Hello Sandra and Mary and Lewis and John. And if you're joining us on YouTube, I just dropped a link in that YouTube chat stream if you wanted to head over to our Zoom call where you can participate deeper. So take a deep breath and find yourself a comfortable position. If you need a drink of water, it would be a great time to have a quick drink. And then just begin to relax. We'll get started in just about a minute now. So welcome the quantum healing experience. Today we are here to practice, to implement and to experience healing ourselves and to share it with each other. So I want to invite you to again find a comfortable position for your body.   If you have just one, that's perfect as well. And the protocol that we're going to be working with today is going to, we're going to continue our work right now with the regenerate frequency. So you're going to find the regenerate frequency in the quantum under the master section. And it's going to look like that tree with the yin and yang symbol. So go ahead and just select the first one there, the recommended 50%. Allow that to play and then just tap on that repeat. There we go until you see a little one next on top of it. And that means it's just going to keep looping while we go deeper in our practice here together. So let's begin by just tuning into this, right? Who here believes that the quality of your energy, the way that energy flows through your body and your mind has something to do with the way you feel, has something to do with your well-being, just raise your hand and kind of just acknowledge that for yourself. Remember it together, right? The quality of our health, the quality of our life is dependent on the way that energy flows through our body. When we experience things like stagnation, when we experience things like depletion, all of these are simply names for when energy is not flowing harmoniously, when energy is not flowing the way that it's designed to. So you've heard it said before, change your energy, change your life, right? So today we're not going to be just theorizing about this. We really want to bring it more and more and more into our lives so that we remember, oh yeah, it's not just those external conditions that are determining my reality. No, it's the internal conditions that are actually determining the way that I see reality, determining my perception. When we feel bad, right? You remember that whenever you're not feeling so well or so healthy, then it's just lower everyone's hands. Thank you. It's hard to look out at life and be excited and be enthusiastic and see the good and the positive and the innocence and everything, right? But on the other hand, when you are feeling amazing, when you're feeling on top of the world, when you are feeling aligned and there's joy in your heart, then everything starts to seemingly reflect that joy. And that's that's part of the miracle of seeing the world as a mirror, understanding that our consciousness is outpictured in what we experience in our life, in our circumstances and even in our body.  What it means is that the way that you are perceiving life is something is bringing your attention to this. Something is facilitating a shift for you. Now that shift can be as painful or as easy and smooth as an aspect of us decides that it would be. Not necessarily do we consciously ever wish suffering for ourselves, but we have certain programs, we have certain conditions and we say, well, I can't be happy unless this condition is met and that condition and that one and that one and all of these conditions are ways that we contract against what is against what is unfolding here and now as this moment. So when the moment is a way that we don't like it to be, well, we end up hurting ourselves actually as a result of that, as a result of our perception, we contract our energy and we contract our energy and we continue to do this day in and day out, interacting with people, having a certain perception of them, seeing them that way, reacting to them. That repetitive cycle creates a pattern, creates a momentum, creates a destiny for our biology, for the way that our mind is functioning. The beautiful thing is that we can change all of this if we want to, because the universe is fully supportive and endorsing of your well-being, God, life, the infinite creator. It's not sending suffering to you. Suffering is coming as a result of our misunderstanding. So what we want to do today is we want to raise our energy, raise our frequency, raise our consciousness to that of love. Higher, higher, higher, whenever you think you've reached love, ask yourself, is there more love? Because love is the creator, love is infinite. And so our capacity to love is also infinite. And the more that we open to the experience of life, the more that we experience love, the more energy flows through us freely, unimpeded, uninterrupted, un-stagnating, un-depleting. We become one with life, as we always are and always have been. Except in our forgetfulness, we are like that branch cut off from the tree. We contract ourselves, and so we squeeze that portal of life force that is always streaming down towards us, that is always wanting to bless us and envelop us. It actually is always doing all of that. And yet we are unaware in our limited sense of perception. But today we raise our energy and you'll