The Mutual Broadcasting System presents The Mysterious Travellers, written, produced, and directed by Robert A. Arthur and David Cogan, and starring tonight three of radio's foremost personalities, Ralph Bell, Louis Van Roten, and Roger DeCoven in S. O. S. This is a mysterious travel inviting you to join me on another journey into the realm of the strange and the terrifying. I hope you will enjoy the tip that it will free you a little and cheer you a little. So settle back, get a good grip on your nerves and be comfortable, if you can, as we join three enterprising men who are in a very dire predicament. It's a story I call S. O. S. My story tonight is about a group of unsavory individuals at the moment discussing a little unhappily their recent past. Yes, sir. Here we are, the three of us. A drift out here. How long is it now? How long, Mike? Let me alone. Ah, Steve, he knows everything. He sure does. Couldn't miss, he said. Couldn't miss. Still opportunities. You just had to recognize them. Isn't that what you said, Steve? Isn't that what you say?  I've had enough of you. Look at him. Now he's going to turn on that automatic radio sender. Isn't that right, Steve?   Do you really think someone's going to hear those signals? No, sir. But for good. You're wasting your time with that radio sender. No one's going to pick us up. Forget everything that happened. There's no escaping it. I can see everything that happened as clear as if it were only yesterday. Yeah. I remember the way I walked into the office. Mike and Doc were sitting there, waiting. Waiting for the bad news. Well, Farson got a life sentence. The rest got 10 to 20 years. Great. Just great. I just can't get over it. Just can't. Things were running so smoothly. The syndicate was cleaning up, and then this happens. The three of us were pretty lucky. Not being indicted with the others. Yeah. We hadn't been in South America. And on that end, we'd have gotten it in the neck, too. I still do not understand. How could they smash the syndicate overnight? There were no records. Farson took every precaution. Let's face it, the day for guys like us is over. The cops have science on this side. They're using every trick in a book. Yeah, you're right. Television radar, infrared cameras, electro detectors, light beam alarms, and 101 other scientific gimmicks. Yes, you are right. They have learned to move so fast that they have taken all the profit out of the rackets. They sure have. They just wish I had a small pot of all that dough I once made. Where did it go? Lawyers, bail, prediction. They haven't got a cent left. Neither have I. What about you, Steve? I've still got a few grand left. Well, the way science is turning the heat on, it looks like we'll have to turn on us. What do we want to or not? Look, I've been working on an angle. What about sticking around for a couple more days? Get wise, Steve. The cops are ready for everything these days. There aren't any more angles. I tell you, I've got one. I just need a little more time to work it out. What do you say? Well, it cannot do any harm to listen. How much time do you need? Two days. Meet me here the day after tomorrow. I'll lay out the whole plan for you. Well, Steve, you still got an angle or did it blow up in your face? For the past 48 hours I've been going over it. Detail by detail. It still looks good. Well, what is the job? Let's have it. The lifting of $5 million worth of uncut Martino diamonds from the SS Europe. What?  It would require an army to take over that boat. It has a crew of over 300. This plan of mine can be worked with three men. Us. This I've got here. Just how would you go about it, mastermind? All right. Two weeks from tonight the SS Europe will be docking in London with $5 million in uncut diamonds and the shipment of 3,000 pounds of uranium under pressure. 3,000 pounds of uranium under pressure. What are you getting at? A half hour before the Europe lands. I go to the captain's quarters.  And you, Doc, you go to the special room where the uranium is stored under pressure. Then what? I tell the captain that I have one man in control of radio communication and another in the uranium storage room. And unless he turns over the diamond shipment to me, a bullet will be fired into the uranium compressor blowing up the ship. You really expect the captain to fall for that? Well, he'll call your bluff.  Of course he will if it like that would never work. You're wrong. You're wrong there. Psychologically, we've got the edge of the captain. Maybe we're willing to die, too. With a crew of 300 and twice as many passengers, he just would risk it. Perhaps you'll hide. After all, his first duty is to his passengers and ship. He would probably figure that we wouldn't get far with those diamonds, that the police would get us in no time at all. Of course. That's exactly the way to see it. Um, suppose you two force him to turn over the diamonds. How would we make our getaway? We'd use one of the ship's emergency launches. Sure. Meanwhile, the captain of the SS Europe is radioed the police. And we walk right into their arms. We captain walk radio the police. No, and why won't they? There are two reasons. First is Radio Rome will be put out of commission. And second, ten minutes after we leave the Europe.  Blow up? The uranium? That's right. There won't be a piece of the ship left or any one to identify it. Uh-huh. Five million in uncut diamonds, you say, huh? At least five million. The first plan of yours, Steve, is just wild enough to succeed. Yes, through sheer audacity it might be carried off. A job like that is all or nothing. That's right. Well, what do you say, Doug? Finding the thought of honest labor abhorrent, I'm inclined to go along with you, Steve. What about you, Mike? The odds are against us. But for that kind of dough, I'll risk it. You won't regret it, Mike. All right, now here's a setup. The day after tomorrow, the SS America is out with bound. We'll be on her when it leaves. You mean so that we can study the same layout that we'll find on the York? Yes, that's right. By the time we board the Europe for the return trip, we'll know every inch of the ship. Now we'll have to work fast. I'll take care of getting us passports under assumed names. Doug, I want you to book passage for the three of us on the America. Two days later, Doc, Mike, and myself boarded the SS America using false passports. We pushed our way through the other passengers, mostly vacationists, to our cabin on the deck. While we were unpacking, the ship's whistle blew for all visitors to leave. A few minutes later, we were on our way. During the next three days, we covered the ship from one end to the other, taking pictures of the layout, learning the schedules of the crew. When we walked off after the 10-day trip, we knew everything there was to know about both liners. Boss and judge, we will kindly step this way on shore their passports. Come on, that's us. I hope we don't have any trouble with these passports. Don't stop worrying, will you? May I see your passport, please? Here you are. Thank you. Richard Werby, born in Boston, the United States. How long do you intend to stay here, Mr. Werby? About a week. Have you ever been here before? No, this is my first visit. Our laws are quite different than those of your country. You will do well to study this booklet, which is issued by my government. Thank you, I will. Your passport is, um, you may pass. Thank you. I trust you enjoy your stay with us. Next, passenger, why don't we go back to the hotel? We might as well see the local sites while we're here. So this is what all our fellow passengers came all this way to see. This place gives me the creeps. The natives, too. Everything looks so different. Oh, come on now. My gut's no way for a traveler to speak. Sure, this place is different from what you've known, but you'll find plenty to interest you here. Yeah. Just as soon as we'll be back in New York, it's all the same to you. Relax, Mike, another week and you'll be back in New York. Relax, he says. I don't like places that are different. I like what I'm used to. These crazy birds, what do they call them anyway? I don't know. Do you see? They're the national bird called martinos. Look at them, like vultures. Thousands of them. Oh, you'll get used to them. All these canals. Never seen nothing like it. That's one of the great attractions here. People come from all over the earth to see these canals. Yeah, well, they can happen. Look at those ruins over there. The war's been over all these years, and yet they've never cleaned them up. Yeah, our rocket fighters sure level the countryside. No wonder the natives aren't any two friends there. You say that again. I'll be glad when we board the Europe. Leave this place forever. Check all our luggage. Yes, I went through the motions of looking like an anxious tourist. It'll be in our cabin when we go up off. What cabin did we get, Steve? Cabin 32B. 32B. That's just a few feet away from the radio communications office. That's right. Attention, please. All passengers bound for London. We'll now board the SS Europe. Departure time is 0900. All passengers for London. Will please board the SS Europe. Come on. That's us. We followed the returning vacationists aboard, had our passports checked, and were shown to our cabin. It would be 10 days before we'd go into action, but already the three of us felt that sense of excitement that comes before a big job. And this would be a big job. The biggest ever. The minutes and the hours seemed to drag on that homeward trip. We checked the craft from Stem to Stern, and the layout was exactly like that of the SS America. And the final night out, all the passengers were celebrated, none of them expecting that they'd never seen London. At 4AM, with a liner just one hour from London, three of us went over our plans for the last time. The impermeable roar of the motors in our ears. Okay, this is it. You both have your guns here? Of course. I'm Ike. He'll take over radio communications. There'll be just one radio operator on duty. Remember now, take him quietly. He won't let out a beat, Grud. It shouldn't take you more than a few minutes to put the radio and radar equipment out of commission. Now, make sure you don't damage the ships and the communication system. Just leave it to me. Doc, there's one crew member guarding the storage room where the uranium ship is being kept. Once you've taken care of him, lock yourself in the storage room. Now, you don't come out until I give the signal. I end up dead. Now, have you got the demolition stick? I've got it. I've explained how it works. When I wrap on the storage room door, you plant the demolition stick under the uranium compressor, where they won't be able to see it. Right. We'll have to move fast now. That explosive will go off ten minutes after it's set. Will we be able to get far enough away before the explosion? Oh, yes. The launch is on B-deck, right outside the storage room. We'll be in the launch in a way in a matter of seconds. Doc, you've already checked the launch engine. Yes, I just came for me. It's all set to go. All right. I'll take care of everything. Now, let's set our watches. I've got 426, 45 seconds. 