Hello, everyone. Welcome to another episode of Engaging Ideas, the Parsons TKO podcast where we like to bring leaders and luminaries from the mission-driven sector to explore ideas and all kinds of things we could talk about for how to move our work lives forward. And we're excited to have you here today. We are now on all of the podcasting channels. You can access us anywhere if you have listened to the show, if you listen to this show and you enjoy it, please leave us a comment. Give us a like. It'll really help us. We'd love to hear from you and get your feedback. So without further ado, today I am joined by Jenna Slotin, who is currently serving as the Senior Director of Policy with Global Partnership for Sustainable Development Data, also known as the Global Partnership. Today, we are going to talk about the data values campaign that Jenna and her team are leading. And I wanted to read a quick about from their website, and we're going to have the website linked in the show notes, as always, with a lot of other great materials that we're going to be able to provide to you, dear listener, after this. But a little bit about that, about to help us set the context here. The data values campaign is a global movement to challenge power structures and data to ensure that we all share in the benefits from its collection and use. We're a community of hundreds of people from more than 60 countries working to create a fairer data future. The data values manifesto calls for change in how we design, collect, fund, manage, and use data. Organizations, governments, and people must act now and together to create this change. Jenna, I am so excited for this conversation. Welcome to the show. Thanks for having me, Tony. This is going to be fantastic, y'all. I think, you know, we've talked for quite a bit on this show, too, just about data equity and getting into data values. It is going to be fantastic. Jenna, can we start at a really high level? And can you tell us how you define data values? Sure. So let's start by breaking it down a bit. Data, in its simplest form, is information, facts, or statistics gathered and formatted for analysis. Now, our definition includes all data that can be used for decision making that's in the public interest, whether those decisions are being made by CEOs or statisticians, presidents, or local community leaders. The Cambridge Dictionary defines values as a person's principles or standards of behavior. So in other words, we're talking about values, which are the core beliefs that guide our attitudes and actions. So what we mean by data values is the principles and beliefs that should guide our behavior in relation to how data is designed, collected, and used in the public interest. And by our, I mean in the global development sector, are the data values campaign and manifesto is really focused at the global development sector. The data values manifesto also says data needs to serve everyone and getting it right is as much a political and social endeavor as it is a technical one. So I bring that up because we're emphasizing data values because we're trying to inject a sort of values driven orientation into a very technical space because the decisions that are made there affect people's lives in very real ways. Thank you for that. It's great to the context too. I mean you're focusing in the global development arena. You and I talked previously and for me, I think there's just a movement that we need inside of the nonprofit space in general because where are these principles going to come from? And if we are a principled part of the sector in these global economies, how can we start to provide those principles and how to really do something with the data side? Again, super excited. I'm glad you mentioned politics there too, as much as technical. I know you're talking sort of NGO politics, big country level politics, but for any listener here too, I'd say this probably can pertain to your internal organizational politics as well. The politics is almost short for the will of the people that have to get together to do this beyond the technology because we can make the technology work, but if people aren't ready to adopt and do something, it's not going to help. So I had in the intro there, we did talk about the data values manifesto, and I've pulled the five key points from the data manifesto, which is on your website as well for everyone who's listening. We'll make sure again, you get the link to that. But I was hoping we could dive into each one of the points and talk about those today. So yeah, let's hope we could dive in the first one. The first point, key point in the manifesto says to support people to shape how they are represented in data. So what does that mean in context? How would, if somebody's represented in data, what does that really mean? Just in terms of like the piece about support is really about giving people a say. In the design of data, which is when we say design, we're really talking about like what are the questions that are asked? What are the ways in which data is collected? What type of information is collected, for example, through the use of digital tools? And we're talking about data that will affect people's lives, though they may not be aware of that because it's informing decisions that affect how they receive services perhaps, how goods are marketed to them, etc. So it doesn't necessarily mean this idea of support. We're not necessarily arguing that every person is consulted on everything because that's not realistic or desirable. But what we're trying to get at is that those in power and those making decisions about what data is collected, how it's collected, whether and how it's going to be used, create avenues for consultation and participation with those who might be affected. So let me give you an example that historically indigenous peoples have, I think, quite rightly argued that they've been consistently misrepresented in data about their communities because they have different worldviews and conceptions. For example, they have different conceptions of well-being, of health, etc. So when government entities that conduct censuses or household surveys work with indigenous communities to redesign questions or data collection approaches, and we've seen this happen in Canada, in Peru, in Colombia, in New Zealand. When governments work with these communities, that's a way of supporting those communities to shape how they're represented. It goes all the way to the level of how questions are asked, to how that data collection happens, and then what kind of analysis is drawn from that information and how that then informs, for example, resource allocation across government and the allocation and delivery of services. So in that scenario, who takes the first step? I mean, is it somebody within the community that finds the researcher or the government advocate, or does the government advocate go, hey, by the way, maybe we're not doing these questions right? How does that all happen? Yeah, I think it really varies. So one of the things we're trying to do with the manifesto and the data values campaign is raise awareness across some key stakeholder groups on this. So one is to lift up the lived experience. Let's continue with the indigenous community's example, but extends far beyond to communities, persons with disabilities, and other historically marginalized groups. But where communities that have taken on that issue and advocated in their own context, in their own government can serve as demonstration for others, can work through global national, global regional alliances to help others recognize that they can take that action. So the groups, representative groups can be the first movers and kind of advocate with their governments, let's say. But we're also trying to work advocating for government entities to recognize where taking an orientation towards inclusion and equity is necessary, where there might be built in bias, and where those with the power can be the first movers and can take those steps as a result, let's say, of broader policies around diversity and inclusion or broader policies around resolving historical inequities, etc. So it can come from different quarters. And I think there are examples around the world of a diversity in that respect. Yeah, it's hopefully with the social awakening we've had over the last year and a half or two years now that maybe there will be more attention and more demand for this type of thing from our governments than anyone who is in the position of setting policy that can infect a lot of different folks. I feel like this might tie right into the second point in the manifesto too, which is invest in public participation for accountability. So I feel like we're scratching on that a little bit by trying to figure out the who in those scenarios. But what is the vision of how the public would participate in being holding, I guess, it's a government accountable for their use of data? Yeah, and this is a great one. It's complicated, right? So in the data values project, our focus is a bit more specifically on exploring how to build participatory mechanisms into or alongside more formal mechanisms of data governance, which includes things like legislation and institutions like data protection offices and privacy commissioners and other entities that would typically be institutionalized in a city level, at a national government level, etc. But the idea is to build participatory mechanisms in right inside those institutions, operating alongside, but also to strengthen the civil society and mechanisms that connect as watchdogs or sort of third party accountability. So there's a range here. So some of the examples that we'd advocate for that we've seen from our partner organizations have tried and have worked well in different contexts is, for example, establishing committees or councils that would be made up of representatives of different groups, bringing different perspectives that can be consulted or be involved in more formalized decision making, and they can help guide how decisions about data management and use are made. So this is like a proxy representation mechanism that we would include in a sort of like vision on public participation. Another approach is a very sort of deliberative democracy approach by actually holding consultations with those communities themselves. Data assemblies is a term that's been used where a government working maybe in partnership with an organization might organize, you know, consultations like church basement or high school auditorium and bringing people relevant and affected people together to be involved in some of this decision making. Obviously, then the onus is on some of those more formal actors to be presenting material in a way that is understandable and in which people can engage. It should not require a high level of expertise and we've seen success in the health sector and elsewhere where you can bring people in and have those consultations. But I do want to add a caveat here and I mentioned this before. It's not always realistic or desirable to have full participation all the time. We don't live in ancient Greece. Women and minorities weren't