Okay, very good morning to you before I begin don't forget as per usual to subscribe to the YouTube channel new content coming Every day of the week for myself and the rest of the team I'm going to focus on as per usual the kind of macro top level fundamentals of what we're looking out for not just today But this week, but if you want the technical setup video as issued by Sam yesterday You can find it on the channel by just finding his category So let's just have a look at the the charts this morning and what have we got in store. So Yeah, a little bit of risk off I guess in terms of the equity index futures seen negative at the moment does follow a little bit of a downside session seen in Asia Some significant individual single stock news seeing HSBC standard charter shares in the Asia Pacific Time zone coming under some pressure. So keeping an eye on them at the open of footsie trade I'll get into that in a little bit more detail shortly Otherwise in the FX market the dollar was weaker overnight Or be it has just bumped up a little as Europe has come in but that does see then Euro dollar in slight positive territory Also cable just sitting above its pivot in the futures Euro dollar you can see here just running into some Resistance and around the highs that we're seeing towards the back end of last week Also during the Asia Pacific session noting as well that Japan was out overnight there on market holiday not returning Until Wednesday So elsewhere fixed income pretty quiet gold as well relatively range bound Oil a little bit negative bit of a break of a trend line in the short-term technicals this morning And that $41 handle here just with those previous lows that was seen at the opening of electronic trade Maybe just acting now as a little of resistance on that last run low. We've had more recently But moves relatively contained at this point in time Right, so let's get let's get stuck into some headlines Quite a few things starting off with HSBC shares Fall to a 25-year low So why has this happened? Well, their shares were down in excess of 4% at one point standard charted down a similar margin in their Hong Kong shares And they dropped after media reports that they and other banks move large sums of alleged illicit funds over nearly two decades In addition to this HSBC is a possible candidate for China's quote Unreliable entity list that aims to punish firms organizations or individuals that damage national security according to the Global Times which is the kind of state-run media newspaper in China in the mainland that came out over the weekend China have issued rules regarding as proposed Unreliable entities list while it reportedly do not have a timetable or preset names of companies They warned that foreign firms if they violate nation's laws or commit illegal acts It could be included in this list and face measures now although over the overnight session China have denied this Those media reports do hint that US firms of potential targets from that list could include lights at Qualcomm, Cisco, Apple and FedEx as well So worth keeping on those guys at the market reopen in a few hours time on the nizy But yeah, HSBC getting pretty pounded overnight Does come after you know just in that that local region Whether it be trade war whether it be disruptions that have been seen in Hong Kong and the national security law or the ongoing protesting that's been happening, you know their shares now I think they're down roughly 50% on the year So incredibly difficult times there and not only those two banks, but Deutsche Bank as well Appears to have facilitated more than half of the leaked two trillion dollars of suspicious transactions that were flagged To the US government over nearly two decades is part of the same story That was weighing on those other banks and DB shares head of the cash equity open are called down around 7% at the market open. Well, let's get the latest We're seeing down around 6.8% at the moment So that was some of the overnight stuff Otherwise elsewhere a lot of the weekend press has been filled with COVID updates I'm not sure if you were out and about over the weekend, but again managed to go for a bit of a walk on Sunday and it was Super busy. I did say this before the lockdown From the group gatherings from 30 to 6 and I was commenting I remember this time last week about how to walk along South Bank and it was absolutely heaving Well, this time I went to Battersea Park anyone familiar with London and I have never seen it that busy in my life Enough that I felt uncomfortable and and wore my mask All day rather than just generally when it's necessary when going into shops that so I've said this last week and I'll kind of repeat it. I think that and it's already being seen, but I think it's going to get a lot worse just the general Lack of I guess adhering to just general sensibility of the Realization that we are still in the middle of a pandemic just by the broad mass I think that these rates are going to get far worse than what they are At the moment and hence the reason why I think you're starting to get a lot of these noises this morning The government knows this is the case So what what have we got here? Well, Britain is said to be at a critical point now In the coronavirus pandemic Boris Johnson is set to say today as concerns mount of a second lockdown That might be needed to stop the renewed spread of the disease So daily cases now as we were seeing towards the end of last week at their highest level since May Hospitalizations in England are doubling every eight days and there are number the reproductive rate For the virus now stands at between 1.1 to 1.4 as of Friday. So Anticipation is that number will be rising the warning comes as well amid expectations that local restrictions could be extended to London Mayor city Khan was speaking the telegraph over the weekend will recommend Tightened rules on the capital later today is the expectation This will include then the potential for pushing people back to working from home if possible rather than going into the office Separately one of the other things that's come out is Rushi Sunak has indicated further support is needed to prevent large-scale business collapsing Plus job losses He is preparing to extend for loan programs that have already issued some 53 billion pounds of credit for companies through state guarantees according to the FT it still isn't Thought to believe that Sunak will extend the furlough program But he's preparing these other measures according to those close to the situation also as well as just last Tuesday I think the Chancellor gave a speech where he was saying that extending furlough is not the right situation One of the things that they fear here is that they're basically propping up I guess what you could call zombie jobs that are only there because companies are getting backstopped by the government paying for large proportion of people's salaries and that if that was to be removed then they would just fire them anyway, so Here I guess what the approach would appear to be is that there's a wave of job losses set to come then at the expiration of furlough at the end of October and so what he's looking to do then is provide extra credit facilities to a number of Companies so that they can still function and operate So yeah, there's seemingly then something to keep an eye on Not just in the UK, but Europe as well mainland Europe is experiencing equal size rises at the moment in COVID-19 cases Similar news I guess in regard to the virus AstraZeneca stated its vaccine trial in the US still remains on hold Remember that was thought to have come back in last Wednesday after we saw that previous weekend disruption Due to the halt in that trial still that I think that that's the real major thing at this point It's still relatively normal practice and procedure to see these types of halts to investigate As per what happens that particularly individual in question in the UK as response to those clinical trials, but Yeah, the COVID situation is worsening in important economic areas mainland Europe and the UK and depending on the severity of course of the types of Rollback of them moving back in towards more tighter more stringent lockdown Obviously is going to have repercussions then on the economic recovery of these countries in question So yeah, this will be a recurring a big thing. I'm sure throughout the week Sticking with the UK one of the other things that a lot of people are looking at on the calendar this week Is this chap? This is governor of the Bank of England Andrew Bailey, of course And he's going to be speaking a couple times this week But before that we did have the chief economist He spoke at the weekend Andy Haldane and he actually said that the UK is recovering faster than anyone expected Yeah, probably a little bit ill times just given the situation what's going on with COVID But that's beside the point that I think what Haldane is being used for here Which is a tactical approach by the Bank of England to manage and tame runaway expectations the Bank of England will immediately adopt negative interest rates and the way that Financial markets tend to react as we over interpret what central banks say This is just general human psychology. We take one little morsel of information and we run with it and obviously after the kind of The revealing of the progressive talks that they had been having Regulators about the mechanics of how the negative interest rates work It's about as close as we've got without inaction in negative rates that they were definitely heading toward that direction Potentially in the future. So for me, this is kind of Central banking 101 communication tactics you send out arguably the most hawkish member of your monetary policy committee Which is well known is Andy Haldane. He comes out talks the other side of the book just to make sure that Investors are kept honest And it doesn't get to a point where the Bank of England has to deliver that policy response That's definitely what they don't want to do They want to assure markets But they don't want markets to be priced so certain for a rate cut into negative territory that they then have to deliver It at fear of disappointing markets and causing, you know, a loss of confidence So I think I wouldn't read too much and over interpret Haldane's comments and what can we expect from Andrew Bailey, he's going to be speaking. He's giving two separate speeches on Tuesday and Thursday this week I would expect him to not really give away too much I would say that don't look for anything to explicit the appropriate hints that he wanted to Convey I guess from the Bank of England meeting have now been deployed So I would be looking for too much Additional guidance, but it will be something that will need to be watched quite closely and obviously would carry the propensity to move The sterling currency quite sharply Looking at the US this was one of the other things that Has come up as a bit of a talking point and probably will do so state side Because you might not have heard of Ginsburg But the death of Supreme Court Associate Justice Ginsburg Has opened another front in the