50 seconds. 55 seconds. 427. Right, chick. OK. Let's go. The three of us left the cabin and separated on the deserted and dimly lit deck. I walked to the nearest staircase and went up to A-deck. There wasn't a soul in sight as I walked to the captain's quarters. It was exactly 4.29 a.m. I left a cigarette waiting. On the horizon, far ahead, I could see the lights of London. I could feel the liner losing speed. In exactly 4.30, I knocked on the captain's door. Kevin, come in. Oh, come in, Phillips. Are we ready? I thought it was Phillips, my first officer. Oh, no, Captain. I'm merely one of your passengers. I'm afraid you'll have to excuse me. I'm doing the control room. We'd be landing shortly. You'll have to hear me out first. Yes, but I've just told you... A gun! What's the meaning of this? Sit down, Captain. I see here. Sit down. That's better. Then what is it? You're carrying $5 million in uncut martino diamonds. I want them. You must be out of your mind. I'm not alone in this, Captain. At the moment, the ship is at my mercy. It's your mercy? Yes. My men have taken over key positions on this ship. Right. I don't believe you. That isn't possible. No. Well, just as a test, pick up the phone and dial the radio communications office. Go ahead. Communications office? Who is this? It ain't one of your crew members, Captain. Let me have the phone. Hello, Mike. Yeah? Everything under control? It wouldn't be better. Good. I'll be talking to you.  You must be. You believe you can commit piracy and get away with it? I'll get away with it, Captain, because you see you're going to help me. I help you? Yes, that's right. One of my men has taken over the storage room where the uranium is stored under pressure. You can't do that while that pressure machine calls for constant care of an engineer. If the pressure falls below a certain point, the uranium will explode. Take it easy, take it easy. That pressure machine is being looked after by one of my men. Nothing will happen to it. That is, if you do exactly as I say. You think I'm bluffing? You think I'm bluffing about the storage room? Storage room? Everything under control, Doug? Yes. The Captain's here for the phone. Tell him what your orders are. I am to put a bullet in the pressure machine if I don't hear from you in 15 minutes. You heard what he said. Well? He's bluffing. If he put a bullet in the pressure machine, uranium would blow us all up. You and your men included. That's right. But you see, Captain, my men and I have nothing to lose. And you and the rest don't. What do you mean? The authorities in London are waiting to arrest us. To murder her. So as I said, we have nothing to lose if we're forced to blow up the ship. Even if I turned the diamonds over to you, how would you get away? We'd take the lawn, John B. Dagg. I see. You've got 13 minutes left, Captain, before my man fires that bullet. And believe me, he will. Seems I haven't any choice. None. The authorities will get you for this. Well, let me worry about that. You've got 12 minutes left. Now you're being sensible. First Officer Phillips speaking. Phillips, this is Captain Andrews. Yes, sir. I want you to go to the purse, sir. Have him turn over to you the consignment of uncut diamonds we're carrying. Bring them to my cabin. Sir, we'll be lending in less than... That's in order, Phillips. Yes, sir. You should be here with the diamonds in a matter of minutes. For your sake, I hope so, Captain. I hope so. That must be Phillips now. Have him come in. Come in. I have the diamonds here, sir. Turn them over to this man. But, sir... As I say, the safety of the ship and our passengers are at stake. Yes, sir. Thank you. You don't mind if I look them over? What's this all about, sir? Seems that after many centuries, piracy has returned. Piracy, sir. All right. I've checked them. Now, Captain, if you and your first officer will escort me to B-Dagg. They will. So along, Phillips. Yes, sir. After you, gentlemen. Our first stop will be the radio communications office. Right. Yes. Stuff's in this box. All right, Captain. The next stop is the special storage room. Very well. Did you take care of the communications office, Mike? Yeah. They won't be sending out any messages. Good. Ah. Here we are, Captain. Back. Quite many ants. Now, the door slots. Open up, Doc. It's us. Something's wrong. Yeah. Look, let's take the launch and blow out of here. It isn't our fault. Something happened to Doc. If we're getting one thing, we need Doc. He's the only one of us who knows how to navigate that launch. Yeah. Come on. Let's break down the door. To get it out? Sir, shall I try to slip away inside the alarm? It won't be necessary, Phillips. There's Doc. Climb on the floor in there. It's not cold. Let's get him out. Now, these two men have the third one on our guard taken out of the storage room when the guest disperses. Very good, sir. You've revived the third man, eh? Yes, sir. The three of them are all conscious again. And the guard? All right, too, sir. Oh, uh, we found this, sir, in the third man's pocket. A demolition stick. Uh, as I see it, they were going to set it before they left the ship, sir. Blow up my ships and passengers, would they? Shall I put them in the brig, sir? Brig? No, Phillips. I'm not taking them into London. I'm dealing with them here. Now? Well, I... I don't understand, sir. This launch they were going to take have it filled with concentrated food and water. Enough to last them for years. Very good, sir. Then I want the launchers' motor completely demolished. Is that clear? Yes, sir. What? What do you want to do with us? You've attempted a crime unheard of for centuries. Piracy. I'm going to meet out the old punishment for it. I'm setting the three of you adrift. Adrift out here? No. No, you can't. You've got to take us into London. You've got to... They're right, sir. Your duty to turn them over to the police. You haven't the authority to... It's Phillips. Out here, I'm the law. You carry out my orders to the letter. Yes, sir. Captain, give us a break, will you? Don't set us adrift. It will be murder. That's what it will be. Murder? Can't set us adrift out there. You can't. I can and I will. You and it. If we've been adrift out here... two months, I guess I lost track. A long way back. Out here, with nothing but the sky to look at. Black, empty sky, blazing with stars. Time loses all meaning. The automatic radio senders keep transmitting signals. But no one listens. Yes, sir, Steve. Couldn't miss, could it? It couldn't miss, huh? You had everything covered, all right. All you missed was that automatic gas alarm they had in the storage room.  Yes, doc. When that guy failed to check in, I got a good dose of that gas. Just a small detail you overlooked. It's such a... You think because you're sending out those signals, someone is going to pick us up, huh? They've got to pick us up. They've got to.  We are drifting further from the Earth all the time. But they can't leave us drifting in space in this rocket launch. They can't. No, why not?  And has anyone come after us yet? The space patrol. They'll rescue us. I'll tell you they will. Never. They're letting us be examples to anyone else who tries to hijack a space liner. We're drifting out here in the air. We're drifting out here in empty space, Roman. We'll drift onward till the day we die. No. No. No. We won't. We'll be picked up, I tell you. Yes. Why don't you get wise for yourself? This is the year 2185. Miracles don't happen anymore. It seems that criminals of the future aren't going to have any future. Not what science did it against them. Poor Steve, Mike and doc. Imagine being adrift in space in a disabled rocket launch and being completely ignored. Yes, it seems that not only doesn't crime pay today, but it's going to pay even less in the year 2185. Oh, but that reminds me of my story of the next week, the big die. It's about a young man who figured out a perfect alibi for murder and forgot to take into account that it... Oh, you have to get off here. I'm sorry. But I'm sure we'll meet again. I take this same train every week at the same time. You have just heard The Mysterious Traveler, which is played by Maurice Tartland. In the cast were Ralph Bell, Louis van Ruden and Roger DeCoven. Original music is composed and played by Al Finnelli. All characters and tonight's toy were fictitious, and any resemblance to the names of actual persons was purely coincidental. Frank Waldekker speaking. This is the Mutual Broadcasting System. The Mutual Broadcasting System.


Yes, we're ahead, but I think that there is a right time and the time is now today. We've been working on Slythian Mayans for 17 years with very advanced algorithms.


Teutonic floors, the west is on average the best idea humanity had so far, but it is in deep trouble currently, and we westerners have the responsibility to save the west from the ideologies from within, which weaken the west. A strong west would not be so susceptible to regressive anti-western ideas from within and outside. Being free would be and is the best immune system against authoritarianism, totalitarian structures. I agree with Teutonic floors 100%, but I wouldn't say the west. I think the United States, that applies to the United States, because the United States has many things in place that were laws in place, the Constitution, the Bill of Rights and all this jazz, the right to bear arms and no taxation. They have all these laws in place because those people are escaping totalitarianism, monarchies, tyrannies in Europe. I don't think the rest of the western countries have the same rights for individual rights, individual liberty as the United States, so I think on paper the United States, the laws in the United States, should be applied to the rest of the western world and any other country that wants to do it, but those laws, those rights, aren't even being applied in the United States. So we, citizens of the western world, if you want to say the western world in the United States, but let's say the western world is have let monsters run amok. We need to change that.


