So that was my thinking for this, but Amanda's done this for as well. So I'm going to turn it over to you for a minute. Amanda, just talk about how, I mean, in previous sessions, you had this long journey. Yeah, absolutely. So something that we've always found useful when working with educators, we usually try to build something at the end for just like ideas and stuff. Sharing in the sense? So like we said that some of the classes are using census data in different ways or maybe these are happening in different ways. I had envisioned this being on big post-its up on a wall. I didn't bring my big post-its in there really at all. So I have little sort of big post-its. If there were any ideas that came to you that you could like maybe adapt something that we talked about or something you're already doing that you want to share with people, we can just like stick them somewhere and we can do pictures of them as a sort of resource. So I can pass things. I got like normal looking and right looking depending on your persuasion. I stopped at Target and bought some random markers that I think we'll be able to. So we just like passed up around. I really thought I was glad that team, but I didn't. Thank you. So yeah, just anything that came to you while we were talking? Or also have you maybe if you went around the fair and saw all these other amazing resources that are in the city, if there's anything within them that you could maybe integrate into what we talked about today? So just to sort of clean it out. Yeah, as a way like that. I always have this vision in my head of holding onto a helium balloon. But I'm at things like this and there's always that idea. And then with the minimum level of the balloon. Yep. Yep, so get it out before it disappears into our weekend. I'm actually thinking that this would have been helpful if people wanted to figure out what they were and what they were here and then having to figure out what they were and what they were going to be like. Yeah, around the introduction. No, no, no. And then also understanding the particular context that it makes because it's kind of related to what it's actually about. Yeah, I don't think that is it. Like as people are coming in, it's like, what are you trying to get out of this kind of question? Yeah, something like that. I know we did a three day teacher institute in Vietnam recently. Which is quite a good thing. And all of them were like, what I want from this is a deeper understanding of why this happened.  At least it was nice to know that what they were looking for was understanding and then they could shape what we talked about. I don't know if we should explain about the ways people are thinking about maps in this same space. You can just look at history's center and remember what was the name of his organization. Oh yeah, National Humanities. Yeah, it was really interesting. You need to connect with them. Are you kidding me with them? No. And I guess I was thinking of that. I have thought along the line that the mapping of this map of GIS it just takes on a whole new resonance. It's kind of something that's all important to me. The calculus, science, and math, and the humanities. That it really is such a powerful, transdisciplinary with the possibilities of strong comparison. And I think what is interesting to realize is just how dispersed our work on maps is. I mean, as educators, do we know how to do the mapping? I'm just like, that's not a big thing. We need to work on this and really think about this.  And it's being used by, you know, it's like a professional tool and it becomes this and that. And so, yeah, it's not an easy-to-use tool for our teachers. But, you know, as an educator, it's very difficult to know that that is how that tool is, you know, how archer has taught those stories.  But then the demand thing is what I love about that is the deer skin. And it's kind of a mental model of the trading process. It's just something such that is so interesting. So it'd be, it's back to recognizing mapping as a transdisciplinary, key educational thing that maybe shouldn't be worked on in the way that you have which is like, you know, this little deer doing this, this little deer doing this, and, you know, meantime educators are up to their levels just trying to struggle through with curricula that's in the way of this. And, you know, it's, to me, it's, it's got a real, you know, I was glad he was showing us it. I was glad he was showing us because I thought, oh, maybe we're going to pull it together. We're going to have to work on what's going to sound key, but, and we did have examples of how it could come together. Is there community practice for educators like you who want to get together and learn digital, learn the great utility of digital mapping together? Is there a specific remedy? It's a remake service, so. They're like our... They didn't fit it here? Do you think they should? And, you know, but I would make the suggestion, so I think about a nice history center providing a project, you know, that it's like partly identifying it as an issue and then getting the keys to some groups who could orchestrate, who could collaborate to create opportunities for educators to deal with that. But in some ways, I feel like we're still, I don't know if there are places where I'm not creating it. I doubt it. I bet we're sort of like individual educators now. Oh, this could be important, but we haven't really figured it out. I think that's a huge opportunity, what here is there. And even Andy talking about the resources that they have, those are still not. If anything, you'd think that a scholarly organization like that is also supposed to be helping teachers would be a place where there is already a resource, but I don't get the sense that there's not. Honestly, right? There's obviously an understanding to present that we have to open