notice that as we raise our energy and we're going to be doing some breathing, we're going to be doing a meditative practice. We're going to be, of course, working with the frequency as each of us now already who have our cheek oils turned on. We are synchronizing this entire group, all of us participating together, we are attuning to a collective frequency and we're going to feel the power of that beyond our individual practice in synchrony as doing this together in one shared intention, we can draw upon the power of oneness, the infinite storehouse of the universe, not drawing only upon our own little resources, no, upon the universal, universal love. And so let's go now beyond words and really start to connect with what we're here to do. Remember that your consciousness, that essence of who and what you are and override any program can override any external influence. Our energy stagnates as a result of things we see, things we consume, the way we breathe, the thoughts we entertain, but as our consciousness lifts to the experience of love, to the realization and awareness of oneness, suddenly all of these things that seem to have all kinds of influence on us, all kinds of ways that it would determine our destiny suddenly become little more than pop up ads that say, hey, do you want to suffer right now? Do you want to go into judgment? Do you want? And we're like, of course not. No, thanks. And we become the witnesses of the egoic mind play no longer drawn into it, no longer at its mercy. And instead of the mind being our master, shaming us, guilting us, making us feel like we need to do something to appease it to pacify it. Well, now instead, we become the master and the mind becomes this beautiful servant with incredible and infinite capacities. And that is our right relationship to our mind, likewise to our body, not a master over, not a power over, but stewards, stewards and and leaders of this universe that is your body, of this universe that is your mind, taking ownership, taking responsibility for it in a way to serve in a way to make it the most beautiful that it can to actualize its potential so that it can serve love in the highest. So let's now go into the practice together. Okay, remembering that in the presence of higher consciousness, there is no pathology, just like in the presence of light, there is no darkness, just like in the presence of heat, there is no ice. And so as we raise our consciousness, think about this as the raising the heat, this universal heat, this love melting the ice of our unforgiveness, the ice of the grievances that we have, the ice of the judgments. And suddenly it starts to trickle, it starts to move, it starts to circulate and as it does so, our quotient of well-being goes up and up and up. And suddenly we realize that we have so much to give, suddenly we realize that we are connected to the source, we're no longer lacking, we're no longer needing, but we are the source by virtue of being one with it. So what we're going to be doing today is intentionally raising our energy and then using that heightened consciousness, that love energy to direct it to our bodies, our minds, our lives and also the lives of the people who I'm going to ask in a moment to put up your hands. So if you have come here and you're looking for healing, you're looking for support, you need healing at the mental, emotional or physical level. I'd like to ask you to please put your hand up and just click that raise hand feature at the bottom of the Zoom screen and we're going to see how many people are here as he leads. Now all of us of course will get to give as we receive because in oneness there is no giving something away and losing it. Just like when I share an idea with you, I did not lose the idea. So in the sphere of oneness, whatever we give, we actually receive, we give unto ourselves. So I see six people in Zoom. Let me just check. Check also in YouTube and see what we see here. Seven, eight. OK, beautiful. All right. So eight, nine. So about nine people. And I'm going to raise my hand for this one, too, because I just came back from an incredibly beautiful trip where we got to spend Easter with family on the other coast and definitely took a lot of energy and I noticed myself going down a little bit. I don't know if you guys can tell, but my voice is a little bit raspy. So my hand goes up in this round. And so we have about nine people, nine raised hands. OK, so I'm going to lower everyone's hands. And let's let's begin our work together. So the way that this is going to look is we are going to begin by again, if you're joining us late, turn on the cheek oil, if you have it, set it on the regenerate 50 percent frequency. And in the moment, we're going to begin to raise our energy through a coherence frequency activation. So what we're going to be doing here is breathing with an awareness on our heart. And we want to generate, connect with one of the regenerative emotions. I'm speaking about love, joy, joy of existence, right? Gratitude for something or someone or just gratitude for no reason at all. Right? Again, that kind of connects with that joy of simply being alive, being here. Or perhaps it's compassion, that sense of just noticing.  