Practice does not make perfect. Let me illustrate this by telling you a little story about a friend that I went to school with. He lived on a farm and his dad bought him an old car and he drove around the farm every day in this car. When it came time to doing our driving test, all of the other friends that I had that were doing the test did about six weeks of practice. He had seven years of daily practice. Six weeks, 90% of them passed first time. The guy who drove for seven years practiced every day. He failed multiple, multiple times. This is because he developed bad habits and every time that he drove that car, he was making these bad habits worse. This is exactly the same with IELTS student. They have bad habits, they're doing things wrong and by doing lots and lots of practice tests, they are getting worse, not better and they're wasting their time.


Dear viewers and aspirants, greetings from Shankarayesh Academy. We thank you for actively participating in the current affairs test series 2020. So far we have conducted two current affairs tests and results are already out. As promised, we are announcing the top three rankers in the first two tests, who will receive the full reimbursement of Rs. 1000. The top performers in test 1 are Ms. Tirupavai, Ms. R Sathya and Ms. Ankita. In test 2, the top performers are Mr. Rameshwar, Mr. Sachin Kumar and Mr. Yuvraj. Congratulations on behalf of Shankarayesh Academy and all the best for your prelims examination. The top performers would have received a confirmation email or will receive a confirmation email within one or two working days. The third current affairs test starts today that is 5th September 2020. So aspirants are requested to be prepared well and to win a chance to get the cash back or reimbursement. Note that the registrations are open till 4th October 2020. For more details and for registration visit the link given in the description box and also in the comments section. Now let's move on to the daily news analysis source from the Hindu newspaper. These are the list of news articles taken for today's analysis and the page numbers and different editions of the newspaper. The link for the handwritten notes in the PDF format and the time stamping of the discussed articles are provided in the description and also in the comments section for the benefit of mobile phone viewers. Now let us move on to the analysis of first news article. This editorial is based on the recent statement made by the Chief of Defense Staff, General Bipin Rawat on Quad. In this discussion we will see what the statement means and whether India's stand has changed towards Quad. The syllabus relevant for the analysis of this editorial is highlighted here for your reference. In yesterday's discussion we saw that Chief of Defense staff has told that India wants the Quad to become a system to ensure freedom of navigation and freedom of navigation operations in the Indian Ocean and around. As you know, Quad is an informal dialogue mechanism among four countries, India, United States, Japan and Australia. And freedom of navigation operations is a tool by which the United States challenges the maritime claims which it considers or deems as excessive under the international law. In short, through freedom of navigation operations, United States conducts military patrols in the oceans. We discussed about freedom of navigation and freedom of navigation operations in detail in our yesterday's analysis. Now coming to the statement, what Chief of Defense staff meant was Quad will be a good mechanism to ensure freedom of navigation operations in the Indian Ocean and the surrounding oceans including the Indo-Pacific. That is Quad conducting military patrols in the oceans like the United States of America. Now this is what is referred by saying militarization of Quad. If Chief of Defense staff really meant this, then it could refer that India is now prepared to join Quad military patrols. But this stand points at departure from India's earlier stand of restraint or reticence regarding militarization of Quad. Because earlier, in many instances, Indian leadership meant otherwise. That is not making Quad as a strategic mechanism. Here militarization of Quad would mean using Quad for strategic strength. For example, Indian Prime Minister in the year 2018 has told that India sees the Indo-Pacific as a geographical concept and not as a strategy or a club of limited members. And as we know, Quad is an important grouping in the Indo-Pacific and militarizing Quad means using Quad as a strategic mechanism. Now by this we can say that the assertion of Chief of Defense staff is that the Quad operations are needed to ensure that there is no fear of any other nation which is unilaterally or singularly trying to dominate the oceans and obviously he is referring to China. Now currently we can see Chinese aggression in the South China Sea. Now one of the reasons as to why CDS took this stand might be the tensions and clashes along the line of actual control between India and China. Now even though initially China agreed for disengagement along line of actual control, now Chinese army is refusing to implement border agreements. But still India continues to engage with China at the diplomatic level and Indian officials have already spoken about the importance of resolving this issue through talks. But that does not mean that India should not have other options. Actually such stand of China has only mandated and also convinced Indian officials that India needs new strategies to deal with China and one such new strategy is militarizing Quad and safeguarding Indo-Pacific region from the Chinese aggression. Now another strategy is strengthening India's ties with global powers such as the United States which could also be done through Quad. In a way we can also find the members of Quad around the same boat when it comes to issues with China at various levels and various dimensions. Now the new strategies it is clear that India is going to use these strategies because India is planning to host a ministerial level meeting of the Quad next month. Experts expect that this meeting will possibly coincide with India-United States 2 plus 2 meet or dialogue of foreign ministers and defence ministers. So India will use this chance to strengthen itself strategically therefore we will know for sure about India's stand regarding Quad and militarization of Quad next month. However regarding the change of stand of India about Quad, author of this editorial urges Indian government to remember why initially India had restrained or reticence in terms of militarizing the Quad. According to author the reason for India's initial stand was that India is the only country in the Quad that shares a land boundary with China and already we are facing tensions along the border with China. So if Quad is militarized in Indo-Pacific waters China could see this as a threat and it may increase or it would increase the territorial clashes or threats with India which is the only country in the Quad grouping that shares a land boundary with China. So this means Quad militarization may not alleviate or reduce the threat for India from China. So because of this reason author finally asks the Indian government to provide clarity on the statement made by chief of defense stuff and also clarity on India's current stand in Quad before matters go out of hand with respect to China. So these are some of the important information with reference to the analysis of this editorial article. We saw the meaning of the statement made by chief of defense stuff. We saw how India sees militarization of Quad as a new strategy possibly to deal with China and also we saw the change of stand with respect to Quad from the Indian side. Now let us move on to the analysis of next news article. This editorial article is written in the wake of recent ban of Chinese apps in India. In this discussion let us understand why India had to ban these applications and what will be the consequences of such a move while we are having high tensions with China along the line of actual control. We have been seeing articles assessing the strategies adopted by India to deal with China. This is also one such article. There are always pros and cons of such strategies adopted by us. The assessments help us to take advantage of the pros and help deal with the negatives or associated challenges. The syllabus relevant for the analysis of this editorial is highlighted here for your reference. We all know that the ministry of electronics and information technology has blocked 118 mobile applications most of which are from China. This is a recent development that was announced three days ago that is on 2nd September 2020. The government invoked its power under section 69 capital A of Information Technology Act and under relevant provisions of Information Technology Rules 2009. The ministry has blocked these mobile applications because they are