Everybody today we are debating intelligent design on trial and this is a triple threat debate and we are starting right now. These in general have been thrilled to have you here for another epic debate as this is going to be a fun one folks. We haven't had a triple threat debate in a while but I can tell you that these are really fun. This is basically anything goes. So these guys they might tag team like they might in other words tag team up against the other guy or it might be more like sometimes we'll have kind of somebody's like eh well I kind of sympathize with that argument I don't know if this objection against that argument is actually very good even if I don't agree with the conclusion of the argument. So anything goes no holds barred and it is on intelligent design so this is going to be a lot of fun. If this is your first time here consider hitting that subscribe button as we have a lot more exciting debates coming up. In fact you'll see at the bottom right of your screen this Saturday Sargon versus Vosh is coming and it's going to be a huge one. Terrific very exciting. These guys are going to be debating immigration capitalism and socialism as well as transgenderism so it's going to be wild. I want to let you know for our guests today who we are honored to have with us their links are in the description so if you're listening and you're like hmm I like that that feels good you can find more of their content at those links down in the descriptions like that little description box just down there so. But very excited to have these guys here so Mac can you like I'm waving up at you can you I know so I'm waving upward I forgot Mac can't see me right now that's embarrassing I was trying to do the old like Brady bunch thing you know when they would like see it. So anyway we are going to be a lot of fun. I want to introduce these guys and then we'll jump right into it. It's like really flexible opening statements to the point where if they don't if they don't really want to do opening statements they want to jump into discussion right away. They can say I'll pass on the opening I just want to go into the discussion with that given that our dearest friend true empiricism takes the affirmative today will let him start but I do want to say it first thanks so much great skeptic or reacts and true empiricism just for being here guys it's a pleasure to have you it's a pleasure to be here thanks for the invite yeah absolutely so this is going to be really fun folks if you have a question fire that question in the live chat it'll make it easier for me to not miss it if you happen to put at modern day debate in that question chat so so folks true empiricism the floor is yours you've got like a flexible eight to ten minute opening statement you can take that if you need it and I probably won't need that well what I'm gonna do is I'm gonna give my argument really quick that way we can jump right into the discussion it'll be the same argument as last time premise one certain patterns in nature only known to come from an intelligent agent's premise to those patterns are observed inside of the cell conclusion therefore because those patterns are observed in the cell best explanation to hold to is that an intelligent agent was behind them and so right guys provocative daring very short into opening statement or yeah so gentlemen if you guys want to make an opening statement you can otherwise you can pounce untrue empiricism all righty cool yeah I'm no scientist I would like to just say real quick I'm Matt Clark I have the YouTube channel very skeptic and also the League of extraordinary atheists for humanism I my main focus is not evolution I do like to talk about an intelligent design because I think anyone who doesn't um agree on evolution then they just pretty much don't understand it because it's pretty it's pretty easy to understand but that doesn't make it easy to explain because there's so many facets and then it goes into such depth that it's easy to get kind of just kind of get lost and know which ways left which ways right which ways back which ways forth just because there's so many specimens and this is I understand it's hard to keep it straight sometimes but the premise is simple so I really hate the arguments where a dog will never producing on dog because that's completely absurd and correct a dog will never produce a non dog a dog will always produce a dog and it might just be a different kind of dog and they might not be able to produce with other kinds of dogs in the evolutionary chain because of speciation that's just evolution it's just it's a pretty easy concept so I'm just kind of here to do my best to set the record straight and just try to simplify the concepts because I don't think they're too hard but I understand that they can be confusing so I'm here for a good conversation you bet thanks so much absolutely um so I am oreax I am a comedic pagan so I believe in the Egyptian pantheon and I have a youtube channel as below where I will talk about the paganism in general that sort of thing but I'm here because regardless of religion you can take a a stance such as this where I believe in evolution and divorce that from the whole religion concept and all this you don't need religion you can believe in science in this case especially with this where it's demonstrable and that you can you can more prove that evolution is um by the scientific standard it is very much something that we can go and observe and see and see that for life especially there is no need for a creator in this aspect so that that's just all I have to say I didn't really have an opening statement you bet we can go into open conversation with that thanks guys okay so what about evolution do you guys believe makes an intelligent designer unnecessary I'm just the fact that it can happen that um I mean you can say it however you want we could we can use the term evolution that I agree with like largely um or just just like breeding like different breeds of dog they breed you can breed um you can breed them to be smaller and cuter and furrier um and somewhere down the line and it tends to happen to what with certain species that you can't go back so far and reproduce with different kinds of we'll say again dogs um but um you've had this with rabbits and also um insects um you'll see speciation occur um and it's that's like the simple part um just the fact that it can't happen and you can get variations within a species or through speciation um you get a ton of variety just naturally um in nature so that along with um like astronomy and just how star formation works you want to go back that far too we can um it just I don't really see a need for a god at all um it is not the the defining thing um that um makes me not believe in a god but I really don't see a need need for one in that argument I think we have enough evidence um showing how evolution works um that we just he just doesn't really need to be part of the this kind of conversation well there's a couple of things to know here the I actually uh bred wolves and the wolf dog hybrid since I was um very young Canadian gray wolves, timber wolves, tundra shepherds, Ikea, Siberian huskies, malamutes I've trained them the difference is between wolves and dogs is less than two tenths of one percent of the same DNA and um the it's very minuscule the difference is between what you see between even coyotes wolves and dogs it's just very minuscule um but I would say that if you're gonna believe that the continuation of those changes where you uh where you are suspecting that we had diverged from some sort of common ancestor you just as an example before chimpanzees and um and humans we supposedly diverged from a common ancestor a long time ago you're no longer dealing with those similarities in genes you're dealing with a difference of about 48 to 58 million nucleotides and so the similarities in between these different species that doesn't really really say anything to myself the question that I would have to ask is how do you account for those differences and um when you're talking about speciation events there's a lot of speciation events that happen um and that organism might not breed with one another because they may not have interests in one another or there might be a physical problem why they can't breed with one another like uh genes being repackaged but they tend to stay the same organism that they are and the anatomical changes there's no let me put it like this this this is the example that I typically bring up as to what my problem is with evolutionary theory okay there are a lot of mechanisms positive horizontal gene transfer vertical gene transfer gene duplication um mutation you name it but none of the mechanisms of evolution it seems like in any article that I've looked through or with any person that I've spoken to about the topic seem to be able to show that any of the mechanisms have been tested to show how these animal anatomical features can arise and so when you're talking about speciation events you're talking about differences between dogs and variation it doesn't answer the question it stays in the confines of variation dogs are still what they are even if they can't breed with one another it's a very subjective thing you can say well they're not breeding with one another because you perceive in your head they've diverged and they're going to continue to diverge and so they become something distinct but that doesn't get us to any sort of objective case as to whether or not we all share common ancestor with with uh with some group of organisms millions of years ago do you know what I'm trying to say and so my question is is how can you account for those major changes occurring what evidence can you show that there is a mechanism in evolution that has been tested to show that these changes can occur because I think if you're the word to claim that you know myself and an octopus and and um all canines and then all creatures share a common ancestor millions and millions of years ago that we need to at least know that there are mechanisms that have been tested to show that that is actually a possibility and so I'm going to use that as an example to segue into why I believe Intel was designed is the better explanation because we actually have a causal example of language for example that's obviously analogous to the dna code that would be talking about it's simply brought up by the proponents atp synthase and use that my last argument to what we consider a turbine these are attributes or or patterns that we know uniformly have come from an intelligent agent there's no opinion there these have always come from an agent we have a cause a causal linkage there but what with evolution is does that exist it seems to me that all we're looking at is similarities in an organism so uh just to just end it here I don't think that speciation is going to get us anywhere and I don't think that uh talking about variation within the dog species organisms that can breed with one another uh it can it's it can get us anywhere past a subjective perception you know what I mean because if you're if you're an evolutionist and you already are convinced of evolution for some reason and you you can connect dots all you want to say well these organisms look similar similar speciation means whatever you feel like it believes you know that it is but doesn't answer the question as to whether or not we all diverge from a common ancestor so some something um interesting to look at would be retroviruses as well and how they have um they do have the ability to go back and we're able to look at the ancestors um for example humans and examine the DNA that they have or that they had a time and compare that to the DNA that we currently have and we we see that there are large variations um within the DNA and how the human being is structured themselves based upon the information we have in the