our eyes to do the things that we want to do, but to actually have the tools to do this, that part is still missing, and to do it in a way that's more inclusive and help to raise issues that students really care about, like how are they using these tools? That's not been connected. I do wonder, I don't know the difference between ArcGIS and Australia, I know there was a thing together, but I've never understood that. But I wonder if they have a little bit of, I know they do train teachers, even that a lot of classes, like teachers, but they might be a part of it. They might have done a little bit of... And I'm searching myself now about that, what do educators do? What sorts of ArcGIS? I don't know what the difference is between them and Australia. I'm looking at math people. I think that's what makes ArcGIS. From what I remember from a class, and it could be outdated, three years from now. So I know that as we're in story maps, they do a wonderful life. And then I've always imagined ArcGIS sort of like the back end of that, but I don't know what it is. But I see that in a lot of my classes, so just get a start. So I think I might have a little bit of background just a little better. Yeah, Esri, Esri is the Environmental Systems Research Institute, and our supplier of geographic information, systems, which is GIS. ArcGIS is a form of geographic information. And I don't mean to say that somebody else would do this all day, but... But then take the conversations at some level, so the pedagogical application is not something that they do. I think that ArcGIS is about the big history that I remember in the city that I'm now in the history project. But I was thinking that big history is another group that would be, you know, a key group potentially, because it's where the sciences, history can come together and just... But I do feel like because we're working the way that it's... This is just a way out of the question. All of us. All of us. Everybody kind of... It's interesting to know all the partners here, whether everybody does that their own, or gets a lot of overlap, but what's cool for a new manager is to come in and have a question and bring all these investors to have this overlap at the table. And it sounds like that's the kind of thing that should be happening. More. You make a good point, Margaret, and when we're done here, we also have to create space for the people to do it, and that's the space you have to create with money. If we're being really crafts, right? Fellowships or programs that allow people to release time from their day job, whether they're educators or designers to engage in this. So, you all had going with the cooperative model of students here, right? So... Is that true? Yeah. Because I mean, I think that's actually a really good idea. But when we do the writing project, because that's when educators actually have a good point to make. You know, so, I think teachers, and the projects, first of all, they need to actually pull up their shirts to get into it and figure out places in their curriculum where they can do this kind of work. So, that's one kind of thing that I think could happen. But I do think there's another thing that we should be talking about. There are these people. And it's not just here in Pittsburgh. I mean, it's really, of course, around the country. But have we identified this, you know, the idea of napping as a transdisciplinary hoped place to work? You know, and I'll just say, like, the writing project, one of the group that we played around with on this was a group out in San Francisco called NEXTHEM. And they were doing work with paper circuitry and stuff like that. They came in and the head team guys were involved. And that little learning party, they were doing the mapping. They were downloading the maps and we were mapping out their stories and paper circuitry and laid out some places and it had been programmed and programmed into it. And that was kind of a little play date that we have from that kind of show. But we didn't go beyond that. In effect, it was a good idea. Well, that's a question I've had about our time and other tools. Like it is, I'm not an educator in schools that often is there a demand for this kind of technological currency or is that a demand that we're creating or trying to create? Here's the thing. What's happening in schools right now is not my argument. It's being driven by forces that are out of the hands of teachers and students and the like. It's just happening. If we thought about it for a minute and realized our students have cell phones they have mapping tools in the cell phones this is kind of a key thing right now. We have a sort of moment in history where we really need to understand the bigger story than you might see it as being really important. But I'm just saying that's not teachers on the place. If we had more teachers around the table I think they would say they might like to do that. Yeah. I do work both in the community and in schools and I feel like doing more a larger project and we're diving around critical theory could happen more in my community-based settings where I can actually spend more time with you versus like what constraints I have in school in the classroom in the community so it just that's like the challenge that I felt I was really excited to come to this workshop because I was like oh mapping but I haven't done mapping outside of the apartment and doing things like that where we weren't necessarily mapping people and their stories and which is everyone was just like data points and that was that. So I think for me I've been challenged by the breaks I've had between data and information that we never had. I think of kids digital storytelling like tip-top and like everything and it's like at every point youth have the ability to tell their stories but also how do we connect that to history