election battle with President Trump intending to make a nomination in the week ahead So this is about then the potential to have a more let's say Trump Conservative Political alignment in terms of the positioning and nomination of the candidate he would want to put forward Which could then have a knock-on repercussion of being more beneficial for him should as we expect then the mail-in ballot process of going into a US election the result is unlikely to be known for a number of weeks There's probably lots going to be lots of legal action about contesting over certain Results over certain states and so having a Supreme Court Associate justice in his favor is going to be much more beneficial for the prospect of him potentially winning the US election So he's very much going to be on it and it's already been a dominant theme over the weekend And one of the things that I think this could be then is is it going to detract from what was looking like some slight progress in? Stimulus talks in America where you had you've got this kind of Ongoing debate and we've seen some movement But the lights of Pelosi for example still standing pat at 2.2 trillion And that being too much what the Republicans want at this point in time But are they going to be now distracted given the legal consequence and the repercussion this could have on the overall outcome of the election over this particular Vacancy now in this role To give you a bit of idea Lisa Murkowski and Susan Collins have come out against pre-election confirmation of a nominee and they are two Republican senators Opposition from two more GOP senators would put brakes on the process So just in terms of what to look out for on how to interpret the news I'll be aware of that I'm just having a quick look at the US equities at the moment I did see technically I was looking on some daily charts this morning and we have got beneath what I thought was quite a key area Which is this trend line going back to April We've had a test a couple times in May in June and then some of the recent price activity through the earlier part of SEP and a failed break on the 17th last Thursday So we've gapped below there and that does that trend line kind of map the 50 DMA very closely Which would be in a key level of near-term technical relevance. So here now It does look quite interesting from a potential For a little bit of a short-term push on the downside here thirty two eighty four and a half would be that high point From the peak before the intensification of trade tensions with China And I think below there on the week if we did push lower down Thirty two thirty one and a quarter would bring in that previous recovery high we had in mid-June That was an area of resistance as well. You can see in mid-July as well Would be a target and then down to thirty two hundred and thirty one ninety two if that were to continue as a trend The NASDAQ similarly has come to quite an interesting point on the chart from a daily continuation point of view and I was looking here at Really this Rectangles that I've colored which was an area of previous resistance and support which the market has respected really on a number of occasions through July August and September it's kind of been like this area of which the market either Fails to get above or if it breaks it really does start to move then to the upside and interestingly we At the reopening of trade open just below what had been a key area of support You can see even more recently in the month of September on three previous occasions So be interested to see how you perform here. I mean technically then it does Mean that the NASDAQ could be susceptible to some deeper moves to the downside I'd probably be then looking at around 10,000 514 then 10 to 96 which starts to bring in those previous highs that we've seen in June which also Comes up to that EU COVID fear low that we saw on the progressive developments that we saw at the in Spain and the likes at the end of July So definitely I'd say equities a little bit susceptible here potentially for some downside Not so much North American COVID related, but if stimulus is there's a lack of stimulus still coming at the moment If people just losing a little bit of confidence Let's say on the global level because you came Europe COVID situation is worsening It certainly could be quite interesting to keep an eye on those those levels and if the trade war Starts to ratchet up a few notches again. It certainly could act as a bit of a catalyst A few other headlines just to be aware of this one. I don't think it's really major But definitely something perhaps to be aware of And this is the ECB is to review its flagship Bomb buying tool in fighting COVID crisis Basically debate on the length of the PEP program and on transferring its flexibility to other asset purchase schemes So this this could have I guess More dovish connotations about transferring it to other asset purchase schemes I if you think about the asset purchase program, could it be as flexible as this kind of pandemic response PEP? Process but it's probably too early to say this is just a review stage But something to just be aware of it's not really having any meaningful impact this morning A few other things on the weather front. We continue to see a particularly busy Hurricane period at the moment and the one we're focusing on here is a new one in the Gulf tropical storm beta And if we actually look at the the details here, you can see it's right in quite a key and sensitive area as far as the energy markets are concerned So the slow expected the expected slow motion of beta will produce a long duration rainfall event from the middle of Texan Coast to southern Louisiana There is the danger of life-threatening storm surge near times of high tide Through Tuesday along portions of the Texas Louisiana coasts within the storm surge warning areas So by the looks of it at the moment doesn't look quite to the intensity of some of the others that we've had of late But certainly just warrants keeping half an eye on at the moment And then just quickly looking and reviewing the overall candor for the week There are a few other things to be aware of so today is particularly quiet overall There really is not a great deal on the docket coming out as per usual really on the Monday And then as far as weekend headlines were concerned although I've covered quite a lot I wouldn't say there's one singular smoking gun that's going to mean the market's gonna go in either direction at this point There's just a lot of more kind of nuanced sensitive news flow coming out But Tuesday then we get Bank of England Bailey Speaking at the British Chamber of Commerce webinar, so that'd be the first of his speeches And then we've got feds chair Powell testifying to the house of financial services panels So this is quite an interesting one drone Powell is going to sit alongside the Treasury Secretary Stephen Mnuchin They will brief a congressional committee on the effectiveness of policies inactive to combat combat economic effects of COVID-19 Now markets may look for hints as to whether further fiscal stimulus measures are likely in the near term And if not, then how the Fed might react in that type of situation So definitely that'd be one that warrants watching as well. That's gonna be a 330 London time When we get round to Tuesday So again, you've got Bailey and power interestingly if you actually look just a quick glance across the counter for the week You've got feds Evans on Tuesday Powell on Wednesday You've got Evans and Rosengren on Wednesday Powell then to the house panel on Wednesday as well You've got feds Evans discussing the economy and monetary policy again on Thursday. So there's a lot of feds speak This isn't uncommon. They have just obviously unveiled a new policy tweak in the form of average inflation targeting And so it's they generally like to shoo that in and smooth it over in terms of its market Delivery or an interpretation of that new tool So I would be looking for too much from them But it's something to be mindful of and I guess that point of Look if stimulus doesn't come. What are you going to do about it? Is there going to be anything else that you can do support the economy as far as these politicians will be concerned? Moving on elsewhere Tuesday the other other highlights You've got existing home sales coming out the Fed Richmond Fed manufacturing But then moving on to Wednesday arguably then the most important as far as Europe is concerned Because then we start getting into the key focus which will be an update on the September confidence readings You get the flash PMIs. You've also this week. Got the German iPhone Reading so these will be particularly meaningful when we get to early Wednesday morning trade Manufacturing service PMIs. These are the flash readings, of course We also get the same out of the UK and the US later on Going into Thursday, then you get that German iPhone reading And then if we skip further into that afternoon, we then get Bailey's next speech and then Power and Managing testifying towards the Senate Banking Committee So they're really going to be a main feature throughout the week and in Friday is relatively quiet The only thing looking out for is durable goods orders One of the other things I'd say just to be aware of on Tuesday I know it generates a lot of media attention But Tesla have their annual shareholder meeting on Tuesday followed by their battery technology day So I am absolutely certain that Elon Musk will come out with a new Dance move or a new something that will see their shares go through an extreme period Probably a volatility So it's worth just keeping an eye out for that if you're monitoring that type of Stock and then finally on the calendar point of view for Brexit Gone but not forgotten. I'm afraid in formal talks between the UK and EU's negotiators will continue This week, but next formal round of talks is not until next week The UK government's internal market bill, of course will remain in the detailed committee early Next week in terms of getting its approvals another vote in the House of Commons lays ahead However, media reports suggest the PM now has done a deal with the rebel MP. So should ensure its its passage at this point in time And that's it. So yeah, any questions at all? Feel free to just drop me a line in the comment section. I'm always happy to help More videos coming of course Tomorrow, so I'll see you then. Good luck for today and this week. All the best


Emergency workers worked around the wreckage of a bus on Tuesday after a city bus-carrying tourist to a campground crashed off an overpass near Venice in northern Italy, killing at least 20 people. The bus veered off the road and fell close to railway lines in the district of Mestre, which is connected to Venice by a bridge, the cause of the accident was still unclear. Sky Italia Television reported that 18 bodies had so far been dragged from the wreckage after the vehicle fell 15 meters on to. City lines and caught fire at around 7.45 p.m. local time, 17.45 GMT. It's an apocalyptic scene. I am speechless, Venice's Mayor Luigi Brugnero posted on X, formerly known as Twitter.