People are struggling and we can really appreciate that because we can feel that in ourselves. So that outpouring of compassion is another powerful emotion. So as we do this, we're going to come into a greater awareness of oneness, greater awareness of love, reaching beyond our individual sense of self to the greater self, universal self, the one self that we all share in the self with the capital S. And then we're going to direct our cultivated energy then to the people that have raised their hands first, then to ourselves and then to the collective humanity, our planet, OK? And then we're going to close by bringing this energy one more time to our heart center and just feeling gratitude. OK, so if we're ready, I want to invite you now to find a comfortable position for your body.  And if you don't have your cheek oil, just place your two hands over your heart and just feel for a moment, your heart beat, allowing now the eyes to close if you feel comfortable with that.  Let's take a collective deep breath, exhale first. Now inhale, breathe all the way up to the top. Hold it for a second and let's exhale with a sigh.  Let your scalp relax and feel the cascade of relaxation now moving down your body over your neck, your arms, almost like you're in this shower of light, liquid, golden light and everywhere that it touches opens, relaxes and feels the warmth.  Let's take another deep breath in, breathing in and breathing all the way up. Hold it for a second at the top, let it out with another sigh, sending that sense of relaxation down the torso, down the legs, all the way down to your feet, your toes, feeling connected to the awareness of your body, maybe connecting with that gentle sense of gratitude. Thank you, body. Thank you for your perfect health and function, you for sustaining my life. Thank you for allowing me to connect and to communicate with everyone that I love, my friends, my family. Just feeling a sense of gratitude for your heart, gift of life, with your attention on your heart, just allow your consciousness now to slowly make its way down and in to your heart chamber, down from the head, down, down, down into the heart, as if you are looking out at the world through your heart, as if your eyes at the level of your heart, just feel your consciousness centered here. Begin to breathe as if you are breathing directly into the center of your chest, both from the front and the back. So taking a deep breath and pulling that energy in through the center of your chest, right into your heart from the front and from the back, like two streams of light meeting in the center. And as you exhale, just feel your auric field, your energy field expanding, the energy circulating, let's continue to breathe in this way, seeing and feeling this energy, this light pouring into our heart. As you rest here in the center of your heart, bring up one of those emotions, the regenerative emotion that you most connect with, be it the joy of life. Gratitude for some special moment or special person or special achievement, whatever you find to spark this energy in you, and breathe and feel and fan this spark into flames with your breath, with your attention. Maybe you can see a loved one in your heart or even a beautiful red rose in your heart, whatever brings up that sense of love and beauty, appreciation and gratitude, joy for life. Spend a minute with our heart now, just breathing and feeling in this way, remaining conscious and aware. Each breath, feeling and raising your consciousness to the head of love, feeling your heartbeat remaining present.  Thank you, heart. Thank you for this heartbeat, this heartbeat and this heartbeat. If you can connect with that awareness of your heart beating, gratitude, love, wholeness, coherence and gently repeat for the next few moments, one of the words that symbolizes your intention, love, coherence and feeling the harmonization of your mind and body, your heart and your brain coming into a state of coherence and wholeness. Open your awareness now. You're not alone here. All of us are here with you. All of us coming into a greater consciousness of love, greater consciousness of oneness. And as each one does this, making this choice with the intention of healing and wholeness, it helps to uplift every other one of us. Feel our connectedness. Feel the oneness we were always the field. We're always one. Just forget as we get caught up in our individual stories and narratives of our particular dream, which is unique and special and dear to us. But so is our oneness. Just breathe for another few moments here, feeling the collective intention, collective presence. Connect now to that frequency of giving, just like you have the capacity and the power to give the gift of a smile anytime and anywhere that you choose. You have the capacity to drop on the universal love and give not from your own storehouse, but from the storehouse, the universal and infinite presence in which we all share. So gently you can keep your eyes closed. If you want to, you can continue to stay in the same position or you can lay your cheek oil down. Raise your hands if that feels empowering for you and begin to direct your energy now towards the nine people that raise their hand. The requested healing. Just begin to see and feel this energy now glowing through you as you intend wholeness, harmony, coherence. We are not fighting disease. We are not fighting or pushing away limitation. We are simply