and also connect that to current social issues and the issues that youth care about in their lives and their communities have and so I also have questions and challenges like what can we do to make things that are youth-led and not just centered focused and actually give youth like a critical theory to actually imply a system like it's really cool to talk about things that are interesting to them but also like how do they how can they connect this to like a larger issue and that is about like issues or like how can they like how can you do something like kidnapping storytelling and I also just think of who has access and what you're going to see is the way you can do research and like I think that with all these digital tools we all have the ability now to create media but like it's not what we're doing I'm excited I definitely want to connect with you I'm excited I'm excited I'm excited I've done lots of and I think also we're doing STEM scene work like that's like a big thing it's very goodness not just pushing youth and young people into those fields but like how are we also like having kind of like a social justice and equity like kind of mindset already that's like built into these fields I predominantly work with Latin around youth it's like we're pushing into the pipeline into STEM scene but like they're still experiencing so many different forms of prejudice, of misogyny of transphobia and all these things and it's like well this is like that's a different industry it's like that shouldn't be the way it is or like I think it's great college and research have these things so it's like how do we not just you know communities that have been marginalized historically we're just like kind of a research idea or the project how do we actually get folks involved schools involved can be involved I think that if maybe we can't do this individually in schools as teachers maybe we can do something together it's like a community it's like a larger project where youths become teachers and kind of cool and strong this project outside of just like these projects funding and capacity it's very very grand reliance so it all depends who's got the money and what they say so I just said a minor little brainstorm because we have to do and I want to do what I'm excited to do a fourth event like once three events have happened bring people back together and show some insights that came out of this but we don't want it to just be something showcasing insights that came out that can be useful to the community and that can actually help people move on so here's my crazy idea what if that fourth event is almost more like a charrette or some kind of moment where youth can design based on what we've heard but helped to prompt discussion by calling out some of the things that we've heard from discussions there but then really have Pittsburgh's next generation be the ones helping us determine what's next designing around because one of the things that's been rich about these moments for us coming outside Pittsburgh is that particularly J.B. Brown and the folks from the YMCA brushed in brushed in and he had some really neat ideas about what he wanted to help his students have access to putting that in one of the center thoughts from youth led participatory design would be amazing I think that developers in the room as well to talk about these sorts of things we'd love to be part of that that sort of thing we're very grateful to you this is actually a couple of them just even right now I'll put some ideas down and we'll do a little more on how to work with the first event and some kind of reflection of what happened in the second event and where some of the news that came out of that so that will come out but we'll let you know about it thank you and thank you Chris we appreciate it I saw the beginning we've changed so great


Okay folks Larry Pesavento with the afternoon update and there's nothing to update it's just up up up that's what we're seeing we got the NASDAQ the Dow Jones the Russell and e-mini S&P soaring to new highs everybody's happy that the bank thing is all over and there's no problem anywhere and you'll be able to look at that as you see these bank stocks start to rally some of them are up almost 1% folks and that's after dropping about 80% anyway we're going to see what happens over these next few weeks the strange part about this is we got a strong move in the Treasury bond market this been still going higher and we also are looking at the bank stocks on the NASDAQ the smaller regional stocks and they're not rallying at all so if you take a look at all these bank stocks at the end of the day and see how well they held up that's what you want to be watching because these are the people that own the stock the stockholders not the people that have their passbook that's a totally different animal those people usually be prepared be protected by FDIC but we'll have to wait and see I personally do not believe this banking thing is over when you get everybody in the banking system you got Yellen you got Powell and a couple other dudes there in Washington come out and say there's no banking problem we got this thing taken care of it was just an aberration that's when I began to think you know if it was real silence nobody said anything it's because there is no problem those I'm not going to go into what Bernanke said in October of 2007 except that he said that everything was green lights in the economy didn't look like there was going to be any problems for the next two years and there wasn't if you were short so anyway that's had a nice move in gold up to 2000 it sold off about 10 $15 no much not too much a silver hit 24 27 still looks very very bullish but could get a little bit of a correction in here but other than that things look pretty good but the stocks are really rallying quite a bit today they've reached 78% level in the S&P 500 within about five points so there's a few things that may or may not happen but we'll have to do one thing at a time that's all you can do as you look at some of these things here today now if we have to take a one small thing that I'd like to bring to your attention is and this comes from our good friend David oh dear I gotta take deep breath here is sell when you want to not when you have to so that's a good thing to remember so live every day in an attitude of gratitude and may God bless