A'r ysgol sefydlu dan nifer i chi'n dweud ar unrhyw gadewch. Yna yw'r hyn sy'n gwneud eich ddwyd yn ymgyrch ei ddweud? Yna, mae'n ddwy'n mynd i chi'n dweud. Mae yna'n mynd i chi, ond mae'n ddweud i chi'n dweud i chi'n dweud i chi'n dweud. Dwi'n ddweud i chi'n dweud i chi'n dweud. Rwy'n wedi'i gweithio i chi'n dweud i chi'n dweud. Mae'n gweithio that it didn't creep into the crew game which it didn't. We nailed it and put it to bed and like I say we've got to follow on from the crew game now. Real professional for home that's needed again. Be hard to beat and we know it's going to be a tough but it's a tie that we obviously are looking to win. And we know that it's chessing me knighted at home in the second round for us if we should progress. This in my notes is important to stay focused, pure in all the shot, I'm just professional in doing things the right way. Definitely. We can't look too far ahead. We've just got to look to tomorrow night really. If we play like we have been playing at home recently then there's no reason why we can't win the tie. But we've got to be on the front foot again. We've got to work hard as a team. If we do all the right things then we can come through.


As you can see I'm working for red hat, you know and after this fancy behind this fancy name Which doesn't mean a lot. I'm going to talk about the integration between ansible and open daylight and more specifically specifically ansible networking So this is a little bit of the agenda. What is open daylight? What is ansible pretty raise your hands if you know what is open daylight and Ansible Not pretty good. So I can go much quicker then The third point We're going to talk about the integration between those two these two technologies and then I'm going to show a video of a demo. So they will they will not be hands-on actually What is open daylight? It's an open source project. It was created with all these SDN wave and one of the Definitions that I like the most about open daylight is that it's like the middleware for for network services, right? So it's not just an SDN controller. It's It's a kind of a platform to create network services red hat was a platinum founding member of the project and It was it's quite interesting because the presentation from last noise is that the architecture is pretty much the same and So you will understand easier The the heart of the open daylight is this blue box here, which is called md sal model driven service abstraction layer and What it allows you to do is to to model your network service via Language call young where you can define attributes RPC calls or any kind of parameter and There will be some rendering of this model into Java classes that are ready to to be implemented, right? It also provides The databases like we have two different data stores configuration operational data store and on top of that we have what it's called not bound applications. So we have You can do many things with it we have Kubernetes networking management we have service function chaining network utilization applications There's plenty of them and in the south of this blue box below We have what we call? Southbound plugins or protocols. So we have open flow of the SBB BGP and so on and what we want to do here what we want to show it is it's basically a prototype, but It it could be quite promising. It's to integrate Ansible as one of these southbound plugins and now why Ansible Mainly because you know is one of the fastest growing projects I think in in the last decade There's a huge community. It's very simple to use like Great in a playbook Which is like a recipe of tasks that you want to automate is very very easy. There's a thousands of modules to to use Unlike puppet or chef you don't need an agent on the target machine that you want to automate and and it's very powerful You can automate servers storage and what we are going to talk about here network devices, so there are like 50 more than 50 platform supported and 700 modules something like that for just Ansible networking and of course it's not only switches and Routers you can also there are load balancers and any other platform the way Ansible is a structure We have playbooks which are the recipes where you write your your tasks that you want to automate and then some roles Which is like a group of of tasks around a same topic. Let's say and In in Ansible networking we have Function roles and provided roles. I'm going to explain better with with an example The demo is going to be about creating an L3 VPN between two endpoints to routers so our Function role is basically to create a VPN or delete a VPN and That's very simple that that's something that everyone understands and you don't need to care so much about how it's going to be implemented The implementation details are embedded into the provider roles So imagine you have a lab with heterogeneous hardware, so we do you have Cisco's and juniper and And another vendor comes for example Dell and says hey I will give you a very good deal with this bunch of hardware take it because the only thing that you want to You have to provide or the vendor will have to provide is the provided role for for that same Function role for creating the VPN. So the beauty of Ansible networking is that you get an abstraction layer and the user doesn't need to care about the implementation details and The provider roles will connect to the devices and configure whatever is need to be configured So the integration is mainly these two boxes here We're using Ansible towers a GUI to interface with open daylight just not to send like Rescom calls VSEI but The important part is here Ansible is it's a stateless right and it was meant to be like that the thing is From the network Operator standpoint you need some kind of a state you need to to have to know the state of the network and Ansible can cover the management plane of Then of the network, but not the control plane. It's not done as the end and that's what the What open daylight provides? It provides state it provides network topology. So I think that the combination could be very very powerful So the demos about creating an L3 VPN, this is all running in one server is virtualized and we have a bunch of virtual machines these four boxes that you see here are acting as piggy routers and Which are there the routers that are in the service provider network and we are assuming that Some underlying connectivity is provided like MPLS and BGP and so on so these peer routers will have customer premises routers connected to them and and From Ansible tower we will instruct open daylight to create a VPN between two of these peer routers so one once the VPN is created We will be able to see two of these C routers Being able to ping each other, right? so in the end what it will do open daylight will Know in the topology we'll execute L3 VPN and civil role and And the provider roles will connect to for example the Cisco boxes. It doesn't matter is if the boxes are virtualized or or physical and We'll configure the VRF the interface the IP in the interface that is connected to the CE router and so on So this is the operational workflow, but I'm going to show you in the video because I don't have So much time. Yeah, okay. Can you see it more or less? Okay, I can explain anyway It's okay. No problem. So This screen is showing the CLI of the terminal of To see of the to see routers. These are the routers that are in the customer premises or at home, right and As if you can see here, we have this IP 10 dot 10 dot 10 dot 5 and 20 dot 20 dot 20 dot 5 different networks so what we are going to do like I'm showing that that IP and I'm going to try to ping each other Okay, ping doesn't work So this is a civil tower It's a good to manage and civil playbooks and roles and things like this what we have here are different templates the job template is like basically one Playbook let's say and a workflow template is a chain of different job templates so What we are going to do is Execute the configure site template and we will pick to the two endpoints of the L3 VPN We have a bunch of parameters like the the site name The IP of the peer router of the interface that the peer router faces to the C router So what we are doing here is pushing information to open daylight From the first site now. We are going to execute the same With the second site the other endpoint Okay, we change the VPN ID doesn't change because it will be just one We change the name of the node Okay, it's executed. You can see like a civil tower provides logs and everything is pretty cool Now we will execute the manage L3 VPN service will which will do It will push the information to Open daylight to to create the the L3 VPN this is skydive It's another open source tool that allows you to monitor the the network and as you can see this is the underlying Infrastructure so you can see the box is connected and this is the VPN And there is no links between between these these items so now once we Execute we execute the manage L3 pn It will create the VPN it will SSH into the boxes Configure the VRF the IP in the interfaces and so on Now we see the three VPN is in green Now we are pinging if it's correct and Suddenly the pin starts working right so now let's see that the L3 VPN will be established and and the people connected to this serial router will be able to connect to the other side of the network and there The overlay Drawing is it's connected now you can see the interfaces so that there's a budget of information that Sorry for going so quickly, but that's basically it any question. I will be outside


This is Ratna Gupta. I recently completed my graduation from the Tetsuo College securing gold medal in become accounting and finance Firstly, I would like to congratulate to all my meds for their well-deserved success I also want to express my gratitude to all my teachers my family my friends and all my well-wishers for their endless support Which always motivated me to give my best and yes A big thank you to Tetsuo College for providing me with all the knowledge moral support and for showing me the path to success Believe in oneself be confident in one's abilities and always try for excellence and Above all I thank God for everything Last but not the least I would also like to give a small suggestions to all my juniors Have faith on yourself Try to make a habit of studying every day at least for an hour or more Work hard on the lessons consistently and most important do not give up before you reach your goal Remember what you achieve will inspire the entire group to aim higher and achieve more and yes I also are you to enjoy your college life and other aspects of your life, too And do your best and leave the rest to God. I finally wish all my juniors a big success in your future endeavors


The peer administration on November 1st decisively took the first step toward ensuring the exhaustive St. Jude Hospital reconstruction saga, which began some 13 years ago, reaches a state of completion with the welcomed resumption of works on the original construction site. I want to thank the staff of the St. Jude Hospital and the board of directors for guiding this process.  My heart bleeds for them, because the conditions at least at that stadium were not easy. And because, most of the time because of selfishness, we kept these people in that condition for six years. And I had to walk in these buildings this morning and I was saying to, that I went myself to see for myself. I'm not an engineer, I'm a professional engineer, but there is nothing that says that these buildings could not have been completed for years. There is absolutely nothing that says. It's a callous act for people to have left people in the conditions at the stadium just because you want to prove a point, but we're not proving any point. The only point we're proving is we are trying to improve the healthcare for the people of the south and giving them better conditions. That's the only point we have left. In the last eight months since his initial announcement on the continuation of works on the original construction site, Prime Minister Hon. Philip J. Pierre successfully coordinated the required human and capital resources across various government departments to reactivate the St. Jude Hospital Reconstruction Project, which was left to decay by the previous administration. As promised by Hon. Pierre, work on the original construction site, which is now teaming with construction crews, has finally resumed. We have started today with the phase one of the St. Jude Hospital Rehabilitation Project. Phase one includes the cleaning of the entire site, including all the buildings. It also includes the fumigation and anti-termite treatment that needs to be carried out because of the time that has elapsed since the buildings were not used. So today we have started with the east wing, we have started with the surgical building as well as power laundry and maintenance building. We are cleaning up the floors. That's the first step that we are doing and we are about seven subcontractors currently working here. There are 42 people in the crews that have started to work here today and this will continue for the next four months. The importance of employing a reliable and trustworthy oversight committee is not lost on the Pierre administration who has assembled a cohort of experts across the public and private sectors to ensure project deliverables are met on time and within budget. We expect to utilize the best practice of interministerial management and that includes close collaboration and active participation of the Ministry of Infrastructure who will lead on technical supervision as well as the Ministry of Health who you heard earlier would be responsible for activating our oversight mechanism and that is a broad-based steering committee which is made up of both public sector and private sector individuals. I think it speaks of a model of, as the Prime Minister always articulates, a model of transparency, accountability and best practice. St. Jude Hospital construction deviated in 2019. By 2021, less than two years later, more than 89 million taxpayer dollars was expended. However, St. Lucia's south was still no closer to having its own hospital. Pierre is committed to ending wastage of public resources. So in total, we possibly may have spent between 250 million and 300 million dollars when we are completed paying the debts on these two millions as they are. That is what the taxpayers of this country will have to go through and whereas I'm happy it hurts me because 300 million dollars later, the people of St. Lucia still have not got a hospital. But I can assure them and the Cabinet can assure them that in the shortest possible time, the people of the south of this country will be, not maybe, will be receiving healthcare in these St. Jude millions. Upon assuming office last July, Honourable Pierre requested a status report from the Ministry of Economic Development on the Phase II iteration of the St. Jude Hospital, which was commissioned by the previous administration. Phase II, or the new structure, was erected near the original construction site between 2019 and 2021, nearly three years after construction on Phase I, the original construction site was abandoned. Honourable Pierre has confirmed the Economic Development Ministry's report does not recommend proceeding with Phase II. From the Office of the Prime Minister, Rihanny Isidou.