engaged in activities that are prejudicial to sovereignty and integrity of India, prejudicial to defense of India, security of state and public order. Of section 69 capital A of the IT Act, it provides power to issue directions for blocking for public access of any information through any computer resource. Now this can be done by the government or through the authorized officer if they are satisfied that it is necessary or expedient to do so based on six reasons. One is in the interest of sovereignty and integrity of India, then in the interest of defense of India, then for the security of the state, then for friendly relations with foreign states for maintaining public order to prevent incitement to the commission of any cognizable offense relating to these things. I know that this is not the first time Indian government has banned applications that are mostly from China as similar order blocking 59 applications was issued in June 2020 as well and later 47 clones or 47 similar apps of these banned or blocked 59 applications were also blocked in India. In this context the author says that Indian government is leveraging its position as a massive market for technology in dealing with potentially dangerous geopolitical issues. Here by dangerous geopolitical issues the author refers to the tensions along line of actual control. Now the timing of the order is what is used by the experts to say that this is one of the ways by which India deals with such tensions. Even when the first order banning 59 applications was announced there were high tensions along the line of actual control and so far more than 200 applications were blocked or banned in the country. Many experts have said that this would deeply hurt China and its ambitions of tech superpower. Here are the questions that would such a ban is effective as a counter in a geopolitical fight and how far can India go on banning these Chinese tech giants who are well entrenched in the global tech supply chain won't this tech side ban have a side effect on India's growth. Now these questions have to be carefully deliberated and addressed for the best interests of the country. Now in this context author also brings the attention to the absence of data protection law in India. See government has banned these applications for stealing and surreptitiously transmitting users data in an unauthorized manner to servers that are located outside India. In this context author points out strong need of data protection law. See if we had a data protection law taking such actions would be considered legitimate at the international arena. Now then the author is also of the opinion that such ban or block of mobile applications does not go well for India which has aspirations of global leadership in the field of technology. Here note that China for years has enforced widespread censorship of information and has blocked many applications. For example there is no Google no Facebook in China. Ironically China has found a rare chance to take the moral high ground and accuse India for banning its applications. Now even in the past China has accused India of violating world trade organization rules for banning Chinese applications. It has also criticized India's move accusing it of abusing the concept of national security. But as we know similar criticisms are also leveled on China. We can say with reference to national security law in Hong Kong. But here author says that technology is an industry that thrives on global networks and global rules. So India certainly needs a more considered approach to tech regulation so as to achieve its aspiration of global leader in technology. And that is why the editorial is named as appropriate strategy. You can take this editorial in this way or in another understanding while India takes these steps say for example blocking access of these applications such steps or strategies should be adequately prepared to deal with the associated challenges at the domestic level national level and also at the international level. So these are some of the information with reference to the analysis of this editorial. Now let's move on to the analysis of next news article. This news article talks about a proposal of ministry of railways to amend some of the provisions of the railway act 1989. Through these amendments the railway ministry is planning to decriminalize certain acts and to rationalize the penalties under the provisions of railway act 1989. This comes at the backdrop of the plans to make modifications in Indian laws to ease the burden on courts. In this context let us discuss some important provisions of the railway act and the amendments proposed for those provisions as mentioned in the news article. First let's discuss in the context of beggary. See section 144 subsection 2 of the railway act deals with begging. Subsection 2 states that if any person begs in any railway carriage or at railway station he shall be liable for punishment which is imprisonment for a term that may extend to one year or fine that may extend to 2000 or both. But now the proposed amendment to subsection 2 states that no person shall be permitted to beg in any railway carriage or upon any part of the railway. This means now the severity of punishment is considerably reduced and we can say that there will be no punishment for begging in the railway carriage or at railway stations. In this regard with reference to legislation related to beggary you should know that states have laws related to beggary in their local jurisdictions and of all the state enactments the Maharashtra Prevention of Begging Act 1959 which was called as the Bombay Prevention of Begging Act 1959. This law had been in the public attention as for us discussions on anti-beggary laws are concerned. This is because of its application in the metropolis of Mumbai and the subsequent extension to the Union Territory of Delhi in the year 1960. The extension was done through the Union Territory's Laws Act of 1950 that provides for the extension of laws to certain union territories. But the Delhi High Court in a landmark judgment held that the Maharashtra Prevention of Begging Act 1959 is unconstitutional on grounds that it violates Article 14 and Article 21. Criminalizing begging it violates the fundamental rights of most vulnerable people in our society and it ignores the reality that the poorest of the poor are forced to beg as the last resort because of various socio-economic conditions. Now secondly let's come to the offence of smoking. Here section 167 subsection 1 of railway act states that no person in any compartment of a train shall smoke if objected to by any other passenger. According to subsection 2 railway administration also has the power to prohibit smoking in any train and whoever contravenes the provision shall be punishable with fine that may extend to 100 rupees. But now the proposed amendment states that provided that if the person liable to pay the fine under this section is willing to pay such fine immediately the authorized officer may compound the offence by charging the maximum fine payable under the section concerned and the sum so recovered shall be paid to the railway administration. Provided further that the offender against whom the offence is compounded shall be discharged and no further proceedings shall be taken against him or her in respect of such offence. So here this amendment is to facilitate compounding of the smoking offence. So what is compounding? There are two broad categories of offences compoundable non-compoundable. Now compoundable offences are those offences that can be compromised that is the complainant can agree to take back the charges levied against the accused. In such case there would be no further legal action once compounding is done. So in compounding offences the parties can affect a compromise whereas non-compoundable offences are more serious offences in which parties cannot compromise. So these are some of the information with reference to the analysis of this news article in connection with the proposed modifications in the context of begging and smoking in the railway act of 1989. Now let us move on to the analysis of next news article. This news article talks about Turkey's blame on Greece for rejecting the dialogue for military de-confliction. Know that de-confliction means avoiding a potential clash or accident that involves non-enemy military operations in a particular combat area. Now this blame by Turkey comes after Greek Prime Minister who said that NATO brokered talks to reduce tension in eastern Mediterranean ocean could only be held if Turkey stops from making threats. In this context let us have a brief understanding of NATO. See NATO is a political and military alliance. We say it is political because NATO promotes democratic values and it enables members to consult and cooperate on defence and security related issues so as to solve problems build trust and in the long run to prevent