That's it. Hi everyone. I won't take too long because the dinner is approaching so This talk is gonna be on this realization bug. So if you are a pentester, this will this talk will give you a good trick that will probably be able to reuse this year at least and if you're cis and min this will expose you a problem that is Getting more popular and and yeah, so it's a practical talk But the technical one So who am I before starting the talk? I'm a researcher at go-saker. So basically I'm doing analyzing varieties and trying to find new ones on a popular Software I'm also doing various tool to help pentester and other security analyst Some of the tool I do I do find security bug as Pierre David mentioned so it's a statistical system I also do one for a dotnet and other burp extension for Helping pentest pentest task I'm a volunteer at for nerd sec for a few years. I'm doing challenges and It's the second time. I'm giving a conference here So now getting into the subject. So why we are here So what do all these application have in comments so late at the last year all those Application were available to the same ability class So it's the same pattern not exactly the same exploitation but it's really the same ability class and All those are Java application But we'll see I'll try to highlight also the design principle and the design problem related to this flaw That also apply to other language and other library So the common thing is that they all use Serization functionality that are accessible remotely so I Will divide this talk so first we're gonna go to the basic So just explain what is this realization to make sure you understand off Serization is used Properly, so what's the real use case then we'll go into exploitation scenario to see how we can Use alternate behavior and expect unexpected behavior based on this functionality I'll also give example of other language just to show that there's our small differences But it's same principle that will apply you. So what is this realization? So I'll give a basic overview. So first what is this realization? It's when you transform data and you put it in a format that is ready to be transfer or store So why do we do this? We do this transformation either to persist a state. So for example to do storage of a State of the application a session or anything We can do caching with civilization Also communication between process if we need to restore something in another process and And what will be the most interesting case will be network communication because if we're talking about client server communication That's much much more potential for security For pentester to get remote code execution then and when it's all local communication So that will be the main focus of our different attack So as does Serization work. I have a visual representation So we have one application running in this case. It's a client application we have various object in memory and We cannot just copy the memory representation because Object will have tons of reference of caching property that we don't necessarily need to transfer That's why we're doing a transformation and we'll extract some of the field potentially So then we will create Will serialize to an object. So it will be a format so here we're gonna talk about native serialization, but It's same as Jason XML a protobuf being called all those are can be considered serialization format But there they will have difference obviously in their representation and When the other application will is receive this format it will be able to restore this state And reconstruct the object out of it. So I have list a couple of formats But what's the main difference between? native serialization in Java and for example Jason so the main difference is that Java native Serization you can add custom behavior to Object that are being deserialized In Jason it's static and info so you can list property, but you cannot Add custom behavior when deserialization occur at least not in the most popular lives So I have a couple of example Just to give you an example so here optionally for Serizable object we can In Java Create a read object method and this read object method will be called when the object get deserialized So if it's a communication over a network when the server will receive the object if it's a custom Serizable object with a read object this will be execute when it's deserialized I have another example here That is doing other thing, but in general it can be more complex calling other classes. These are really basic example and One thing to remember is from a design printer view From a security perspective, I mean As soon as you have custom behavior that library we are introducing for the attacker it's an additional entry point so Contrary to static data like Jason if I know that I can Instantiate any class of your application and trigger those read object. Maybe I will be able to Instantiate class that are not expected to be called. So then those read object Behavior could be triggered in an expected way and one thing to mention Like in the example on the left The object state will be restored so the property will be filled and then some execution will occur So then the attacker has an interesting entry point because you'll be able to initialize the object as you want And then the behavior will be executed. So this