Hello friends, welcome to the session. I am Alka. We are going to discuss determinants. Our given question is, find the inverse of each of the matrices if it exists given in exercises 5 to 11 are 10 exercises matrix 1 minus 1 to 0 2 minus 3 3 minus 2 4. Now let's start with the solution. We are given that a equal to matrix 1 minus 1 to 0 2 minus 3 3 minus 2 4. Now we'll find the determinant of a therefore determinant of a equal to 1 into 8 minus 6 minus of minus 1 into 0 plus 9 plus 2 into 0 minus 6. This is equal to 2 plus 9 minus 12. This is equal to minus 1 which is not equal to 0. This implies a inverse exists. Now we will find the co-factors of the elements. Co-factor of 1 equal to minus 1 to the power 1 plus 1 into 8 minus 6 that is equal to 2. Co-factor of minus 1 equal to minus 1 to the power 1 plus 2 into 0 plus 9 which is equal to minus 9. Similarly, we'll write the co-factor of other elements. Co-factor of 2 equal to minus 6. Co-factor of 0 equal to 0. Co-factor of 2 equal to minus 2. Co-factor of minus 3 equal to minus 1. Co-factor of minus 2 equal to 3. Co-factor of 4 equal to 2. Therefore, matrix formed by the co-factor equal to matrix 2 minus 9 minus 6 0 minus 2 minus 1 minus 1 3 2. Now we'll find the adjoint of a therefore adjoint of a equal to transpose of the matrix formed by the co-factors. This is equal to 2 minus 9 minus 6 0 minus 2 minus 1 minus 1 3 2. So this is the value of adjoint of a therefore a inverse equal to 1 upon determinant of a into adjoint of a which is equal to minus 1 upon 1 into matrix 2 minus 9 minus 6 0 minus 2 minus 1 minus 1 3 2. Therefore, a inverse equal to matrix minus 2 0 1 9 2 minus 3 6 1 minus 2 which is a required answer. Hope you understood the solution and enjoyed the session. Goodbye and take care.


Is your phone pwned? We're going to talk about auditing, attacking and defending mobile devices. Smart phones are exploding. It's a pretty exciting time. More importantly, it's a very exciting time to be hacking phones as well. So we're going to start off with what you all wanted to see. We're going to start by attacking some phones. First going to introduce us. My name is John Herring. I'm here with Kevin Mahaffey and Anthony Limeberry. We're with Flexilis. We're a mobile security startup working on software. We started in the research community, actually born out of Def Con in Black Hat, and decided we were going to build software to defend mobile devices. So let's take a look at a real-world attack scenario. So I don't know if any of you have had the pleasure of working with WAP, but it's very, very complicated. Basically what it is, it's an application data protocol for mobile devices, and it was originally designed so you can get things like the internet on your mobile device. They also have a service called WAP Push that basically allows push services to be sent to your device instead of your device having to pull them. So this would save battery life, et cetera, et cetera. So you can see that the WAP protocol stack is fairly complicated and somewhat reminiscent of the TCP IP protocol stack. We're starting to see a lot of attacks targeted towards WAP at Black Hat this year. There were at least three attacks that went towards WAP. In my opinion, the state of WAP security is somewhat poor and not many people have audited it, and we hope to lower the bar to auditing mobile protocols today. So we hope you all take something home and help secure this stuff. So under normal circumstances, the way WAP works is it goes over all sorts of different data channels, but the one we're going to look at today is SMS. So when you get an SMS on your mobile phone, we're going to assume you have a GSM phone. The SMS comes through what the carrier's system called the SMSC. And under normal circumstances when you get a WAP push, the SMSC trusts a specific gateway that connects to other services. So let's imagine the carrier wants to update some settings on your phone. They would use this thing called the Push Proxy Gateway, which is the trusted person who's supposed to send WAP pushes to your phone. And your phone has configuration settings that say, hey, I only trust this Push Proxy Gateway to receive WAP push messages. This is all secure, right, guys? So just like you can send SMS's to your friend on the same network, this routes to the SMSC, you can also send WAP push messages to somebody else on the same network. The device should, of course, say, well, this is not a trusted WAP push initiator, so I'm just going to ignore this message. But on certain Windows mobile devices, they shipped from the factory misconfigured with security policy settings, and this basically says, I will trust WAP push messages from any initiator. This attack has been live in the wild since 2008, and I'm surprised it hasn't gotten more attention than it has. Basically what it does, it allows unauthenticated senders to send these things called service load and service indication messages. And what those are is it's either a way to pop up a URL on a target device, or on a target device you can literally install an application over the air with no user intervention. And I'll let you guys, your devious minds, think about all the wonderful things you could do with that. And so just to be clear, this isn't necessarily a Microsoft issue. It's an OEM issue, so the security policies are misconfigured by the OEMs. They're actually good when Microsoft ships them, and for some reason they misconfigure them. We haven't figured out why that's happening. Also just a heads up that the carrier is absolutely monitoring their networks pretty closely, and this traffic stands above the rest, so it's very easy for them to tell who's sending this type of traffic, so be aware of that. And so as a note, the devices that are vulnerable are Windows mobile devices from a variety of manufacturers, HDC, PanTech, Samsung, Motorola, etc. So let's take a look at the attack. So I know the screen's backwards, but you'll get the idea. So essentially what we're going to do here is Kevin's going to attack my phone. No user intervention whatsoever. I'm not touching anything. We're able to force a browser open with an arbitrary URL. We could combine this with a browser-based exploit. Also what we could do is force an arbitrary URL to point to a file and force it to download and install a file. This could be malware, it could be some kind of malicious piece of hardware. There you go. He just popped open the site. It's loading. And then we see defconn.com is going to load up for us. So this just gives you an idea of exactly what is possible with these types of attacks. I would see this happening, but if this were in my pocket or if I weren't paying attention, essentially I could completely take control of the device remotely with almost no user intervention or no user intervention whatsoever. So it's a pretty cool attack. There's also a lot of speculation. You hear all sorts of WebKit vulnerabilities, and when WebKit gets owned, it owns everything from a PS3 to Android, iOSX, every version of WebKit out there. So this is definitely a vector for drive-by-browser exploits as well. So you pop open a web page and you can initiate that. So we are releasing a fix tool, which will be available shortly at hotfix.flexless.com. So basically what it does, it fixes this. There's two issues related to this, and we're going to talk about some more issues later. It's free, and basically what it does is it patches your security settings on a vulnerable device and keeps you safe. As a note, if you hard reset your device, you'll have to reinstall the fix tool because it doesn't actually hit it in the wrong. And one other note to add is that if you aren't sure if you're vulnerable or not, you can use this tool to detect. It'll scan to detect if you're vulnerable. So go ahead and download that if you're worried. So let's talk about the mobile security environment. What's going on generally with devices, networks, everything that goes into actually attacking these devices to give some context. So we all know mobile devices are essentially PCs today. We were looking back at some of our research in Bluetooth just from a few years ago at DEF CON and kind of laughing at the primitive devices we were attacking just three years ago or so, and these devices have fundamentally changed. I mean, my iPhone is more powerful than my first three computers I ever owned combined, and this is in my pocket, notwithstanding all the mobile protocols and technologies that go into it. So what are the key factors driving the threats? Device advancement, I would say is the number one third-party application adoption. I mean, we saw this on the desktop in the 90s with the shareware movement and malware and SPI were starting to piggyback on applications as they were downloaded, persistent connections and mobile data usage. Data usage is absolutely skyrocketing. So I just read a study, I believe, by 2012. We'll be using the same amount of data on mobile networks as in 2008 on wired networks. And if that gives you an idea of how much data will be flowing over mobile networks, it's pretty staggering in just a short period of time. So in addition to the threat landscape that's being driven by the device enhancement and mobile data, there's incentives for attackers' in-band payment mechanism, as I would say going to be one of the biggest. So how do you monetize an attack on the PC? Well, you could turn the computer into a botnet and leverage that for attacks or spam. You could pull off someone's credit card information or personal information and use that. But there's not a direct monetization path. On mobile, that's not the case. You're directly tied to your cell phone bill. And there's lots of different ways you can spend money. So reverse SMS billing. I'm sure there's, when you buy applications, there's all sorts of different methodologies there. So mobile, for the first time ever, you send a packet. We can actually send a packet and money goes flying. And that's new and that's a really big deal. I mean, if you could imagine a payload that sends a packet and money goes flying to some offshore account, that's a big deal. Sir, I don't know how I can underscore enough how important this is. Imagine if you could just send a UDP packet and like a dollar goes into your account. Like, think about that. I mean, this, you know, from an attack monetization strategy, kids in the mall, you know, large worms, there's a lot of potential for very, very bad things here. And the major fraud mitigation technique is when we see something bad, we'll stop it. Yep. So privilege access to network resources. I don't know how many of you are responsible for corporate networks, enterprise networks. But you can spend a ton of money and a ton of effort securing your actual network perimeter. But then if your mobile device is vulnerable and has a trusted relationship with your corporate network, let's say a VPNN, while I hit this off the spot, use that as a leverage point into the corporate network itself. That's pretty nasty. And then finally, valuable data. I mean, your mobile device is the most personal computer. In my opinion, there's a ton of information relative to your social graph who you're talking to, just running an analysis on your text messages, your calls. You can learn a lot about a person, location data, and then all sorts of other personal information. Mobile is a really hard problem. So we have to deal with performance in terms of battery life