human genome right now I'm sorry say that again the variation in the human genome has been tested yeah so because we have um two variations of the human genome one from a retro virus and another one from uh our current understanding of the human genome as we understand humans right now uh you can compare the two and see uh major differences and mutations um and and the like of that so I don't know what I'm supposed to do with that I mean we do know that there's variation in endogenous retroviruses we've compared our genes with chimpanzees and I believe there is there's a mismatch data there because gorillas seem to have some closer relation in the endogenous retrovirus virus uh segments as well I believe so that really didn't make any sense because chimpanzees are supposed chimpanzees and humans supposed to diverge from one another but the the whole endogenous retrovirus topic and variation within humans I mean it does like again it doesn't really answer the question and we're going to say we diverge from a common ancestor millions of years ago pointing out similarities that we may have with endogenous retroviruses or similarities in anatomy or homologies we may share in proteins you can connect dots all you want it's going to be peridolia it's going to be pattern-seeking what I'm looking for is okay the claim is that if the changes continue to happen with an organism for millions of years right that organism is going species A is going to become distinct from whatever follows millions of years later right because small changes have accumulated right and so a lot of times not always but yes well so you're dealing with the differences so that's why I brought up chimpanzees and humans everybody points out 96 97 percent of the same DNA but it's the differences that that are important because it's the differences that were that that evolution is assume will happen if you allow the changes to continue over and over and over again it's how do we account for that are there articles that actually show mechanisms of being tested to account for uh those changes right because we can talk about variation all day long but it's it's I can get you can perceive that but if I look at variation I mean it's it's not going to do anything for me in an objective point of view do you hear what I'm saying if you already believe evolution is true and you're you're going to look at variation endogenous retroviruses or homologies or similarities I can get it how you can perceive that you can connect dots but from if we're talking about science science needs testable mechanisms and if the mechanisms of evolution haven't been tested to show this is actually a possibility then how can we say that it's actually a legitimate scientific theory then so there are different branches um of like the study of evolution uh one of my favorites is phylogeny um and this is something that aren't rock knows very very well because he has the phylogeny um explorer project um and I'm on this website right now because it really it really breaks down evolution in a digestible way to where you can see um how smaller closer to like single celled ancestors just evolve through the lines and how things evolve to other things but are still the previous things like we're all eukaryotes right um and again I'm no scientist myself evolution is not my main field of hoppy even but phylogeny is my answer because it um it is just a family tree it is it is like the evidence you're more or less looking for is the study of phylogeny it just shows you how everything is linked together and how we know that and it has um a ton of evolutionary um biologists um sending their information to this project um constantly um so I don't know if you've ever looked at phylogeny I have um I wouldn't use Zyronarvally as as a source maybe Ken Miller or something I've spoken to Zyronar and he doesn't really know a lot of the things that he passionately speaks about there's a video on my channel where I'm actually cross-examining him over a particular issue the ATP synthase that we refer to now and from his own admission he did he didn't have a good comprehensive understanding of it but even the phylogeny I mean he goes back to the peridolia issue phylogeny taxonomy I mean most of those materials are studied look at it like this like you'll see charts and you'll see this idea of this divergence where you see you know we all know the the chim the these diagrams where they show chimpanzees he's slowly walking up right then he got a modern human um or you know just these graphs that they show where fishes are diverging and he got amphibians and all these different creatures um the reality is is that these pictures of these these cartoon renderings that they show in these graphs that's not the real thing that you're looking at I mean most of the fossils that we see of of human beings and like Homo erectus Homo Archaic Homo Neanderthal then before that Australopithecus what you're looking at is a divergence of early humans and then you're looking at apes and I know we they like to consider as apes as well just hopefully I can get a little bit of charity so you guys get what I mean we get uh we got apes and then we get we got human beings early early homos obviously they're they're humans Homo erectus Archaic Neanderthal they're all humans then you got Australopithecus and some of the early apes over here what you're seeing is is what would look like a trans a transformation basically there's no transition there and even if you ask what the scientists say most of the bones that they that they're looking at they are completely manufactured here's what I mean by that they may only have a tooth half of a half of a skull they may have to use mere imaging techniques to get an idea of what the entire skeleton looked like but looking at the genome they assume that this these are humans and these are these are early apes and that's not all but you know all the time but the point is what I'm trying to say is that these renderings that you get these cartoon renderings or these graphs that you get that's not the case the second point that I'm trying to to make is that these uh that all we're really seeing in the fossil record especially when we're looking at human beings and uh and the early apes is we're looking at what appears to be chimpanzee or orangutan like creatures or gorilla like creatures and then you see a diversity of what we could we would consider human beings and so when you're when you're dealing with it with with phylogeny and taxonomy it's a very funny thing because anybody can point out I mean I believe they said that 98 percent of all 98 99 percent of all species that ever existed are hercestines so it's very easy for people to randomly point out some species that we've never heard of before with a very scientific sounding name and categorize it based on this like I mentioned this peridolia and so I guess the problem is is that we're stuck in and and the question that I that I that I asked you of earlier is how do we leave the confines of this subjective perception of lining up similarities and homologies and because anybody can do that you can do that with cars you can do that with motorcycles skateboards and I assume because of their similar parts they all diverge from a wheel a long time ago right I'm not interested in that I'm interested in the claim of evolution that the small variations and changes will accumulate to the point to where they will become a distinctive change and that's that's how these major differences occur right small variations lead up they accumulate then you have these major changes can the mechanisms of evolution deal with it can the mechanisms of evolution build these anatomical differences that we see between birds and wolves and human beings if that answer can be at that question the answer to that question can be can be answered I think that we can we can definitely get somewhere but similarities is just subjective we can't do anything with the similarities so what part of what part of birds do you have an issue with like do you have an issue with finches and chickens being related at all or are you are you not convinced that velociraptors had feathers or what's oh no no I'm not trying to get where is it disconnect for all I'm trying to say all I'm trying to say is like I can grant you that velociraptors had feathers it wouldn't matter to me it could have been a creature that had feathers that looked reptilian or like a dinosaur with feathers that we know that there's all sorts of bizarre creatures on this planet that have been alive and that are extinct and exists now today doesn't really matter to me if there's a bizarre creature like that that exists you can do whatever you want with that but when I look at the fossil record we'll say on this issue of phylogeny the reality is is that this idea that people have of there's a small there's a gradual changes that have happened throughout the fossil record is not true look at the mammalian radiation look at the Cambrian era where all the major phyler are there the chordates the echinoderms and and so on there's no evidence of divergence there even when you look at the pre cambrian you only see some fauna and some cyanobacteria a couple of other little stray organisms there but we don't even know how all the major phyla have have actually come into existence that's according to the fossil record if you want the fossil record there's these little spurts of air of time framed where we have no evidence of divergence for many many creatures so what i'm trying to say here is that if we look at the fossil record we can't really do anything with that anyways but there's all sorts of there's all sorts of problems here when we're just staying stuck on the confines of similarities right because i don't care of what if there's an organism out there that that is bizarre or that might have similar features to another it if you are an evolutionist and you believe evolution is true and you connect dots in your head and say this creature looks similar this one this one doesn't have as many of the similar traits to this organism push this a little further down all that is is peridolia it's like you're looking in the clouds and seeing faces in the clouds cars in the clouds i can perceive the same thing that you're perceiving i get what you think in your head by looking at that but that's not how science works science is supposed to have tested mechanisms but i mean or reacts do you want to so something that i that i wanted to get on is you said that evolution is the is uh is relatively similar you made the analogy that it's like um i'm like motorcycles and cars and we can connect the dots like that that watch i mean a lot of the issues with that in that analogy would be that you those aren't reproducing at all and we have no example of that with when it comes to biology and evolution we have examples of changes happening to these creatures over time you know whether you want to say a short time or a long time but we have examples of this within science um take the peppered moth for example we have you know evidence that it can change how uh how within a few decades of our time that these creatures change their appearance and how they look how they how they function in all of this it's completely it's completely just strange to refer to that to just saying well you're looking at clouds and seeing whatever you want to see in the clouds it's it's completely it's a completely different thing well that's actually not true at all what you mentioned was variation and i have no problem at the mc one arm mutation that allows for um for uh pale skin right here that that mutation that actually happened to develop the new traits with that trait you know whether they're not doing it cause people to be more prone to cancers at 4400 generations of pathogens that scientists were doing on bacteria or i'm sorry and their experiments we