involved anyway, but it's not sort of one person, one vote on everything. It's not possible, right? What is possible and you know what I think is also important to remember is that the types of consultative mechanisms that I just highlighted have their own pitfalls, right? A real dilemma around tokenism, a real dilemma around if you open up the possibility for many members of a diverse community to participate, there's a risk of capture. So the people who have more means, resources or time to attend the consultation will attend. Higher levels of education, for example, will better enable them to participate. And so there are certainly actions that can be taken to enable people to participate, to make resources available for that. But we have to recognize that it's important to also be mindful of those pitfalls, so it was not to just create the illusion of participation, but not genuine participation. But on the whole, there's a lot of evidence that as imperfect as these participatory approaches are, that they create more equitable and trustworthy outcomes and sort of better decision-making as defined by greater equity, more representative of what people want and what those affected would want to see happen in terms of the way their data is collected and then used for decision-making. And so public participation is not perfect, but it's I think an important goal to strive for in many contexts. Oh, absolutely. Two quick follow-up for you. One, I was thinking about fear, and I don't know if that's what you meant when you used the word capture, but I could imagine certain populations being afraid to come into a conversation about what's being collected about them because that's scary, I think. Is that what you meant by capture or is there... Well, I did mean something different, but I'm happy to respond to that. Just briefly in terms of capture, I think one of the really common thing you'll see is there are historic examples in urban development, where in a particular geographic area that has both low and high earning homeowners and renters, there might be deliberations around where the highways should be and where the parks should be, and those people with higher income and more resource who are homeowners might come to those community meetings and dominate the meeting about what should be put where, whereas lower income residents have less power in those conversations. And that's what I mean by capture. Capture by those, say, resourced elements of a community, and you could imagine how that would happen in terms of some of these data discussions that we're talking about. But the fear is a huge one. So it's also important to take several steps back, and we try to do this in the white paper that accompanies the data values manifesto and recognize that data means very different things to different people. So we had a speaker at the launch event for this manifesto who represents, who's a homelessness advocate in New York City, and when he said was, well, in the communities I work in, data means surveillance. And then we had a youth advocate from Uganda who said, you know, when you talk about data to people, the first thing that they think about is, you know, the data, the credit you buy for your mobile phone so that you can make calls. Right. The point is that if you come to the conversation and you think the conversation is about whether and how you're being surveilled, it's a very different attitude than if your view or your expectation is, I want to tell you what you think so that you deliver, you pick up my garbage on time, and you build a health clinic where I need it and you improve the school that my kid goes to because I expect services from the government or what have you. So those are very different conceptions of whether and how the data might be used. There are many communities who will not want for very good reason and experience of harm to be giving up their data. On our data values website for anyone who wants to go take a look, we have some first person stories around data values and how data affects them. And we have a really powerful piece from a Ugandan LGBTQI advocate who is talking about the tension and as you listeners may know in Uganda, homosexual acts are criminalized. And the challenges around being represented or not being represented in the data, because of course being represented generates massive fear and has been and has created very real experiences of persecution. However, not being represented means a real lack of services as far as healthcare and other needs that those communities might require and where decision makers need to know where those people are, what they are experiencing in terms of health or economic effects, etc. His testimony is really interesting because he's really advocates with the community that he's a part of to demand to be represented and be heard while also pushing for the necessary protections. And it's tough. We cannot underestimate I think the real fear that that brings about. Thank you for all that. I think for anyone listening too, it's just really important to go back to the opening there that it's the politics and getting people involved. Like the technology is always say this over everything, but technology is easy. People are hard and there are real hard things we've got to work through that have nothing to do with normalizing data streams. It's this other side of the work that has to happen. I was curious because we were talking about public participation for accountability on the input side. But are there talks or things that you're always thinking about on the once it's out, can I put feedback in at that point? Like, hey, this came out, but here's what I think was missing this time. If I maybe if I didn't make it to the initial inputs, I can come back around in a feedback loop. One of the things that we are focused on is around exactly feedback mechanisms, which relates to, as you were saying, feedback or engagement in data governance decisions that were already made. And on that piece, to get accountable data governance, there needs to be a kind of iterative cycle of discussion, audit, third party checking and review. Typically, a decision is rarely a one-off. So whether it's an AI application or a kind of public health decision, the data are being used and reused and collected and updated with a kind of recurrent decision making purpose or a recurrent marketing purpose or a recurrent and so data governance is not like a cannot be a one-off. In some of the work we did in the consultative period to develop the data values agenda and manifesto, we heard some really interesting experiments from in the UK, for example, around health data where they were talking about this conception of the Welcome Trust and Ada Love License Institute, the sort of concept of a learning data governance, that there would be a sort of iterative process and that data governance could sort of learn, and that would be a kind of feedback mechanism. The other piece about getting value from the use of data, so one thing that we see in global development a lot historically, whether we're talking about household surveys or censuses or much more digitally enabled work is that you have underserved communities and surveyors who show up in their town, go door to door, ask them a bunch of questions and then go away and never talk to them ever again about what happened with that data and what decisions were made on the basis. Then they come back again and different people come back and they go door to door and they ask for their time and they ask them and in many cases the same questions and sort of again and again and again with very little feedback when if one takes time to look at what information was collected across health, education, environmental management, land use, agriculture, that information would be very relevant at a community level for very basic decisions for farmers, small, medium-sized enterprises, you know, schooling, etc. And it doesn't reach back to those communities. So there's something about that kind of value coming back to the communities who gave the data. I'm smiling a little bit there because it's such a universal problem even just beyond getting data for public services. I think it's just burnout that people have experienced in the nonprofit sector from too many systems changing all at once and they're like, didn't I just answer these questions about something else before and you never came back? It's just everywhere. So it's almost like we have to get better bigger at that. So the third component here, democratized data skills for greater equality. Love it, but I'm wondering, you know, is there a basic set of data skills that's a starting point or how would we begin with something like this? So that's a great question. We've had a lot of discussions around data literacy and have actually moved from the idea of data literacy to talking more about a concept of data confidence. And this was shared with us by a partner, Bronwyn Robertson at an organization called Data for Change. So rather than focusing on like specific coursework or trainings or what have you, the idea here is to emphasize a concept of being data curious, which focuses on exploring and investigating, being data critical. So interpreting and evaluating what you see and then data creative, which is around experimenting and communicating with data. So this doesn't perfectly answer your question, I get it, but it helps us reframe or change our orientation toward practical solutions for different audiences, right? What do the leaders of civil society organizations or community-based organizations need in terms of skills and an ability to sort of read a graph or a chart or look at information within their organization? What do community advocates need if they are going to hold their government accountable in a particular sector or in relation to data governance decisions? What do individuals need to understand how their data is being extracted and used in the digital economy? Like how do we make sense of terms and conditions and basic privacies and the location, you know, apps on our phone and all of these things? What information do we need? What skills do we need? And how do we make that more widely available for different people engaging in different settings so that they can feel not just confident to engage on the numbers, so to speak, or to read a newspaper article with a critical eye, but also to be confident to question the decisions that are made by people in power, right? Is it always okay to track my location data? Well, what other information do I need to answer that question for myself in terms of what I'm concerned about? In terms of skill development, right? Yes, there are some basic courses in elementary school, high school, and then college university. I think we're seeing education systems go, you know, very much in this direction of STEM quite rightly and to engage in the data economy and hopefully, you know, our children will be way better set up than we are. And then there's, you know, there are some basic trainings to think about for sort of civil servants in the public sector, for social impact organizations. But I think we need to