processing power and defending mobile devices, and we're constrained on the defensive side, but attackers are not. So the attacks are only getting more advanced and they're not constrained. One of the big problems is also a lot of people argue, oh, there's not going to be big mobile threats because the operating system landscape is very fragmented. I would argue against that, and I'll tell you why. So yes, there's fragmentation between operating systems, but smartphone operating systems are growing all of them so rapidly that they're all extremely large. So I believe there's maybe 17 million iPhones. And yes, that's fragmented, but there's 17 million iPhones. And mobile devices in many ways are more consistent than PCs. So a Windows box is not necessarily a Windows box. There's different ports open, different configurations, different types of software. So phones pretty much as far as the outside world is concerned are all the same. So if I have one attack, I can use that attack against 17 million devices. That's pretty sweet. So you look at the fragmented yet consistent, and that's a nuance that I would point out that's important. And then responding to the threats is really challenging. So the real elephant under the rug here, and I'm not sure if everybody realizes this, is that adding on top of platform fragmentation is update fragmentation. So let's say I have this mobile device from HCC. It's supported by 100 carriers worldwide. If there's a firmware update that needs to go out to patch of vulnerability, every single carrier has to re-qualify the firmware to make sure it doesn't take down devices. They're not getting service calls. It's a huge pain for them. So this is not just like on Windows where we can push out and out of band Windows update an emergency patch. They actually have to go through a lengthy cycle. And if you touch radio code, the respective regulatory body has to re-qualify it. So the FCC in our case. So imagine you find an exploit, then they go to patch it. You have to have it re-qualified by all the carriers and the FCC. This takes months and months. I mean, it's an inordinate amount of time. A great example, we'll talk a little bit more about it. We found a zero day and the iPhone in Bluetooth STP in the right when the iPhone came out worked with Apple. It took about four months from when we first reported to them to get patched. That was actually really, really fast for mobile. So the way that we are approaching this problem is we're trying to do our best to work with vendors, operators to try and give them as much lead time as possible. And I highly advise that everyone else who's doing mobile security research do so as well in the interest of the end user. Yeah, standard vulnerability disclosure timelines, like six weeks or a couple of months just doesn't work in mobile. When you have to deal with 133 internal QA cycles, 133 FCC QA cycles, and 133 carrier quals, four months is freaking flying. So let's talk a little bit about vulnerability discovery. You have context about how we think about the mobile landscape. Let's talk about how we actually discover mobile vulnerabilities and then we can look at auditing and attacking. So auditing a mobile device, it's not really much different. I mean it is, but you kind of start with the code. And there's a lot of the same problems that we had back in the day with desktop software. You're looking for your stir copies, pointer manipulation, stuff like that. Also your execution calls like execve and that whole family system with user-supplied arguments. And we've all known about these problems obviously for the past 10 years. But the mobile industry, security, they haven't had to worry about it before. So they haven't had to program with these things in mind. Another thing that you can check for when auditing this stuff, also the same as desktop software is third-party libraries. There's a lot of stuff like Android alone I believe is using like 70 third-party libraries in their build. iPhone had problems with LibTIF. I know the very first Android vulnerability that was found by Alfredo Ortega was in LibBMP and LibPNG. And this is back when it was still just an SDK and there was no hardware released. And they got that fixed. But it kind of goes back to the patching problem that it's a lot harder for mobile carriers and OEMs and manufacturers to keep their third-party libraries in sync with the latest releases and to keep that stuff patch. So just to add to that point, I mean when you think about, okay, so there's open-source software on a device like an Android device, they have to code freeze to ship to go send it to market and put it in boxes and deal with all this. During that time, if there's a vulnerability in one of the open-source libraries that they leveraged, those devices in the boxes are now sitting vulnerable and until they can issue a patch, there's this complete mismatch of the software that in the real world versus the software on devices, super big problem. So just looking at change sets is an interesting way to find lots of vulnerabilities. But, John, you can just upgrade the libraries yourself, right? So a less traditional route, I thought we'd just add this is interesting. We've actually found some, not directly, vulnerabilities through Twitter. So security researchers love talking and we found a number of folks talking about the types of research that they're doing to look at little snippets of what they're saying, work our way backwards, reverse engineer their research and actually find the vulnerabilities faster. So just looking at different Twitter searches is amazing. Just go in and start searching for different keywords around auditing or mobile vulnerabilities or any type of vulnerabilities in general. You might be surprised what you'll find. So let's talk about how we actually audit mobile devices. So we're really excited. We have a fuzzing tool to release. It's specifically targeted towards mobile devices and we found one of the problems with actually securing mobile devices is the companies who develop a software for mobile devices, the companies who make handsets and the companies who make operating systems, some of them have tools they use internally but it's actually remarkably hard to really get good security coverage on mobile devices. And so we said, you know what? We think we can help this and we are going to release a fuzzing tool. I assume everyone here knows what fuzzing is, hopefully. And really what we mean by a fuzzing tool is not just something that generates bad data but also something that handles the injection, the state management and the result analysis which is one of the hardest parts about dealing with mobile because you have a lot of protocols that you have to inject on the device specifically or through some sort of radio. So we're pretty happy with that. It's going to be free and open source and we really have hopes and dreams that people actually use this and help contribute back to this. Has anyone here heard of the site GitHub? Woo! One guy. At least one guy. So let me paint a picture. You're at Defcon. You go and somebody on stage says, hey we have a really cool security tool. You've probably seen this happen like 20, 30 times and how often does that actually get updated? The answer is maybe once and that's a week after Defcon while they're still interested in the tool. And so that's not what we want to do here. We actually want to have something that you all can take home if you're at a mobile company or any company in general and you like hacking on mobile phones you can contribute stuff back and really what we hope to have is a baseline security that all mobile phones can have before they ship because there are just too many silly vulnerabilities that we find 10 test cases in into the dumbest fuzzer we can possibly write that just do not need to exist. So that's what we hope to do here. So the first thing you'll note is in our fuzzer it's written in Ruby and we can have some arguments over whether this domain specific language is good but the idea is that we want to make fuzzing very, very easy for anyone to do. You don't want to have to think about all the underlying goo you just want to say here's what a protocol looks like and here's this phone so just do your worst and do it all automatically and tell me what happens. So basically we have a domain specific language that generates fuzzers and automatically handles generating all of the bad data that you would inject to actually elicit vulnerabilities in mobile devices. So some of the problems and you might ask well why did you create a new fuzzer? There's a whole bunch of wonderful fuzzers out there. Mobile devices use a lot more than TCPIP. You have Bluetooth, Wi-Fi, NFC, et cetera, et cetera. There's all sorts of different protocols that are fairly difficult to deal with normal fuzzers. Injection constraints, the protocols themselves are kind of nasty and so we'll talk about that. The first thing that is important in building a mobile fuzzer is everything has to be over-rideable. You might just say this is good software architecture and you really want anything to be swapped out because I can't tell you how many times we're auditing some weird strange phone and it doesn't support XX or X and it's just really annoying and so being able to swap everything out is important. Go ahead. So basically the way this fuzzer is built is if you're familiar with fuzzers there's a block and there's elements inside of the block and so basically you just describe protocols like this. So let's imagine you have a type length value protocol. You would say, hey, the type's an integer, the length is a length, which is also an integer over this binary value and you describe that and all of your test cases are just generated for you. The other thing that's nice is that we want to make it very, very easy to mix and match protocols so basically once you define a given protocol you add it to this registry and you can basically reference it later and protocols use something called an abstract data element that allows them to attach together so you may describe TCPIP but you want to fuzz HTTP on top of that the TCP protocol will have a data element and you just attach HTTP to that and what this buys us is you can do things like this so straight from the command line you can just combine protocols together and on the fly a test case will be generated in this whole fuzzing suite and so our goal is to say at some point you say I want to audit this iPhone and it will take all the protocols it knows about and throw everything it does at the iPhone which is pretty neat and so if you want to add one more thing to your test case it will add that protocol you can leverage say somebody's already done all the crazy GSM SMS stuff and you want to audit one WAP protocol all you do is have to write that WAP protocol and say hey fuzz iPhone GSM SMS WAP WTLS for example and everything is just done for you so a lot of mobile phones have emulators and simulators if anyone's done iPhone development the simulator runs on x86 so it's not really going to do much for us Windows Mobile is a pretty good emulator and Symbian I don't think is a very good simulator but really we need to touch physical hardware if you're fuzzing Bluetooth or SMS or Wi-Fi or even just things that are on the device different OEMs put different pieces of software on their phones and you never know what's going to happen the Broadcom Bluetooth stack