conflict. It is a military alliance because NATO is committed to peaceful resolution of disputes. If diplomatic efforts fail it has the military power to undertake crisis management operations. Now these are carried out under the collective defence class of NATO's founding treaty. They are referring here as Article 5 of Washington Treaty. Or they can also undertake collective defence under a United Nations mandate alone or in cooperation with other countries and international organizations. NATO was created in the year 1949 by United States, Canada and several western European nations. Now we know that most part of Europe was devastated politically and economically by the World War II and at this time the ideology of communism supported by the Soviet Union started to take root in Europe so that then United States Secretary of State George Marshall proposed a program called as European Recovery Program. This program was also known as Marshall Plan. This plan was proposed in the year 1948. It is this plan which was the catalyst information of NATO. So NATO was formed with the signing of NATO Treaty which is also called as the Washington Treaty. Now this alliance is strategic as it is considered to deter or to discourage Soviet expansionism or to counter the spread of communism. It also had the strategic objective to have a strong North American presence in Europe to prevent or to prohibit revival of nationalist militarism in Europe. See national militarism means a belief that a strong military is essential for a nation so that it can be used aggressively to expand its national interests and values. Now one another objective of NATO was to encourage European political integration. The fundamental goal of NATO is to safeguard the freedom and security of allies by political and military means. The Collective Defense Clause is the most important principle of NATO. Article 5 of the Washington Treaty or the NATO Treaty states that an attack against one ally is considered as an attack against all allies. So when one ally is attacked the member countries would stand together and counter the adversary. NATO invoked Article 5 for the first time after the 9-11 terrorist attacks against the United States. Now that the NATO headquarters is located in Brussels, Belgium and the North Atlantic Council is the principal political decision-making body within NATO. This council oversees the political and military process relating to security issues affecting the NATO alliance. Now at present this alliance consists of 30 independent member countries. The latest members to join NATO include Montenegro which joined in 2017 and North Macedonia which joined in 2020. And note that any European country which is in a position to further the principles of Washington Treaty or the NATO Treaty and which can contribute to security in the Euro-Atlantic area can become a member of the NATO alliance. With this we come to the end of analysis of this news article we discussed about NATO in this analysis. Now let's move on to next part of the discussion. This news article presents the recent development over what we have discussed on August 7, 2020. On that day we discussed in detail about priority sector lending. RBI announced that it has been reviewing the PSL guidelines to align it with emerging national priorities and to bring sharper focus on inclusive development. Yesterday RBI press release stated that the comprehensive review is completed and it has revised the priority sector lending guidelines. The revised priority sector lending guidelines will enable better credit penetration to credit deficient areas. It will increase the lending to small and marginal farmers and weaker sections. It will also boost credit to renewable energy and health infrastructure. Three new areas have been included as fresh categories eligible for finance under the priority sector. One is bank finance to startups up to 50 crore then loans to farmers for installation of solar power plants for solarization of grid-connected agriculture pumps then loans for setting up of compressed biogas plants. So from this you can understand that these are emerging national priorities that require priority sector lending. Now the salient features of the revised priority sector lending guidelines is given here for your reference. Now let us move on to next part of the discussion. This news article states that the Puducherry chief minister clarified that the ICMR had not informed the Puducherry government about any scientific findings that suggest 95% of people in the union territory are susceptible to COVID-19. Now this is a response to the earlier action from Lyftman governor's office stated that 95% of the people in the union territory are susceptible to the virus. While this is criticized as a part of never-ending saga between the Lyftman governor of the union territory and the chief minister and we also in the recent weeks have covered a lot on the tussle between Lyftman governor and the chief minister while one of them that is the Lyftman governor is the unelected nominee of the central government and the chief minister being elected leader with reference to the union territories of Puducherry and Delhi. In today's discussion we'll have a brief recap on ICMR in the prelims perspective. See Indian council of medical research is headquartered in New Delhi. It is the apex body in India for the formulation coordination and promotion of biomedical research. It is one of the oldest medical research bodies in the world. One of its mandates is to translate medical innovations into products or processors and to introduce them into the public health system. It also conducts coordinates and implements medical research for the benefit of the society. Now note that ICMR manages the clinical trials registry of India which was launched in the year 2007. It manages the registry through one of its permanent institute called as National Institute of Medical Statistics which is in New Delhi. The present ICMR came into existence from its precursor which was Indian research fund association IFRA which was set up way back in 1911. In the year 1949 Indian research fund association was re-designated as Indian council of medical research and at that time its scope of functions were expanded considerably. This ICMR is funded by government of India through department of health research of ministry of health and family welfare. Note that it is not a statutory body and from the exam point of view we should have a clear understanding of ICMR, central drug standard control organization and national pharmaceutical pricing authority. See national pharmaceutical pricing authority was constituted as an attached office of department of pharmaceuticals of ministry of chemicals and fertilizers through a resolution. It is an independent regulator for pricing of drugs and also to ensure availability and accessibility of medicines at affordable prices. While central drug standard control organization works under ministry of health and family welfare, NPPA functions under ministry of chemicals and fertilizers. So these are some of the information with reference to the analysis of this news article. Now let's move on to next part of the discussion. We have come to the last session the practice questions discussion session. Now this question is with reference to Bahrain. This question is framed with reference to this news article which talks about Bahrain. The news article states that Bahrain has followed the steps of Saudi Arabia in allowing United Arab Emirates flights to and from Israel to overfly the Bahraini kingdom. Though Bahrain has no official diplomatic relations with Israel, it's decision to allow overflights. It marks a sign of cooperation with the Jewish state that is Israel. Now come to the question. It is a three statement question. They're asking which of the above statements are correct. It is a landlocked country. Now this statement is incorrect. It is not a landlocked country. So you can eliminate options A and D. The second statement states it shares border with Israel which again is also incorrect. So the correct answer for this question is option C. It is a member of Gulf Cooperation Council. See Gulf Cooperation Council was established in May 1981. It consists of six member countries. Bahrain is one among them along with Kuwait, Oman, Qatar, Saudi Arabia and United Arab Emirates. Now see this question. Consider the following countries which of the above countries are involved in Quad and Malabar exercise. Now we know that Quad consists of four members India, Australia, USA, Japan. So China is not there. So any option that has China should be first eliminated. Thereby you can eliminate options A and B. Now with option C and D there is only one doubt whether Australia is part of Quad and Malabar. Because anyway both options are saying that India, USA and Japan are part of both the exercises. Now note that Australia is not either part