ended up finding out that they were they had depleted in and stature they became more prone to disease and illness and in many cases they were not even able to to debris any longer um the the fruit fly experiments where we've been doing experiments on them for the last hundred years increasing uh over 1500 times using x-ray machines we see the same thing there there's a decrease in stature they lose the uh a large percentage of their lifespan or they can't breed or they're they're formed born with some sort of deformity and so you can sit over here and talk all day long about while variation happens it seems like the evidence is showing that the accumulation of changes have taken too far the opposite of evolution happens things seem seem to devolve they seem to lose their stature because i think that would make sense uh because if dna is a language or a code at least according to what the mainstream scientists say if you are copy for example the declaration of independence and maybe have a mistake once here or two there you know you can read it in some case you might even get a word that might uh not show up there but if you continue to do what it's going to get to the point to where your information is becoming unreadable and so i think that that's what we are scientifically observing what we're looking at uh what happens with uh with different um with different organisms that are constantly being overbred but let me make this point because i think this is very important here if you're going to claim that okay it's difference with organisms with living organisms because they can reproduce okay that's a claim that's an assertion okay that's good let's stay there what evidence do we have that shows that the accumulation of changes in any organism that has been able to produce has been able to develop any sort of major anatomical feature and since we're on the topic of intelligent design intelligent design is relevant here right intelligent design is if anybody can go to the design website to deal with the argument that i presented here that there are certain patterns in nature that are best explained by an intelligent cause and because those patterns are observed inside of the cell the best explanation is that it's come from an intelligent agent certain patterns not all patterns certain patterns language that's that's one topic you guys can hit on the ATP synthase that's a that's a molecular turbine with knowledge by mainstream scientists and um there's many other objects like that like the um the helicase the beta clamps i think that that those are some good examples as well just to be sure show me how any of these these these instantly can be go ahead or reacts so so from what i'm understanding here you are conceding that variation happens we we both agree that that happens then i would ask if you're saying that variation happens and within this variation you're also claiming that because of that they that these because these variations will stack up and they will have detrimental causes so even conceding this why do we have life at all if that's what happens if evolution uh macro uh micro sorry is continuing here then at what point would we not have any life because you you would have to like there would have to be some kind of thing that would stop this and it would have to go backwards at least at some point or wouldn't have to change at all but there's all sorts of genes and mechanisms side of the cell that actually help to help it to recover and to heal the pvt-7 gene for example the the there's all sorts of ways that the cell tries to heal itself and cope with mistakes when when they happen um apoptosis that's a good example um but uh i think that this is a bit of a right hearing you're going down i think that the question is is that whether or not evolutionary mechanisms via the continuation of changes in living organisms because you said that there's there's a difference here living organisms they can reproduce okay well yeah i agree with you they can reproduce after what what whatever organism that has reproduced they will continue to be that organism that has reproduced um but that's there's no problem there but once you start you're there's a different claim here that we're smuggling in well it's different with evolution because when they reproduce they don't just reproduce after their own kind and i'm not trying to get into the issue of kinds of species because i'm not a young earth creationist um but a dog wolves coyotes um um birds whatever they will continue to be that organism when they reproduce you're claiming that well no it's different here because somehow there's this play-doh effect that if it continues to happen there's going to be something else that's going going to emerge through millions of years okay that's an assertion that's a claim how do you prove that claim one sorry i missed a little bit of that but i think i get the i think i get the just of it though one thing i want to mention forgive me mac if you're able to let us or i should say gray skeptic if you're able to let us know when you do have to like if you can give us a heads up of uh like maybe like 10 minutes 15 minutes before you do have to go we'll probably jump into the q and a at that point but go ahead right now okay got you i have about 15 or 20 minutes now so so you know i think what we'll do is forgive me gray for cutting it again so sorry i know that's okay what we'll do is i'll give you a chance to respond and then um or yeah so if you were if you have like a pressing issue that you definitely want to get in we can let you jump in uh with a pithy response as well and then we'll probably go to q and a after that given that we let true empiricism start we'll let the opposition end if that works for you guys sure yeah right okay that works that works fine for me um so really this is kind of at at the premise of your thoughts here um i don't i don't agree with the um with the assertion that we just have the assertion of hey this looks like this list looks like this let's line it up and draw a picture uh because well that's just a picture that's not the real thing because of course yes no these are artistic um um takes on how we know to lighten to line things up because of bone structure because of dna because of location um and migration like we don't do it just because like oh this one kind of looks like this and this one kind of looks like this one it's not just guess work like biologically and just how we line things up in evolution that's just not how it's done that's not how scientists and then you know that you know that you've said that that's that's not um that's not how science is done but that's not how we science we don't just take guesses we don't just go by visuals we um a lot a lot of fossils are found actually by migration patterns we can we can determine where missing links and quotations are uh because we know how uh species moved and we know um different earth um ages like ice ages and stuff so so we know a lot about migration we can we can determine where things um may have went we go there we find it it's a different variation of maybe the same species or from that at the same evolutionary line um and it's really interesting that we can do that because it's not just just guesswork it's science we use we use different things um to find this evidence that then supports what we were looking for these these missing links so oriax if you want to bounce off of that or anything else um i just want to state that uh just because there are two hypotheses uh just because one explains the phenomenon doesn't mean it sound or falsifies the other hypothesis so the other thing to keep in mind is when we're talking about a scientific theory uh models of this theory work because it is predictive and the other thing would be if the other side is not a predictive model then why should i take it over evolution i think that's what i'll end on there you've there's been a lot of predictions of evolution that's actually failed hold on one sec just to just to forgive me just because gray skeptic let me know that he has got to leave or a little bit early uh is i think we'll probably go to q and a so sorry to do that to your true empiricism i know you've got a a round in the chamber ready to fire out but just uh just because we want to be able to ask any questions toward uh gray skeptic before he does have to leave yesterday was really awkward where kent hovind he always he likes short debate times and so he left before we got to read all the questions and it was like hate when that happens but and not not that nothing against you gray skeptic so sorry um it's just that i love to get to ask the people while they're here so thanks so much steven seen thanks for your sick super chat he said four days since i've seen james i'm in heavy withdrawal nasty guy just like his sister stupid horror energy thanks steven seen for your other super chat who said over under number people thinking of speciating with modern day debate that's disgusting okay pride steven's thanks for your patreon question he said has true empiricism looked into genetic algorithms which mimic biological evolution and achieve complex goals completely through randomness i guess i have and usually what they have to do is they got to set the thing in motion for it to start in any way being creative to begin with so i think it's it's all in the underlying program before they kick things off so that doesn't work there's actually a lot of examples out there of why that fails it's too much for me to get into here now but uh people who are listening just go ahead and you probably find the information very easily if you just google it got you i've looked into it you got it vik ramsey thanks for your question they asked question for the id person his name is on the screen uh for the id person before you can discover intelligent design don't you need to have a designer if no designer is discovered then isn't id presupposing a conclusion without evidence wow i mean the creation is what indicates a creator it's if you follow the mind of reasoning that i gave out in my argument that it would logically follow that there was a creator it's if you're finding an instrument you know it's just based on our uniform experience if you're finding objects that are only known to come from an intelligent agent and and they're observed inside of the cell what do you think the best inference is i mean we could put it like this i mean i think the best way for people to understand how an abductive type of perception should be imagine if you had a this is basically i go as imagine if you were sick you had a cold or a flu maybe you don't know that you have a cold or a flu but you based on the symptoms you infer that you have a cold or a flu and so i think that that's maybe a better way that to help people understand it maybe they don't get the argument as it's laid out i don't know how you can't but um creation indicates a creator i think that there are fingerprints of design that we're seeing inside of nature and those very clear fingerprints of design is what indicates that there's a creator it's we're not working in reverse i don't know how anybody can even think that gotcha thanks so much nice up i'm just oh wait j shy thanks for your super chat just came in they said true it's not just similarities it's the pattern of both similarities and differences in all caps they said showing a twin nested hierarchy which can only be explained by common descent uh so in basically what they're saying is true it's not just similarities it's a pattern of both similarities and differences showing a twin nested hierarchy which can only be explained by common descent and we have fossils we have fossil genes as proof how do you like them apples true empiricism well i i mean that that's an assertion i mean if if the differences are counted for by evolution i'd like to see it um i i haven't seen it