on one phone and then the southern phone uses the Microsoft Bluetooth stack so we really just need to touch physical devices and so the solution here is we have these pre-built injectors that will work on each platform and interface and what you can see is that just from the command line you can say I want to fuzz these protocols and here's the injector you want to use to inject it and so we have a common injector protocol and so there's basically two types of injectors we use one is the hey, here's a local injector that interacts with the radio and that radio will inject all this data at a phone but the other type is let's imagine you have an iPhone and you want to fuzz the LibTiff library for example how do you do that? One way is to set up an HTTP server and just have it hit it all the time the other way is to have a piece of software running on the phone that takes input from the fuzzing server and will actually load all those libraries with LibTiff and even better you can have local debugging resources so you can run GDB locally for example so you can actually get really really good result analysis and basically what we've built is a standard protocol by which anyone can write an injector for a phone so right now we have iPhone and Android injectors and more are coming soon we have a Bluetooth one just about ready and so we're going to release all this and basically because it's a common protocol anyone can write their own injector it's super trivial so basically what happens is the fuzzing host says hey here's a type of data for example an SMS or an image or audio so the injector knows what to do with it here's the length and we just let's assume you're not going to play with that and the data that you're going to fuzz the injector that runs on the physical device takes that, runs it and will return a result so one of the injections we wrote for the iPhone we wanted to fuzz SMS PDUs so just to give you an idea of how these things work on the iPhone we wanted to fuzz the comm center binary which basically it's actually what runs as root and it does all the parsing of the SMS PDUs so what we did was we wrote a dynamic library to basically do kind of essentially like an LD preload on Linux type thing and we would intercept all the reads, writes and the select calls on all the base bands the SPI base bands 2, 3 and 4 are the ones that handle the SMS coming in so the way we did this was we had a name pipe so we had a standalone binary running as the injector we would send our fuzz packets at that that would stuff them into a name pipe and the dynamic library that was hooking all of these calls it would basically take that name pipe file descriptor that it had opened and stuff that into the FD set for select along with all the baseband file descriptors so when data was coming in on that select would unblock and then we would look that and say ok it's our name pipe set and at that point we could flip the bit and say that there's data coming in off the baseband when there really wasn't at that point then we would pass that on to the comm center, comm center would try to do a read on that baseband and then we would intercept that as well and actually read from our name pipe rather than the baseband device so from there we could stuff that all in the buffer and then comm center would think that it got the data that it wanted and then we could fuzz everything through that and then we just use a simple state machine to keep track because there's the three different baseband that it's reading from that it basically reads from to with a ATXD VRI and a CMT and then it writes a ATC NMA to check if it actually got one so with our hooked right we would actually swallow that and say that we wrote that to the baseband and then fake a reply back rather than letting it actually reply so basically we man in the middle the radio on the iPhone. Yes, simple terms. And a nice side effect of this too once we release this you can use this to actually monitor all the activity that's going on on these basebands with this code and have that log it out or log that to the screen. And if Tom Robinson from 280 North is here he pioneered this original technique we were doing with some Bluetooth stuff so thanks a lot Tom the code is good. I would also recommend checking out a couple of the talks from Black Hat. Colin and Charlie did some similar research on SMS and they had a pretty good prezo so I checked that out too. So let's take a look at a fuzzing demo of the iPhone. That's not how it's supposed to look. This is good so Anthony. Okay so just to give you an idea this you can hear the SMS is coming in incredibly fast so instead of manually testing we can just send obscene amounts of SMS traffic at the device without going over the SMS network. So it sounds like we're winning every time it pings and let me tell you the carriers don't really like it when you fuzz SMS over the real network. Yeah don't do that. That's a bad idea. You might take down a cell tower. You're probably more likely to take down the network. Keep it local. So we just sent 300 PDUs this test suite has about 300,000 there are 7 test suites and it's telling me there's about 500 minutes left on this test. Cool. So fuzzing can you turn the fuzzer off it's going crazy. Yeah. So this software that we're releasing can run basically anywhere on a laptop on a desktop but we run into problems in terms of actually power and throughput and also we want to be able to massively parallelize protocols so if we're doing SMS we want to be able to fuzz Bluetooth and Wi-Fi at the same time we built a distributed fuzzing cluster I'll note in a TSA friendly compliant case but traveling with it's an adventure. Not a bomb. So it works it works extremely well at fuzzing devices massively concurrently so we can you can see in the picture there's maybe 10 devices there we have a bunch set up here we can have 50 phones plugged into this thing be simultaneously fuzzing Bluetooth Wi-Fi SMS a bunch of protocols all at the same time there's 16 cores in this thing it's super powerful so it's just a hardware implementation and we like hardware a lot so this is an example of taking the open source project that we're going to be releasing and extending it to something even more powerful and this wasn't that we did this in a weekend so this is pretty easy to set up. Mobile protocols are in fact evil. If you've ever had a chance to read some of the ETSI specs or the 3GPP specs or the OMA specs my condolences the reason for this is basically we need a lot of efficiency on mobile networks because bandwidth equals money and lots of it so there's all sorts of really weird techniques and there's a lot of bit masking involved for like arbitrary width length fields with a high bit set and it's just crazy there's a lot of state transitions like for example if you ever had a chance to look at the L2CAP connection state transitions there there are way too many states in that diagram it's almost nuts and so one of the reasons for developing this mobile fuzzer is actually to be able to deal with all of these crazy protocol elements and state transitions and things like that in a way that will not make us go crazy trying to override this, that or the other. So important first of all is intelligent defaults you create an int element it says you know what I'm going to be a one byte int element not that Indianness matters but if you said hey I want a two byte int element that's a big Indian too I'm kind of a Ruby on Rails junkie so the concept of convention over configuration speaks very truly to me so second of all let's imagine you want to for some reason have a three byte little Indian integer it will create that for you the other nice thing is that you notice that we don't actually have to define what values we're fuzzing right if you've looked at fuzzers such as sully or other fuzzers they usually have a corpus of data so for example if I'm fuzzing an integer you want to try to trigger boundary condition issues so this is the standard 007F80 FF et cetera and then you probably want to do off by ones on that and you know from fuzzing history that's what's most likely to cause errors but nobody wants to define that every time oh I have to do a three byte integer I have to redefine all those values the system will automatically figure out how big your thing is and make the Indianness all just work so overriding thing so overriding anything is certainly important this specific overriding is this crazy way it's called lacing but it's basically a glorified length field system there is a typo on here so just assume that v is the same as value basically if you have an integer there are umpteen different ways you need to encode it and if we had to write a whole different block a whole new class to handle that integer we'd just go crazy so basically the system allows you to dynamically override the encoders and there's also some kind of pre-built hooks that make it easy to just inject some extra logic and because we know in mobile protocols you always have to change this stuff so the thing we're actually really excited about is there's this concept of how deep do you fuzz versus how long does it take and the two degrees of freedom there are I have an element how many values can it take for example an integer 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 you know et cetera and then the other is if I have 10 elements how do I combine those two values together for example I have do I fuzz all of the first element then fuzz all of the next element if you do that it can take a really long time so there are two ways that fuzzers have dealt with this in the past the first is the one at a time method and so basically what that means is you take a good PDU let's imagine an HTTP request and you break that into blocks you say okay here's the verb you know the post get, delete, put, et cetera here's the URL here's the version of HTTP here's all the headers and what you would do is each one of those blocks has all sorts of fuzz values and you one at a time you manipulate that block and say I'm gonna try this bad value this bad value this bad value this has the advantage of you can go really really deep in any given value but the problem is that it doesn't uncover values where you have two things you're fuzzing at the time for example let's say you had a type length value protocol and you just fuzz the length but the vulnerability lies in fuzzing both the type and the length at the same time you're not gonna find that bug so the other type of ways is basically you combine all the different types of blocks together and so basically what this means is if you have three values you combine all possible values of all the three elements together but when you combine lots and lots and lots of elements together you know imagine multiplying 10 times 10 times 10 times 10 times 10 times 10 times 10 you know you see where this goes and you have like 14 quadrillion test cases and basically you know it'll finish somewhere near the lifetime of the universe and we found this we just a simple protocol can just explode also if you're only limited to 10 values for a given element you know you're not fuzzing that much so the technique we're introducing here is progressively incrementing the amount of combination we're doing and so basically what that means is we have two sets of values for any given element there's a expected value for example with HTTP that would be you know put, get, delete, etc