introduce much more possibilities so In the code we'll see just an example of Java deserialization So if the server receive a pillow it will do read object to deserialize the object So internally what he will do in the byte stream. It will find the class name Based on this it will load the class if it's not already load it will instantiate a class No constructor is called so by default no method is called and it's only if read object method or implement that they will be called and The common cast that we see this is not something that happened prior those steps so The execution of the read object method will happen even if the object is not a comment So it will trigger in the end a cast exception But this is does not stop an attacker from sending any type that is available in the application So there are no assertion that in this case common object will be sent to the server It can be any object So we'll look at one example that was a the most common one to the application we mentioned previously So we'll look at common collection. So we need two ingredients to have a vulnerable to engage in to have a Venerable application first we need deserialization if you're not doing deserialization your application is not vulnerable for sure So if you have property app Lee proprietary application I'm gonna show it in the end and a tool that will be able to scan your application and find if you're using deserialization Somewhere in your application potentially in legacy application functionality and The other ingredient that is needed to have a successful exploitation is have par for Serial is a ball class and those serials ball class will call them gadget these are class that are salesable with interesting read object method and One trig we can do unexpected behavior that will lead to remote code execution So the main design flaw is you shouldn't do deserialization and accept any class Any type of object on your class pad because you'll have so many libraries that you don't have looked at that could Create a bad behavior So this is one of the popular gadget that all the application I mentioned a prior add in their class path so those are a class on the right from a live common collection from Apache and I Won't go into the detail of how the gadget works because I want to stay eye level to just to make sure you understand the design principle that is the design flaw but in the end those class can lead to Remote code execution and the interesting to to notice is that some of the class the chain transformer are not a class with the read object method and the way they are trig is that they are We're using an invocation handler and invocation handler is sales ball object that is Another entry point so it's not only a series of all a class that are interesting to attack because invocation handler in Java it's going to be a combination of Invocation handler and a proxy so the way to work. It's like in a script. So if you want to do marking on object you can Replace if instead of calling class test you could mock a Class that will likely implement test, but instead all all the call will be redirect to a proxy They are deposit to an invocation handler so the idea is that Proxy are sale as a ball so in your gadget You will put an instance of a proxy and it will reference to an invocation handler that will you'll be Your interesting entry point so all invocation handler in the class path Of your application can be a trig by an attacker and it was the case of common collection They were using an invocation handler from the GDK, but in the end it was calling a common collection classes so I will do a demo of A tool that you could use in a pentest that is wrapping tons of of gadget So you do you don't have to build yourself all the chain of that I present previously Okay, so this demo I choose J bus because visually it's a more Easy to understand because most of the venable software were available over a Remote admin client so it was all come in line a client But this one it's over HTTP so it will be more visual and easier to understand so we have all the version of J bus here and the interesting end point is a invoker Just zoom a bit At this URL invoker jmx invoker servlet and this endpoint receive a serialized object So if we're using the application or the admin panel and we see serialized object in the in Bar proxy, for example, then we know we have a potential to replace those serialized object with our malicious gadget And that's what we'll just do So I'll just zoom out So the tool I'll be demoing is a white soil cell So I think it's visible So it's pretty easy to use When you enter no argument, it will list you all the gadget available So the idea is that gadget will only work if the needed classes are on the class path so if for example, you have the Common connection library on the class path of the verbal application it will work but if it's not the case you might need to rely on another variation and The argument are quite easy to to set up so the first argument will be the The payload so in this case we'll use a common connection one and The second argument will be the command will execute so in this case I'll just run calculator, but you could replace this tool So I'm doing a get to our river shell and then execute it for Re-having a river shell on the server So This so the output will be a serialized object we can if needed we can an accord it into base 64 The output is just the payload, but in our case will just send save it to a file To Nordsec.bin Just show back the comment so the only two argument were needed was the which gadget we're gonna use and then the comment being execute so this you replace this with your river shell and Where I'm saving it to Nordsec.bin So on that f I have burp in repeater So I will be sending an HTTP request to the renewable endpoint and if I send nothing I will get this organization