raising the temperature and in this heightened state of love, all that is unlike love melts away. Natural divine blueprint of health is restored. Natural divine blueprint of harmony. So see these nine who raise their hands as whole, as already healed, whole and happy. Remember who they really are. Made of light and of love, one with you, aspect of your own being. Just like your hand is an aspect of the body, so too are each one of us aspect of this greater body of the universe, one with it and one with each other. So feel this now, this energy, this love, this blessing, going out towards those who raise their hands. You can say in your heart something to the effect of may you be healthy, may you be aware of the oneness and the joy and the power that is the essence of your own being, may you be happy, may you be in harmony, may you have peace of mind, part be at peace, all this heightened energy of love that I have within me now I share with you, may you know love and be at peace, harmony in your life, in your relationships, in your body, family, be aware of your true self, the eternal, changeless aspect of who and what you truly are, an aspect of you that never ages, never gets ill, never deviates from the wholeness and oneness and joy. That is our true and original state. We are remembering this together and we are remembering this collectively for those who are raising their hand, asking for help. So just see this energy enveloping them, see their cells drinking it up, this energy bringing coherence and wholeness, vitality to all the cells and organs and systems and structures in the body, to all the darkened places in their mind, illuminating with hope, with joy, with remembrance, with gratitude, a few moments, just allow yourself to work with this energy to direct it in any way that you are inspired to. Just breathe and feel and if it brings a smile to your face, just allow that smile to lift your energy further still and on the next inhale, take a deep, slow and full breath in, breathing all the way to the top and as you exhale slowly, bring your hands now back to your own body, turning this energy towards yourself. You can place one hand on the chest, one on the belly or anywhere on your body that feels comforting, that feels loving, that feels caring towards your own beautiful self. As you feel this flow of energy now from the heart, the creator, the heart of the universe through your heart and hands pouring into you and also that energy that you have given out, that you have gifted, can't you see it flowing back to you, can't you feel multiplied and overflowing, allow yourself to bask in it, see and feel yourself, your cells drinking it in, rejuvenating and livening, vitalizing, restoring, wholeness, coherence and harmony. My body, heal it now as you breathe with it in your heart and say something to the effect of, may I be happy, may I be vitality, wholeness, well-being abounds in my body, in my mind. Everything that is unlike love is dissolving now, it's disappearing because it is not sustained by any law of love, the presence of heightened consciousness. There are no obstructions, there is no interference, there is no second power to love, love is the only power, the only reality, only truth, dreams come and go, but love remains available so we draw upon it now. If you feel led or guided to put your hands anywhere on your body that is asking for more love or attention, any energy center that you want to empower or bless, invite you to place your hands there now, say something to the effect of, I bless you, bless you for the highest good, bless you with wholeness, coherence, harmony, bless you for the highest good and as you breathe just allow this blessing now to move through your body, may I be blessed unconditionally and without exception, on every level and every way I be blessed, may I be happy, may I be peaceful, may every cell in my body be full of light, of love, wholeness and joy. Thank you, body, thank you, every cell, thank you for all the trillions of sentient little beings that make up the whole of my body, this little universe that is the body, thank you, I see you, I appreciate you, I bless you, the highest good, if it's available to you, connect with your heart now, just see you can forgive yourself deeper still, forgiveness is simply the remembrance of our innocence, our innocence is an intrinsic aspect of our true self, you can say something to the effect of, I forgive myself, I forgive myself on every level and in every way, unconditionally and without exception, I free myself of all past, of all debt, free myself of all past errors and mistakes and I realized that I was doing the best that I could given what I knew in that moment and if I had known better I would have done better, heal it, know it, recognize your innocence and lift the burden of guilt, lift the burden of shame, which is so often the underpinning of every unhappiness, so often the underpinning of the illnesses and discomforts that we feel in our mind and in our body, I forgive myself, saying to ourselves now, I love you, I'm sorry, please forgive me, just feeling, care, feeling love, feeling compassion for yourself and by you now to take that deep, slow and full breath in, drawing the blessing, drinking it in, every cell, every organ, every system, every aspect of my mind, body