of Malabar exercise. So the correct answer for this question is option D, one, four and five only. Now this question is with reference to North Atlantic Treaty Organization. Two statements are given which of the statements are correct. Any country can become a member of NATO at an invitation of North Atlantic Council. We can logically say that this statement is incorrect. See NATO is related to North Atlantic area or Euro Atlantic area. So any country in the world cannot become the member of NATO as of now. But any European country that is in a position to further the principles of NATO treaty or the Washington Treaty and contribute to security in Euro Atlantic area can become a member of the alliance at the invitation of North Atlantic Council. First statement is incorrect. So you can eliminate options A and C. Now second statement Montenegro was the latest member to join NATO. This statement was correct before March 2020 because at that time Montenegro was the latest member which joined NATO in 2017. But the most recent and the latest member to join NATO is North Macedonia which joined NATO in the month of March 2020 as the 30th member. Now see this question it is a previously asked question. Priority sector lending by banks in India constitutes the lending to agriculture, micro and small enterprises, weaker sections all the above. The correct answer for this question is option D all of the above. Now this question again is with the recent development in relation to PSL which of the following were added as fresh categories eligible for finance under priority sector as per the recent comprehensive revision of priority sector lending guidelines. Bank finance to startups up to 50 crore, loans to farmers for installation of solar power plants, for solarization of grid connected agriculture pumps, loans for setting up compressed biogas plants. See all the three are added as fresh categories. So the correct answer is option A one, two and three. See this question. Consider the following statements. Two statements are given which of the above statements are correct. Compuntable offenses provide for the parties to affect a compromise in accordance with the provisions of law. This statement is correct. Second statement. Compuntable offenses are those offenses for which the police may arrest without warrant. This statement is incorrect because it is the definition for cognizable offense. Correct answer option A one only. Now see this question. Consider the following pairs they have given organizations or bodies on one side and functions under or funded by on another side and they're asking which of the pairs given above are correctly matched. Let us see the first pair Indian Council for Medical Research under Ministry of Science and Technology is incorrect because it is funded by Ministry of Health and Family Welfare. The moment you find this pair is incorrect you can arrive at the correct answer option C two and three only because you can eliminate options A, B and C as these options say first pair is correctly matched. See this mains question in GS Paper 3 discuss the recent ban on the mobile applications in the context of data profiling and data mining. It's a 10 mark question you're asked to write within 150 words. You may post the written answers for this question in the comment section and we will give you appropriate feedback within a reasonable time frame of one week. Note that you have to write the answer in the context of data profiling and data mining. With this we come to the end of today's the Hindu News Analysis. If you like the video, click the like button, comment, share it among your friends and those who are in need of such resources and subscribe to Shankarai's Academy YouTube channel for more updates and content on civil service exam preparation.


Hello everyone, my name is Ron Benitzchak and I'm glad to be speaking here at DEF CON for the second year in a row. By the way, thanks for attending my talk at 12pm on the last day of this conference. Last year I talked about a new cadential dumping technique and today I'm presenting my new research about how to abuse the Windows filtering platform for privileged escalation. A little bit about me, I'm a security researcher at DP Instinct. I'm interested in Indian bypass techniques and I enjoy playing volleyball and row climbing. Here is what we're going to talk about today. I'll start with an overview of non-privileged escalation techniques and the technical background to understand them. Then I'll show the process of reverse engineering the execution of an RPC method throughout the entire Windows filtering platform. Once we understand how this platform works, we'll be able to abuse it to gain high-privileged tokens. The final part will be about how to detect these attacks and I'll also share some interesting findings that you can continue and dig into and maybe you'll find your attacks yourself. Privileged escalation is the ability to execute code in a higher level of permissions on the system. It is useful when compromising a weak process. Let's say if an attacker gains the ability to execute code in a process that runs as a local service account. This user is limited in the operations it can perform on the system and escalating to higher privileges is necessary. Here is an example for that. On the left we can see the token of a process running as anti-authority system. And on the right is the process of a token running as the local service account. The token of this user is limited in the privileges it holds and it prevents the attacker from further compromising the machine. Anti-authority system is the most privileged user in the Windows OS and it is required for performing attacks like reading the same registry hive as a stinker ring and dumping Kerberos tickets with the tool Rubeus. To understand the techniques we'll talk about soon and this token in general we first need to understand what a token is. So I'll quote MSDN. Access token is an object that describes the security context of a process or a thread. It identifies the user when a thread interacts with a secure object or performs a privileged task. A token details the identity of a process and it is composed of several things. The user that executed it, the groups and the log on session it belongs to and the privileges of the process. For example if it can read the memory of other processes, load a driver, shadow on the system and more. When a thread tries to access an object let's say a named pipe the security identifiers of the token are checked to see if the access is allowed. There are two types of tokens. Primary tokens describe the security context of the user account associated with the process and impersonation tokens describe the security context of a client process. We'll talk more about that in just a bit. To visualize this whole concept we can look at a software called token viewer. Here we can see information about the token belonging to a user named user and this is a primary token and the session ID is one. Let's talk more about impersonation. It gives us the ability to execute under a different security context than the owning process. Let's say I'm writing an application for a file server. The process will be executed as the user network service probably but it will need to check the access of the client's connecting tweets. This is the purpose of impersonation. A new thread will impersonate the client and try to access the file. There are several impersonation levels and I won't go into details about each one but the level most offensive tools attempt to gain is the third one, impersonation. Which means the thread can impersonate the client security context on the local system. And again we can look at an example with the token viewer. This is another token belonging to the user named user and this time it is an impersonation token and the level is identification. Now let's talk about actual techniques. The first one is based on the API duplicate token which duplicates the primary token of another process and we can combine that with the ability to launch a child process with a different token than ours. These are the steps for that. Let's say we have our offensive tool on the left and a process running as anti-authority system on the right. We start by calling open process token which gives us a handle to the other process primary token. Then we'll call duplicate token which gives us a new token with the same security identifiers that we can use with the call to create process with token to launch a new child process as anti-authority system. This is a very simple technique and it is implemented in PowerSploit and Rubeus. There is another technique based on the API duplicate handle. The tokens held by a process are listed in the handle table and here we can see the handle table of Elsas. It holds several tokens and other processes can gain access to them. Let's see how. Again we have our tool on the left and