platform coming up and it would be really handy to have it on ARM as well yes so next release I can expect it to have these features as well yes we are working on it wonderful a question from the internet yes we have one question on IRC what is the easiest way installing a hypervisor in a general Linux OS and what are the minimum hardware requirements for embedded systems with current distros I have been compiling Xen from source myself but I guess you can get install Xen something of that effect KVM is of course built into the kernel so that's usually a loader if your hardware supports it so usually your distribution has some built-in support for that microphone number four okay so first of all I was trying to get into the same area as the first guy what's the actual purpose of those tools I mean those tools are really cool if you want to analyze a system you have a contained environment and you want to you know that it was compromised and then you want to figure out what actually went on right so you can analyze it dynamically and trace things that's pretty nice for an actual life system everything that's coming up with live patching like Perf, like KGraft, like the others you can do a fingerprint for a security vulnerability that's going to happen in a year right so you don't you can't you simply cannot do a right list because you are in time before the fingerprint would get created but that's where the right list approach sort of comes into play like you know what the good things that can happen to the kernel so only allow the good things that you want and know about and everything else you can flag as potentially malicious it means you need to update your right list before the guest can be updated so you have a time right so if you deploy a very new kernel that the protection tool doesn't know about yet then yes that has to happen okay so imagine there's a zero day coming up and somebody like you basically get a specially crafted KGraft kernel module that you load to fix that kernel that thing it's first off it's probably tailored to you because you might actually have another security fix in your system that is just only for you so you actually might be running a kernel that's not being printed by you or by anybody else um or your host provider your your cloud provider and uh and then the cloud provider might not even know about that fix yet because well they might be in the loop after you yeah but that's a general thing like for the internal integrity part that I showed that's very very kernel specific like you need to know exactly which kernel is running on the system with everything you have to have the binaries and currently we extract all of the information for our verification or validation out of the binaries so if you as the cloud provider don't know what's in that system you can't do that anyway but you're also not supposed to do because if you would supposed to we're supposed to do that you would know about the patch that is in the system and if you can also take like this is the kernel code that we are running and these are the patches that we are applied from that we can build like the ground truth and match it against what's in the system so my main point is I don't think cloud is the right term in this case this really is an awesome thing for embedded projects where you control the whole stack as soon as you have different tenants doing different things things fall apart because not everybody has knowledge of everything left and right and also um this is also not only like for real malware detection like from the beginning you want to you have a system you think is clean and if you work with a system you have the different tools that you with which you can look at the system and once one of the system reports any funny things about the system you definitely have to investigate further so you don't have all our systems running like with the most details viewed about the systems and it's also not for preventing any malicious things or entirely for preventing them so it goes in the right direction I think and but it's not a tool like that solves everything just having a hard time figuring out where to use you but so the second thing I had was on the VMID flushing stuff so the first generation CPUs didn't like first the first generation uh VM cable CPUs didn't have assets or anything of the likes and performance difference between having assets and not is like what five percent two percent something around that ballpark you can just flush and every vm uh context switch and call it at age is just at submit a patch to kvm um to enable always to flush it always right i mean that's always a possibility that you just disable tagging and your problem goes away but then you sacrifice performance and you always sacrifice performance if you trap on every heap allocation right that's yeah so so that performance really is not an argument here um if you lose two percent you don't the two percent is definitely a lot less than your in your way oh yeah it depends on what your security application is doing so you might not need to hook all the fast path functions to really protect stuff so it really depends as I said you probably don't want to trap on everything because if you have an ingest agent then you don't need to trap you just have something within that you protect from the outside and for cloud application that's probably the way you want to go but for malware analysis doing something like this where you really can't trust any kernel data that's really essential okay number one are any of the large cloud providers offering malware detection service for their clients not yet but we are expecting that to happen soonish I guess number three you mentioned something about the android um how far we are today to use this we are my end and the system on on ARM devices so the thing with ARM is that we have the two-stage paging and I have the code to have that trapping mechanism working with Zen but unfortunately that's only one part of the picture so for all of these things that I showed here today it's really required all four types of trapping for now it's only the memory part that's functional so there is more research need to be done on how to do single-stepping and efficient trapping so for example there is no breakpoint trapping on ARM so there is some alternative that needs to be found yet but it's still very early in the research phase so interestingly the people who are looking into that mostly are Samsung so I expect them to have some sort of security stuff that they want to sell soon so it might be improving as well so and does xen already support full virtualization on ARM yes yes yes thank you so if we have no other questions we will conclude the talk and thank thomas and thomas for this very deep look at the hands of the total