error telling me the empty value I get an error Instead I will load from the file. I've just saved the Nordsec.bin and This is the serialized Gadget so and as soon as I will send it then I get execution because My server is running on the same machine. So this is just a visual confirmation and the Okay, okay, it's actually a really reliable exploit So if you see in your assessment over noble all the gboss web sphere all those Java container a lot of them add remote API like this So that's so that's for identifying exploiting actually with gadget Those available services so the basic methodology is you need to first find serialized object going through your proxy Sometime it will be in wire shark if it's not HTTP requests First then I mean the second step will be to generate a gadget so In this case with the wire so sale we will able to generate one for common collection Then we replace the initial object by it and then we just replay the the request or continue that with the protocol If it doesn't work You can repeat the same thing with different gadgets So it just trial and error since you are if you're doing a black box test You won't know for sure what are available classes on the remote application, but you can just try one after the other If it doesn't work It might be a specific protocol sometime if the Read ends or other primitive type prior reading the object You'll need to just follow the sequence of the protocol until a read object is done and you'll be able to do the same thing so that's a little detail and If it doesn't work it might be that it's not available So a there are whitelist thing the class that could be deserialized or there could be a blacklist in place So that's the demo. I've just did so that's from an attacker point of view or if you're doing pen test That's what you would do a black box But what if you have a proper proprietary application in Java for example, and you want to know I'm available to that this and Because you could have so many endpoint sometime. You don't remember the legacy one So To I'll do give do an example of how you can scan your application or even property Proprietary application that you don't have the source code from So what you'll look for is two thing the two ingredient I mentioned prior so the deserialization operation so this is the design flaw and Potentially the gadget to exploit so if you have if you are testing an application and you are able to download a trial Or download the application you could do a scanning and potentially find the interesting endpoint that are Exposed that do deserialization. So this will give you some ends and Also, if the gadget are not Part of the known you might need to build a custom payload for from this so So the demo I'll do is with the find security bugs. This is the static and SS2. I'm maintaining so in this case, I'll just analyze the same application as Privacy so in this case it will be gboss But if you have an application you could do the same thing So find security bugs the command line are at work. You specify directly or jar But if you want to scan completely All your application you could extract all the list of jar and then passing it to the The tool and it will scan everything. So in this case gboss, it's around 2000 meg of binary jar file so What I've done I've created List contains all the jar and I will pass this the content of this file to the tool so The command just looked like this Okay, so the command is in detail. It's not that it's interesting But I will be analyzing all the jar of the gboss and I will be creating a report out of it so this could take a couple of minutes, so I have already a report produce and One little detail to mention is that I don't have the source code of Gboss right now. So it's only scanning the binary format. So this is interesting because you'll have a full coverage of the class available and You'll be able to reproduce this on a proprietary application also So I'll let this scan but I have already the the result So we're looking for two type of thing first the desalization part. So As an attacker if you're looking at the big application you want to know where in the application Desalization occur. So you have you'll have obviously couple of false positive because as I mentioned previously serialization is used for multiple use case and it's not always a remotely accessible But here in the gboss we can quickly see by the package name that We'll find some remoting packages. So this is a remoting API. So most likely accessible from remote and other Rest easy is also something Accessible for a rest API so could have a potential so we could analyze those We have a reference to in which method and in which class the desalization occurs so we can review With a disassembler or decompiler Now that we know that it's a Venerable to desalization we need to find gadgets. So we could try the gadget from a why so sale But if we didn't win have a known one that that work In the next version of find security bugs there will be a gadget finder for a Based on multiple heuristics So basically we don't want to list all the serializable class in the the application because there would be a couple of thousand Possibly so those are all a case where desalization it's solables class with a Risky operation being done sometime reflection or Other behavior also invocation handler also identify as a variant of those and the third Occurrence that it will find is actually the vulnerable Gadget that was found in a common collection So with this tool if you want to do research and find your own gadget if you're stuck because some Because currently a library are proactively patching those so they add switch to make them not Serializable remotely or add switch So the gadget are still there, but not exploitable So we need to find new ones So if you want to find you ones That's a one way