let's say Elsas on the right. We start by calling anti-query information process. This gives us the handle table we just saw. Then we start going over this table and calling duplicate handle on each object. This will give us access to that object and we can query it until we find the token of anti-authority system. Then once again we can call create process with token. This is a very common technique and it is implemented in Metropeter and Mimicats. The final technique is based on the impersonation concept. It is a feature that gets abused by many offensive tools. They manipulate common RPC servers to connect one of those threads that will then impersonate system. Let's see how they do it. The tool launches a new thread. The thread creates a named pipe. Then a new service is created that interacts with this pipe. This gives the thread the ability to call impersonate named pipe client that will change the thread security context to anti-authority system. This is another technique implemented in Metropeter and also many potato tools manipulate services in various ways. These techniques are known for a long time and detecting them is easy. We can look for events of duplicate token or duplicate handle that return a token of anti-authority system through a process with lower privileges or a thread that impersonates system after calling one of these APIs. Many tools are very similar and will be detected by the same logic. Now that we are familiar with privileged escalation techniques, let's talk about how this research started. It all began when my teammate San Obsieller developed a tool for mapping RPC methods. The purpose of it was to find ways to manipulate benign services. For example, to call as a service to change the protection of a page in another process or to encrypt a file. All RPC servers on the system were mapped and methods were marked if the parameters that will be sent to the WinAPI are controlled by the RPC clients. The WinAPI could be called directly by the RPC method or after several internal calls. RPC methods were also marked if the specific keywords appear in their names. Let's take a look at the output of the tool. Here we can see it founds RPC methods that lead to APIs like create remote thread or create processes user. It found the calls after one, two or three hops. An example of a call will look like this. The RPC method server pass message is exposed by the DLL D3D10 warp. It will call an internal non-exported function called build, which will then lead to read process memory. Now let's look at one of the interesting results this tool produced. The DLL called BFE caught my attention because it exposes many RPC methods and I looked for one with an interesting name. This script goes through each RPC interface exposed by this DLL and looks for the word token in the name of the procedure. This led to a method called BFE RPC open token. It sounded interesting to me, so I started looking into this DLL and found out it is part of the windows filtering platform. This platform is a native part of the Windows OS and it can be interacted with by using dedicated APIs. It controls network traffic. It can block or allow it based on several fields like the path of the application, user, address, port and more. It does that by hooking the network stack and that allows developing security products like host firewall and IDS. That platform consists of several components. The first one are caller drivers. These are user-defined drivers that can be loaded and integrated with the platform to extend its capabilities. They receive network data and can process it in custom ways that the platform doesn't offer like the packet inspection, packet modification or just perform some custom logging. The second component is the filter engine. This component is designed to filter network data by using multiple layers from the OS network stack and the layers are set in user and kernel mode. The user-mode component filters RPC and IPsec network data and the kernel-mode component performs filtering at the network and transport layers of the TCP-IP stack. It also sends the network data to the caller drivers. The third component is the base filtering engine or BFE. This is a user-mode service that is implemented in the DLL BFE that also exports management functions for user interaction. It accepts commands to add or remove filters offer data and statistics about the platform and force configuration settings to other components in the system. This is how it all comes together. The Windows firewall and other security products use an RPC client implemented by a DLL. It invokes methods in the RPC service which then sends device hour requests to the filter engine in the kernel. Also, the various layers in the TCP-IP driver use the filter engine to classify network data which will then go through the relevant filters and caller drivers. Okay, we are done with the technical background. Time to move on to the reverse engineering process. Like I said in the overview of the platform, there is a DLL that acts as an RPC client. It has exported and documented functions that trap RPC calls to the BFE servers. This is the function that interests us. It has several parameters and most of them are clear. The engine handle can be gained from another WinAPI and we get back an access token that we can specify the desired access to. There is one parameter I couldn't understand, the modified ID. So I looked into the code to find out what it is. We're going to dig into several components until we'll have the full picture for this query. The first step is an RPC client, then the server, and the last one is a kernel driver. All the pseudocode snippets I'll show you today are a bit simplified. I removed variables declaration and error handling to make them shorter. This is the function in the RPC client, and it calls NDR client call, which is the first step in an RPC call. Based on the index that is specified here, we can tell that the method that will be invoked in the server is BFE RPC OpenToken. This method receives the modified ID and sends back a process ID and a source handle. The source handle is then duplicated from another process into the current process and stored in the access token variable. So the modified ID is still unclear. Let's look at the server now. This is the method from the RPC server, and it is undocumented, but the parameters for the RPC client make this call clearer. It starts by calling driver token query, and if this call is successful, we get back the token handle. So let's look inside driver token query. What happens here is that a device I requested sent and the handle to the device is stored in a global variable. Based on cross-references, we can tell that this device is called WFP-ALE. So what is this device? I searched for this string in the driver's folder, and it led me to the file tcpip.cs. This driver has a lot of functionalities, and it registers many devices. But for now, we're going to focus on the ALE device. I mapped the control codes and the functions they invoke. All of them are undocumented, and they are listed here for future use. Now let's look at the code of the driver. This is the function the BFE service will invoke. It uses an undocumented structure I named token entry. It will try to find it based on the earlier ID it received, which is the modified ID that we sent. If it is found, duplicate token is called. This is when I realized I found something interesting. Invoking APIs in the kernel means bypassing user-mode hooks. The desired access is hardcoded to bid token duplicates, and also the token type is hardcoded to bid token primary. If the duplication is successful, we get back the new token handle in the output buffer. But how an entry is found? Here we can see that the hash value is calculated based on the earlier ID and then sent to another function. Okay, this is the last step I swear. The driver iterates over a hash table and tries to find the entry that matches the parameters it receives. If the entry is found, it is returned to the caller. So this is the recap of the whole process. We use an RPC client that invokes a method in the BFE service. This service sends a device request to the TCP-IP driver, and after several internal calls, a hash table is looked into. Time to understand what this hash table is. The table is used by over 30 functions and stores various undocumented stocks. We can see here names like processing information, peer information, and connection context. The function that inserts tokens appear on the screen, it's too long, I'm not going to read it. The next thing I did is try to debug it and see how it is invoked. But it isn't called at all. Not during the boot process and not by simpler interactions with the machine. What we can tell about the insertion function is that it is called by another function named ALE Process Token Reference. Looking back at the control code table, we can see that it is