American intelligence services can destroy the president of Ukraine Volodymyr Zelensky and the head of the General Intelligence Department of the Ministry of Defense of Ukraine Kirill Budenov. Larry Johnson, a former U.S. Central Intelligence Agency analyst, said this. The United States has been making agreements with reprehensible and despicable people for a long time. Zelensky and Budenov will soon understand that the West does not need them, he said at Johnson noted that CIA director Burns went to Kiev and said that Washington and Kiev are still friends, but when the time comes to pull the trigger, they will not Burns visit, the 10th one since the beginning of the conflict in February 2022 was geared to reassure the Ukrainian leadership in a situation when the House of Representatives is failing to approve additional financing to Kiev. The U.S. Congress has been unable to approve additional funding for Ukraine since October 2023. Due to this, the U.S. suspended supplies of weapons and ammunition, including artillery rounds, to Kiev I in late December, while EU supplies fall short of what Ukraine needs.CIA veteran Larry Johnson believes that the invisible hand of the West is orchestrating what may end up in regime change in Ukraine. It's always important to pay close attention to what's going on in the media because these stories don't just appear out of nowhere, Johnson told. Remember, Time magazine, who had featured Zelensky on its front cover in 2022 as Man of the Year, they described him as like, the reincarnation of Winston Churchill, and this great military strategist. When he was put on the front cover of Time and decried is basically like Adolf Hitler, delusional, out of touch with reality, crazy. So when I see those kinds of articles appear from both British sources and American sources, it's telling me that the political establishments in both places are preparing the exit ramp for Zelensky, he said. According to Asia Times, there is a growing consensus that the West wants to replace Ukraine's president, Volodymyr Zelensky. NATO responds to Putin's latest nuclear weapon threats. Representatives of the Russian Federation have been constantly threatening with nuclear weapons for the past two years, but it's about psychological intimidation rather than actual intentions, states NATO Deputy Secretary General Mircha Joana. We have seen such use of nuclear threats by Russian leaders for at least two years since the war in Ukraine began. And this comes from a nuclear superpower like Russia, the statement reads, according to him, this is extremely irresponsible because when possessing such weapons, restraint is also necessary. NATO believes that this is part of their arsenal for psychological pressure and intimidation. Joana has said that the statements of the Russian President Vladimir Putin are based on the logic of psychological intimidation rather than real intentions. We do not see a direct threat of Russia using such weapons. However, such statements are very dangerous as they undermine trust in the field of nuclear weapons. Russia knows the consequences of such a development, says the NATO Deputy Secretary General. Joana also adds that this is largely the same arrogant way of attacking the West and describing the war that Putin started in Ukraine as a war of civilisations, or to justify the claim that the West is supposedly trying to destroy Russia, which NATO called complete nonsense. On February the 29th, Russian President Vladimir Putin addressed the Federal Assembly of the Russian Federation. The Kremlin chief in particular began to boast about the weapons Russia has, including missiles capable of carrying a nuclear payload. He threatened to demonstrate the intercontinental ballistic missile Samat, allegedly capable of flying 18,000 kilometres. The State Department said that the U.S. had already warned Russia about the consequences of using nuclear weapons. Threats from Putin are irresponsible. Russia's Black Sea War Plan isn't working. UK. Russia's tactics against Ukraine's creative warfare in the Black Sea are falling short. According to a new assessment, as Moscow and Kiev step into the third year of all-out war. According to Newsweek, Russia can still strike at Ukraine from the eastern parts of the Black Sea, but it is increasingly evident that the defensive posture adopted to mitigate against Ukraine's non-conventional approach to maritime warfare is not working as intended. The British Defence Ministry said it is noted that shortly after Russia launched its full-scale invasion of Ukraine in February 2022, the Black Sea emerged as a key battleground between Kiev and Moscow. Ukraine has vowed to reclaim Crimea, which sits to the south of the mainland on the Black Sea, but has been controlled by the Kremlin's forces since its annexation in 2014. Ukraine does not have a large navy, but has made impressive use of naval drones to carry out dramatic strikes on Russia's Black Sea assets that have proved deeply embarrassing to Moscow. Russia's Black Sea operations have been greatly complicated if not paralysed by the nearly two years of all-out war between Moscow and Kiev, Ukraine's navy said in early February. Ukrainian-designed Magura V-5 naval drones attacked and destroyed Russia's Caesar-Kunikov large landing ship near the southern Crimean city of Alupka, southeast of Russia's naval base at Sevastopol, Ukraine's military intelligence agency said earlier this month. Russia has lost a slew of other vessels, including its Black Sea flagship, the Moscow, several other landing ships, and a submarine. The Kremlin has used uncrewed vehicles and guided missiles to push Russian threat perception to new highs and force Moscow to shift many of its assets further east, away from mainland Ukraine, the UK government evaluated. The Kremlin has relocated some of its Black Sea assets from the peninsula to its Novorossiysk base in Russia's Krasnodar region further from Ukraine's coastline. Russia is also thought to be establishing another Black Sea base. In Abkhazia, a breakaway region internationally recognised as part of Georgia. This would move Russia's resources in the Black Sea even further away from Ukraine's reach.


To install an SSH server on your Android device, install Turmux. Open it. PKG install, open SSH. It will download, install, and generate some keys for you. Next, set a password. P-A-S-S-W-D. Type in your password. And then start up your server, SSH-D. Now it's running in the background. You'll also want to pull down your bar here and acquire Wakelock if you haven't already. And now allow it to run in the background. Next, go to your other device, SSH, your IP address. No username needed. Port 8020. Unless you have root access, you can change that. By default, it's port 8020. Once you do that, type in the password you created, and now you're logged into your phone through SSH.  Next video, we'll talk about getting that to run at boot time. Thanks for watching. Filmsbychris.com. Chris with the K. Link in the description.