No, no. So basically, you don't plug the microphone in. Hold the microphone up to them with the cable plugged in. Okay. Oh, we don't have the cable. Yeah, but then I'll do voices for them. Okay, you really want to do that. Usually I'm the one who has a lame idea like that and you're like, no. You gotta ask them good questions, though. I gotta ask them good questions? Yeah, hold on. Ask them questions when I can read the answer from down there. Okay. Let me study each one. Alright, maybe we should just only do one of these. Hold on. I gotta study them some more. It's harder than Wikipedia. It's not as well written. Are you ready? No. This was your idea. Hold on. I gotta read it again just to be sure so it'll be smoother the more I study it. Okay. It'll come out better the more I know. So, Jose. Yes? What do you think of Scott's ridiculous plan for me to interview you as a statue? Well, you know, Scott is quite intelligent in his ways and I always need more people to interview me.  Finally, I have something to do. Thank you, Scott. So when you were living in San Antonio, what was your job before you joined government and other offices? I just managed a general store and sold the nice things to all the convention goers like Ricola and camera film and batteries and Red Bull, you know, helping the people out. You really want me to keep doing this? Yeah. How did you not sign the Texas Declaration of Independence? I did sign the Texas Declaration of Independence. And how did you feel about that?   Even though my name is Jose Antonio Navarro, I was surprisingly pro-Texas. So you did live through the American Civil War. How did you feel about the American Civil War, Jose? I didn't really care about that.  Didn't care about the Civil War that much. Didn't care about the Civil War? You had no thoughts at all on slavery, no thoughts at all on Texas being independent of all these states, not just the south? Well, yeah.  Those people over there, not Texas, fighting each other. I hope they just all died. It's all about Texas. Your accent is really interesting. Why do you sound like a New York Jew? Because I am a New York Jew in disguise. Yes, Jose. That's why I was fighting against those Mexicans. Antonio Navarro. What year were you born? 1795. What year did you die? 1871. Crap. You read that part already. Yes. Do you want to move on to another statue? I can do one more statue. Do we have to use this statue? No. We got to do the awesomest statue. The awesomest statue, the astronaut? Yes, the astronaut. So Edward Higgins White II. Yes. How is space? It is amazing. You have never been there. That is why I'm a greater person than you can ever hope to be. How is the temperature in space? It is cold. Cold as a witch's tit, but thankfully I was inside a Gemini space capsule when I was up there, and it was not cold inside the capsule. Well, it wasn't as cold as, say, New York in January. How do you feel about the circumstances of your death?    That is true. That is true. Going to space is a dangerous endeavor, and that is what makes me a badass. I took those risks. You would not even be daring enough to get into the capsule. I went in and went into space. Are you kidding? I spent most of my childhood wanting to go to space. In a fake space simulator.   There is a zipper in the space suit, which is kind of weird. Yes, that is for the sucking. So, Meldred, where did you get your nickname, Babe? Because, did you even say that on there? Meldred, Babe. Does it say where she got the nickname from? No, I asked. Why do you think I asked her that? Why would we interview someone? I want something that everyone already knows. You asked a question that people don't know the answer to. Where did Meldred get her nickname? I can't think of a funny answer for that right now. Maybe because it's I'm So Sexy. I don't know. All right, fine. What do you think of golf? Golf is the best sport that you can do after you're old and can't compete in real sports anymore like the Olympics. Biting commentary from Meldred Babe, did Rick's son, Zaharius? Yeah, even when I was mad old and had cancer, I was able to win at golf.  In 1932, in the Olympics, you won gold medals in Javelin and the 80-meter hurdles. That was because I was mad young still. How did you train for the high jump? By jumping a lot. I didn't have to go to work because women weren't allowed to work in those days. So I spent all my day running and jumping. How do you feel about the fact that you seem to be one of two women in this hall of heroes? I'm glad that in a state of Texas that there are at least two women, even though it's not 50% as it should be. Two is a vast improvement over the times when I was alive.  You can join the country club where I played golf and get great meals three times a day. Oh, yeah. What was the name of that country club? Big-ass place in the middle of Texas where they play golf because there's plenty of golf courses out here. All right. I think we're done with this. We should make this. Take this engine. You know a game we should make with it? High Fighter. CineStar. Run, coward. You can just see it on the horizon. Oh my God. And it comes for you. You've got to get to an asteroid and drop Marines to go mine it. Yeah. Like Marines are fighting.


Good afternoon. Yes, I'm Tim Jones from Christchurch Art Gallery, and I had the pleasure of spending six months in Bougainville in Papua New Guinea this year, so yay to Christchurch City Council for letting me go. Yay to VSA for sorting it all out. Six months and seven minutes to talk about it, so we'll whistle through this without further ado. That is a map of where Bougainville is, so that you can imagine where it is. It is the most extraordinarily beautiful place. It has fantastic scenery, fantastic beaches, fantastic people. It has active volcanoes which bubble away like that. That's Mount Bangana. It has the most amazingly rich cultural life, particularly song and dance and poetry and music and musical instruments and stories and oral histories. My project there was to gather oral histories. I'm not really talking about that now, but that's why I was there to set up a system for them to record their oral histories, which they were hitherto rather failing to do and they were under threat from the dominance of English and all the usual things. That is the town of Arawa, which is a sort of Australian mining town built in the 1960s and 70s, not terribly pretty and made even less pretty by the fact that for ten years they had a civil war there and so half the buildings in Arawa looked like that still because there's no money and various sort of political problems that surround the country, so tough place. The power supply was extremely intermittent. There were lots of power cuts and all the electricity came from diesel generators and half the time they weren't working or they ran out of diesel so the power was very intermittent. There was really only one internet provider and that was DigiCell. I don't remember any customer of DigiCell ever smiling as happily as... I don't think any customer of DigiCell ever smiled at all, but he looks pretty happy, but I wasn't. DigiCell run the show. They're based in Jamaica and they make a habit of offering their services in developing countries and their headquarters is actually in Ireland for tax purposes so you smell a rat. They offer these extraordinarily expensive and small data packages. There's one and so you can get right down to a 250 megabyte package and if you do the maths that is unbelievably expensive even by our standards, by local standards it's just unimaginable. Having said that, cell phone use is pretty widespread. Those are kids at the local high school photographing a fashion show, but they didn't have cell phones. They didn't really know about the internet. They didn't know what Wi-Fi was. The little database that I set up was made available to them on their phones using Wi-Fi, but they never used Wi-Fi. Nobody knew what Wi-Fi was. There is a bit of a web presence. That's the government's internet page, but talk about an echo chamber. There's a small elite of government people talking to each other, writing web pages for other government people to look at and precious few other people. Some of the things that annoyed me were things like even to get help on word, you have to go online. It's so annoying. Even to register your high score of playing solitaire, you have to go online. Why do you have to go online to do that? It's just nuts. Free basics is another whole seven minutes all to itself. Free basics is Facebook's. You can have a little bit of internet for nothing. The one thing you can have of course is Facebook plus a few other bits and pieces and they're free. It's supposed to be an on-ramp to the real internet, but in practice it isn't because the real internet isn't affordable. So you are stuck with what Facebook dishes out to you. A terrible poverty of information is the consequence. The only place you can get information is at the market. It means that the public library, which looks very pretty, doesn't have any computers in it, doesn't have any internet access.  Tourism and other businesses are absolutely stunted. There is a tourist company and there they are, but how do you make a booking? How do you email them? How do you phone them up? How do you arrange anything? It will be ages before they get back to you. So that's the situation. I then thought what are the consequences? What's the take-home message for New Zealand? I originally thought that, oh, I know what it means. You must keep your pages very lean and you must have great alt text and you must have pages that work on really slow connections. Then I thought, no, this is absolute nonsense. It's not like this at all. I turned my mind back to 2004, if you remember that document there, which recorded the important things that our then digital strategy needed were content, confidence and connection. Connection is just, you cannot imagine how disempowering and how poorly informed you are if the connection is non-existent or outside your budget. So in developed countries, it's very hard to see these children having a healthy informed prosperous future if they live lives starved of information. In developed countries we fret about too much information, just as we perhaps fret about eating too much food. But if you think too much of either is a problem, just wait until you have too little. Thank you very much.