invoked by device R request. But again, there is a complication. The function in the BFE service that sends this request isn't exposed directly by RPC. It will be invoked under very specific circumstances. We want to find a way to trigger this device R request so that token entry will be inserted into the table and we can retrieve it. Let's see how this insertion is done. The function receives a very simple structure as the input buffer. It is made of a process ID and a handle to a token. Note that any process ID can be set by the caller. One process can specify the ID of another process. This design can be easily abused. The driver changes into the context of the process specified by the PID by obtaining the address of the E process structure and then calling stack attached process. Then, the token specified by the input buffer is duplicated, a new token entry is created based on the LEID of the new token and this entry is inserted into the hash table. The LEID is returned to the caller. We finish reverse engineering the process of adding and retrieving a token from the TCP-IP driver. Now let's see how we can abuse the Windows filtering platform. To recap the last step, we had a problem. There is no RPC call we can make that will add a token to the table. But if we'll send this device, our request ourselves will bypass this limitation. We want to gain access to the device WFP-ALE. But guess what? Opening a handle to this device results in error access denied. This is because the device is created with a security descriptor by the TCP-IP driver. Here we can see the creation of the device. It is pretty standard. IOCRAY device and then IOCRAY symbolic link. But there is another call to a function named allowBFE generic call. And if we look at the token of the BFE service, we can see it has a unique security identifier that allows it to access this device. So what can we do? The BFE service has an open handle to this device and we can see it in the process handle table. What we can do is to duplicate this process or duplicate this handle to another process. This will give us access to the device and this action is allowed because the security descriptor doesn't block the duplication of the handle, only creating a new one. The next image shows how well the security descriptor is protecting the device. One thing to note, there are a few requirements for this action. The first one are debug privileges which are pretty standard for most offensive tools and also will need a handle to the BFE service with the permissions of duplicating handles and querying information. Gaining this handle isn't suspicious to any DR. Process Hacker does the same thing. That's how it shows us the information about the handle table. And also this type of handle is opened by the RPC client. So overall, it's a pretty legitimate action. Another benefit for sending the device our request directly is avoiding detections. Like I said before, specific calls to duplicate handle or duplicate token might be detected if they retain the token of anti-authority system to a process with lower privileges and using the RPC client will trigger those detections. This is why. We duplicate the handle to the token from the BFE service to the current process here at these points. And the only permission we can have for it is token duplicates because that how it is set in the driver. We can see it right here. This means that we'll also need to call the API duplicate token to get a new token that can be used to launch a new process. Sending the device our request directly will bypass these detections because the TCP-IP driver will duplicate the token for the current process instead of the BFE service. I will say that the initial permissions will still be token duplicate. So we'll need to call the API duplicate handle to change it. But that call will most likely be ignored by NDR because the source and the destination process are the current process. This object already belongs to us. Time to put all the pieces together. Our goal is to store token in the hash table and then retrieve it. We can rely on the technique we talked about before, the one that is based on the API duplicate handle. Like before we have our offensive tool and the process running as anti-assorty system, but now we also have the TCP-IP driver and the hash table. We'll start by calling anti-query information process to gain the handle table, but instead of calling duplicate handle we'll call ALE process token reference. This will cause the driver to store a token in the hash table and send us the LERID. Then we use this value with the call ALE query token by ID to get back this token. Time to see a demo. All demos were recorded on a fully-patched Windows 11 machine and these PowerShell commands show us the token held by the WinLogon process. We can see that the first token belongs to anti-authority system. We launch our tool from an elevated command prompt running as the local admin and we get a new console as a system. Let's conclude this attack. It has a few advantages. We avoid a suspicious caller because a handle to a token isn't duplicated from one process to another. Also, the requirements aren't suspicious. Duplicating a handle to the ALE device should not be detected by security products. Another thing is that I compared this technique to the techniques we talked about before and the token of several services can be duplicated only by this method, services like the LSM, WinManagement, Task Scheduler, and many more. At this point I was happy. I found a new privilege escalation technique, but it was based on a known one. I wanted to find something truly novel, something that will be accepted to DEFCON. So I looked for additional cross-references to the token insertion function and I found one that is related to IPsec. So maybe using IPsec will insert the token. But what is it? Internet protocol security, or IPsec, is a set of protocols that allows private and secure communication between two machines. It creates an encrypted tunnel that supports almost TCP-IP protocols and it also protects against several attacks. The first one is network sniffers because the payload of the packet is encrypted. It protects against data modification because each packet contains a cryptographic checksum. So if the data of the packet is modified, the checksum will be altered. It also protects against identity spoofing because the IPsec communication is established after its mutual authentication. This means that only trusted systems can communicate with one another. The final protection is against denial of service. The IPsec filtering methodology will draw packets that don't match the address, protocol, or port of the policy. This means that in an application, one process requests from unsecured sources. Before exchanging data, a secure connection must be set up. This is done by the Internet Key Exchange Service. Machines can authenticate with one another based on Kerberos, certificates, or what we're going to use a pre-shared key. There is another protocol called OTH-IP, which expands the Internet Key Exchange with more authentication options, most notably NTLM, and the IPsec policy can be configured with the Microsoft Management Console or the documented APIs. Here we can see an example for it. On the left is the Management Console and on the right are the APIs. So now our goal is to establish an IPsec connection. To do that, I used an example from MSDN. Again, the parameters are pretty clear. The engine handle is already familiar to us, the policy name is just a string, and the addresses are known structures. The first parameter I couldn't understand is the provider key. I didn't know which one I should specify, so I just tried to use every provider key on the system until I found out that the Internet Key Exchange provider didn't return a neural code. The second parameter I didn't understand was the pre-shared key. I wasn't familiar with the structure named Byblob, but I found out that the API GetAppID from file name returns this type of structure. There is one small problem, it only accepted file names. So I reversed engineered the algorithm and made my own function that accepts any type of string. Finally, I had a function in code. What I did is to set a breakpoint in the kernel on the insertion function, configured the IPsec policy on two machines, and started praying. I connected from one machine to another and discovered that establishing IPsec connections results in inserting tokens through the hash table. This is because metadata is kept on IPsec connections, and this metadata includes the token of the process. But I was curious, why is it kept? What is the token used for? So I dug into the documentation and tried testing several configurations, but the closest answer I have is this line from MSDN. IPsec impersonates the security context under which the socket is created. I couldn't find the code in the driver that does this impersonation, but