and being as you exhale slowly and allow that integration to take place, we turn our hands and our attention one more time outward towards our collective humanity, our planet, every being on this planet, big or small, human or non-human, visible or invisible, we who are one, bless ourselves for the highest good now, to feel this energy flowing outward now, enveloping the planet and everyone on it and say, all beings, may all beings, may all beings free of lack, free of limitation, may all beings come to know who self, the love of the infinite creator within them, have enough to drink, to eat, have clean water and clean air, all the gifts of nature, may all beings be in harmony, may all beings be blessed, feel this energy flowing through you now, everywhere that it touches on the planet, there's a blessing, a miracle, a sense of love and wholeness, somewhere across the planet, someone is uplifted by your intention now, this is not wishful thinking, this is reality, this is proven scientifically, our thoughts, our intentions, our awareness, our attention, our energy impacts without limits of distance, without limits of time, but feel it now, know your power to bless, all beings be blessed, every level in every way, unconditionally and without exception, every way, every kill, everyone in everything, on every level in every way, I release all of their death, I release everyone, from owing me anything, I forgive you, I know that as I release you, I release myself of all death, I release myself of all, take a moment now, in any way that you're inspired to work with this energy, wherever you would like to direct it, maybe there's certain people or places on the planet calling for you specifically, so take some time now to breathe and feel and just to direct this energy, those all on you, feel your heart, feel your smile, feel our collective oneness drawing upon the heart of the universe, a heart of God through our hearts and hands, may all beings be blessed, if it's on your heart, you can bring to mind those who, maybe from a certain level of perception, feel that they don't deserve the blessing, don't deserve forgiveness, but I want to remind you that your forgiveness, blessing on these ones is the universal laity, only hurt people can hurt people, so all the hurting hearts out there that feel separate, that feel the need for power over others, that feel scared that without power, there would be nothing, these ones we send this blessing know that you are love, remember your insight, while you don't, I will remember it for you, offer this remembrance to you, form of this blessing, and you be blessed, unconditionally and without exception, every level and all can change, another couple of breaths here, you exhale slowly, bring your hands one more time over your own heart, holding this beautiful heart of yours, feeling heart beat, life, oneness, love flowing through you, take a moment to feel gratitude for yourself, giving thanks for choosing love today, choosing wholeness and healing, choosing to remember and to forgive, heal that integrating now into your heart, into your being, into your body, but reflects it right back to you, hold the intention for a moment, integrate the fruits of our practice, your body, and into the world, and whenever you're ready, you can take another deep breath in, breathing all the weight in the top, as you exhale, just relax and release, and whenever it feels right, you can flutter your eyes open slowly, gently, now breaking the state, I want to thank you for showing up today for yourselves and for each other, I want to ask the people that raised their hand in the beginning, who feels like you received some benefit, you can put your hand up, received a sense of healing, a sense of support, feeling better than you did before you started, we have like seven, eight, nine, so we are at a hundred percent beautiful, there's more, we're over a hundred percent, great job everybody, Matt and Dora, thank you, thank you John, thank you Melissa, thank you everyone for being here, I want to invite you like before to anchor this into your life, think about something right now that you can do, is there a journaling moment that you've been putting off, do you want to engage in remembering your vision of what you want in life, do you want to bring a gift of love to somebody in the form of a glass of water or a cupcake, do you want to just lay down for five minutes and give yourself a rest because you've been working yourself hard, what is it that you want to do to show more love to yourself, to show yourself that there is more love, that's my invitation to you because remember you deserve more love, not less, anytime you're down, anytime you've done something wrong, anytime that you've made a mistake, anytime things didn't go your way, you deserve more love, nevertheless more love, is there more love, there is more love, there is more love, so let's continue to expand our capacity to love, let's anchor it in, I want to thank you, thank you Day, thank you Lanna, thank you so much everyone and on YouTube Natalie, Melissa, Circle of Feminine Power, thank you for showing up, Empress Knowledge, so until next time, looking forward to seeing you here next Thursday, 6 p.m. Eastern, 3 p.m. Pacific, until then stay inspired, remember to love, remember to laugh, take great care.