The military. So with this video, I'm going to talk about five ways to get your PA school paid for. For our military options, one is not a military option. The way I did it, which is kind of a weird way to do it, definitely not the most common way to do it, the story of my life, is going to be last. Okay, so number one, the non-military option is the NHSC, the National Health Service Corps, which gives you $50,000 for a two-year commitment. And the way this works is that once you graduate from PA school, you take a job in a clinic or a hospital that serves an underserved population, such as refugees, rural patients, something like that, and you have a contract with that hospital or clinic for your salary, your benefits. So it's basically a normal PA job. And then in addition to that, you have your contract with the NHSC, which pays you $50,000 towards your student loans in addition to the salary and benefits that you receive from working at that hospital or clinic. So it's a pretty good deal, and the biggest advantage is, you're not in the military. You get to live and work in the United States and basically have a normal PA job without getting deployed and all that good stuff. The disadvantage is that $50,000 probably isn't enough to cover your tuition and living expenses for the entire duration of your PA school. And so most people probably will not have their student loans completely wiped out in that two-year commitment. Now I think you can actually do another two years for another $50,000 towards your loans, but I'm not certain about that. And the link in the description for this video will have much more information. Okay, number two, the HPSP, the Health Professions Scholarship Program. And that's just the first of many military-related acronyms. If anybody's been in the military, you know the military freaking loves acronyms. And this is just one. So get used to it. Anyway, the HPSP, the Health Professions Scholarship Program through the U.S. military or the U.S. Department of Veterans Affairs, something most people actually don't know about, is that you can do this and be active duty military, or you can work for the VA. I personally think this is the best deal on this list if you can get into it, because I know spots are limited. So this program pays completely for your PA school tuition, books, materials, and gives you a housing stipend so you can have money to live on for rent, food, and things like that while you're completing your PA school.  Really as long as you're on the scholarship, that's how long of a commitment you make to the military. And you commit to serving that time in the U.S. Army, the Navy, or the Air Force. Or you can work as a PA for the VA, the U.S. Department of Veterans Affairs, at a location determined by the VA. And of course, if you choose the military option, you become a commissioned officer and you have to go through ODS, Officer Development School, but you can cross that bridge when you get there. And as a PA working for the VA, the Department of Veterans Affairs, you're not a commissioned officer in the United States military. You're just a civilian working for the VA. But like I said, it's at a location determined by the VA so they can put you anywhere. And most likely it's going to be a place that they can't really find providers to go to, so that's why they're offering you the scholarship. So it could be somewhere super desirable, like, you know, Hawaii, New York, Miami, whatever. Or it could be the middle of Idaho. Not hating on Idaho, but you know what I mean? It could be anywhere and it's not up to you. It's up to the VA. And so the only real disadvantage of the VA option is that since the VA sends you anywhere they need you and not anywhere you want to go, you might have to spend two years living somewhere you don't really want to live. Of course, that applies as well to the active duty military option. It has the same disadvantage as the VA, plus you may have to get deployed on a ship or even in a war zone or something like that. And you have to be active duty military, which could be a good thing or it could be a bad thing just depending on who you are and how much you want to serve your country and how much you like that lifestyle. But of course, the massive advantage here is that you're going to PA school for free and you're getting all of your expenses while you're in PA school covered. And so housing and food costs are things that people don't typically factor into the cost of their education. But even if you live in a cheap apartment or share house with some people, living expenses over two years can easily add 30 to $50,000 to your student loans. And depending on how bougie your lifestyle is during PA school, you may be closer to that extra $50,000 mark, which can add up really quickly. So having your tuition and living expenses completely covered during PA school is huge. And also unlike the NHSC, which you apply for while you're looking for a first job as a PA either during your last year, like I am, or once you graduate from PA school. So unlike the NHSC, the HPSP is something you apply for once you get accepted into PA school. So before you even start.  Okay. Number three, this is the military's loan repayment program. So this can be a really good option in two different situations. One, if you're in PA school or you've graduated from PA school and you want to serve in the military as a PA and you didn't get the HPSP scholarship, which like I said, there's very limited spots. So if you still want to be a PA in the military and you've graduated, this might be a good option for you. You can just talk to a military officer recruiter, specifically a military medical officer recruiter. And when they draft your contract, make sure to negotiate student loan repayments into that contract. Now, this right here is just a personal example from a friend I had while I was in the service. And this person came into the service with a ton of student debt. She actually went to medical school, but for certain reasons she didn't finish. So she wasn't a doctor, but she had all the student debt to pay back. And there was almost no way to do it. It was like hundreds of thousands of dollars. And so when she joined the military, she actually negotiated to have a lot of that debt paid back with the student loan repayment program in exchange for her GI bill. So basically they took the GI bill off her contract. She's not eligible for that benefit, but they added a lot of student loan repayment. I'm not promising that everybody can get this, but she was able to write that into her contract. So maybe you can as well. And what they can and can't do with contracts is determined by a huge number of factors. The military is a giant bureaucratic organization. So why they can and can't do things at certain times is really beyond me. And sometimes this makes no sense, but the worst they can say is no. So if this is something you're interested in, just talk to the recruiter. See if it's something that can be added to your contract is a student loan repayment. And if you're anything like my friend, number three can also work for you. Even if you didn't graduate from PA school and you're watching this video or maybe you never went to PA school and you just have a ton of student loans and you think the military would be a good option for you. This can work for you as well. I'm not saying this is for only medical officers. If you go in as an enlisted person, as any other officer, contracts are contracts and they can write in student loan repayment into any military contract. So you should probably ask your recruiter about that. And the worst they can say is no. Now the big differentiating factor here is whether or not you completed a bachelor's degree. If you did, you may be able to go in as an officer and have more responsibility, cooler jobs, potentially higher pay, things like that. But if you didn't, you can always enlist. And there's a lot of really good jobs on the enlisted side too. I can attest. But just make sure if student loan repayment is important to you, make sure it's in black and white. It's in that contract before you leave for bootcamp or OCS or ODS or any of that. Because once you're on that bus and that contract is signed, you are the property of the United States government. So make sure it's in your contract. Number four, and I said there's going to be more acronyms. Number four is the IPAP, the Inter-Service Physician Assistant Program, which is available to all active duty enlisted personnel. And then there's the MSCIPP, the Medical Service Corps in Service Procurement Program, which is only for active duty enlisted personnel in the Navy. So these programs are only for people who are currently serving in the US military in the enlisted ranks. And they're basically a way to have the military take you out of your enlisted job and pay you to go to PA school. So you remain on active duty with your full pay and benefits while you're a full-time PA student, which is a really, really good deal. And then, of course, once you graduate, they commission you as a medical officer in the United States Navy, Army, Air Force, whichever branch that you joined. And then you're just working in the military as a practicing PA on active duty. Now, if any of you watching this video is in the US military and you're enlisted, first off, thank you for your service. Second, you're eligible for this. And please see much more information about this program and the information for this video. I just very quickly mentioned the IPAP and the MSCIPP because it's just so specialized. And it's not really for most people watching this video. But if that is you, definitely see more information because this is an amazing program. And finally, number five, how I ended up getting my tuition for my post back and my PA school and all my living expenses completely paid for. And that is the GI Bill. The GI Bill is an educational benefit that every honorably discharged US military veteran is eligible for and it's amazing.  The post 9-11 GI Bill gives you 36 months of tuition, a yearly book allowance and a monthly housing stipend that's proportional to the cost of living in the area where your school is located. So if you're going to school in the middle of Nova, Ohio, your housing stipend might be a little bit lower than if you're going to school in Manhattan or Hawaii or San Francisco or one of those really high cost of living areas.  