be thinking about that differentiation. And then also, and this also came from our consultation and some insights from colleagues that connected by data, that it's not all about the skills that ordinary people or leaders in organizations need to get. It's not all about everyone on that side getting up to speed. But those who are working with data, those who are making decisions with data, those who are presenting data can do it in a way that's more understandable to a lay audience. There's more work to be done on that side of the equation as well. That's less about the skills of the receiver and more about the that improving the ability to communicate of those presenting or using data. And the last point reminds me of during the beginning of the pandemic, when I was R not, what's the R not? What's the actual transmissibility of this? And like, of course, I know what it is now and it's going to stick forever. But I remember listening to someone, they kept talking about the R not and they go, what are they saying? They're R not what? But I think you're right, there is a way to bring it down. And I'm, yeah, I like the point to your makings. And when you were talking about that, I'm like, people having the freedom to be able to question the data that is taken and what it was used for. I really liked that getting people empowered there. And it was, I'm curious too. I mean, it feels maybe in the US, at least, maybe we're waking up to the fact that we have given away so much personal data for a free app. But I'm wondering if it's the rest of the world has kind of done that too. And what's the behavior change to undo that? I'm just looking at it, because I live in the US, and I've seen it for years, what we do. And to your point, the terms and conditions, who reads those, they just click because you're like, I need access to this app because my friends are on it. I feel like there's a huge behavior change just here in the US. And is it the same in the developing economies, you know, have, are they at that level too, or is it different? So I can't make super well-formed like generalization. I can say that I think, by and large, at an individual level, there's a much greater awareness around data privacy in Europe in the rest of the year. So that's thing one. There are definitely places where the people are further along. I think there are pockets of that awareness amongst different communities for different reasons in Latin America, Africa, Asia. I think it is also important to remember and to bear in mind that there's a very real trade-off for ordinary people that it's the manifestation of what you just said about, I need that app on my phone because all my friends have it. It's also like, on my feature phone in a small town in Malawi, my only access to the internet might be via Facebook or Twitter, especially under present circumstances. You know, my, the, my, I don't have a bank account. And the only way that I make payments is via the digital payment system in my economy. And that is an essential piece of infrastructure that is life-changing for me and my business. And the fact that in the background, the bank or the manager that that data is being harvested is really does not compare in terms of the value I get from that electronic payment system. So, you know, it's not about do I go on or do I not go on. It's the conversation around who is holding, where's the accountability, who's in charge, you know, who's consulted, to what extent is that an issue even in public discourse, how to bring it into public discourse, say through the media, through journalism, et cetera, and start to have that conversation. So, the trade-offs for different people in different places are really variable. Another important consideration is a cultural one and a history. In cultures where personal, where that are more individualistic versus more communitarian, you're going to have different views about invasions of personal privacy. In countries and regions with strong histories of authoritarian government that has used surveillance and not just digital, but in decades and centuries past, then the ingrained experience with surveillance is going to be very different. And how that manifests with digital tools is going to be very different and the reactions are going to be very different. So, that's not determinative, it's just a reality. And so, a solution that works in one part of the world isn't always going to work in another part of the world. And by that, I mean a technical solution, as well as a governance solution is not always going to work and be replicable. Thank you. I'm writing some thoughts down that I might pull back later, but I want to get to the fourth point because I could stuff down really nicely to where we just ended there. But the fourth key point here in the manifesto is create cultures of transparency, data sharing, and use, which feels very fitting to where we were just talking about there. And then the first thought I had when I read that for you was how do you see those cultures coming together to transparency, data sharing, and use in these different places? Yeah, so we brought this idea of a culture of data use into the discussion and data values, because one of the things that we found when we were digging into the question of how do you actually get sustained data use in public institutions, this again is much more human than it is technical. In other words, even when the quality of the data are good, even when the data gaps have been filled, even when the data are interoperable, even when the data are accessible and available, there's a kind of complicated mix of political economy incentives that affect whether that data is actually used for decision making. I think we see that in US politics all the time. A culture of data use is one in which leaders and decision makers are oriented toward that. You get rewarded for doing that. So examples that you can find around the world are having performance management in people's contracts around the extent to which you're really using data for making decisions. You can be rewarded as a politician or a bureaucrat by the public, for example. So if there's a high expectation that decisions are being made based on data, then a vibrant civil society will demand to see that data or demand to see evidence of it or call into question decisions that haven't been made based on data. But building that culture, it's an organizational culture question. Anyone who's in an oversight position asking a subordinate, well, what's the evidence for that decision? Why are you delivering the program in those five communities and not those five? What do you know about the difference between those communities and why that's happening? It's about thinking about what the incentives are and whether the environment really rewards that kind of decision making. Yeah, definitely. And then there was a subtext here, too, I noticed on your website for getting the use of data as a public good, which I totally love. I think it's needed and it just feels right on many levels. And it was kind of tied into what I was writing down when you were talking before. Nothing will ever be applicable directly to each culture individually or ways it can be put out, but are there ways to start thinking about if it's a public good? Is there an open-sourced methodology around it? If it's not the open-sourced technology around it, where you can take it and apply and we saw this framework work for this type of group, now how could it maybe work locally over here? But yeah, what are the, what we need to start doing to start really thinking about data as a public good rather than, especially here in the US, it feels very much like a corporate good more than anything else. So there's a lot of really good work going on in this area around data as a public good and the concept also of digital public goods and whether you would put data under that umbrella. The one thing I do want to say, though, is that as much as we're emphasizing a kind of culture of data sharing in news, not all data can or should be shared all the time. And we've talked a lot about all the reasons why earlier in this conversation, there are good reasons for eliminating accessibility or establishing parameters for how and when data is shared to protect people's rights, safety, privacy, etc. So the idea of data as a public good or for the public good is valuable because I think it helps us think about who's benefiting and who's not. And that's where the kind of should more people or more organizations have access to particular data sets to achieve aims that are in the social interest and are the benefits coming back to the so-called beneficiaries of those decisions. So that's the kind of public good angle. And what I think that then helps us think about is not about all data sharing all the time or this is a public good and therefore it should be open to everyone all the time, but rather just as you think about like public land as a public good, then it needs to be stewarded in the public interest. So we borrow these ideas from economics and bring them in and begin to talk about the concept of data stewardship. So I don't want to be super esoteric here, but this is basically just the idea that there is a person or an entity or a function that has a responsibility for thinking about how that data is handled and managed and used and then considering some of these questions around consultation and participation. This is a concept that's very present in the public private sector, chief data officers, chief information officers, etc., having certain stewardship functions, it's becoming more and more common in governments and in international organizations. And so it's about the notion that there needs to be a function that is thinking about when and how to maximize the benefits of data and share it and ensure it is used and reused as much as possible in the public interest, but also to minimize or mitigate risks. I was glad my head started going to, I'm in these conversations a lot where my wife works in the creative arts field and what's the jobs in the next 10 years, 15 years, but your kids be studying. I don't know, the whole world's changing super fast, but it sounds like it sounds like you're hitting on one right here, like where's the data ethicist who's the data, you know, chief data officer, but yeah, someone, what are those roles and where does she come from? What does she study and how do we make that happen? But yeah, what other roles are there? I mean, what are your thoughts on that? Like, is this something we have to, because you don't hear about these people a lot as a role that is funded and supported, especially in the nonprofit, let alone maybe the government space. Is it time to really say, hey, look, this is the type of role we need. And here's what it looks like. Can we start planning for this rather than piecemealing it from a few people who cared enough, someone had a little bit of technology, someone had a little bit of the social side and cared, and then they're like, we'll come up with a plan. Yeah, I think that's a really good point. I think it's a really good idea. It's interesting because some colleagues