yet maybe he can give you some more money and put up another comment there and let us know what what it is that he thinks you know proves his point we do have subtracted all up in your face they asked are snowflakes intelligently designed by your logic oh that's that's dealing with the issue of complexity not not a causal pattern right i'm not i'm not arguing complexity i'm arguing for here's an object we know for a fact this object has always come from an intelligent agent in the past um so because that object has come from an intelligent agent in the past that is uh that is the reason why we infer it was it came from a designer because when you talk about complexity it's just that's subjective too i don't want to get into complexity i'm so no i mean snowflakes i don't know how anybody would say they're complex they're they got a pretty makeup to them but i wouldn't even consider them complex gotcha so are we we have no questions for we have no questions for gray skeptic or oriax if you do have a question for them shoot it in a live chat we'll try to get through it i'm surprised literally none so i'm sorry wilson thanks for your question they said for true empiricism how are you sure that quote-unquote intelligent design must be related to the god of the bible and not a god such as as uh forgive me if i mispronounce this as a thought the blind idiot nuclear chaos well um that that was something that i wanted to hit on earlier the bible intelligent design and religion are separate from one another the intelligent design doesn't attempt to prove god or any specific religious belief that's why there are scientists on the id side that actually are agnostic or don't believe in christianity at all i'd say that there are separate arguments that can be made that you can reduce to a conclusion to christianity the the enormous amount of historical evidence out there supporting uh uh jesus christ and the crucifixion there's antithonal reasons as well there's a lot of philosophical reasons out there um that can narrow non-theism but i wouldn't say that intelligent design would prove christianity or any god specifically how can you do that um if we're only trying to point out and you know that there's intelligent causation you know that you're you're seeing tell tale marks of the designer of a designer you don't have that name there so i don't think that scientifically speaking well um you can really prove any god just specifically by talking about intelligent design i think it's just a very neutral position to take gotcha brian stevens does have a question for grace skeptic and oriax what evidence would increase your belief in creationism maybe i need to think about that um to increase well i can i can give you one sec because i did want to plug tomorrow jim majors will be debating his father darth dawkins or now as he goes by dunkin atheism do want to mention that to you in case you had not heard about that tomorrow is going to be a barn burner as jim majors confronts his father on video so really exciting and uh but go ahead so i'll let you answer the question thank you so not not only would there need to be um evidence of a creator that is beyond a shadow of a doubt you would then have to conclude that a that the creator whoever whatever however that would be would then have to have something to do with the design of not only the world but the creation itself and the life that lives on planet earth gotcha thanks so much let's see we just had ask grace skeptic what was the first organism and what did it turn what did it form into and how so oria i suppose oriax if you want to as well this is from cameron p thanks for your question yeah um it was small and it turned into something a little less small um it uh just duplicated um but it was still very small it's the best answer i can give you and be completely honest no problemo oriax if you want to you can add or if you have a different even account you can say that as well um i don't know a biogenesis is something i know a little about and uh won't claim to know anything uh i i would imagine though um from what i know it would be probably some kind of small single salt organism probably bacteria something or the rather and uh then it just kind of uh went from there again i i don't know i'm not really a scientist so i don't know much about a biogenesis you got it thanks so much next subtracted thanks for your super chat they said what mechanism does intelligent design have to offer so what mechanism well i'd say that the mechanism is intelligence intelligence is the driving force if you if you don't have that ability that deterministic foresight to understand this component goes here here and here so that you can develop that object um you're not going to be able to make it so a mechanism is basically the driving force and so since intelligence that thought process that ability to think and to understand how to be creative is that necessary driving force obviously intelligence would be the mechanism um so yeah i'd say intelligence would be the mechanism you got it arne rurvik let me know if i mispronounce that thanks for your super chat question they said question for true empiricism eating through the same hole as breathing is pretty stupid no shouldn't you call it stupid design well if you call it if you you can say that it's bad design but bad design does not equal not to design right i got it like this example a lot my Volvo has the car in the trunk and it's powered by electricity and so you lose the key you can't get it you know can't get it uh open so that you can uh um you know charge the battery it's a dumb design i don't know why they built it like that but that doesn't mean it's not designed we know for a fact the car was created just um there's a criticism there so i mean bad design doesn't equal not design and um got you as my thank you and shay ar forgive me i'm so sorry i did miss your super chat you were right i went i pulled up the tab and i found it question for oreax how many impossible burgers do you have to eat to grow gun nipples i i i don't know why you keep asking me this question i i don't know i don't know the context of this question i don't have an answer wait me asking it or no no ar i don't know why ar keeps asking this question okay gotcha i don't either i don't answer i don't know what it means i don't know i have no idea i think it's i i don't know they kept wanting to ask me this question but i don't have the answer for it i i don't know thank you will uh just to sorry respect your time gray skeptic i know you've got to go pretty soon are you uh at that like two minute warning or even less yeah that's probably fair is about two minutes okay we'll try to read through these really quick uh just maybe a couple more okay i'm sorry to inconvenience everyone no no that's totally understandable like i i my presumption is that well even if it's not family i totally understand you guys have got a lot to do and so we're happy to have you here at at all but let's see i know you guys have got a lot going on and arm rovick just sent a super chat and thanks for your question he said are you calling god a quote unquote bad engineer true empiricism i'm just responding to his statements if i were to acknowledge it for what it is just grant it it doesn't logically follow it and tell us that there wasn't an intelligent design and you can criticize what you subjectively perceive to be bad design all day long it's the bad design exists all over the place but it doesn't mean not to design so it just doesn't follow gotcha next up thanks so much sebella shepherd i always wonder is she trying to troll you or is she a legit fan she says is ronnie having an aftershow oh uh yeah i guess i'll probably do an aftershow maybe for a little bit not not too long gotcha i only ask because they use your real name so i'm like letting it out okay next up we'll try to do one more so let's see emotionally scented emoticon thanks for your question they said for te what does he mean by quote unquote new anatomical features when evolution works primarily by modifying existing features does the evolution of brassica count and why or why not we can narrow down specifically to what i what i mentioned earlier just the differences that you're finding in the organisms i don't care about the similarities those differences what would be a new feature in relation to what it what what what the ancestors were right i mean for humans for example we were to continue to breed and then somehow millions of years in the future we gave birth to some or some sort of organism arise that was distinctly different than what we are whatever made it distinctly different according to evolutionists was the end result of accumulated changes producing new information to build whatever new traits that organism had and so you can just narrow down what i mean by new feature to the differences that we're finding in organisms so that's what i that's what i mean by that those differences or if you if you know if you want to claim that something new could arise a new feature can arise up some sort of i'm feeling to entertain that but that's what i mean i'm talking about differences how can we account for those differences gotcha vibrant brandy has one for you gray skeptic if if you gotta go it's okay but if i can ask this one for you gray since it's specific go for it thanks for your question vibrant brandy they said what would you think if you came across a watchmaker dead on a beach it's undeniable that watchmaker had to be designed what are your thoughts about that statement whoa um that's a good question i think i would be um probably a little grossed out because i kind of hate dead things um so other than that yeah i think i'd probably just uh call some professionals and not try to to guess anything because uh i probably wouldn't search the body for evidence gotcha thanks so much and then one last one because arne is coming after you true empiricism he said why are you dodging true empiricism why am i dodging what am i dodging he asked apparently he wasn't satisfied with your answer to the question of whether or not you're calling god a bad designer a bad designer um i mean no i mean i'm not calling god a bad designer at all i didn't say that anything that god did was a bad design he did i'm just saying okay let's grant it does that mean that the design argument is is invalid because you're criticizing that design no obviously that doesn't logically follow it's a bad it's a bad bad argument gosh yeah so thank you very much gentlemen for being here want to remind everybody their links are in the description so if you're like great skeptic looking just foxy you can always click on his link and see more of his beautiful face we're too kind want to say we appreciate everybody being here whether you be christian atheist democrat republican you name it no matter where you're from no matter what walk of life we hope you feel welcome and with that want to just say one last thank you to our speakers for being here it's a pleasure guys we know you get a lot of channels out there to go on and so we appreciate you spending your time with us thank you you betcha and thanks yep and uh thanks everyone for uh for watching tonight it was nice thank you yes it was very nice to be here always a pleasure gentlemen take care and keep sifting out the reasonable from the unreasonable everybody