And so anyway, my post back was about nine months. My PA school is 24 months. And if you do the math, that basically means I still have three months on my GI Bill benefits to get training in whatever it is I feel like and everything that I've done so far has been completely covered. Tuition, housing expenses, food, books, everything. I've been able to go to school for post back and my PA school completely debt-free and I'll be graduating completely debt-free, which is incredible. And also just like I mentioned in number two, going to school knowing that you're not racking up student debt and having money for housing and food is amazing. And it really takes a lot of stress away during grad school where there's enough stress as it is. So taking that little bit of financial stress away really makes a difference. It's kind of like being one of those really lucky people who have a rich family, except your rich family is America. So if you're currently in the military and you want to get out and go to PA school, this is an option for you. If you're not currently in the military and you want to go to PA school or any grad school, but you just don't see yourself taking out another $100,000 or more in student debt, this is an option for you. It's definitely not a fast track to becoming a PA because this option is going into the military doing something other than being a PA. But it could work out for you in the end exactly like it did for me. And like I said, if you have a bachelor's degree, the officer route might be good for you. If you don't have a bachelor's degree or even if you do, you can always enlist. I mean, I enlisted after college. Maybe I could have gone the officer route, maybe not, but I ended up enlisting and it was a pretty good experience overall. You know, no complaints. And another thing, if you enlist, you can select a medical job like a US Navy corpsman, which is just the most bad job on the planet. And you can rack up thousands and thousands of high quality patient care experience while you're serving your country, getting paid, possibly traveling, learning to have a greater work ethic and discipline. And of course, earning that GI bill that you can later use for PA school once your enlistment is up. So especially some of the younger folks watching this video, this could be an incredible option for you. You know, spend four or five years in the military, get that amazing experience as a corpsman or an army medic, and then of course go to school for free, maybe knock out some bachelor's classes while you're enlisted. And I've heard of people getting out with like half a bachelor's degree or more from just one enlistment because the military pays for your college while you're in, if you have time to take courses. And that's not even using your GI bill benefits. That's using a whole different benefit that I'm not talking about right now. So if you're a younger person or even if you're not, this is an amazing option to get your bachelor's and your master's basically for free and also rack up lots of high quality PCE hours in the process. And hey, if you're enlisted, you might just qualify for the IPAP or the MSC IPP, like I mentioned earlier. So what I ended up doing in hindsight probably isn't the most efficient way to do it, but it worked out really well for me. I could have probably gone officer. There were a few reasons I chose to enlist. I enlisted in the Navy and signed up to be a corpsman. The enlisted medical job in the Navy that can serve a role similar to kind of a medical assistant or an LPN, or they can go out in the field and be attached to a Marine unit and be a combat medic. But during boot camp, I actually ended up getting recruited by the US Navy Presidential Ceremony Guard, which was really cool, and spent a couple of years basically marching around Washington DC, doing really high visibility ceremonies, and then eventually coordinating those ceremonies and being in kind of a logistics leadership role, and then eventually getting sent to Hawaii to complete the rest of my enlistment. So like I said, life is good. It ended up working out for me. Anyway, guys, that's the video. I really hope you learned something. I really hope you got some good ideas out of it. And for more information on all these programs that I mentioned and some programs that I didn't have time to mention, take a look at the info for this video just down below. Please like this video, share this video, subscribe to my channel. Please help me get to 1,000 subscribers. And of course, ask me any questions you have for me down in the comments below, and I'll do my best to answer as many as I can. If you'd like to get my help personally with your PA school application, just go to BorisThePA.com, click on the services tab and book whatever service is best for you. Follow me on Instagram to keep up with my day-to-day, more like week-to-week life. I don't post every single day, but if you wanna see what I'm doing, that's where I put it, and I'll see you in the next video. So in this video, I'm gonna, oh, all right, that's a little better. Yeah.


Conventional nano-channel sensors are passively responsive and may be slowly damaged by analytes present in the environment before detection. Here, authors developed a light-controlled inert active-switchable biomimetic nano-channel sensor to achieve SO2 on-demand detection and long-term preservation. This article was authored by Dan Zhong, Yongqiao Sun, Chih-Chao Wang, and others.


All right, I think we get started. If this is not loud enough, let me know. Just remind me of it. I hope it works. And if anything should not be large enough, also just let me know I can always zoom in. But I hope this should all work out. So I'm here today because I am releasing the first real release of Enzyme, which is a tool I've been working on for, I think, two or three years now. And I'm gonna go through what it is, what it does. And I wanted to check first, has anyone heard about the tool before? Because there is a released version already. Let's see a few hands going up, okay. And I'll try to also cover kind of a few basics of how wireless networks work and what some problems with the security of those networks are. You can always either interrupt me if something is completely unclear. And I think we'll also have a good amount of time for question and answer after this talk. So just a few things about me. I'm from Germany originally, but you can probably hear it. I did start the Greylock project back in 2009. We actually had a birthday party here in Vegas this year. It was 10 years ago. Then a company behind it in 2013 and moved from Hamburg in Germany to Houston in 2015, which was an interesting move for sure. Started Enzyme in 2017 and had an initial release in the same year. I think I released it around DerbyCon 2017. Used to be a software developer. Gonna make some people smile up front here because they used to be software developers together with me. I'm the CTO and the founder over at Greylock now. This word Greylock is gonna come up a few times. It's very important that I'm gonna show Greylock because that's the tool I'm obviously the most familiar with. You can possibly do the same things with an elk stack or a Splunk or something like that if you send the data into that instead of Greylock. So don't consider this a vendor talk or something. This is just the tool I'm obviously the most familiar with. And Enzyme is my site project. It's not affiliated with Greylock. I'm saying that because you should not expect the same level of support and help and everything that comes from a company like Greylock because it would probably be very easy to expect that. It's my site project. I'm personally, I'm a huge fan of site projects because when you make the transition from being a developer to being more of a manager and you're managing other engineers, it's very helpful to have something that you're still building yourself because it reminds you constantly of the challenges that software developers are facing and I think it helps a lot when you work together with them. So that kind of keeps me in the loop. The trick is to never have that actually interfere with what your real job is. So it's mostly a weekend, holiday, after work kind of thing when I really want to write some lines of code. I'm at underscore Leonard on Twitter. I was specifically asked to point out that my last name is Koopman and I'm not affiliated with SystemD either. That I was asked to say that. So I'm making this joke every single time. I'm starting to get tired of it myself but I spent a lot of time for the second picture that's about to come. This is Hamburg, moved from there. Did this. And then moved there to Houston. So we are, Greylog itself is based in Houston. I live in Houston. It's kind of a little bit of a background of what happened in the last years here. I'm going to go over just a quick introduction about what enzyme is, what it does and also what it's not. Few things about architecture, deployment, configuration. This is not going to be a tutorial. I just want to give you an impression of how you set it up and how it's architected. We're going to go over some detection methods, some threat hunting that you can do with it. And then I think the biggest part of this presentation today is going to be a live demo actually. And then after that we're going to have Q and A. I want to say a few things about what I really want to work on after this. So what's going to come after this initial release and where you can actually download it and all these fun things. So I tried to summarize this in one sentence and I ended up with this whole slide. So enzyme is an open source tool that reads Wi-Fi frames using network adapters.  