over at the NYU GovLab have been working on this concept of data stewardship for a long time and arguing that it's sort of a profession and needs to be built in private and public sector. I think the other piece of it, which is less about the role itself, is that there is no doubt, I have a daughter who's going into middle school next year, and every middle school is pitching their technology, the data piece, the STEM piece. Data science is very buzzy, and that is a kind of set of skills or exposure that there's big focus on kids getting, coding, et cetera. There may be also a value in starting to build some of these, I'll call them values or governance related considerations, into that learning incrementally over time, so that from the beginning, people who are developing their expertise in data science or analysis or visualization are actively considering the impacts of the decisions, the biases and frameworks that they're able to bake into that when they design and when they do analysis. The biases part is, yeah, just hear about it all the time, a lot of the AIs that are developed and everything that was going, and it's blind biases sometimes. You don't even realize you're putting it in, and then I think to the accountability pieces you talk to, how do we get enough diversity into these roles that the accountability starts to be built in from the start, rather than trying to then in hindsight go back and be like, oh my god, this AI that we unleashed and has been running for five years has these incredible biases that we overlooked, like you cannot do it at that point, you're starting over. And if we can get it upstream instead of trying to work on it downstream, yeah, that's actually how a daughter is about to be going into middle school next year too, and yeah, the coding thing is the toys they have now, even just for getting kids to start on coding and building robots is interesting. We'll see how the feature goes for that part of it. So the fifth key point in the manifesto says fund open and responsive data systems so that all people share in the benefits of data. I feel like we've been talking a bit about that for most of this conversation, but is there something you'd want to add there and define and talk about what an open and responsive data system would look like? Is there a vision that you could help to start painting for us and we could see it with you and maybe start moving the world there? Yeah, I'm not sure I can give you a perfect depiction of it. I think a lot of the themes we've already talked about around various forms of consultation and participation that allow people to weigh in, raising levels of awareness and even sort of education or skills or data confidence amongst the sort of user or affected community side as well as on the side of the sort of data analyst and decision maker. I think there's an institution's piece and this is the piece we haven't focused on very much. Just because in the data values sort of campaign and manifesto, we're really focused on this participatory piece because it's underdeveloped. The formal pieces are incredibly important and there are a lot of parts of the world where we're really not there yet including here in the United States. Legislation, institutions, oversight mechanisms are incredibly important and need to be developed. There are basics around infrastructure and connectivity, etc. At the risk of recommending a very dense piece of work on this, the World Bank in 2021 published their World Development Report which is one of the flagship publications and it focused on data and it's called Data for Better Lives and in that they have a chapter on at the end on what they call an integrated national data system and I think that's trying to give this sort of full picture of what a data system needs to cover. I think that they, on the piece about participation and inclusion, it's certainly there. I think it could be even stronger but I would refer listeners to that if they really wanted to get a kind of full picture. Well, that's wonderful. Yeah, I mean one of my questions here as we're getting closer up and up is just if people are really interested and I think they are. I mean a lot of people I talk to really care about data values, they care about data ethics, they care about what are we doing and how do we move this forward in a much more inclusive and equitable manner than has been previously done. How do we build it in from the beginning? Where do they, so it sounds like the World Bank Report would be a good start. Where else could they get started? I mean hop on your website and yeah tell us, tell our audience where they should go to start getting into the into the work with you. Certainly I would recommend the Data Values site which is a sort of a hub on the global partnership website and there there's a lot of material, there's the manifesto and there's a campaign toolkit for advocacy and a possibility to get in touch with us and to work with us on this. Also there I would recommend, I'd be remiss if I didn't recommend the white paper that accompanies the manifesto. The manifesto is obviously extremely short and easy to read and easy to digest. The white paper is much longer but also digestible and useful because it unpacks a lot of these concepts in a much more detailed way and brings a lot of examples from across our partners hundreds of organizations working around the world that brings those ideas to life and then it has some more concrete recommendations and a lot of references. So we worked with a lot of partners to put that together. It doesn't so much represent our thinking in the global partnership so much as it does a consolidation and a compilation of all the inputs we got from partners and so the references are incredibly important because you can find a lot of incredible work in great organizations doing fantastic work around the world in that way. It's wonderful. Thank you. I mean it's always having a tool and a resource like that to find what's been done, who's been saying what instead of always feel so often everyone's trying to start from zero or started over from scratch instead of building on some of this great like the great work you're doing. How do we build on and keep moving forward instead of trying to find some new starting point? So thank you for that and anyone who's listening we're going to have links all over the show note page which will be on the part of the DKO website. Those show notes should transfer out to anywhere you are listening to us and grabbing this podcast from. To anyone who's been a regular listener of our show, you know we always end with the same question and that is as we've been building a Spotify playlist that you can also enjoy to help you get through your workday, maybe you run or you're walking the dog. But Jenna, what is your go-to song when you need a boost and why? Well I'm going to choose Hallelujah by Leonard Cohen. So it's not a beat but and it's a little bit mournful but it's also I think quite hopeful in a lot of ways and I find it it's really a touching song. I am Canadian as well as American and so I do love Leonard Cohen as a poet and a lyricist and a songwriter and I think the music is really beautiful and so it just helps me like both to feel and think. It's wonderful. Thank you phenomenally touching song. I appreciate you sharing that with us. I end your time today and answering all my questions and walking us through you know the data values manifesto and how it can start to get better at being more participatory and getting to open data that can help everybody. So thank you so much for joining us today. Thanks a lot for having me. Bye Jenna.


I would like to show you today how I teach subtracting using objects to the student in my classroom. And I use anything that I have more than one of, so today we're using beans. Alright, I'd say boys and girls, today we are going to be subtracting using our objects. And I'm going to tell you a story. I am a lucky girl and I have five candy bars. Today our beans are our candy bars. So let's put five candy bars in my bowl. One, two, three, four, five. I have five candy bars. I was so hungry that I had to eat one of them right away. So boys and girls, if you eat one, do you put one in the bowl or do you take one out? Oh, you are so smart today. We're going to take one out because I ate it. It is gone. So let's count how many candy bars I have left. Okay, I have one, two, three, four candy bars left for another day. Nice job of counting.  And in the package there are six dog treats. Six dog treats. So let's put six in our package. One, two, three, four, five, six.  So we are going to feed him two. He eats two. Now do I add more to my cup to eat or do I take away? You are right. If I'm eating them I am taking them away. So let's take out one, two. How many bones does he, or dog treats does he have left for another day? Let's count them and find out. He has one, two, three, four. Now did my bone, my dog treats get smaller or larger? Do I have more in my bowl or less than in my bowl when I started? You are right. I have less in my bowl. Let's go back out to my garden. Remember my garden from before? I had eight flowers in my garden. Let's count one, two, three, four, five, six, seven, eight. They were so beautiful and smelled so lovely that I wanted them on the table while my family was eating dinner today. So I went out and I picked three of them. Hmm, am I putting more flowers in my garden or am I taking them away? You are right. I am taking them away. So let's take away three flowers. One, two, three. Oh, by the way, they looked lovely on my table. How many flowers are left in the garden? Let's count them and see. Boys and girls, I have one, two, three, four, five flowers in my flower garden. That is wonderful. I love the way you counted today. And this is one way that I teach subtracting using objects to the children in my classroom.


And the Supreme Court of Justice in Abu-Jerab held the election of Uba Sania's Kaduna state governor after dismissing an appeal by the People's Democratic Party PDP and its candidate, Mohammed Ashiro. The apex court ruled that the election petition tribunal and the appeal court were right to dismiss Ashiro's appeal as lacking merit. The PDP and its candidate challenged the election, claiming it was marked by corruption and non-compliance with the Electoral Act 2022. With a final sale, this is a mandate freely given to me by the People's Democratic State. First, I would want to commend the Honourable Justice of the Supreme Court for their sound judgment. I also want to thank my brother, Honourable Isha Ashiro, for approaching the court to ventilate his grievances for me. That is democracy way. But having concluded today, I believe it is a high time for us to join hands together to work together for the progress of Kaduna State. Since the inception of our government on May 29, we have the Ronin People's Centre Inclusive and Pro-Development Administration. I've been said that I would like to call on all the staff members and partners irrespective of party affiliation to work with us. Don't forget to hit the notification button so you get notified about fresh news updates.