Thank you. Thanks for coming. I know it's an early start. Good morning and welcome to smashing the state machine, the true potential of web race conditions. Have you ever seen a vulnerability that made absolutely no sense? Something that didn't just leave you wondering why would anyone code that, but asking how is it even possible to write code that has that effect? Maybe you even got hold of the code and stared at it for hours and it still made no sense. And perhaps if you showed it to somebody else, they'd say something like, oh, it must be a race condition. In this session, I'm going to share with you tools and techniques to discover and exploit that kind of race condition. Let's start by surveying what we do understand, what race conditions have you seen or exploited in the wild. Maybe things like reusing a single-use voucher multiple times or bypassing some kind of rate limit or reviewing a single product multiple times. One of my favorite ones that I found is I noticed that you can reuse a valid single recapture solution multiple times within a short time window. And when I reported that to Google, they were like, oh, yeah, that's not good, but, well, unfortunately, our system is so distributed that we can't patch this. So that technique still works on a bunch of websites today. But all of these examples could be classed as limit overruns, right? They're all about doing something more times than you're supposed to. But if you go digging through every post that you can find on this topic, you'll land on one called race conditions on the web by Joseph Frankovich. And in this post, he describes four vulnerabilities. And three of them are regular limit overruns. And one of them is different. The vulnerability that he found took two months just for him and Facebook's security team to figure out how to replicate it. And the issue was that sometimes when changing your email, Facebook would put two confirmation codes for two different addresses using two different parameter names in a single email. Now, I had no idea what was happening here. And I don't think they did either. But one thing was clear. This wasn't a limit overrun vulnerability. And so last September, six years after I first read that blog post, I decided to try and figure out what happened. And gradually came to realize that the race condition attacks that we all know and love already are just toy vulnerabilities compared with what else is out there. So in this session, I'm going to show you the true potential of this attack class, tools and techniques to achieve this potential, and case studies and a live demo to show some of the insanity that's out there waiting for you to discover it. After that, I'll share where things can be taken further, how to prevent these attacks, and the key takeaways leaving five minutes for questions. On certain slides, you'll see there's a mortarboard icon. And that just means I've designed a free online replica of this vulnerability and published it in the Web Security Academy. So you can practice exploiting that vulnerability on a live system for yourself. Now, to communicate the true potential of this attack class, I'm going to use a multi-step vulnerability that I discovered by accident a while back. I noticed that when I logged into this website, it asked me to select a role before proceeding to the application. So I thought, okay, if I visualize the state machine for the user's role, it looks something like this. And well, maybe we can just jump from the role selection page to the back end without choosing a role and get some kind of privilege escalation going. And I tried that and it didn't work. And I thought, well, I guess it's secure then. I mean, look at that diagram. It looks pretty secure, right? But the diagram was actually wrong. It's missing a state because it's not zoomed in enough because it's assuming that the GET request to the role selection page doesn't change the application state. And as it so happened for reasons that I don't entirely understand, the applications was creating every session with administrative privileges and then the GET request was revoking those privileges. So by failing to zoom in, I almost missed quite a serious vulnerability. But, you know, that's just my bad, right? Because everyone knows that multi-step sequences are a wonderful source for all kinds of serious vulnerabilities and so it's essential to always zoom in as much as possible and test every possible permutation of a process like this. But researching race conditions, I found myself looking back at this finding and thinking, well, is that the furthest that we can zoom in? Or can we go further still? What if the application had dropped our privileges immediately using a second database statement? There would still be maybe one millisecond time window where every session had administrator privileges, but I would never have discovered it. And that's a little bit of a scary thought because, well, any login form could have that vulnerability. It doesn't need to be a multi-step login. And actually, worse than that, it shows any HTTP request might be transitioning the application through invisible, vulnerable substates like that one. And these could potentially lead to some serious attacks. In other words, we all know that multi-step sequences are really dangerous. And with race conditions, everything is potentially multi-step. That is the true potential of web race conditions and now it's time to start hacking some stuff. To discover a sub-state, we need a collision. That means we need two requests, one to trigger the sub-state or the race window and another that accesses the same resource at the same time. So in the example we just saw, that might mean trying to log in and access the admin panel simultaneously. However, there's a major barrier to making this happen which has plagued this attack class ever since it was invented pretty much, which is network jitter which randomly delays our requests inconsistently, meaning that the race windows don't line up and the vulnerabilities don't get discovered. To solve this problem, I've developed the single packet attack which lets you make 20 to 30 HTTP requests arrive at the server simultaneously, regardless of how bad the network jitter is on your connection. Under the hood, this technique is all about TCP and HTTP. The previously best known technique was called last byte synchronization. And it takes advantage of the fact that web servers generally won't start to process a request until the whole request has arrived. So with last byte sync, you withhold the final byte of each request and that makes the final packet of each request nice and small and it makes the jitter not quite so bad, but it only goes so far. But a couple years back, I read an academic white paper called Timeless Timing Attacks and there they noticed that with HTTP 2, you can actually stuff two entire requests into a single TCP packet. And they used that for timing attacks which was pretty cool. But I was wondering, well, can we adapt this and use it for race conditions? There's only one barrier here, really, which is to find a race condition reliably thanks to factors like server side jitter. We need more than two requests. So what I did was I took these two techniques and smushed them together to create the single packet attack which completes 20 to 30 requests in a single packet, eliminating network jitter. And I've just released this in an update to the open source tool turbo intruder. Now, this technique, frankly, is pretty obvious. And I was like, this is so obvious. I wonder if anyone else has already done it. And I googled and it turns out someone else implemented something quite similar for a master's project back in 2020 but nobody noticed. So why am I so excited about this technique? Well, it's because this isn't just some cool implementation trick. After refining this technique over months of research, it now works on all major web servers. I can still fit the entire algorithm on a single slide. And ultimately, it brings insane performance in a parcel that's so easy to implement, I think it will end up in all major web testing tools. The reason it's so easy to implement is that thanks to some creative abuse of Nagel's algorithm, which is in all operating system network stacks, you don't need to code a custom TCP or TLS stack. You can just take a HP2 library and bolt this feature onto the site. If you're tempted to make your own version, I'd say go for it. And I think Golang's HP2 stack is probably one of the easiest to extend in that manner. And I'm really looking forward to seeing where other people take this technique in the future because it can definitely be developed further. But of course, the thing I'm most excited about is the performance. So to benchmark this technique, I repeatedly sent a batch of 20 requests from Melbourne to Dublin, and I measured the gap in the execution time stamp of the first and last requests to reach the server in each batch. In other words, how close together the whole batch landed. And using last byte sync, I saw a median spread of four milliseconds and a standard deviation of three, which is, to be honest, not that bad. It's better than I expected. I think that's because I had data centers at both ends of this benchmark. And if you were using Australian consumer broadband, you might have a different experience. And then I retried it with a single packet attack and saw a median spread of one millisecond and a standard deviation of 0.3. In other words, the majority of these 20 requests traveling 17,000 kilometers were getting executed in the same millisecond on the target server. In terms of what that means in practice, well, you could say, okay, it makes this technique 4 to 10 times more effective than last byte sync. Or on one real vulnerability that I found, I was able to replicate the issue within 30 seconds using single packet attack and it took over two hours of automated attempts to replicate the same issue using last byte sync. In other words, if you want to kind of summarize this up in a little sound bite, I would say, by eliminating network jitter, the single packet attack makes remote race conditions local. Now that we've solved network jitter, it's time to go hunting for some bugs. Now limit overrun vulnerabilities, it's easy to find. You look for a limit, you try and overrun it. But going beyond that, things get a bit trickier. And after months of manual testing and discovering every possible pitfall, I've developed the following free state methodology to find these bugs reasonably efficiently. First, you predict where you might have potential collisions. Then you probe those places to identify clues that there's a substrate there. And finally, you prove the concept by figuring out what happened and using that knowledge to build an exploit. Prediction is just about efficiency. In theory, because everything is multi-step, every single request is an arbitrary complex multi-step process, we ought to test every possible combination of end points on the entire website and any other websites that have the same back end. But that's not very practical. So instead, we're going to hone in on places likely to have collisions that have serious consequences. After doing that, we can further more rule out end points that don't have as much collision potential. So for example, two threads that are editing a single piece of data at the same time, that could be quite interesting. Whereas if the two threads are just depending to the same piece of data, that's less likely to have an interesting outcome. Similarly, you can ask, well, are these requests going to be editing the same record in the database? If the password reset system is storing tokens in the user's table, then if you do two resets for two different users at the same time, then two different rows of this table are going to be edited and you're not going to have a collision. Meanwhile, if it's a password reset system that maybe SMSes you a pin and it stores the pin in your session, then you can use your single session to do resets for two users and cause a collision and maybe something interesting will happen. Once you've built your requests, it's time to just take them and probe for clues. The essential thing here is that it's quite easy to fail to recognize a clue. So the first step is to benchmark the normal standard behavior of the application by sending your requests one at a time with a delay between each