that you could help you because it will highlight you some interesting class instead of looking at all the code of All the library in your application So that's from a defense perspective if you have You're maintaining a web application in Java you could use also the plug-in in your ID to do the scanning also and And I'll quickly go to the other language so that's just to highlight that this is Design flow that apply to multiple type of library. So it's not just Natives civilization in Java as soon as you see custom feature that occur during parsing it It's something that we have saw also on other library in other language that they decide to add custom behavior That could be triggered by inserting a specific keyword or specific part in XML for example So any library that has custom behavior to this organization Will could lead potentially to unexpected behavior and a remote code execution potentially So We'll look at the PHP case. So PHP answer lies method There's no possibility to whitelist the class that you want to answer allies So really if you are doing answer lies PHP, which is you should never do Your opponent to all the class that are allowed from your file So anything that you have include will be accessible and will be able to be this allies This will include obviously also all the class of a PHP API and The interesting trigger here. There's no read method like in Java, but all the magic method can be trig Accidentally that mean that if you're desalizing an object that an attacker send it will also call the destruct method When the script will finish execute So then you could have also a chain of execution that would lead to remote code execution In general that the chain will be a quite complex It will be a chain across multiple object, but here I have a small example that is easier to understand So this is taken from a clue CTF and the challenge was There was a answer lies operation that was being done and You add also sort of access to source code So you add a couple of PHP file also with the application and what one of the class SQL DB was having this deconstruct method a destruct method and Each time the SQL DB was being closed It was calling a square close and then create log and the create log was doing a SQL queries So from the developer perspective, he didn't intend that this method will be called remotely. It's all the variable Coming from the local object, but the attacker this class become an endpoint because I Can call the destruct method with any state that I want of this object so any field I can Put it in the state that I want So in this case the interesting part was the create log operation and it was doing SQL query with sanitization, but Sanitization what it will do it will It will if you add a single code it will add a backslash and the proper Escaping but here the thing to notice is that the log table the table is not between codes and In this case, we don't need to add code. So we'll be able to just a straight injection So the way the get the gadget or the malicious payload will work is you serialize this class with the malicious value log table and Once it will execute it will trigger the SQL injection So that's for the example in PHP in Python, it's also a bit different. There's a pickle which is a highly documented that you shouldn't use in remote API, but you'll find it Not often but more often in CTF And the interesting part is the reduced method. So like the read object method in Java You can specify a custom reduce method and this method will be called one object RDC allies and The main difference with Java is that you're not dealing with all the object You can also even serialize this method in the object that you want. So you can also see allies code Code section with the object. So here we have a basic Example so code box calling call.exe and The remote application that doesn't even need to have this class in in its application will Serialize this class and the reduce method as we can see is doing the code that we want to it to execute so in this case it's creating a process and in the exam or the Serialized version we can see that the code of the reduced method is also bundled. So this is probably the most Easy way to exploit the serialization because we don't need to yes Yeah, potentially But yeah, yeah, but then you would need to use another API that is available. Yeah That's something I'm not sure but I would have to check So the main difference to remember is that in the case of Pico The reduced method the code is serialized with the object. So it's not just property and data So solution the instead of Doing patch and doing whitelist so for existing application If you have legacy Java application that are doing Serialization you could add a blacklist to make make reduce the risk of Having known gadget being used as a exploitation vector For a new application you should simply choose a library that are not doing fancy a behavior on this realization So using Jason Protobuf if you need a compact Protocol so That's something to remember at design because afterward it will bite you as you have more Problem to maintain it and patch for the different gadget One of the project you can use autorebox for Java is not so sale It will a blacklist by default all the known gadget, but it's just a guacamole game until Somebody find another gadget So that's it I'm done with my clock in my demo. So if you have any question Don't hesitate to ask them now or afterward