Alrighty, let's play this in full here. There is sound at the very beginning just couple gunshots, and I'll leave it at that Last one and then there he goes Cool, I'm gonna turn a sound off Just in case and you're mentioning an email that you so you're gonna have this guy here.  It's my sweat That's it now Let me see it felt a bit long the couple things what if someone watches this without sound? I'm not sure you need to sound. I think we should play it safe and just work with it Without the sound if you just play this. I mean you have The tracers, but I wonder if we could just start right away on This guy and then you know when once he gets to here Think what I would do personally with it again is as always is you can do whatever you want I would start off right with the character coming in so Imagine there's no sound so no one's kind of wondering. Hmm. What's coming here? And I know there's there is Stuff here, but I'm gonna ignore that and imagine character comes in Runs to it. There's a slight glimpse at the character looking back, which is cool It's not extremely important because it's gonna be clear here, but I always like that kind of a little bit detail So you might potentially If you want to do this pushes a bit more where the chest is more turned away from us It's a bit more of a side not like a sidewalk Or side stepping thing, but it's just it's just a bit it feels a bit like it's mostly the head and then that's it And I know this is stepped and we going straight into this post But as you move forward something to think about like how far you want that to be turned where that arm might be a bit more In front of the body, even if just for that small moment, but again, it's a minimal thing Well, personally what I would try to do is comes in and looks here and now Just for a moment you might think oh, I might make this I can I can jump down and the cup That's following me. That's really big eating way too many donuts You can never jump down. I'll be free and because for that moment where he's he's thinking about this And he's much more occupied with that and his escape. He forgets the gun person in the back It's a weird name gun person. So he comes in and then you have the shot One here and then one here Hitting so it's a really close call That's that makes him look back again It was just for a moment He was forgetting the person because he thinks oh, I can be free because only I can jump down here Then looks back Then that shot again here and then the other thing was on the on my first viewing that he felt very casual He's being shot at I wasn't all right. Yeah, I guess looking back. Yeah, I guess well Let me jump that seems very very relaxed for someone who's being shot at so with Probably do this and then that's why I'm thinking about that's why he is Somewhat distracted by that moment of freedom there and then you got that shot Like I said here where he really wins this and moves away from this like really Changing his pose Turning around so it's not just that but it's it's a bigger post change and really whoa make it make it much Much faster. So after this The shooting he gets he goes straight into this pose and not going back It's a full-on. Oh, what's over that?  So much faster reaction and then as he gets to this You know, it will be me with potential side steps or something just a bit more active because he's he's back here He sees mmm copy still here. He can kill me at any point. I'm gonna be much more frantic and Panicked about it and it doesn't have to be fumbling in terms of oh falling down and getting back up But just just a bit more than Than that because then if you are going forward, yeah, maybe that person's not really a threat Then I will play that up a bit more so that for instance He could look back and he's being shot at and all he does is hold on to this here and he leans back You know arm here arm down Maybe one leg up and it's kind of like a very casual. Oh, let me just let me just move over while He's shooting at me.  Hmm still behind me. Yeah, not really a problem Let me just jump down here It feels like you want to push me personally I would push into either one of those directions and right now It's kind of like what he seems like he wants to get away, but it's not that concern especially through here Then it gets back up to here. This is cool Because this to me seems a lot more and not a lot more but not massively in control I like that they'll changes in arms and all of this Like it's not extremely casual, but it's also not fumbly So again, I would push up potentially either ends in one of these directions where he might even land here and Have that bit more of a slip down And then into this And when you do this that lands could be ever so slightly Off balance where he has to rebalance itself and then that that step over imagine would be, you know, potentially You know, I'm horrible at drawing but lower so he has to he almost turns around This way pushing off of this arm Into this or if he's extremely casual it could be a lands home And maybe Instead of going there it's almost like he lands and does a bit of a one hop up and go to kind of a I don't remember Elasti girl before when you have you have Bob the buildings in Elasti girl after she says you have to be more flexible She has the little hop backwards little one two and then she goes between those little jump It's a little bit of a casual hop there Then I will push that potentially These are kind of the for me the two areas that you could potentially Think about this is extremely picky and and silly but I would somehow move either Something or extend the geometry so that this does not fall straight into here. I know this is extremely silly I'm just seeing tangents and and lions. I know I mean very silly and then you mentioned that the cup at the end I don't know. It's already pretty long So like you can come I mean you could potentially Have him as he lands Cup starts to show up and again, you can make him really big and out of shape. Maybe even holding a doughnuts So that's so that we know all that cop is really not in any shape or form a threat that his person Doesn't mean that he doesn't have to be frantic and wants to get away But you know something where my trainer thought is he jumps down and right through here You would see the cop coming So that when this happens, you know, there might just be or the cop might be here It's a bit more visible and might be just Angling his arm down to shoot When he does this might be again here Some ricochet and shooting comes down and then as he flees Still some hits, I'm not sure personally if you need to go all the way back up to see The cop just if I play this even if you play from here, right sake. That's like two seconds We can shave off the shot comes here. It checks around. Be more frantic jumps up and then And I guess you could maybe maybe maybe shave those two seconds off we can go back up to show the cop maybe But it could be interesting too to have the cop now suddenly show up here You know, then you can you don't have to go that low with the camera that mean this frame down here Could be here. So we see a bit more and then it's then the characters really leading the camera But right now the camera is a bit anticipating that whole thing So imagine that we're maybe not lower than this and see that gives us enough room for the cop to still arrive And then you could you could play with the fact that the cop is out of breath. Maybe a cop is he goes Maybe you play up the casualness where this character is more of a Move like this where it's kind of like he does that I imagine you got you know, like really pointing that the the fingers here in the very big exaggerate It's all right. I'm out of here moment So that imagine he's here and maybe he holds on with one arm Chases a bit higher head up and then with this hand he does kind of like okay. Bye. Bye and then does that one two jump down while the cop is Maybe trying to reload or grabbing a gun or fumbling the gun or something and then again that lower frame might be here and Then only through here The camera will catch up and we can easily break frame where that character is this far off-screen and then land and does his His run off and maybe you have some humor where now the gun goes And he ultimately did drop the gun and fumble it because it's just it's a very inept cop anyway Food for thought or not or maybe I don't know these are my thoughts. It's definitely already well done These are just kind of different ideas. I'm really not worried about your animation skills It's just kind of throwing out Different animation ideas and story points or something that you could consider or just use exactly do what you do But I think even if you do what you have or probably waits with the camera so that the characters leading the camera just a bit more But that will also change once you spline this because of this moment here All right, but that's it. Thank you All right, there's an email you can sign up you can start whenever you want you can submit whatever you want You get 16 submissions either way a like and subscribe would be awesome. All right. Thank you


Hello, everyone. Welcome to the annual phenolate speech at DEF CON. We got plenty of material to cover, so I might actually step over some stuff pretty quick. And if you've got questions, the idea is I will hang out on the first pool, and you're going to buy me beer, and I answer your questions. Okay, let's go. What we're going to do. First, if you catch Richard Thiem's talk, lots of people are concerned about what's the matrix, are we in the matrix, how to hack the matrix, so we thought we're going to look at it and tell you how to hack the matrix. Then we have some GSM stuff, you know, of the short fun excursors. We were actually covered GSM and GPRS basics. GSM is swapping over finally to the United States, so you finally got decent phones. And I thought it would be quite useful to actually give you an introduction on how the backbones work, so we will also discuss two things about the mobile phone networks, attacking mobile phones and attacking mobile phone backbones.  Hacking the matrix. There is a product from made by in terraces. They used to be cable char. It's called the matrix. So just because they gave it the wrong name, I started looking at it. This is basically a switch router, so you have a switch and you basically can say the use in that port is now going to be a router. And to sum it up, the vulnerability is a God. If you do anything for management, you better have TCP, IP working, right? So this being an embedded system, you do like ten connections or you complete ten TCP handshakes to any given service that you use for management. Let's say it's Talnet or SSH and that's about it. Nobody else is going to do that anymore. The same thing on the switch ports that are not assigned to a router. They use this very advanced technique for calculating initial sequence numbers for TCP that's known as the 64K rule.  So well, when you unpack the box, it is a switch, so as soon as someone Talnet's there, you can hijack the connection easily. And also, of course, it does OSPF. For those of you who catched a talk two years ago, you know that OSPF is quite useful and you can do lots of things with it. The bad thing is vendors tend to read RFCs incompletely, so they actually read the part that told them how to build the packets for OSPF but they didn't read the part that told them how to make OSPF work. So you just sit there and flutter with OSPF hello messages, which basically means here's the next new router, here's the next new router, here's the next new router. And instead of validating that first and then tell everyone else, it will tell everyone else in the network right away. Which translates to all you need is one of those boxes in your OSPF network and it will actually kill the whole network for you. And well, to make a long story short, last year I said if you got an embedded system and it got port 80 TCP open, you can bet your assets vulnerable, so same holds true for the matrix. Which answers the question how to hack the matrix, use HTTP. Okay, GSM basics, the global system for mobile communication, GSM, is actually used for quite a while and was standardized by the ETSI. In contrast to the mobile networks you got here, usually, there is a very specific difference between what they call the terminal equipment and everyone else calls a phone and the SIM card that is actually a smart chip handling all your information. You use the SIM card to authenticate the key material on the SIM card to authenticate and to use your caller ID and other IDs to authenticate. The phone does not matter. The GSM core networks actually rely on this information to find out who you are and actually bill you for the service they provide. So, lots of people have tried to do caller ID spoofing and other stuff with GSM. Some succeeded in very limited environments, but in general it's all fine and all good. Which actually changes. It changes with what's known as GPRS, the general packet radio service. Well, this service now is pretty much like the internet was compared to least line services.  