of them so you don't trigger any races and then you just resend them all at once using the single packet attack and look for anomalies, clues, any deviation from the behavior that you saw during the baseline. If you don't see any, it might mean that they're secure or it could just mean that you need to tune your attack timing which I'll talk more about in a case study later on. Finally, by this point, we should have found an anomaly so all you need to do, which is often the hardest part, is actually understand what happened, clean it up and replicate the behavior and explore the impact. Now, a word of warning here. Exploring the impact might sound kind of obvious but if you're doing this methodology right and being ambitious with it, you're going to run into some quite weird and unfamiliar behavior and as a result the path to maximum impact may be quite hard to find. So I would suggest thinking of the behavior you found as a structural weakness and looking throughout the application to find security relevant features that rely on that structure and also don't just stop and report the first exploit that you find. I actually made that mistake myself and lost out on around $5,000 of bug bounty as a result. So now we're going to take a look at a tiny slice of what you might find if you apply this approach in the wild. GitLab lets you invite unregistered users to administer projects via their email address and I thought, okay, sounds juicy, I'll test it. So as a baseline, I just invited one address six times. This created one invitation, one invitation email and caused six responses saying, say to success. When I re-sent these requests in one packet, we saw one site of success, five error messages and two emails. So we've got two clues that we've hit a race condition here. The first clue is obviously two emails from six requests is quite suspicious. And the other one is that the responses that we got differed from when we did the baseline. Note that if we hadn't done the baseline and we just looked at those responses, we probably wouldn't have spotted that second clue. So using that race, I was able to create multiple invitations with the same email address, which I first thought, well, that's nice but kind of useless. But I noticed that the page on GitLab that lists pending invitations only displays one invitation per email address because it doesn't think that multiple ones can exist. So you can make a kind of a low privileged invitation. And if an admin sees it and deletes it, it actually effectively says user, well, it says user was successfully removed from project and replaces it with a higher level invitation behind the scenes. Now, that impact isn't amazing because you need quite high privileges to exploit it in the first place, but it got my attention kind of focused on GitLab. And it left me wondering, well, maybe there's another angle that I can take that's a bit more deliberate and will achieve a more serious impact. Now, one approach to finding inspiration for these kinds of race conditions is to look to classic multi-step exploits and see if you can find a race condition adaption. So, for example, there's a classic exploit where you add an extra product to your basket somewhere in the payment validation process after taking it to checkout. And if you time that right, you can get the extra product for free. And I noticed that if you draw the state machine for GitLab's email verification process, it looks kind of similar. So maybe if we change our email address while GitLab is validating our previous email address, it will end up validating the wrong one. And that would be high impact because it would let me hijack administrator invitations intended for other users. So, I tried probing for this and it didn't get any clues or anomalies, but I noticed that the email change response was arriving after the confirmation response every single time. Presumably because changing email was a slower operation. So, it was possible that there was a race condition present, but I just wasn't lining the requests up correctly. And after some trial and error, I was able to fix this by sending the confirmation request 90 milliseconds after the email change. But that approach, although it did work on GitLab, it's not ideal because it rules out the single packet attack. And I later discovered an alternative approach that I think is better. Web servers often delay requests that are sent too quickly. And we can take advantage of that by sending a single packet which contains first the slow processing request followed by a load of dummy requests that trigger the right amount of delay server side and then finally the fast processing one at the end. So, using that technique, you can do a kind of staggered attack and because the delay is implemented for you, server side network jitter is not going to make that technique fail. Lining the race window up like this on GitLab revealed a massive clue. Sometimes the email confirmation token was sent to the wrong address. Unfortunately for me, although this looked really exciting, the misdirected code was only ever valid for confirming the already confirmed address and therefore it was useless. But it showed that there's at least one sub-state hidden inside GitLab's email change endpoint. And so it's worth digging further on that functionality. And I'm going to do this via means of a live demo on a remote server hosted in Ireland over the conference Wi-Fi. Cool. So here we have GitLab. And here I'm just going to show if I change my email address, then the new one I entered is just been set as pending because I have to click the confirmation link to prove that I own this email. So that's what we're going to be targeting. So let's see how it goes. I did test this earlier. It's not 100% reliable. So, okay. On this Wi-Fi it was, I mean it's never really 100% reliable to be honest. Okay. So first I'm going to probe for, I'm going to probe for clues. So I'm going to try and change my email to six different email addresses in the same millisecond using the single packet attack. And I'm going to get all of these emails. They're all going to me, but every email address is unique. So I'm going to send this. The responses should arrive all at once. Yeah. Good. And the first kind of tiny little hint that something interesting might be happening is in this X runtime header. So we can see the server process this request in 350 milliseconds. And for something that we know is sending an email, that's quite fast. It's almost like they're passing some data to a background thread. And the background thread is sent in the email. And as soon as you've got data being passed between different threads, race conditions become a lot more likely. So that's a nice little hint, but it's definitely not evidence that there's a vulnerability there, right? For evidence, I'm going to check my inbox and we'll see what we have. Okay. So we've got our eight confirmation emails. And if I scroll through these with a bit of, right, there we go. Okay. So here this was sent to demo six at ports with a dot net. Sorry, it was sent to demo four, but it's intended to confirm demo six. So this is our clue. This has been sent to the wrong address. But it's not a vulnerability because this link isn't actually going to work. It's just going to say the confirmation token is invalid because that confirmation token has been overwritten by one of the ones that came after it and for some other reasons. So we've completed the probe phase and now we're going to prove the vulnerability by switching to exploit. And this is where things get a little bit less reliable. So I'm just sending two requests in the single packet. One is setting an email address that goes to my inbox. And there's one setting spoofed at local host, which is obviously not supposed to go to my inbox. And there's just one other thing to mention here, this little line here. So in order for the misdirected confirmation token to ever be valid, you have to trigger GitLab's resend token functionality, which you can do by changing your email address to the same value twice in a row. And if you don't do that, the token is never valid. And it took me around two months to discover that. So I'm going to run this and if we're really lucky, we'll get a misdirected token. And if we're even luckier, the token will actually work. Okay. So that looks kind of promising. This is intended to go to spoofed at local host. And it went to me. The killer question is, is the link going to work? It does first time. I should have pretended it was always going to work first time. Cool. So yeah, that was that. So I originally found that vulnerability on gitlab.com. And I could not resist obtaining the email address albino waxed at gitlab.com. And you can view that email address on my profile if you can go there. But that shiny finding left me wondering about what the code looked like. And the vulnerable code starts out in a Ruby on Rails framework called device. And the problem is there's an inconsistency between how the system decides where to send the email and what to put inside it. The email is sent to an address stored in an instance variable which is passed directly to the thread that sends the message. Meanwhile, the body of the email is populated using data from a server side template engine fetched from the database. Which means that the data in the database can change in the meantime leading to this discrepancy. And the impact is quite significant. So as I mentioned, you can use this to hijack pending invitations intended for other people and just gain administrative access to random projects. But also GitLab can be used as an open ID provider by third party websites to create a sign in with GitLab button. And depending on how the third party website does that integration, this can enable a load of follow up attacks against that third party all the way up to arbitrary account hijacking if you're lucky. If you were to find this bug in a major open ID provider, it would be a pretty big deal. Now, I reported this to GitLab and they patched it pretty fast. And then I reported it to devise and things did not go so well. Over the span of 200 days, I reported to over four addresses and I received no reply from them until last week. And there's no patch available yet, but at least they've applied. So maybe there'll be a patch in. So I went hunting for other bug bounty sites using this library. And as it turns out, it's really popular. Her loads of rails based sites use it. It's really easy to fingerprint because it registers an unauthenticated endpoint slash users slash confirmation that you can just spot. And because of the way the library is written, every website integrates with it slightly differently. And as such, every exploitation journey is slightly different and it's great practice and good fun. So a couple of highlights that I encountered during this process were some sites had visible locking. They were obviously only processing one email change at a time. So they were secure. On another site, the confirmation email that they generated didn't tell you which address it was supposed to confirm. So there were no hints that the vulnerability was present and it was really unreliable on that site. So I had to write a script that would do the attack, receive the email pass it, click the link and reload my profile to work out which email address had actually been confirmed and then I had to run it for 14 hours to actually compromise another email. On a couple of other targets, their visible email change functionality is secure against this attack, but device registers a different hidden endpoint for triggering an email resend and that was still vulnerable. Now with that, let's move on from GitLab and device. So race conditions are weird and I've saved the weirdest one for last. This was another token misrouting floor but the two requests that triggered it could be sent with a 20-minute