You can put them in monitor mode and they will, it's almost like a promiscuous mode on a wired network interface where they're just going to read everything that comes in and you can use a TCP dump or wire shark or tools like that to read these frames that are going through the air. Enzyme is reading every single management frame that is going over the air and it is parsing it and it's sending it to a gray lock instance. Like I said, if you put a lock stash in the middle you can send that anywhere else too. And that means that you're going to end up with a repository of frames that were recorded in a lock management system that you can then later search over, filter, use for forensics, use for incident response because I think that if you catch someone who's walking around with a, I don't know, with a Wi-Fi pineapple or someone is actually targeting people very specifically in the parking lot, I think we're all struggling then with, okay, what are we going to do next, right? You know that, but what actually happened? Who did someone connect to it? Was only one specific device targeted? Was it just spraying SSIDs? Was hoping someone connects to it? This is something that you can do the moment you send this stuff into a lock management system. And that's pretty much what Enzyme used to do. That's what the currently released version of Enzyme does. This new release that is coming out now is also allowing you to raise alerts automatically. So it does things that are very similar to what I think what Kismet does. Why it's not Kismet is however on the next slide. It, you can run it on a Raspberry Pi, it comes with a web interface and it's not only employing, I would say these classic signature-based alerts of, well I'm expecting this SSID to only be served by access points with these MAC addresses and then when another MAC address pops up, I get an alert. It does that too, but I think that is so easy to evade that I don't think that's enough anymore. So it does a few more things that I'm going to go over in just a moment too. And then I always, I'm a big fan of having stuff that's easy to be deployed and easy to be configured. That's actually something that if you go out and you want to try this out, I'm very interested in where you, if you get stuck somewhere if something was confusing because I hope that the configuration is fairly easy. But then I wrote it, so for me it's fairly easy. I hope that it's also easy for you. I'm running this in production for a while now at home and in the office and we are over at the Blue Team Village. There's a sensor running under a table. It runs pretty stable and it runs really well on a Raspberry Pi 3. I'm also running it on one of the new Raspberry Pi's, the fours. That's better, it's going to be faster and especially for an environment like here where you just have a lot of stuff going on, a lot of devices, a lot of access points. If you can get a Raspberry Pi 4, that might be a good idea. Because what it's not, it is definitely not designed to have a low resource footprint. As in, I'm not saying I'm just wasting resources for fun, but it does a bunch of stuff that are simply resource intensive. That means that if you're looking for something that you can deploy on a tiny embedded system or something like that, this is not it. This needs probably around at least 256 megabytes of memory. Probably a good idea to have at least two CPU cores, like I said, runs on a Raspberry Pi, not gonna run on one of the small hack five devices, for example, that's probably not gonna be enough. And then it's also not designed to be used for any kind of war driving or reconnaissance tasks or something like that. It's supposed to be run stationary at one point, not be moved around a lot. It really likes to be in a somewhat predictable environment. I'm gonna show why in just a second. So it's also nothing with you. I had one feature request if we can hook up a GPS receiver into it, probably could, but the whole system is not designed to be used to walk around with basically. I have heard or I've found this interesting that red teams were interested to use it for recon, not for alerting necessarily, but to send, basically point a Yagi antenna or something at an object that they're looking at and just record a few hours of data and see what is usually connecting to what, what kind of devices do we have, what SSIDs are they looking for. I could totally see that and that would be something that would definitely work. I just, I've never heard this from more than one person so I'm not sure if that's actually the case or if there's better tools for that out there. This is a screenshot. So this is the web interface that comes with it. This is being served out of the same binary as Enzyme itself. So when you start it, it just tells you, hey, on this IP address in this port, you can reach the web interface. Supports TLS on top of it so you don't have to mess with like a proxy in front of it and I'm gonna show more of this in the live demo in just a second. This is a network detail page. You see here we're recording the beacon rate of this specific access point and the SSID that it's advertising and then we got a list of all the channels and you see that we have a, there's a red line that is the, that is the upper expected signal strength. We have a green line that's the lower expected signal strength and then we got the blue line that's the actual signal strength that we're receiving. Also more about that in just one second. The architecture in the end is pretty simple. You have the Enzyme process. That's the binary you're starting. That's connecting to a PostgreSQL database. That's where it's keeping state and also some information that it's using later for alerting and then to whatever box this is running on you're collecting, you're connecting at least one Wi-Fi interface that supports monitor mode. Works fantastic with the standard Alpha adapters. I think it works great with a Panda 5 and a Panda 6. Those are gonna work. You don't have to do anything as long as the interface is up. Enzyme is automatically gonna put it into monitor mode. It's gonna get a P-CAP handle on top of it and it's gonna start reading the frames that are coming off the air. I'm gonna show the configuration of this also in just a second. And then there's the Greylock cluster. This one is by the way that's optional. You can also start it simply not connected to Greylock. If you don't wanna have the part where it sends messages into Greylock, that's fine. You don't need to do that. Then just leave that configuration out and it's just gonna run and everything's locally and you don't have this long-term repository of frames basically, which is completely fine. Depends on your use case. If you wanna try this out, maybe download the Greylock OVA or an Elkstack or Splunk or whatever you have already sent it in there and just see what you get out of it. Really interested in the use cases that you also find for this. I said this was not gonna be a tutorial but I just wanted to show you that this is literally all you have to do to get it running on a Raspberry Pi.  That's what it's written in. You're downloading the depth file, you're installing it, you're changing the configuration file and you start it. That's all you have to do. It's gonna tell you when it starts up, it's gonna tell you where to point your browser at, you configure the interface that it's gonna listen on in the configuration file and that's all you need to do. That's how fast it is usually. And it's one other important thing which I might remember later on but that's really the steps that you need to do to deploy it. I'm wondering where the, oh yeah, split this up. So going through the detection methods that it has out of the box, these are these really, really classic alerts. There's an unexpected MAC address that's serving our network. It's serving it with an unexpected security setting, serving it on an unexpected channel or there is an access point that is serving in an unexpected SSID. What you have to do is you tell enzyme in the configuration file, that's the screenshot down there. You basically give it a list of its networks, that's this array there that's defined there and you tell it, okay, this is one network, this is its SSID, this is the channels it's usually running on, this is the security that I'm expecting on it and these are the BSSID, so the station MAC address is basically that it's being served from.  It does everything behind the scenes automatically for you. Do you see the fingerprints in there? I'm gonna explain that also in just a second. I'm calling this anomaly detection, it's not, I mean this is a little like standing and telling you about AI and next-gen security. It basically looks at a sliding window of what the signal strength was and the moment the signal strength deviates from its expected value too much or for too long, it's gonna raise an alert. This could be that after we record for a day what this access point up there usually reaches our enzyme sensor with from a signal strength perspective. If someone is spoofing that from across the hallway even if they're perfectly spoofing it, it's really hard to spoof the signal strength. So you're gonna have in between all these expected frames there's gonna be perfectly spoofed frames that have a much different signal strength and enzyme is trying to figure this out and is trying to find those and it's gonna automatically for all the networks that you defined as your networks in that configuration file, it's gonna run in the background constantly checking if there's like anything going on with a weird signal strength. That is still fairly experimental because I wanna see how it works in the real world if you try it out. It has worked pretty well for me so far but there are some tuning parameters.  So you have to tune these parameters a little and just see how the data behaves. But I've tried it out. I walked in the garden with a raspberry pipe, turned that thing on, came back, alert was there, signal strength anomaly. So it can work. I wanna hear how it actually works for you in practice if you wanna try it out. So just consider it experimental for now. The other one is an unexpected beacon rate. So we're constantly recording how many beacons we're getting from per station or per access point. If someone will go in and would start to very aggressively send its own beacons that would raise this beacon rate even if the frames are, again, if they are really well spoofed, the beacon rate would change and Graylock would also alert on that on a threshold basis. For this, it's not trying to do this automatically for you. You give it a threshold, you say this is how many beacons we're usually seeing and then the moment it crosses over there for too long you're getting an alert. That works really well. It depends a little on the access point that you're using. If the access point starts to change the beacon rate a lot then you might be out of luck for that. But for those that I've tried it with so far it worked really well. Then there's fingerprinting. That is something that is the most interesting part, I think, of the new version of enzyme. So what happens is that when we receive a beacon frame or probe response frames, those are the true frame types that are really advertising in network. So this access point up there is constantly sending beacon frames saying, I am here, these are my settings, this is how you connect to me, this is my SSID, and this is how on your phone, for example, the list of access points and range is being built. Appropriate response is when your phone asks for, hey, is this network in range? Then this device might reply and say like, yes, I'm here and it can connect. So these are the true frame types that are advertising in network and they have in their payload. If you look at Wireshark and you look at the details in the payload there is a part of the payload that's called attack parameters. And attack parameters are stuff like, hey, I'm this access point and I'm operating on these frequencies. I'm using these channels. So don't even try to connect on other channels. There's stuff in it like this is my regulatory domain. I'm in the North American regulatory domain, so I'm not even gonna be