At 1201 p.m. on Tuesday, October 21st, with hot, dry conditions in the area, the first report comes in. A fire threatens the community of Deleuze near Camp Pendleton. They call the fire Roblar II. Two hours later, near Fontana in San Bernardino County, the Grand Prefire is reported in dense, old growth chaperral. North of Moreno Valley and Riverside County, the past fire begins in inaccessible terrain. But a fourth fire front is opening up, with a blaze reported near the town of Payru in central Ventura County, northern Los Angeles County near Santa Clarita, the Verdeo fire, causing evacuations on its Valverde bank.  Two minutes to get out of here, two minutes. North of Happy Canyon in Santa Barbara County, the ironically named Happy Fire begins.  The old fire, which will become a major battleground, roars through 10,000 acres. In Ventura County, the Verdeo fire has split. Jumping Highway 126 with the southern front, now called the CME fire, threatening CME Valley and Moorpark. It was insane, absolutely insane. At 5.37 p.m., too late for safely using air attacks, the fire is reported in San Diego County. The Cedar fire, which will quickly become a gigantic blaze, immediately grows to threaten 50 residences and cause evacuations. There are mass evacuations, and 22 evacuation centers operating in southern California. Airports are closed as the FAA evacuates its regional air traffic control center. Many freeways are closed, rail lines are shutting down. Bad air quality is a widespread health danger.  The Paradise Fire near Valley Center roars through 15,000 acres. I've been in the business 45 years. This is the worst fire conditions I've ever fought fire and we've got a massive fire, sand anticonditions, burned in multiple houses, we've got multiple burn victims and this is the third fatality I've seen this morning. As the mountain fire breaks out in Riverside County, whipped by the wind across more than 2,000 acres. We are experiencing a history altering event. The Ote Mine Fire ignites in San Diego County with extreme rates of spread. The Wellman Fire near the community of Anza, one of the over 900 smaller fires successfully controlled statewide in less than a week. What happened there? There's a potential space state all the difference in the world on this one. Crews on the Cedar Fire contend with high winds and heavy amounts of dry fuel as the blaze burned through Scripps Ranch in numerous rural communities, destroying more than 1,000 structures and causing 13 civilian fatalities. We just have to pray for the best for all of these people. This fire has burned 80,000 acres in 10 hours. That's over two acres per second. A 50-foot high wall of flames in the Lake Arrowhead area, and 300 homes are lost. As a fire crew from the Nevada Fire Protection District is overrun by fire near the historic Miney Town of Julian, and one firefighter loses his life. A light rain begins falling on much of Southern California, and a healing snow begins to fall in the mountains. Adding up the toll, 14 major California wildfires burned through 739,000 acres during these 11 days. Destroying over 3,600 homes and more than 1,100 other buildings. 15,000 personnel were deployed over five Southern counties, with many more handling dozens of smaller blazes occurring at the same time in the North State. 246 injuries were reported, and 24 people lost their lives, including one firefighter. The cost of battling the fires was more than 150 million, and damages are estimated at a staggering $3 billion.


Hi folks, this is the Basel Chap and this is the 11 o'clock Tiger Financial News Network market update. It does up 143 at $31,905. It's a little unusual to see that early a climb to the upside on Fed speak day from about now 11 o'clock going into like 1.30 you start to see diminishing in price as the market gets nervous about what the Fed is going to say. The market seems to think that the Fed is going to do the 0.75 and then they're going to talk about the next week and then it's going to be quite straightforward and actually power quite often is straightforward. So all we can say is Dow is acting really well if by the end of the day it can hold the gains and these be up 100 points or more. That's really good action certainly if it's up at $31,907 if it goes to the $32,000 that's great honor. I personally don't want to see a break below the low of the day of $31,855 and now maybe that's okay. $31,800 is key support that needs to hold by the end of the day. Looking at the S&P, let's go to the S&P, there it is, S&P is trading right now up 53 at $39.74 that's really good action concerning what's going on but great action would be if it can get to the $44,005 area by Friday instead of breaking under $39.20, meantime back at the ranch we'll be looking at the QQQ so the S&P is up 1.4%, Dow is up 0.52% but the Q is up 2.74% at $302.45, really good action but it needs to start an AG and get into the $310 area by Friday that's a lot of points, it's another eight points. Anyway, it's acting well right now, hopefully it doesn't give back half of this by the end of the day because that'll be action, that'll be poor action, we'll see what happens there. RWM is acting well as well, it's also up nicely, it's up 2.181, gold, so what does gold do at the end of the day? Right now it's down 2, it's just been stuck in a tiny little range over the last four days or so, if gold spikes very sharply high that's going to be impressive because if it can break above $17.58 in the next couple of days, that means finally it's still in the corner, it can have a decent rally but if it's stuck here and it hits $17.20, not good. The dollar is already part of the key, it's always part of the key, it's acting now at up $0.10 and $1.07.31, holding the trend line support level, so far that's good, let's see what happens to the dollar by the end of the day and the TLT, that's really important, the TLT is down up 59 ticks and $1.18.07, oh I never got a chance to talk about it, I'll be doing that in the coming hour because Larry Pizavento is ill, he's not doing his show today, I'll be doing the show, I'll be doing at least the hour, I'll be doing the bonds, I'll be doing the currencies, I'll be doing the grains and I'll be doing the oils. So I'll be back in a moment, see you.