and a set of fuzz values which would be all of the crazy wonderful strings that you're trying to do to elicit fail in what you're testing as we test we want to increase the amount of elements we're combining together with their fuzz values and here's a little example so imagine you have a protocol of four elements you start with fuzzing one thing at a time and the rest take their normal values and it'll iterate through all that after you exhaust all of those that is what we're saying is the most likely to find a bug is just fuzzing one thing but then after we exhaust those then you go to two at a time and so you fuzz two values and iterate through all that and the cool thing is is that you could technically leave this indefinitely you can go three at a time, four at a time, five at a time and you know somewhere around six at a time it's a reasonably complex protocol you're never going to finish but you know that's why we build things like this so we can just kind of leave it going all day long and also don't worry that the math is a little scary when you have lots of elements and then they have different numbers of values and fuzz values so just don't open the fuzzer class if you don't want to look at that math okay TCP IP is very well encapsulated what's the last time you've seen an HTTP vulnerability resulting in some mobile protocols are very very leaky one example of this is WAP authentication mechanisms way up the stack are based on addresses way down the stack similar with Bluetooth authentication mechanisms way up the stack are based on things way down the stack and so in fuzzing mobile you don't just want to fuzz the top level protocol you want to talk about you want to fuzz this entire thing and ordinarily if you couldn't do that because it would take forever but with this progressively combinatorial system you can actually in reasonable time fuzz a lot of these protocols together another really cool thing we're excited about is let's imagine you're fuzzing a complicated protocol with lots of state transitions you actually have to implement that protocol and that that's usually not fun but because we have fuzzers we've already implemented that protocol so you can we just reuse these data structures to actually generate and parse data the data structures for the protocol and it makes life easy you know I don't want to rewrite an entire protocol and I don't think any of you guys do either so around iPhone 1.0 time we took an early version of this fuzzer and targeted against the iPhone and there were some interesting issues you know this is this was a STP vulnerability STP and Bluetooth is a way for enumerating services that are on a Bluetooth device and we found that in this one specific case a weird element type so there's this concept in STP where you have one byte that specifies both the length and the type of the data to follow and it's kind of funny when you're writing fuzzers it's usually a good idea to put yourself in the mindset of somebody who's writing the protocol and what you would probably screw up and you know that's what we did and look they screwed up the same thing we thought we would screw up I think we found this vulnerability in the first five minutes of fuzzing it was a little bit longer that but yeah it was very really what this was is we would get a kernel read to fffffff and we disclosed this to Apple and we didn't actually try to weaponize this but the feedback we have is that it could have been bad had this been found so that took about four months to fix as John said if something like this were to be found and weaponized four months is quite a long time to be vulnerable so there's another vulnerability we found this is similar to the vulnerability we demonstrated earlier it's also in WAP it's also a result of misconfigured security policies coming from the carrier and basically what this allows you to do is push something called a WAP provisioning document this is something that the carriers use to do everything on the phone this is configuring proxy settings this is hard resetting your device accessing your files there's basically nothing you can't do yeah the good thing about this attack is that basically it's the same sort of idea that it doesn't validate the source of the push message and what we speculate is that carriers say you have two giant carriers to come in together and they had different push proxy gateways and if they had to change the trust model on all their phones it would just be a really hairy nightmare and so they just said oh we're just going to trust all WAP push at all and so what this vulnerability requires is that you need to sign the message with a network pin which is the IMSI of your phone it's a number that's written on the back of your SIM card or oftentimes the receipt when you go to your carrier store so make sure that sort of information doesn't get out we do recommend that people do your run the fix tool that will patch this and you won't be vulnerable we disclose this to Microsoft in late 2008 and the OEMs are aware of this and it's very, very prevalent so let's talk a little bit more about attacking mobile devices now so we're going to paint a picture of the mobile landscape as far as attacking goes it's what we like to call the 1999 factor because the state of mobile security right now as far as the code goes is very, very similar to how code was back in the late 90s if any of you did any hacking back then so we didn't have the heap in stack protections back then x86 back the day did not have non executable bits for pages ARM does they have the XN bit the execute never bit but a lot of mobile operating systems are not using this currently there's in fact the only one I could think of actually we have so here's our obituary matrix of what is and isn't on these things address space layout randomization currently android is the only one using that on their stack no one else is randomizing their heap stack or library loading windows mobile uses stack cookies but it's only a 16 bit cookie on the stack so I can't imagine it would be terribly hard to brute force that cookie android does use stack cookies and then the iPhone is using like non executable permissions on their pages for the stack and the heap and they actually have extremely strict permissioning with their memory to the point where you cannot have a page that is both writable and executable at the same time it'll cause an exception but you can still get around that with return to libc as far as signing code goes iPhone obviously we all know that they require it to be signed windows mobile they do have a they do use sign code for their applications but they will allow the unsigned code to run but it will present you with some user interaction prompt yes or no if you want to install this whereas I believe sign code will just install without that android it doesn't use sign code for their applications in the market but and they use kind of a block known bad not allow known good type thing but the good thing is that things are getting better within the past year or so the iPhone I know they've gone from having everything running as root with no permissioning in their memory to their segregated mobile user account and these strict memory permissions but for the most part security is kind of an afterthought for a lot of mobile developers they've never had to worry about this problem before and it's understandable no one's been attacking it in the past because there's been nothing to gain so we'll talk about some specific things on each platform on the iPhone unlocking is very common a lot of people don't want to use an iPhone on AT&T and we now have the push notification services that everyone's using for a notification of IMS coming in because iPhone doesn't allow background processing or background processes push notifications based on the XMPP publish subscribe protocol which is based on the IMS and they use SSL certs basically as user IDs for each device when you activate your iPhone it generates a public-private key but the problem with these is that with these unlocked phones when you activate them it's not generating a key for you to use the push notifications and so the way they solve that was basically copying the private key that was generated onto all these unlocked phones so this is the problem that was all over the internet for a little while everybody thought it was Apple's fault at first but then they realized it was the fault of these unlocked phones and people started getting instant message push notifications that were destined for other people and it's been speculated they used this for like spamming mass push notifications another problem with the iPhone is well I guess the App Store which is basically a centralized location for getting applications on your phone they released their SDK so that everybody could start developing applications for it but the SDK basically it encouraged a lot of first time developers to start jumping in and working on this and a lot of these first time programmers have no concept of security whatsoever all the code for the iPhone is running native luckily it's running as the mobile user so it doesn't have root privileges another thing is the jail breaking a lot of people were doing this back in the day not so much recently because of the App Store but jail breaking actually turns off code and it makes it a lot easier to do a lot of exploitation on the iPhone so with Android everyone was stoked that Android was well it's kind of stoked that everything was running in a VM each process is a sandbox basically Java gets compiled down to Dalvik bytecode but not everything on Android is actually running as Java the VM itself is native code and it all supports JNI the Java native interface to be able to run native compiled code for optimizations till recently it was unsupported then they just released their NDK so now everybody can start using that it doesn't really support the many libs but it's pretty easy to compile your own libraries and that kind of goes back to the problem of third party libraries of a lot of these first time developers to conclude about these problems so we did look for some vulnerabilities in the Dalvik VM because we figured that's a good place to get some code execution one of the ones that we found that we can disclose is in the JDWP which is the Java debug wireless protocol it's in a DVM debug output array which basically just outputs an array to the console it was basically just a textbook integer overflow in it and it's not really a problem because it is in the debugging stuff but a lot of the dev phones which was the first hardware released with Android on it they actually have a lot of listening processes with listening JDWP ports that are just sitting there but luckily this vulnerability we found isn't actually exploitable in the wild because of the amount of memory that's required to copy in the future there's a lot of talk about having Android on netbooks and that could actually become a problem it's also pretty interesting Android's permission model is such that the process is the isolation not the JVM so a lot of times Java security is based on like if you can break out of the JVM you win that's not so in Android they just assume you're just the UNIX process so it's good also the same thing with the Android market they have a lot of similar things with the iPhone just like first time developers that really have no concept of security and they don't really