on, I believe, channel 14. These are my security settings. These are my encryption options, all of that. And that usually doesn't change. And if you take that, parse it out and basically hash the result of all of that, you get a fingerprint. And this fingerprint is actually very, very, very, very different per device. So I've not yet seen the fingerprint been the same twice or have seen a collision, which means that this device over there has a fingerprint like what you see over there and we can identify it by that. Now every other device from the same vendor with the same firmware on the same chipset and the same network settings is also gonna have the same fingerprint. But we can now say, okay, for my network, I'm expecting this fingerprint. If I'm seeing another fingerprint, this is simply a different hardware, different chipset, a different firmware that is trying to advertise my network here. That is certainly not good. And the cool thing is that you can actually fingerprint known bad devices. So a pineapple nano management access point, that's its fingerprint. And I've not seen that anywhere else yet. That is only a Wi-Fi pineapple nano management access point. So it comes with a list of, I believe, probably six or seven of these devices that it automatically identifies. So if someone should own a Wi-Fi pineapple in this room, I challenge you to later turn that on when we're in the demo. It should immediately pop up and say, there's a Wi-Fi pineapple somewhere around here. It does that also for de-author boards. For that one, I'm still trying to see if that's really the de-author or if it's just the ESP-8266 chip on it. I think there might be some false positives on that one. But it works with Wi-Fi Fisher, the pineapple nano and the pineapple, like the larger one, the tetra or whatever they call it. It will identify those automatically before you when someone turns them on. But we'll see that in the demo. Then there's deception. That's one more thing they've built into it. Which is basically, if you add another Wi-Fi adapter, that also supports packet injection or frame injection, which there's a list in the README that tells you which ones do. And most of the alphas in the pandas do, so it's no longer a problem. Enzyme is actually going to start sending probe requests. So Enzyme is gonna act like an iPhone, for example, and saying, hey, I'm looking for these networks. Is any of those in range? And none of those networks actually exist. You configure them like this, and you basically say, fake this transmitter MAC address and start looking for these SSIDs. If anything replies to that, that's not good, because those don't exist. There's no legit reason for anything to reply to that. Except if you're at an airport, then you might sniff up a United Wi-Fi sometimes. But if you're somewhere in the middle of nowhere and off, it's probably not gonna happen. And you can craft these SSIDs in a way that you might even attract attention of an attacker. Like, for example, you could fake an high-risk employee iPhone. You look for the corporate network of three different locations in San Francisco, somewhere in Asia and somewhere in New York City. You're looking for all the airport lounges, and you're looking for all the United Wi-Fis and all of that stuff. And for an attacker, when that person spins up, his attack platform, it's gonna see like, this is a very interesting phone. Let's see if we can answer to some of those, except none of those actually exist, you know? So if that happens, that is a pretty clear indication that someone's trying to lure someone to connect to a rogue access point. For this to work, that's all you need to do. That's in the enzyme conflict file. You basically just tell it what's the device name of the device that's sending, which channels you wanna send on, and then you define these, I call it traps. You're literally setting up traps of non-legit networks, and if anyone starts interacting with that, now you wanna go in your log management system and see, okay, who is that? What's the signal strength? Is that person moving? Has that person been here before? Who else is he targeting? You can do all those things. So that's when it really starts to come together. And then you can, of course, I think I talked about this a little bit already. If an attack was detected, you could use a log management system like Greylock and go in and figure out what exactly happened. Who connected to this? Was this very targeted, or was someone just spraying responses and beacons hoping that something happens? So we're gonna do a live demo. Here we go. My friend up here in the first row probably knows that I spent most of the time in software projects finding background images for login pages. It's kind of what I do. So it's fully authenticated. If you dive into the code, you'll see that a lot of it is weirdly similar to how Greylock is architected. So it's very similar. It's fully authenticated. Enzyme is basically spinning up REST APIs that you can only connect to if you have a token. Token is exchanged here during login. And so you can interact with it through APIs too because this is really just a React JavaScript-based web application that's just firing out REST requests.  So if I log in here, what you're seeing basically, hi, here we go. There's the alerts. I expected that if I start this up in here, I'll probably get an alert or two. So this is all running locally because I turned off pretty much all the network on this device here earlier today. So I only have these charts look weird because I started up, I shut it down. And then I think we have about half an hour of constant data going on here right now. But what you see is we've collected about 83,000 wireless frames so far. We're seeing about 428 distinct clients right now and about 238 access points. I don't think that there's actually 238 access points in range because what we see here already, these are the active alerts. We see all these known fingerprints. If I click on one, this one, for example, you'll see that the SSID Bravo, which is one of those, I don't know, I only see those during DEF CON, one of those that around here was advertised by one of these D-Authing boards. It just detected that, spins up and sees, I know that fingerprint, that's no good. And we see it was on Channel 11. We get an antenna signal here and we also see that that's the fingerprint of the device that does it. I think we're getting pretty much flooded here right now with this, which I expected, honestly. But we can go into Greylog and see what exactly it is. This one here, for example, is Wi-Fi, Pineapple, Nano or Tetra. For those two, we can't really distinguish which one it is, but it's definitely one of the attack frames, which means it's a beacon that comes out of the Pineapple firmware frame injection, which is this one here, which I think from the SSID, we can see that this is probably really not a legitimate network we want to connect to, right? So that's the overview here. We see here, this is the channels that we're currently looping over. When it's highlighted blue, that means that the adapter is currently tuned to that channel. So you see life, kind of, which channels we're currently hopping over. We see how many malformed frames we're getting per channel and then we also see how many different frame types we're getting and as expected, we're getting mostly beacons and probe responses and then a bunch of de-auth frames, obviously, in this environment. To click on networks, I'm getting a list of all the wireless networks that are currently in range. Earlier when I turned it on here, I figured out we do support emojis. So someone is advertising an emoji network, so that works. We got this list here of all the networks. And if I click on one, so let's say, Caesar's Resorts. Click on it. That's loading all the channels that are in this network. You see this one is only active on channel 11. We're gonna receive two frames though, so that's boring. Let's see if we got another one. Caesar's Resorts, take this one. Click on it, we see on channel six here, we got about two and a half thousand frames that were recorded. Click on that. And then we're getting, oops. Then we're getting, this is when I started it, so it's only have a few minutes of data here. But you see per channel, you're basically getting the signal strength, what the expected signal strength was. You see the fingerprints that we see on this channel, so that's this specific access point. You see the expected signal quality. All of this is here. If I click on the system status, you'll see that we see which alerts are currently configured. You see that we would be warned if there's an unexpected BSSID, SSID or channel or fingerprint, would be warned if the crypto settings on one of our network suddenly changes. If there's a known fingerprint around here, unexpected signal print, fingerprint signal anomaly and also the beacon rate anomaly. This system, this environment here is actually so noisy that I can't, no, it stopped. All right, currently do not have any active alerts left. So they also stop. The moment the same alert is no longer seen, they disappear from that list. So this is a good moment. If someone has a pineapple, we're gonna turn that on now. This should pop up here then in just a moment. Then if we go back, I think someone turned it on for a moment because we're seeing a pretty good spike in access points. So that is simply someone using random MAC addresses probably, which then identifies a different access point all the time. So that's what we're seeing here. Now if I go into gray log, you'll see that this data is coming in here. If I click on a view, I can say, okay, I wanna get my summary of all the data that comes out of enzyme. You'll see that I'm getting a histogram here of how many deauthentication frames we've seen, how many distinct devices that were transmitting deauthentication frames. Get an overview here of the frames and subtypes that we're seeing. So there's a total number of frames that were recorded and then also which subtypes they were. So you see here we got a few malformed one, but then this association, association response, authentication, probe request, probe response, beacon. It kind of gives you an overview of what's currently going on in the environment. Then if I click on it, this is where it's now really starting to feel like this is a very long-term wire shark, you know? If I click on it, you'll see that, okay, we have recorded a probe request where this MAC address was looking for on the network alpha, which was this signal strength on this frequency. If I click on it, we're getting this broken down. Let me see if I can make this a little bigger. See, we'll see this broken down. And what I can do is I can now say, okay, I am interested in all