Same here. So, this is actually packet services for mobile phones, so you can serve web faster and do all kinds of stuff with it and consequently the whole backbone infrastructure is running on IPv4. Now, authentication is a bit different here. If you want to find out which network you're talking to, you use the APN, the access point name. This is something you transmit to the GSM network and it will figure out on which side you will pop up. So, that does not have to be the internet or a VAP gateway. And then optionally, you got PPP running over that, giving you IP addresses and of course doing this chat, pat thingy, find out who you are if you got a right username and password. APNs. You should actually think of an APN as a URL. It is quite similar actually because you give it a name and it will tell you which network you're talking to in contrast to a real URL telling you which server you're talking to. So, the same thing in full color. What you got here is actually a very basic, well, yeah, very basic picture of a GSM network. You got the guy here being the mobile phone talking to the PLM and which is the public land mobile network. Everyone else just says the mobile network.  Often it runs Oracle. If you're home, there's another thing that's called the visitor location register. And the HLR actually holds all the information about you and your credentials and what you're supposed to do and what you're not supposed to do. Then you got the SGSNs and the GGSNs. The SGSNs are the serving GPRS support node. Think of the GGSN as a backbone router and the SGSN as the one actually talking to the HLR and forwarding this stuff. So it's pretty much like a framework network. And of course you got more than one GGSN. So you got one facing the internet. You got others facing company dedicated networks.  That is quite useful. So you got, let's say you got any kind of logistics company like UPS or FedEx and they got what I call the oversized Gameboys where you're supposed to sign on. These devices have to talk back and actually make sure that, well, you signed and the package was delivered. And, well, it's quite easy for them to actually order GPRS services, request an APN and every time those devices have to talk to the network, they open the APN and say, this is where I want to talk to. And now they end up being in the UPS internal network instead of the internet. Of course nobody prevents you from doing the same. So GPRS attack points. First the GGSN as I said is just another IPv4 device at stake actually figured that out. They had an OQGPRS box hanging off the internet and they actually found a vulnerability there. Something totally simple like a special TCP option. So you can actually expect a lot of stuff going on with those especially on the networks that face not the internet but some company networks. And the scary thing here is Cisco also does GGSNs. Now APNs can actually be GGS. They're not considered a secret. It's like the URL. So most of the APNs are actually either the URL of the company's home page or the company name. So you can just go ahead and try it. I did that in Germany and it turned out that lots of major companies actually have their company name as APN and you get asked for a username and password via PPP. And of course this being a large user base you often find usernames and passwords called test and test and yeah you know how that works. So the thing here is you can actually do APN filtering in a HLR but no provider does it. For a simple design failure reason. You can only say that a user account is allowed to do all APNs you want or a limited list. Now that would be pretty bad for the database if they had to write that down into the database for 22 million customers. So they don't say that. They just say everyone can go to whatever APN he wants and yeah the GGSN were the authentication servers, radio service hanging off that during the authentication and with a large username and actually user account database you should also find weak passwords. But there is actually more to it. So if you happen to have for whatever reason, maybe for staying at DEF CON or talking to some guys, you happen to have one single computer in a mobile phone provider's network. It can be the secretary's Windows PC or whatever. You can actually do quite some interesting stuff. There is the GPRS tunneling protocol GTP. It's standardized here for everyone who loves to read boring documents. You can actually get that off the ETSI webpage. The protocol is actually designed to transport user data and control data via IPv4 and the GPRS backbones and is also used in UMTS backbones for the third generation that you didn't even hear of. The protocol can control pretty much everything in the network. This includes setting up modifying tunnels, connections, data transfer path. You can modify the VPN access for an active subscriber. You control how they roam and of course you control how the accounting works. Now both the control connections and the user data are ran over the same protocol. So we are talking about all the same thing. Now the most funny thing is actually already on like the fifth page of the standard because it says that every device SGSN and GGSN is supposed to support this protocol including version zero. So what they did was actually they standardized their inability to fix the protocol because even if they come up with a new version that isn't so screwed as the one we are now talking about, the devices are supposed to support the screwed version and this is in the standard. I would say that was not a good move. So what's it all about? What's it cool about it? This is in protocol running over IP so we are quite familiar with it, right? It runs on UDP which enables us to spoof. It has no authentication. You can create, update or delete user context to your lightning with one UDP packet. You can modify or remove billing information with one UDP packet. You can actually reroute traffic and redirect traffic over the backbone. Guess what? One UDP packet. You can actually invite people into VPNs. So you got one of those boxes and you got a friend who got a GPRS phone. You can actually invite him actively to one of the company VPNs, one UDP packet. And of course you can force people to roam. Roaming is handled by GDP between the SGSNs. So I was actually wondering why there isn't someone, maybe I do it, starting a company as a mobile phone provider and just having one SGSN and constantly sending out UDP packets and make all the users roam over you. Which I think is a good business concept but it wasn't declared as such in the standard. The fun thing is how they dealt with security is this. They say we're ETSR, we're doing GSM. So we don't care about IP. Someone else is going to make IP secure. Period. And a statement. Okay. Assumed you do not have a computer in a mobile phone network. And of course most of you are not supposed to have one. There is other stuff you can actually do with GPRS and VAP. This is anonymous HTTP. The good thing here is a lot of people especially at this conference have certain interest in doing HTTP without revealing their real IP address to the server they're talking to. Those reasons might include something like Unicode or web applications or other overflows that you might find in port 80 applications. So how do you do that? The VAP protocol is actually the vehicle to go for. You have the wireless transport protocol and the wireless session protocol. The wireless transport protocol is used to do basic transport stuff. The wireless session protocol is actually the one doing a session over the UDP stuff you talk on the air interface to your mobile network. Now this is used to actually talk to something that's called a VAP gateway. The VAP gateway is supposed to work as a proxy both in protocol terms and in HTTP terms. It will accept UDP on one side which is your phone and it will talk TCP to the other and it will grab down the web pages you asked for. Do something that they call compiling which basically means take an HTTP or in this case WML tags. Make them non-tax so compile them in one binary format so it's smaller and send it to your phone. So WSP in the default setting that your phones use is a connection over UDP so it got actually numbers to track the connection and the session which you compare for those of you who know DNS and the DNS IDs for packets for requests. This is pretty much the same idea here. Now an often overlooked fact is that actually the standard says there is a way to do connectionless WSP. Connectionless WSP means you're not setting up a connection. You just send the HTTP request to the VAP gateway. This has several advantages. First of all you can tell the VAP gateway you're not really interested in the answer which means it's not going to send one. The second thing is this being UDP of course we can easily spoof again. Which now means we're actually giving the company, the mobile phone company money by using GPRS but we're actually not using our own source IP address but someone else's. And this is quite okay. The VAP gateway does not filter that usually. I have not seen a VAP gateway or any other device in a mobile network that will actually detect spoofing but they might exist. Correct me if I'm wrong. So you actually got anonymous HTTP request capabilities and to make it nice and have a little drop of sugar on top of it, it's built to someone else. You just find out which IP addresses are used which of course you do with this ICMP sending utility called Ping and then you use their IP addresses. So not only is your HTTP based attack anonymous but someone else is going to pay for it. So this is the summary of how to do that in case you want to try that at home. The good thing is you don't actually need to have a phone. There are open VAP gateways in the internet. So you can actually look for UDP port 9200 and well then apply your responsible procedure in dealing with new waste of exploiting things. Yeah. I had a certain problem with an NDA here. So I just wanted to make sure that this is covered in the slides.  Okay. From the backbone to the actual devices, this is the thing we're talking about. The Siemens S55. Now there are lots of smart people actually dealing with PDA sized phones and other, yeah, the new generation stuff that runs Symbian OS and I'm not really smart enough to compete with them. So we had a different reason looking at that one. Simple for the reason was we had it and those Semi smartphones as I call them are very widespread used.  