Hello, everyone. This is Alice Gao in the past few weeks. I focused on talking about reasoning in an uncertain world Starting with a short review of probability. I Moved on to introduce patient networks, which is the main tool we can use to model uncertainty After that I talked about performing inference in the patient network using the variable elimination algorithm It's important to be able to reason in an uncertain world But ultimately we want to make a decision and take an action in the world Starting with this lecture, let me start talking about decision theory, which focuses on acting in an uncertain world If you want me to explain decision theory in one sentence I would say that decision theory is equal to the sum of probability theory and utility theory The goal of decision theory is to determine how an agent should act in an uncertain world In order to do this, first of all the agent needs to be able to reason and to perform inference in an uncertain world This requires probability theory as we are already familiar with this from the past few weeks Once the agent knows how to perform inference It can derive a lot of probabilistic estimates about the different states of the world So is this particular state of the world? How likely is it to occur based on the evidence that it observes? Now given these probabilistic estimates, how should an agent make a decision? Well, given the multiple possible states of the world, the agent has a preference over these states The agents may prefer for some states to be realized than for other states to be realized In other words, an agent has a different degree of happiness in each possible world So we can use utility theory to measure how happy the agent is in each potential state of the world So by using the agent's utility function we can use this to guide us towards the decision-making process and Utility function assigns a single real number to each possible state of the world And this real number is used to measure how happy the agent is in that world Then a rational agent can make a decision on what to do based on the principle of maximum expected utility This principle says that a rational agent should Choose the action that maximizes the agent's expected utility And the reason we have an expectation here is because we don't know which world is going to be realized We don't know which state, which state of the world is going to become true However, we have probabilistic estimates over these possible states So using the probabilistic estimates, we can compute an expectation over our utilities for different states And then use this to guide us in the decision-making process In some sense, the maximum expected utility principle could be seen as defining all of AI Right after all, this is what an intelligent agent wants to do It formalizes the notion that an agent should do the right thing And how does it do the right thing? It should maximize the expected utility However, having this definition doesn't mean that the entirety of AI is solved So for example, in order to realize this definition, in order to operationally maximize the expected utility We have to do a lot of things For example, we need to estimate the state of the world This often requires observing what's happening in the world Learning, representing knowledges, and inference And for the past few weeks, we just talked about the fact that performing inference in a Bayesian network is NP-hard So this is a very challenging task to do In addition, the other important thing we need to do is calculate an agent's utility in each state This might also be a non-trivial task That's because that often, just given a particular state, the agent might not know how good it is Often it needs to look into the future to do some search to see which other states Are we going to be able to get to starting from this state? This kind of search will give us an idea of how good is this state And we can incorporate that information into our utility function So all of this is to say that our ultimate goal is to take an action to maximize the expected utility However, to actually do this is quite difficult In this unit, we are going to focus on thinking about how to make a decision in an uncertain world In order to do that, we first have to perform inference to understand the uncertain world And then decide on which action will maximize our expected utility Because of this, the main tool we are going to use Is going to be related to the tool we use for performing inference So for performing inference, our main tool is the Bayesian network And turns out to make decisions to act in an uncertain world We will use a related tool called decision networks Decision network is essentially an augmentation of Bayesian network We are basically taking a Bayesian network and adding some additional components to it So one component, we add our notes representing actions Because now we have to estimate if we do a certain thing, what are its consequences? How does a particular action affect our happiness? So we need to be able to represent the action and also the relationship of the action to all the other notes In addition to representing actions, we also need to represent our utility function So how happy we are in each state of the world So decision network is simply starting with a Bayesian network With all the notes representing random variables, so random events that happen in the world Plus notes who represent actions, plus notes who represent our utility function That's everything for this video After watching this video, you should be able to describe Why decision theory can be seen as a combination of probability theory and utility theory Describe the principle of maximum expected utility And describe components of a decision network Thank you very much for watching I will see you in the next video Bye for now


Questions, comments, okay right back there and then yeah and then Imran and then up front and then Channing and then Yvonne, that's five people already. So please do say your name. Yeah my name is Christophe Muller, I'm from the University of Ex-Marseille in France. I found the presentation very very interesting with in-depth data analysis and obviously we can learn a lot with this type of exercise. I'm a little bit worried about one thing which is the unemployment. The fact that a lot of the effect of the economy on the poor is going to go through the fact that some people are just unemployed, they don't have so they don't have wage and you miss this part of the analysis with these techniques especially in South Africa where the level of unemployment is so high and in some communities it's still higher than the average that you have shown. So my first point is what's happening with unemployment and how does it interact with this analysis. Perhaps some of the effect that you see are through selection effect in and out an unemployment state. And the second remark is that would be really interesting to look at at the different committees, different ethnic group to see what happened especially you know that is South Africa so we are really interested in the difference between