delay in between them. So you might be thinking well that doesn't look like a race condition but it was really unreliable so chances are it was and after some analysis what I think was happening is that my email change requests were getting put on a queue which was then being processed by a multi-threaded batch job once every 30 minutes or so. So the timing of my request was practically irrelevant and the vulnerability was triggered basically by my request volume rather than the timing and also the only reason I discovered it is because I noticed two emails were sent to the same address which over the course of this research due to things like this I've begun to regard spotting anomalies like that as the single most important skill for finding race conditions especially for deferred ones like this where the response the application sends to your actual request is never going to tell you a vulnerability is present because the vulnerability hasn't even been triggered yet. Now I focused on email based attacks during my research but where else can you find these things? Well basically everywhere but one pattern that you may well encounter is partial construction attacks. These occur when an object is created in multiple steps creating an insecure middle state like you can see in the code snippet here where this token variable is briefly not set. I didn't use this as a case study because I actually wrote this code myself about 10 years ago but it was not supposed to be vulnerable. Now this type of attack is most likely to work on applications that support default or null type values and don't just throw exceptions when they encounter them so you think SQL PHP but that's not a strict requirement and for a completely different type of partial construction attack check out the linked vulnerability found by Natalie Silvanovic in Google's WebRTC implementation in Duo. Now another angle for further research is exploring the root cause of race conditions from the ground up which is unsafe combinations of data structures and locking strategies. There's three main strategies that you'll run into. The classic defense is locking. So for example PHP's default session handler only processes one request at a time in a given session. So that means two things. Firstly they're not gonna have a session-based race condition but also if you try to trigger a database layer race condition using a single session you'll fail to find it every time. So it's important to recognize this behavior and work around it by doing things like using multiple sessions. The probably the most common approach that you'll see in session handlers and orms is batching. So this is where they read the entire session let's say from the database into a local in-memory copy and then any reads and writes that the application does during that request are applied to that local copy and the whole copy is written back to the database at the end of the request life cycle. So this makes the values internally consistent during that request life cycle but as we saw with device as soon as data gets passed to a background threat you kind of outside the scope of that protection and everything falls apart and also if you have two requests operating on the same record simultaneously then generally one will end up overwriting the database changes from the other. Finally if there's no defense present all the bets are off basically and you see that most commonly with databases where people aren't making adequate uses of transactions but you also see it occasionally with custom session handlers and if you find a session handler that has that property that's not doing batching or locking that needs some really heavy testing because there's a whole load of completely plausible reasonable code patterns that suddenly have critical vulnerabilities if they're built on top of a vulnerable session handler so it's I would say I think it's almost impossible to write secure code at the application layer when you're building on top of a session handler that's not doing some kind of synchronization or batching now the final area for the research is improving the single packet attack so my implementation lets you get about 20 to 30 requests into one packet and if you get more than that the operating system just puts them in another packet shortly later and I'm certain you can fit a lot more requests into a single packet with enough effort you can totally do it with a custom TCP or TLS stack and there may be other easy ways of making it happen that I didn't think of I didn't try to push that side of the research that far because 20 requests is enough to cause a lot of damage in the wild by itself the other thing that will be really valuable on that angle is other ways of causing server side delays because that will let you trigger staggered attacks more reliably and it will also help out with the timing attack side a little bit as well and more generic techniques would be especially valuable there now one final word of advice this is a slide just for DEF CON and this might be a controversial take we'll see now in this session I've tried to squeeze six months of research into the space of 40 minutes and one thing that can get lost in that condensing process is how big the gap can get between exploiting something and actually understanding it so for example that githlab vulnerability I exploited githlab.com successfully in I can't remember but I think maybe two days whereas when I built my own local replica for the live demo it took me so I could get the token to be misrooted but the token was never ever valid I like ran attacks running every 10 seconds for weeks and it was never valid and it took me over two months to figure out why that was happening and gain the understanding to actually replicate it successfully and similarly I've mentioned timing information can be really valuable but front ends can do all kinds of different things with your requests which can cause other timing delays and massive timing red herrings now you can recognize that behavior and work around it but what I'm getting at is with this bow class you will encounter things that don't make sense and that's absolutely fine my advice is just to embrace the chaos normally I would say you should understand a system and then use that understanding to exploit it but with race conditions there's a risk that limits you to finding vulnerabilities that make sense and in my experience the coolest race conditions make the least sense in other words it's nice to have an explanation but all you really need is an exploit now for defense when a single request can push an application through multiple invisible substates understanding that application and predicting its behavior is incredibly difficult and defense is just not practical so my advice is try to eliminate substates entirely like the effects of each request should be atomic you can achieve that generally using your data store consistency features and another thing that will help with that is avoid mixing data sources so device was vulnerable because they sent an email to an address from an instance variable but took the contents from the database if they took the email address and the contents from the database they would have been absolutely fine the other key thing is to make sure that you know what kind of locking system your session handler is using because if it's not doing any locking that's bad news now there's a lot of further reading available the three key things I would suggest are check out the white paper that's basically the written up version of this presentation it does have a little bit of extra info and some different angles on stuff have a practice on our online labs because there's no substitute for real experience with these vulnerabilities and finally grab my code take the single packet attack and find some real vulnerabilities out in the wild if you have any crazy findings with these techniques that you'd like to share I'd absolutely love to hear all about it and the three key things to take away are the single packet attack makes remote race conditions local with race conditions everything is potentially multi-step and to find these bugs predict probe and proof I'm going to take five minutes of questions now if you have any more after that just come and chat to me at the back or chuck me an email thank you for listening any questions yeah can you use them there's a microphone over in the middle sorry yep what's uh what severity did uh gitlab eventually rate that vulnerability as uh so sadly for me gitlab rated it as medium uh which I don't think is accurate I think part of that was because I hadn't discovered uh so when I initially reported that I didn't discover the invitation hijacking angle I didn't realize getting a validated email would actually let you do that and by the time I realized that it was already fixed and paid out so I think if I'd originally reported it with that impact it would have got high whereas as it was it was only risky to people using gitlab uh via the signing with gitlab button which thankfully not many people are doing anyone else thanks for the really interesting talk uh you mentioned that uh front ends and load balancers cause issues with this sort of thing and you said there are some work arounds what they're not all trivial but you basically you have to observe what's happening so you can notice if you send your requests in a batch and the first request always comes back faster you can try changing the order of the requests uh and so sometimes by flipping by flipping the order you can fix the issue uh or just adding a dummy request at the start uh that's one way of dealing with it but there's there's like so many different things that they can do uh it's hard to give like a playbook for every kind of scenario I think the most important thing there is when you see a delay don't assume that that's something that's happening server side that could just be the load balancer so test that assumption before you try and work around it cool I think that's everyone


Hello in this video we're going to talk about another penny stock which I believe to be is going to be very very big This is going to be a big penny stock We'll go through the information why I think that it's going to be a big penny stock some of the research some of the information I've got I'd certainly put this one on your radar. I would I would consider this I would make a note of it, but I would want you to get the best possible price So we've got to be patient with penny stock sometimes as well You've got to be careful to not get firmer so to speak and I'm just shuffling around my seat there Okay, moving on. So I'll get right to the information. I'll get directly to what I've got for you today Okay, I've got to say I'm not a financial advisor. I'm a business teacher in my daily life But I'm by no means an expert on the stock market So I'll just go into the information for you today and get right into it So what I've got for you today is called score media in gaming SCR First I want to talk about what they do and a bit of information about them and why I think that this is prevalent And then we'll get into the charts. Okay, so the about us. So what do they do? So the the score creates mobile first sports experiences connecting fans to what they love through an addictive an addictive Combination of real-time news scores fantasy information and alerts while creating and curating content that is mobile optimized comprehensive customizable and seamlessly shareable Okay, so this is a This is a stock. This is a penny stock Which is very much content marketing base meaning they're creating a lot of content that people are sharing and then that spreads through word of mouth Okay So what do they do though? What is what is the actual products? Okay? Well, first of all, they've got the main one Which is called the score. Okay, which is some news information on