It got Bluetooth. So what's bad about the Bluetooth implementation here is every time you start a connection it will of course ask you if you want to pair with this device. This is fine. Well if you start the next connection it will ask you again. So you open about 100 connections and it will have 100 message boxes on the screen. That thing is there's not being Windows. You don't see that those are multiple message boxes lying on top of each other. So you acknowledge one or dismiss one and it still looks the same. You have no idea what's going on. And well the same problem actually holds true for the connection was that the connection resource is in the phone. So you do more connect to it. At some point in time it's so busy waiting for the user to acknowledge or dismiss this pairing that it doesn't have any connections left. So if this guy had a headset or anything else actually working with the phone this changed. It's no longer working. And all you need is something that's called an L2 ping. It's just a layer 2 kind of ping. So that's quite easy. The big inbox is something I really like to do in airport lounges. You got all the executives with their little nice phones and well everything they do is like they get the phone, they set a new background picture and turn on every possible feature. So the thing is the S55 accepts whatever files you send to it and puts it in a directory saying incoming data. Now it is quite easy and not really time consuming to send 2100 files. Unfortunately it is quite time consuming to delete 2100 files on your phone. Because they actually got a function that's called delete all. But this function seems to use a counter for what all actually means that is bite sized. So you can actually delete 255 files at the same time. But this is not going to win the race against the one sending the files. And it is by the way quite annoying when they're on the phone because it keeps peeping. Okay so the next big thing that the vendors of the phones actually advertise is the whole Java stuff. Well if you remember last year I hate Java. But Java is actually supposed to be a secure programming language. And this is done by having exceptional circumstances in your program code manifest themselves as exceptions. One of those exceptions is an out pointer.  Actually here it does. So everything that could possibly trigger an out pointer exception, which often is just leaving out data, will result in what we call the white screen of death. Because as you see on a picture this is how it looks like. All you have to do is trigger an out pointer exception and we're going to show you how. There is the thing called the Jot files. Jot files are actually text files that are comparable to like INI files on Windows. They're lying around on web servers. So you serve web and it says download Java application or it says click here. And you actually pull down a Jot file and it figures out what the name of the Java application is, what size, where it comes from, what classes it needs and stuff. And of course the name of the Java application is quite interesting because it wants to ask you if you want to install it or not. And that's stored in the mid-let name. Well, if the mid-let name is missing, you get what you see here, the white screen of death. So you can actually build web pages with evil Z mince links, which is quite funny. But the other thing is even more funny.  You have an over long mid-let name.  So it passes the Java application name as a directory name to the core operating system. Now there seems to be a limit which means that if you have a normal name that works well, if you have an over long name, it will actually overwrite the name of the file and some structures that are supposed to run the file system. So you cannot delete this. You actually have to flash the phone and remove all the data by reformatting the whole phone, which is the reason this little fucker here doesn't know any other ringtones than the default one anymore. But even with the Java stuff, well, you can crash it, but you can actually do more. Spider Jar. The idea actually is here that you can have some limited information pulled off the phone by Java applications. Most phones will actually complain if a Java application tries to make a connection outgoing and like send data. Well, the Siemens doesn't.  Questions, which information can you get? In a standard Java classes, Java X and all the Midlet stuff, there isn't any interesting. But we got the company class trees, and of course Siemens got one, and they're growing every time. This is the information from like today. It might change with the next firmware and they got new classes. But today you also can, you already can get the list of missed calls. Now the information, what calls you missed and from which number they came, can be quite interesting if it's sent to some external server. And of course you can also get the IMEI of the phone, so you can actually identify the phone correctly. So we try that and you can have a Java application. It could be a little game or whatever it is posing as, and every time you play the game, it's actually telling some web server in south of Russia which calls you missed. I don't think that's a good idea.  Sending an SMS or placing a call can be a costy thing depending on where you call or where you send the SMS to. I don't actually know if you got so-called value edit services, SMS and MMS in the States already. So where an SMS costs you about three bucks. But we got quite a lot of them in Europe and guess what they're offering. So normally it is supposed to actually ask you when a Java application will trigger the phone to call someone or send an SMS. It is supposed to ask you and say, hey, look, do you want to do that? But we got a little problem here. This confirmation is done by a dialogue. Now Java not being the fastest programming language in the world has a timing issue here. If you before you try to send the SMS actually fill the screen and do something else on it. So to make that visual, this is what it is supposed to do. For those who cannot read it, it says allow sending SMS to whatever number. And well, you're supposed to press yes or no. Due to the timing problem, you can ask different questions like, would you like to play a game? I had the idea of actually using the two buttons that are supposed to say yes or no as a control in some jump and run game. So you would actually press yes approximately 50 times, 50% of the time and send about 1,000 SMS each three bucks. The next thing we got here is something that is actually related to the whole MMS picture phone thingy. Well, of course to send pictures and do MMSs, you need to have image formats. So the image format of choice here is GIF and JPEG. Now the GIF file format, as you all know, supports multiple frames for animated GIFs. For that to be flexible, you got something in the file format that is called the virtuous screen, which describes which area on the screen is actually covered by the sum of all frames in the GIF file. Now what you can do here is send a GIF file that actually has one of the frames offsetting in this virtuous screen. This is supported by the standard. The good thing about that is, well, the virtuous screen itself is not really supported by Siemens. So you're actually writing the GIF data into some memory that is not displayed, but holds something different. So if you actually open such a GIF file or you get an MMS with it, your phone will crash. It will crash and it will just go off. It is very interesting, but you can make this permanent by placing this picture as a background image on the phone, which is pretty much the last thing you did with the phone.  Actually go and do some of the Cisco stuff. This was not intended to be here, but since a lot of people were talking about the latest iOS bug where you could like deny a service or device and actually some brilliant people send very extensively explained IRC shadlocks to full disclosure claiming this might be exploitable. I thought I going to comment on it. So the recently discovered bug is for those of you who don't have email that there is a way with like Metform packets to fill the input queue. Now the question was, is this exploitable? Well, my question is, when you're stuck in a traffic jam, does that mean you control the traffic light? You can describe the bug as something like you have people checking in in Alexis Park and you've got like 75 people go into the front counter and then you kind of like kill the person behind the counter which still doesn't mean you get their money. So to answer the question, no, it's not exploitable. But the good question would really be, what is the problem? The problem here is that iOS is interrupt and message driven. So the processes themselves are responsible for draining the queues which obviously those four processes didn't do. And while most processes in iOS for what I know do their own protocol parsing. Means the IP header is actually parsed at a central place but everything else is parsed each and every time in each and every process whoever is responsible for it. That means if you got a hundred types processes 99 can do IP protocol parsing quite well and one is totally fucked up and all you have to do is find the one. So that obviously leads to the point, can we expect more of that? I guess the simple and short answer is yes. The bug is actually a design failure in my eyes. iOS 12.3 is already out and it's already deferred and there are some specific protocols that are handled differently and have higher priorities and stuff. So it's just a matter of time. The effects of the bug were not as bad as we thought because Cisco actually went to the background providers and told them upfront here is something major calming so please filter that. And the bug actually was found Cisco internally so they could do that but what if the next bug is not? Well at this point in time here is the one finding the bug. He's the only one from the Cisco staff team. I'm glad he is here. He didn't get credit in the advisory so I wanted to give him credit here. Okay back to bugs that we found. Cisco iOS 11 and X, 11 X and below there is the UDP Echo Service. Now Nessus is telling you since ages that the UDP Echo Service is bad because someone can do ping pong attacks on it. On Cisco the UDP Echo Service is actually worse because they got a bug here that is on first time very small.  So you have one single character in the packet but you say the packet was 100 bytes long. You get 100 bytes answered. Now we tried and tried to look at how much data we actually can get back and it ended up being something about 19K with one packet. So that could be quite useful because that is IO memory. IO memory is used on Cisco for handling all the crap that has something to do with the packets themselves and some limited routing information. So we actually got comparable box in 12.x like the Cisco express forwarding. That's a certain way of getting packets from A to B that Cisco uses. I think it's now the standard setting. This one had a comparable bug where the IP length was the trigger. So there is more of it. But back to the UDP Echo Service what can we do with it? Oh no here's something because people started complaining about finding bugs in 11 is useless because nobody uses 11. This is a router actually alive in the internet. He found it. It runs iOS 9. Well this one is not even available on the Cisco FTP servers anymore. So people do update their routers once in a time. Okay the UDP Echo InfoLeak bug actually is quite useful because we can do reliable iOS fingerprinting. In the past we got the problem that you got like 22,000 different iOS images sitting on Cisco and well you don't know what the router you're targeting is running. Now you can because it contains block headers which contain addresses who allocated the block. You got addresses of the allocating image, allocating function which change per image so you know which image it is and you got address ranges for IO memory and heap memory and those change by platform. So you can fingerprint it. This is what you actually get back. You see you have the allocation stuff and the pointers we talked about last year. They're all platform specific but you also got the ring buffer information and the actual packets in the device. So question is can we and yes we can. There is of course the possibility of draining the router of memory leakage and actually get 19K per packet back and parse that correctly. So we came up with phenolate iOS sniff which is remote iOS sniffing. You don't need any account, you just need UDP echo. What it does is actually pulling down the information, parsing the memory block, identify them, identify the packet offset, do the packet decoding and present you with a nice TCP dump