have to worry about that and also without sign code yeah so Windows Mobile current versions of Windows Mobile since I think it's 5.0 at least based on the WinC5 kernel and basically what this means is it's one giant 32 bit address space there's actually no process level memory isolation it's kind of neat what this stuff you can do threads migrate from process to process of particular note is that SMS parsing is done in the kernel in a privileged process you know similar to iPhone and that's usually not a good thing if you were to exploit that you can basically touch any memory on any process in the entire system including the kernel so yikes Windows Mobile 7 is getting actual true process memory isolation so that is good so there have been a few Windows Mobile vulnerabilities we can talk about we found vulnerability in Broadcom's Bluetooth stack we actually drove down to San Diego and sat with their engineers and like showed them how and got them to fix it that was pretty cool but basically it allowed I think it was just a really textbook buffer overflow it just you know it's silly that we're still seeing these types of things in code you know in what 2006 2007 we discovered that Colin Mule and a couple years ago at DEF CON if any of you guys saw that MMS vulnerability basically was able to get remote code execution on one mode device by sending it a carefully crafted MMS and if you guys pay attention to the news there was a Bluetooth phone and some HTC devices recently basically that directory traversal on the FTP so basically you just get out of the FTP jail you know we're starting to see vulnerabilities in mobile phones and like I said that vulnerability was not actually in Windows Mobile it was in the drivers that HTC was shipping so that's a really important point OS vendors OEMs ISVs they all have software on the phones and any one of them can be vulnerable so it's important to just don't blame the carrier vendor etc it's not always their fault cool so let's wrap up with talking about defending mobile devices what we can do so there's four pieces of the puzzle and the way we like to think about it there's absolutely no silver bullet to defending mobile devices software security, device security network security and end user security are all going to be super important if we actually want to make an impact on keeping these things safe so it absolutely all starts with the software and this isn't just OEMs or OS vendors or the operators this is also application developers so I'm sure a ton of you have built iPhone or Android apps it's super important that everybody involved is aware of developing secure code it's really really important it's the whole death by a thousand cuts idea is that if we have tons and tons of apps that are insecure it's going to expose the devices themselves to vulnerabilities device security also something that's incredibly important the OEMs and the OS vendors are going to need to take that really seriously network security is tied to device security so we're going to see the carriers filtering a lot of SMS type attacks which is good but at the end of the day things will still slip through so if the devices themselves are vulnerable that's not going to help us and then end user security so there's this interesting concept we found that there are lots of vulnerabilities for mobile that do get patched we're seeing it more and more with the iPhone for example almost every update that you see if you go look in the documentation there's vulnerabilities but then there's a ton of folks who charge their iPhone in the wall at night and don't sync with iTunes that often so in fact stay out of date many versions behind they're not as excited as many of us are to upgrade to the and hence are vulnerable to scores of vulnerabilities and this is more common than you would think actually keeping the firmware on your mobile device up to date patched and most people really don't think about this it's extremely important so everybody else software developers device security network security everybody can do their job and then the end user doesn't do their job and is vulnerable so at the end of the day we have to make sure that we keep our own devices safe as well and participate so what you can do to take action like I said ensure your latest firmware software is up to date that's really important enable only essential services and protocols while you're here at DEF CON my advice is airplane mode or just don't bring your phone that's probably the safest bet but if you have to leave bluetooth off, leave wifi off be cognizant of your surroundings I would say that this is definitely probably the most hostile environment for a mobile device you could possibly be in in any short period of time verify any software you have deployed this matters less for end users but if any of you guys are IT admins watch out for software that your users are actually installing on their own because that can cause a lot of problems and introduce vulnerabilities into your deployment and establish a system to monitor mobile vulnerability disclosure and information we've built some pretty cool tools just to keep up with the variety of information that's flowing out there on mobile vulnerability so we have twitter feeds we have things that scrape all the different disclosure areas and aggregate them into a single place so we can actually see what researchers are talking about mobile what vulnerability disclosures are happening everything in one place and be super on top of what's going on so thank you very much we appreciate all of it I want to thank Microsoft the BlackBerry security team Google Android and Apple


Hi everyone, Dr. Solver and Beverly Hills wishing everyone a great 4th of July. We have our follow-up patient here a year out from her tummy tuck and some lipocontoring. She's in her mid-40s, has two kids. This was her a year ago. You could see the excess skin drooping all around. You could see the width of her abdomen compared to her hips. And here she is a year out of her surgery. Look at the contouring. Look at how she has this concavity, the fullness on the abdomen. Look at how flat she is.  Look at the pictures from before. Look at her now. Her scar healed beautifully. You could see her incision here very nicely. And look at her belly button looks very, very natural. A little bit of a hooding which abdiments out. Here she is from the side. Look at how beautiful she looks and here she is all around. How much weight have you lost? About eight pounds. So you can see that it's not necessarily the amount of pounds you lose, but the excess skin is gone. And how do you feel? I feel like a woman. I feel like a girl. You always are a woman, but how do you feel when you're closed? How is it like? I feel beautiful. You feel beautiful. I feel like myself. I feel like me again. That's such like great words to hear that you feel. It's all about self-esteem. Obviously, you did it for yourself. Myself. I did it for myself. And you're more confident? Much more confident, especially in bathing suits. For these mother of two and look at how confident and the smile on her face that tells you how life-changing this was. It was kind of life-changing. It was absolutely life-changing. One of the best decisions I've ever made in my entire life. Really. Honestly. Honestly. Honestly. I am very happy and I've even talked to other people into looking into it and pursuing it because they were just so impressed with the change with me. And in your whole attitude towards myself and my body and how I was more comfortable expressing myself. So. It's days like this again that make me that rejuvenate me and give me the energy to go on when I when I see that I've actually made a positive influence in someone's life.  Honestly. It's very moving. Thank you for sharing your story with everyone at home because I'm sure there are other females that might be thinking about it on the fence. How was the whole surgery and the after work? It's a long process. You have to be patient with the process. You have to be patient with yourself and have to be patient with the healing process.  It's like giving birth again because your body changes so dynamically that you just you're patient with the process and you keep reminding yourself that every single step is one day closer to becoming who you want to become when you look at yourself in the mirror. It's just you have to just trust the process and trust your doctor. Trust what they say. Trust what they say. When you come in, the things are improving. Progress is being made and just, you know, just follow through and it is about a year long process. How was how? Email, text, whatever form I was always able to get somebody if I need to reschedule. It was always accessible. You worked with me in my schedule, which was huge. The key thing she said is patience. It wasn't an overnight thing. It took a while, but we got to the finish line. And what really was helpful was that your nurses told me that before I went through that step. I took that step. They said it's going to take about a year. You have to be patient with yourself and then being mothers themselves and I being a mother, we understood what that meant. Now the biggest question is now that you've gone through it, would you do it again? Absolutely. If I would do it again, if I had to do it again, I would do it again, but I don't have to do it again. Of course not. You look fantastic. But now I'm confident that I can physically go through this successfully, that I'm strong enough to go through something this dynamic, that if I wanted to do other things, I'm not as frightened to speak up and ask questions and to say, well, what about this? What about this? What about this? Those things that we think is sometimes we don't say. I hope we made you comfortable and you always come and ask us questions or whatever, but you healed fantastically, you followed our regimen, whatever we discussed, you were a good patient and the results speak for itself. Is this what you were expecting? This was better than actually what I was expecting. I didn't expect any contour. I'll be honest with you, I did not have that anticipation because I had been in that of my other body and see how it changed so dramatically and I had just thought, well, as long as I just look okay and close, but to actually have contour again, like I did when I was young and dancing all the time, that was exciting when I saw developing in the mirror. That was really exciting. That's fantastic. And how do you fit in your clothes? How are they when you go clothes shopping and everything? Oh, I like it now again. I went through a period of really not liking it for a long time. Emotionally, it was really distraught. I was emotional and I just stopped for the longest time buying myself anything and in the last six months, I teetered back into the nicer sections of stores and started buying things for myself again and it's nice. That's so good to hear and we're so happy for you.   That was beautiful. Thank you so much for sharing everyone. Everyone, that's a great story. It could be you. You're having problems and look, when you go through childbirth, you have birth and you give kids to the world and you do everything, there comes a point where you want to feel back to where you were before kids, rejuvenate yourself, the second stage of life and everything. Sometimes it's needed.  And this is a perfect example.  Thank you again for sharing with everyone at home.