the devices that are looking for the SSID alpha, okay? So what I can do, I can go in and I can say, okay, in my enzyme messages, show me everything from the last hour, where the subtype equals probe request and the SSID equals alpha. Execute that, this comes back immediately and now we get a list of all the probe requests for the SSID alpha. And let's say I want to get an overview of who requested this. So you'll see that we have a field here called transmitter. This is the IP address. This is the MAC address off the device that was asking for this network. And if I click on it, click on aggregate, and we're getting a list of all the MAC addresses that have probe request this SSID in the last hour. So you can click this stuff together like this. You can save it as a dashboard. You can create reports out of it, but it becomes a very, very powerful, really long-term PCAP that you can use for forensics. You can use for threat hunting. If you wanna check if something just deviates from what you'd usually see, you can go and you can run real forensics on long-term network data, which I think is a really powerful concept. And we can also go in and look at an alert summary. So this one here is now showing me when, how many alerts we got here. It shows me what the targets were. So you see here the SSIDs that were used in an attack. You can see here the types of the alerts. So you see that we had 18 alerts for known bad devices, which were 18 for Wi-Fi pineapples and five for a de-authentication board. And we had, where are we? Yeah, I think that is the types of devices that we are getting. And if we go in and we say we want to do that, we say we want to see this, this here, and also this one here, United Wi-Fi, there's someone already went into that trap, someone already triggered an alert because they responded to something that they really shouldn't be responding to. And I think we should be able to, second, see here that we're getting a alert type in here somewhere, alert type. You can aggregate that again. It's gonna give me a list of all the alert types. And there you go. We had 10 times someone trapped into the probe response trap, basically. So if I search for only that, we should be able to see when that happened and who did it, and here we go. That's the alert. This device responded to our probe request trap for CenturyLink, something for United Wi-Fi and for this fake corporate network. So you can use Greylock now or any other system to go in, get an overview of when the alerts happened, what they were about, then go deeper and investigate what exactly happened. And you can, of course, also add your own fingerprints in this list that it's constantly searching for. So if you have, I don't know, you have this one employee who's really unhappy with the Wi-Fi signal strength and they just bring their own access point, right? That has happened a few times in the past, I think. You can now just record that fingerprint of that, send an alert whenever that device is back online and you can use Greylock or anything else and just send out a text, send out an email and kind of just be alerted the moment someone turns that thing on. So there's probably also some operations use cases. I'm sure there's some red team use case for that and there's definitely a lot of Wi-Fi defense use cases for this. So that will be my quick live demo. Do not actually have any alerts right now, that's surprising. I have one more slide, I think there should be this one. That is right here. So the full release, as in the release that also has the documentation, the release that also has Debian packages, system descripts, all that fun stuff. It's happening probably on the next weekend. You can already build it yourself. It's on GitHub, that's the link down there. And you can try it out, it's on the version 1.00 branch. Like I said, it is, the software itself is done. It's just a few of the scripts around it, it still needs some testing and I simply don't want to release it in a hurry just to be able to send your link right here. So it's gonna take a few more days until you can release the full distribution. And if you don't want to forget about that, just follow me on Twitter, that's my handle there on the left. And then you should see a tweet when that thing is finally coming out in the next days. From a future roadmap perspective, so there's a few very clear things I think that need to be done. There's certainly more deception methods. I think the deception message also needs some more fine tuning because if you think about it, now an attacker could technically fingerprint us and figure out if that's a enzyme deception frame or not basically. So you wanna have a little bit of variance in there. Right now the beacon frequency or the frequency of sending these things is very stable and if you are a very sophisticated attacker, you might see that there's something going on. I do think, however, you're gonna trap a lot of people who are not expecting something like this to happen right now. But there's definitely, there's someone work that needs to be, that needs to go into that. Multi-note support, so right now it would be if you have a large campus and you can't cover everything with one enzyme node, obviously. You would spin multiple up. They don't really know about each other and they would all send their messages into Greylock. I kinda wanna get it to a point where you have one that's the leader and all the others are sending their frames into that one and that one then writes it up somewhere else to central alerting and can get smarter about when it alerts.  So that's definitely gonna come. And like I said, this is side project so I know this version's gonna come out over the next days. But something like multi-note support is nothing that's gonna happen the following week. So it's on GitHub, you're all more than invited to maybe contribute your own fingerprints. If you have devices out there, start fingerprinting them and send a pull request to get them in the list of known fingerprints. Try it out if you feel comfortable writing code, send pull requests for features, open tickets for stuff that you would like to see in it, stuff that doesn't work. So this is supposed to be a fully supported product. This is not something that you just throw out there and good luck. There's gonna be, I hope that there's community forming around it that keeps on improving it and it's not only me in my very spare free time. And I hope that that's gonna happen. So that will be my demo and my presentation and I think we have 15 minutes, 10, 15 minutes for Q and A if you have any questions, any feedback, any initial ideas? Yes. Sorry, got it pretty close. So the question was which adapters are supported by it and then also kind of how much space you can cover with the sensor. How much space you can cover really depends on your physical location. I had a demo labs last year for the previous version of Enzyme and there were people who said they deployed 20 of those across their campus. I think you ought to try it out and I think you want to reach a point where it has overlap where you have frames recorded multiple times because multiple Enzyme instances are picking them up. When it comes to supported devices so far, pretty much anything that works that you can put into monitor mode. So it's not specific to any device but you need to have a driver and a chip set that you can put into monitor mode. So if you have some experience with Kismet for example, I'm pretty sure that you can use the same adapter. And all those that I've tested so far work, there's a list in the documentation of tested devices that definitely work. I've seen it with several of the alphas that are the bigger ones and some of these more mobile ones, the Panda with an antenna, the Panda without an antenna. Everything that kind of works with P-CAP and monitor mode is gonna work because we really just interface with the P-CAP. So if P-CAP works, Enzyme is gonna work too. Any more questions? Okay, I'll be around at the Blue Team Village for the rest of the day but I'm also gonna hang out here for a moment if you have more questions. Try it out, follow me on Twitter so you see when the full, the easy to install release is coming out in the next days and I think that's it. Hope you enjoyed it.


You are looking at the 2018 R8 V10 Audi sports car I'm here now with Scott Keele was the president of Audi of America Scott We have to talk about what I think is the coolest feature of this beast laser headlights right here. Amen I couldn't agree more, you know Audi has been a leader in lighting technology as you know We started with daytime writing lights Then it went to LEDs full LEDs and we feel the next frontier of course is laser and what laser allows you to do other Than looking cool and sounding quite cool is it gives you a lot more power much further distance now There's only a limited number of these cars. We're testing them out But of course we anticipate these will be wildly successful and we'll expand them just like we did LED lights and the laser lights This is a feature you're not going to see on any other Audi which is only car on the road in America period that has lasers All right come with me this way stuff we do I want to show everyone the inside I'm going to open this door here It's absolutely incredible. This as you had mentioned is only one of 200 R8s made very exclusive And it's not surprising given the hundred and sixty five thousand dollar price tag Well, that's a bargain 165,000 for a car that has stunning horsepower in a v10 all of the carbon fiber one of the best driving cars on the road I think the other thing that's nice is you know a lot of people in this segment Of course have been going to downsizing in turbos We think what people want here is a naturally Aspirated engine which is what this is and of course it's a v10 power plant and as you said it can't be any more unique One of 200 vehicles the only use of laser lights in the country So we think a 165 is a bargain for this car We also want to point out that this is part of a broader effort to bring the Audi sport line of vehicles a high Performance line that's currently in Europe. You guys want to bring that to the US That's correct and look Audi sport at the end of the day is the brand that makes really cool Audi's really cooler and Usually our RS models, but of course the pinnacle of Audi sport and what we do best is the RA So that's the pinnacle and then of course we have the RS models over here But of course, you know you need a great name which is Audi sport and of course a great name needs a powerful logo So we've been using the red rhombus in our racing program for over 40 years And this is the logo that's on every RS model and of course it's an incredible car. Thank you so much. Thank you very much