nonetheless, we have what we want. Now our goal is to manipulate the service to create a socket that matches the IPsec policy. And this time we'll target a specific service, spooler. We'll start by configuring an IPsec policy from and to the local host. Then we'll call the method RPCOpenPrinter, which is a documented RPC method in the spooler service that will cause it to connect to the local host. Then the TCPIP driver will duplicate the token of the service and store it in the hash table. There is another problem. We don't know the earlier idea of the new token, but the value ranges from 1 to 4096. So we can just bootforce it. We'll start guessing the value until we find the right one, and the token will be sent to us. Let's see another demo. So we start recording events on the machine, and again, we launch our tool from an elevated command point. Now we can see that we caused the spooler service to create a socket. Then we guess the earlier idea of the new token, and got back a new console as a system. Let's conclude this attack as well. IPsec is used by admins of enterprise networks or for just ensuring secure communication with a server. So configuring an IPsec policy on a machine is totally legitimate. Also, the policy doesn't alter the communication on the local host. No service should be affected by it. And EDRs will most likely ignore local host communication and not slog it anywhere. Another benefit is that the driver automatically adds the token to the hash table, so we don't need to call ALE process token reference. And the final thing is that the interaction with the spooler service isn't suspicious. We don't retrieve the handle table of spooler or open a handle to its primary token. The call to RPC open printer isn't a known way to manipulate the service for privilege escalation. So now I was really satisfied. This technique is truly different.  So can we manipulate more services and gain other tokens? Yes, we can. A certain new goal. To steal the token of another user logged on to the machine. And it can lead to lateral movement if, let's say, the domain admin is connected to the same machine as us. I looked for RPC servers running as logged on users and noticed the local service account or anti-authority system. This script looks for processes running as a domain admin, then checking if they expose an RPC interface and what happened is that I started going over this DLL until I found out the DLL that had what I needed, sync controller. Once two or more users are logged into the machine, each session launches the one sync SVC service with the user's permissions. Here we can see there are two instance sets of the service, each one with a unique suffix. This service loads the sync controller DLL. And this DLL implements an undocumented RPC method. Again, the name is too long, I'm not going to read it, but it receives a string that causes it to connect to any address we want. Time for one final attack. We'll go over the services and find the instance of one sync SVC that runs in another session. Since the interface of sync controller is exposed by several services, we need to find the unique LPC port opened by the service that we are targeting. We can see it in the process handle table. Then we'll start a listener thread on the port 443 and call the RPC method. This will cause the service to connect to us, and while the socket is active, we can bootforce the early idea of the token stored in the hash table. Let's see a demo for that. Okay, so we'll look for instances of one sync SVC. There are two, one running as the local admin and one running as the domain admin. Then we'll look at the handle table of the service and find the LPC port we want to connect to. We'll start recording events on the machine, and we can see that the local admin cannot access the shared drives on the domain controller. We'll tell the tool to target the second session, and we can see we caused the service to connect to us. Then we get the new console running as a domain admin, and now we can access the shared drives on the domain controller. Let's conclude this final attack. No other tool abused one sync SVC before. I didn't see any mentions to the service online, so calling this RPC method should not trigger EDR solutions. Also, like I said before, it can achieve lateral movements. There's another thing. It is possible to be notified about a new login session and then execute this attack. I might add this ability in the future to this tool. So these are all the ways I found to abuse the Windows filtering platform. We can gain tokens of system as well as other logged-on users. Now to the final part of this talk. I submitted my findings to the Microsoft Security Response Center. I explained every attack I found and sent them POC code, and the response was, we determined that this behavior is considered to be by design. Well, what can you do? Let's move on to detection. I tried to make these attacks as stealthy as possible, but they can still be detected new IPsec policies that don't match the known network configuration or even correlating RPC calls with the existence of an IPsec policy. Calling many times to ALE query token by ID is also a strong indication for this attack, but the best way, in my opinion, is detecting device IO requests to the ALE device by processes other than the BFE service. For those who prefer log-based detection, let's see if it's possible. The Windows filtering platform generates logs for events, but most of them are about packet drops or other types of failures. It is possible to log a loud packet, but it is generally not recommended because it will generate a lot of noise. I looked at the logs generated during the attack, and saw they are not indicative enough. Let's look at them. This log shows that the spooler service was allowed to connect to the port 135 on the local host. There is no mention of an IPsec policy disconnection, but there is a filter ID. Quaring this filter returns the following information. Again, it's just allowing local host communication, no mention of IPsec or any data relevance. Let's move to further research. During this research, I had a feeling that the TCP-IP driver is a gold mine, and I'm sure that with the community can find more ways to abuse it. There are more devices than just ALE, with various functionalities and a lot of methods to invoke. Here is just a partial list of them. Although we talked a lot about the hash table, it's worth digging into even more. It is used for managing data about various operations and it stores a lot more than just tokens. Some of the data can be valuable for attackers, and there is one thing that caught my attention. Credential information. The TCP-IP driver stores something called process explicit credentials. In much like tokens, it can be retrieved through RPC. Unfortunately, the exported function in the RPC client is undocumented, so this query is even more obscure. I tried calling the RPC method with arbitrary values, but got back the error code access denied. My immediate response was to execute the code again as system, which worked, but if we don't want to do that, we can just skip over this check. This check is done by the BFE service, so we can just send the device our request directly. The same device that you can see here. I dug into explicit credentials some more and found out that much like token entries, none are inserted into the table by default. I tried to find configuration that will trigger it, but found none. So I did the same thing as before, looked at cross-references. Cross-references to the insertion function show names like security and early process circuit options, so maybe the API WSA set security is somehow relevant. The Internet Key Exchange service uses the query function and cross-references in this service show names like initialize SSPI and create SSPI IKE, so like you might guess it is somehow related to SSPI. This is everything I found on explicit credentials stored in the TCP-IP driver. I encourage the community to dig into this subject and finish this research. Time to conclude this entire talk. I showed the process of reverse engineering an RPC call and achieving lateral movement and privileged escalation. We looked at the various components of the Windows filtering platform, analyzed them and bypassed the security mechanisms, protecting them. Also I shared some leads with you that you can continue and look into. Several attacks were developed and their advantages are that they avoid Win API that are likely to be monitored. They can execute code as system and other logged-on user, compared to many tools that only elevate the system. They are very sturdy, there is barely any evidence and logs and I tested them against some security products and no detection was generated. This is the code for the tool I'll leave the link up a few seconds so we can look at it. Thank you. Any questions? You can just talk to me right here.