different stop different stocks Some news information on different and sports. Okay, then there's they've got the score bet Which is a relatively new where basically people can bet and as we see, you know, we're having the kind of legalization and Of lots of sports betting in in in many different states, okay? And that's continuing to happen. It's why DraftKings is trying to you know, doing really well at the minute also Golden nugget I remember actually suggesting those when there was actually a merger Okay, well, you know when there was a SPAC and a very low price as well And then you've also got here esports, which is essentially talking about esports And it's like sort of a news YouTube channel got over a million subscribers. I believe So this is the area where there's a little bit of a lot of revenue generation Okay in terms of people betting on this app now these two Are more for the fact that they could have advertisers on those platforms and they're generate revenue that way So you've got multiple streams of revenue this from the fact that you've got the sports betting, right? But then you've got the content which can have advertisements on as well So two forms of revenue, but also these can be integrated together, right? Okay, so for example They have this hat this app. Okay, so say for example, I'll go into this actually I'm going to get into this with a better example. Okay, and so just to go through some of the main informations It's one of the most popular sports media app in North America. It's got a dominant dominant position in Canada It's cutting-edge natively built sports betting platform Rapidly growth esports channel and can you believe this is a penny stock by the way Massive engaged audience on our sports media app with over four million monthly active users The app hundred times the app gets the app actually gets her opened Hundred times a month each on average from a user. Okay on average Monthly rates you social media reach of a hundred million So the point with that there is really important that because you do have a lot of apps Which they've got millions of downloads and companies will burst we've got millions of this downloads But what really matters is how many time how much engagement are you getting with that app? How many times are people opening that app? It's the reason why I know it's not direct comparison But it's reason why Facebook three's my snapchat and all these other social media's are very Lucrative it's because people keep opening them and people keep going back to them So they've got the high amounts of downloads say for example snapchat But people are open them on a daily basis sometime 20 30 50 times a day, right? Okay, and obviously they they get money through advertisements. Well, this is a news app Okay, but they're getting money through advertisements, but again millions of people open in it. Okay So you got second most popular sports betting in North America dominant mobile sports app in Canada Positioners perfectly to capitalize on the growing momentum around regulating expanding online sports betting So again as this market grows This has got a lot of lucrative potential Right and we'll go into that a bit more I've got some good points that I want to make on that an award-winning sports book the score bet Which is uniquely integrated with the scores popular sports media app And that's the point I actually wanted to make work. So they've got this sports media app Okay, well, they you know, they they become in the authority of in sports, right? They're they're actually put you know producing media content. Okay, and Customers are familiar with them. They've got brand awareness. So if they then go into a state for example that is legalized betting, okay They can then go to their current user base on this this the score and The score main website Yeah on there on their main app and they can really they've already got a brand reputation brand presence with that individual So they're more likely to get a crossover of revenue from people saying right. Well, I check the sports The score bet the score main app in terms of the content I'm going to use that to bet with as well because I trust them or I've used them I'm engaged with what they do. Okay, so there's a lot of brand awareness elements there that is untapped potential Okay, I hope that makes sense Market access agreements by the way if you enjoyed the video, please leave the video like the channel's been blowing up recently It's unbelievable. So thank you for all the support if you leave a like that'd be fantastic So let's get back to this market access agreements providing potential access to offer mobile betting Services to approximately 30% of the US population Leading independent provider on on-demand video coverage Almost more than 1.5 million subscribers on your on the YouTube channel So I wonder if within this sports betting they're going to include e-sports betting right in terms of like betting on Competitive teams to win Etc and then they could integrate that with their YouTube channel as well in terms of like doing predictions I'm starting to do their marketing for them now, but okay But you see that there's an integration here that like one app benefits the other, you know, it's very interesting And another point here is really How much of a presence they have right so exceptional brand strength and large and highly engaged customer user base Okay, one of the most popular media apps in North America So it's actually number two best for in-class sports media brand number two Okay, just beyond just them. Obviously ESPN being the number one, but second is the score penny stock total cross-platform monthly reach of 105 million So authentic sports brand catering to highly engaged bettas. Okay, so they've got an engagement there So there's a lot of potential. So they've got loads of average minute This is interesting the amount of minutes that people use the app. Okay 137 minutes Okay, compared to yahoo sports, which is 78 and everybody knows yahoo is right and ESPN 74 minutes they're getting 137 minutes of Average views per minutes there. That's that's an incredible amount of engagement with it with their app And obviously within that they can place advertisement because they're getting more engaged content Now next point here. It's uniquely positioned for success in betting sports as well So why is that? Why is it uniquely positioned? Okay, you've got product differentiation So that means how it's standing out from the crowd. It's doing something different. That's what differentiation means So it's a provide seamless integration between sports media and betting. So it's got the media side It's got the betting side It's got that combination of the two together, which is really powerful Creates ecosystem of content and data to inspire betting opportunities Market access agreements for rapidly expanding industry So obviously 18 billion online gaming market opportunity by 2025 and 13 states are Access to 13 states and approximately 30 percent of us population Highly engaged user base. I've already mentioned that An authentic brand for avid sports pack van fans and betting So you can see that this is just a showcase of the fact that the as we all know the online gaming market Betting market is going to grow as it becomes more You know deregulated and allowed more in states. Okay And also canada as well is starting to sort of potentially deregulate this as well So on november 26 2020 the canadian federal government introduces legislation to legalize single event sports wagering in canada So there's this pushing canada as well where this company is actually based to to to allow this Now this is the most important point I can make out of them all for this Here so it's over a 1.4 million users in ontario ontario alone. Okay Now 1.4 million users of the score, right? So say for example That that that particular area is allowing online gaming right if that allows online gaming They've already got 1.4 million users That are using the other app So they've already got that brand recognition that brand awareness when they actually go into this Area they're going to know who they are they're going to know who you know the score are as as a betting solution So they're more likely to choose the score as a betting solution Um, this is following on from the q4 2020 Now this guy this this betting solution that they've got That they've got here. It's fairly new. So obviously it's just expanding It's trying to get off the ground so to speak So the revenue is not incurring enough just yet So here we've got the total revenue for q4 2020 Is 2.5 million It's saying that there's been a decline in revenue because of the sports because of them The pandemic and because of sports events not being on Uh set up some of the time and there's not been enough viewers Or interest because you've got to think maybe you know with that with the app and that where that might not be But there's much interest So that that that is a concern that the the revenue is going down, but it's also understandable But what I'm interested in is the gaming side of the of the app because that is what's going to drive a lot of the revenue I would believe So that's got a lot of potential in the future. Okay, so it's an untapped revenue potential you've got to think in terms of the future So what is the benefit sir brand awareness? Okay, it's got a strong brand awareness Millions of people downloaded the app. They're getting millions of eyeballs on their social medias. They're on tick tock. They're on YouTube all sorts, right? So there's a lot of brand awareness for them Um, eventually, you know, which is building their brand up and then they've also got a large market potential as well as this industry grows The online gaming betting market Okay My only concern obviously was those revenue figures, but I think it is understandable because there's I just it the pandemic did hit um sports events Okay, and you'd have an impact. So the revenue figures aren't there yet I mean, they're still growing still well, it's not growing, but it's still got some revenue, right? There's a lot of penny stocks with no revenue But that needs to be improved. Obviously The revenue, which I think it will be so what what is it now? So it's um so it's c SCCR is the um ticker symbol score media and gaming. So it's at one um $1.50 canadian. Okay. Now if you can get this um, essentially anywhere around $1 to 140 I would say that this is a buying opportunity I think this stock is going to be a long-term hold Hold it for the long term because you're only really going to see the benefit of the stock price as it generates revenue from this The the betting side of the app Okay, and the you know, obviously enhance their marketing for that as well So this is in terms of it's available It might only be available on some brokers. Okay, because it's something the canadian kind of stock exchange I believe so it may only be available to some brokers So you might have to look around for where you can get this But um, this is a one of the diamonds in the rough so to speak. I think it's got a lot of potential Look into it at least make a note of it. Make a you know Make a note of it. See how it does So thanks for watching this video if this was helpful in any sort of way Please make sure to like the video and subscribe to the channel if you knew we cover penny stocks and loads of stock market videos So any support that you can offer whether it's like in the video or subscribing. That's fantastic. We don't offer thousand pound $1,000 courses here, you know, I'm not that sort of person I give the information out for free And you know all you can do to support is basically like and subscribe and that's all I ask really I may start a patreon at some point, but You know, maybe not just yet not not big enough as a channel yet, but maybe one day Okay, so thanks for watching and I'll see everybody later