like output. So this being the receive buffers it's quite useful because well the router receives certain information especially when people log in. So what you see here are the first two lines or three lines of stuff that actually is sent to the router when someone is telenetting to it. Well the first lines he is probably sending are the passwords. So that's quite useful. But there is another bug. Cisco has an HTTP service and as I said earlier if you've got an embedded system and it got a TCP port 80 open it is vulnerable. Well Cisco is no exception. The HTTP server on 11.x and up to 12.2 has an integer overflow. It unfortunately requires you to send two gigabytes of data. But well I actually did a survey on people and said is this bullshit or should we actually go ahead and see if we can exploit it. And most said yeah I don't care if I wait a week and I got root on the device that's fine. And since that is a stack based overflow and it might be quite interesting to do because last year we did heap overflows we did it. So exploitation issues in the past for those who missed last year we need server image dependent information like previous pointers, size value and IO memory, stack location, location of the own code which probably means you should already have a console connection to the router you're trying to hack. And this isn't really practical. So things change. What we got now is the UDP echo memory leak. We see Attica provided data which is the UDP stuff you send there in the first place. We have live iOS memory addresses. The leak memory block headers if you remember. And we have the ability to fill multiple memory locations because it's a ring buffer. So we just send it multiple times. And we got the HTTP overflow which is a direct frame pointer overwrite and return address overwrite so it's straightforward to exploit. So what we can do is we actually send four binary shell code there via the UDP echo block. On the response we see where it ended up and we can calculate the exact address it is. We also have no limitations on byte because UDP echo doesn't care what it got in a payload. We need actually to select a good address from those in the ring buffers because if the router is not sitting in a phenolate lapse it has probably something else to do namely forwarding packets. So it's using the ring buffers actually to do the job and we need to find a way to actually have a stable address where the shell code survived and is not overwritten by other IP packets. But well if we figure that out we own the box. So combined we actually send the maximum URL length allowed by iOS. Then we send two gigabytes of additional URL elements which has a nice side effect because it keeps counting and counting the number of bytes received and compares it to the size of the buffer. Now after you send two gigabytes of data this being a signed integer the number of bytes received variable will be negative and this is smaller than the size of the buffer so they can still copy it which means they're overflowing the buffer.  For those of you who prefer like all in color here it is. HTTP connect legal size URL send lots of A's do the UDP echo get the info back repeat until happy send the overflow on the box end of slide. The problem we got here is of course the binary via HTTP. We're overriding the return address so HTTP doesn't really like characters like line feeds character turns, slashes zero bytes are obviously bad but we found out that the HTTP encoding you know the percent XYZ stuff that everyone like uses to screw up in their web servers is actually performed on the same buffer before the overflow function returns. So we can actually do overflow and use the HTTP encoding so we can use arbitrary addresses which made it even easier. I said we need an intelligent address selection so what we are doing is there is several strategies that are listed here I'm running out of time so I'll skip over and just tell you use the second smallest address or the third smallest address is the best way to do you will see it in the code. Now shell code we had shell code in the past that overwrote the complete configuration which unfortunately means you lose all the juicy info like the passwords they use and they're never never going to use on any other router in their network and the routing information access lists all the stuff you could be interested in so we figured we need new shell code and for that we actually did binary research on iOS. iOS, Cisco actually supports serial debugging via GDP but it sucks but they also got some debugging capability in the ROM monitor which is comparable to what you have in your PC as a BIOS and so you can set breakpoints and do this assembly the cool thing here is code identification of the critical part of the huge chunk of code you got is quite simple because the string that is shown in a function is actually stored right next to the function in the text segment and that's before the function so all you do is turn on every possible debugging you can give and do whatever you wanted to find out and then look for the strings find them in the code disassemble the function after that and you got the function using those strings so equipped with this knowledge we actually figured out we need new shell code call it next generation code whatever what we do is runtime iOS patching we actually teach the Cisco device to forget about certain functions it performed before namely password validation so with the new shell code you turn it to the device and it stops doing the annoying user authentication give me the password stuff it just drops you on the user shell and of course on the same is possible for the enable password so it will actually ask you for the enable password when you say enable but it will not validate the results of course you can do other stuff you could actually introduce something like forgetting about to check if the bgp neighbor I'm talking to is really the one I'm supposed to talk to use your imagination the problem here is we have to keep ios running the overflow actually destroys a lot of stuff on the heap because of the encoding we use we send twenty four bytes and they end up being eight bytes but we destroyed a lot but the Motorola call structure actually saves frame pointer and stack pointer pretty comparable to the Intel ones and so all you need to do is search the stack upwards for information that was set there by a function preamble and use this information and your clean return and better like clear the return on information so it will actually return faults and nobody cares this is the code I guess nobody can read it there it just finds the return and cleans yeah you can check it out on the slides later ios runtime patching advantage of course the router stays online it doesn't reboot anymore the configuration is preserved so if you're interested in stuff like the passwords there's a heavily encrypted with the password seven algorithm and of course uh... it proves that what people talked about for years and years back during ios runtime code is actually possible and quite easy disadvantages of course it's depending on the image so we got the image independent and image dependence again uh... you need therefore a large target list and well you actually got annoying messages on the console saying check some error because it does check some the tax segment and uh... figures out that there's a problem but of course uh... we patch that out as well so this is what the exploit is Cisco Cosmos reliable ios remote exploitation that's just a summary uh... and this is how it looks like quite easy she's bad okay here is something uh... lots of people for last year's were complaining that all the presentations held on blackhead or actually uh... held the same way on defconn and there is no well yet so here's our well yet to defconn what about image independent shellcode we can actually uh... instead of modifying the image we can actually modify the configuration now the configuration is portable over images and versions so all we need to do is have a shellcode that does string search uh... mem copy and check sums well we can do that config modification code uh... we start searching at the beginning of the nvram uh... we look for currencies of uh... like interesting data uh... let's say password and enable uh... we replace it with our information uh... and hereby replace authentication information for the listed services we then just need to recalculate the checksum uh... for the nvram and write it back and this is how that looks like you know ios also has the advantage of ignoring lines with bullshit so uh... we can actually replace the stuff and uh... introduce a line feed the rest of the encrypted strings ends up being butchered ios ignores it that's fine advantages here it's image independent the configuration is pretty much preserved except for the passwords but of course we can change the shellcode and copy the passwords elsewhere uh... and we have actually more choices of what to do we can have shellcodes just renaming every router to like piece of crap uh... disadvantage of course it's still uh... platform dependent but well we cannot change that except for uh... if one of the guys that sees a challenge comes up with a uh... cross-platform shellcode for Motorola and MIPS uh... and the router has to reboot so we got a little downtime so what what's the whole thing about well didn't we mention last year that you shouldn't run unneeded services like utp echo uh... that you actually should protect your infrastructure and um... that you actually should not copy data into the buffers that are not large enough to hold them so the problem here is ios moves forward uh... the new ios versions actually got legal interception building half a year ago i was talking to jaya who did the uh... legal interception talk and i said that that would be quite interesting because uh... then you can wear a t-shirt saying my other computer is your legal interception system this seems to become true slowly well and if your infrastructure is owned uh... you can't defend your systems of course okay and one thing i wanted to mention is that there are more people than we are researching ios exploitation as a birthday gift i got body of secrets james bampford it actually has a whole page on the fact that uh... the nsa is actively trying to find hacks for ios so they can take over sysco routers i just wanted to mention that here uh... you actually got some very excellent uh... experience on defcon we just have to identify the people so the defense part of course mobile phones that's easy turn the crap off do not do bluetooth or have no uh... uh... infrared enabled when you're sitting in the airport do not run any java code just because it says it's going to show you titties uh... when you receive files delete them right away uh... think of your mobile phone as a crappy version of outlook and well if you got a chance uh... keep your phone from where up to date some vendors actually uh... allow you to do that for others you have to arrest on the people at the shop and if you're anyone is with the company doing that uh... don't do gpr svp ends defense sysco um... in summary do not trust devices just because they're in the black box it doesn't mean they're more secure it mostly means they're less secure uh... keep your ios up to date if possible actually block every direct communication to your routers there is no legitimate use to someone else in the internet talk directly to your router so if you have done that in the first place even the uh... q filling back wouldn't even affect you and of course uh... to do that you should prefer out of an management uh... so the one talking to your others actually coming in on a different interface and well you should include your router in the ideas watch list but i was racing through it and i guess i made it on time uh... thanks a lot being here and well i will be at the pool for questions uh... i know that most people don't see the lower part of the screen but this is something they just got in germany out with the advertisements and i thought we're gonna change that a bit and thanks very much