Hi, this is Jimmy Glass and this is my match my... Heeey! Heeey! Heeey! Heeey! Heeey! You know how speciality hosts the boy. The what? Match my catch. Okay. I am Jack Simpson and this is match my... What? The match my catch challenge. The match my catch challenge. What do I do with the ball when I catch it? Oh, keep him. Yeah. Hello, my name is Nathan Hackey and this is catch my... What is it? Hi, I'm Jack Simpson and this is the in my... Why is this? This is a mouth. Match my... The match my catch challenge. The match my catch challenge. Hi, this is Nathan Hackey and this is the match my... catch... Super slow. Hi, I'm Brad Smith and this is match... Whoa! What is it again? I can't remember what it was. Hello, this is Nathan Hackey and this is... I'm Nathan Hackey. Again? Hello, this is... Hello, I'm Nathan Hackey and this is match my catch challenge. No? Yes!


Here's why Casper thinks finding a job is harder than starting a business. Even though Casper Nyovost has good intentions by sharing his words of wisdom, it doesn't seem to land the way he intends it to. The rapper had to once again fend off trolls who targeted him for being a high school dropout and for his views on starting a business. Casper was replying to a question over why people who got jobs were seemingly more celebrated than people who started businesses. That's cause finding a job is harder than starting a business. Anyone can register a business. The rapper had to further clarify his statement. Running a business and getting it to be self-sustainable is something else. That requires time and effort, he said. The tweet was enough to attract more trolls who insisted on calling him flashy but the rapper is so used to that type of backlash that he had a reply on standby. I don't even have to say none of that anymore. They know. It's all fun and well when they come at me and rub my background in my face but when I celebrate what I made of myself regardless of not having a metric, rich parents, a job, degree etc. Then I'm too flashy he said.


The U.S. tests air-launch hypersonic missile. The United States Air Force has tested the AGM-183A, an air-launch hypersonic missile. The first round test of their air-launch rapid response weapon, ARRW, was conducted near Southern California on December 9, paving the way for the U.S. Air Force to adopt a hypersonic air-launch missile for the very first time. The Armament Directorate Program Executive Officer Brigadier General Jason Bartolomey confirms that the ARRW team successfully designed and tested an air-launch hypersonic missile in five years. The service reveals that air-launch rapid response weapon reached hypersonic speeds greater than five times the speed of sound, completed its flight path and detonated in the terminal area, completing its objectives. Manufactured by Lockheed Martin, ARRW will be put into production in 2024.


The meeting we had with Prime Minister Modi was absolutely fantastic because it was the recognition that India has done a tremendous job in creating a road map that's pragmatic that tries to achieve sustainability. And by sustainability, it's sustainability of the economy for advancement and growth of the population, it's sustainability in environmental performance, and it's the critical recognition that there is a need for hydrocarbons to make energy available to all in a just and affordable manner. So it was really a pleasure to be part of it, it's really outstanding that India is following this path, there are very few countries that are doing this, clearly no one has decided as committed as India. So great effort to be part of this and really enjoyed it, thank you.


Yes? How do you reconcile the based-on-objectivism with democracy? Maybe you need to place a mass of people in the majority of people. If you don't mind that. So I... Sure, so how do I reconcile objectivism with democracy? I don't. I'm against democracy. If democracy is understood as majority rule, that is, I'm against the Thenian style of democracy, where they don't like what Socrates has said. They all get together in the arena and they vote to execute. And of course Socrates takes the poison, because he believes in democracy too, and the people have spoken. And Plato's sophisticated escape plan goes to waste. So I'm against majority rule, and I think this is why defining the role of government is so crucial. If we define the role of government as protecting individual rights, then no majority should ever be allowed to violate somebody's rights. The fact that 51% of the people want me silenced gives them no way to actually do it. The fact that 51% of my neighbors want me to keep the trees, and I want to chop them down, gives them no way to do it. Of course, in the U.S. today, and I'm sure in many other countries, they can't. They can't decide what type. Whether I go down to my house, whether I chop down a tree or not, all of that is decided democratically in the United States. America's moved towards democracy. The whole idea of a right to property is an anti-democratic notion. It says that 51% of the people can't vote my property away from me, eminent domain, which is democracy's applied to property rights. The speed says 51% can't silence me. 99% of the people can't silence me. I'm a strong believer in constitutional republic, in the context and framework, like the founding fathers of the U.S. established it, where they are individual rights. Nobody can take them away from you. No majority, no democracy. The things people can vote on are very limited. They can vote on their representatives, and their representatives can do very few things. Things like a clearer definition of what property rights actually mean. Property rights are an evolving concept that challenges the property rights. Continuously, we need a legislature to continuously define and look at how do you define property rights over the internet? How do you define property rights over minerals? They went a long way in the 19th century, for example, with property rights, and at some point in the late 19th century, all new thinking about property rights basically stopped. And today, we don't have property rights. Today, it's just whatever the community wants. So, I think we need to get away from democracy, and towards protection of individual rights, and away from a majority rule, and towards people voting on very narrow things, only things that are not violations of other people's rights.