these people. Great, thanks for that Harun. Just one one thing that sort of doesn't end up for me is your story about about the automation in the trade union collective bargaining story so my sense of it would be it's precisely the it's precisely the group who do the automated routine jobs are precisely the group that are that are most sort of powerfully in the trade union movement and they likely to be the group that would most sort of managed to have secured some sort of premiere. Thank you very much Ivan Turok very interesting presentation just a quick question right towards the end when you talked about the outsourcing from United States and Europe South Africa could be a recipient of some of these jobs and I'm thinking particularly around the BPO call center type is that ICT category of tasks that you talked about the government claims this is one of the major beneficiaries of South Africa and there are advantages of same-time zone as Europe language issues for UK and also big government incentives I'm just wondering whether that could be a factor as well in the positive performance of that particular category of tasks. Thanks Arun I'm looking forward to reading the paper just when you were talking through the the first points with the share it was a lot of technology and then when you were talking with respect to the wage wage was a lot of trade and I if you just talk about that a little bit and then the other thing that if you happen to have thought about it you know we're observing you know tremendous penetration of South African enterprises into the rest of Africa and you really are I mean you're not highly skilled in doubt versus the United States but you certainly are skills in doubt versus versus Africa and I tend in the South African case I tend to think that trade would might be a big player bigger than what your first shares would seem to indicate and but I what your story was telling in the second part me is this FDI if you just talk a little bit about that I think my question is related to last questions but it's related but the basically story is a task wage premier is driven by trade in tasks and possibility of slicing up productions and is it really is it multi-nationals different multi-nationals American firms or European firms targeting South Africa and therefore South Africa wage premier in particular tasks is changing according to competition or its perception that that is fair it's really you know competition global competition and driving so without really moving around the production site actually task premium is reducing in particular segment of production process and the fed it is I mean related to chance question last question that is it to South African firms moving out or is it coming in to South Africa or what is the situation with respect to firms behavior in regions continent that's where the global says thank you sure thanks those are great questions there so the race the race effects are in the the quantiles but what I hear you saying which I think is correct is run them separately so see if there's anything different that's going on for Africans versus whites and see and I think that's a great suggestion actually the I think partly the bottom end is where some of the actions going on in terms of unemployment so I think the bottom end of these quantile distributions is where you see a competition for jobs that's actually not happening either because of trade union action or and then and then across the rest of the distribution you've got the structural mismatch and I think that's where it's not a case of necessarily institutional effects that prevent a reduction in the employment it's more structural barriers right so whether it's a skills mismatch or whatever the case may be that means almost that you've got a fairly heavily segmented labor market so you've got the excess supply of labor that that really doesn't allow much churning except at the bottom end between the employed and the unemployed across jobs Imran's point I think that's a really that's that's a clever point because in a sense are we saying that you've got the National Union of metal workers is is really should if they're doing their job correctly which they supposedly are because they're one of the strongest unions you should be seeing a wage distribution that looks the opposite of what we're showing there so one way to think about that is possibly that that we observing we observing wage bargaining as it happens at that point in time so the real question is over time have you seen a decline in the bargaining power of that trade union and I think that may be true I think you may be seeing a decline in the bargaining power of trade unions despite despite what the sort of strike strike data and annual bargaining around seem to suggest I think that's true for all private sector unions except the public sector so I think it's true for all unions except the public sector unions where I think they've actually grown in power and in strength over the period and I think there's data to show that that's true yes so teachers teachers are there so exactly teachers are in face-to-face thank you so if Ivan's points Channings and Machiko's if you don't mind I'll sort of combine them because they sort of similar right so there's a two-part answer one is the modeling approach is that there is something called the new approach called the recent influence function which I'm not clever enough to figure out yet but I know I'll eventually get there but that allows you to decompose across the quantiles the effects of those different forces so you can actually get at technology trade exogenous policy shocks and then all the other individual control so that's the if you like that's the technique answer so that's what we'll try and do I don't think it's as good as your stuff the input output analysis I think you really in order to separate out the technology trade story you need more than these these techniques that we have but but we'll give it a go all the same just in terms of a general reaction I think that's it's interesting yes South Africa is a big player but the in the rest of Africa the question really is what kind of trade and my sense is that it's primarily in the retail end so if you're looking at retail goods and final sort of produce goods that's where South African retailers have actually got a competitive advantage in the continent are they setting up large manufacturing like manufacturing firms I don't see that happening there's mining license action a little bit of primary sort of resource extraction going on and then the really big one is our comparative advantage which is financial intermediation and so if you like the probably the biggest story in South Africa is around China buying 20% of standard bank as a portal of entry into doing deals in Africa and I think that's that's particularly interesting but then that would reinforce these kind of trends it's time to zero minutes okay I'll stop thanks floor is open Carol over there even so I have three people so far okay okay and that's enough thank you for an interesting presentation a couple of small questions really I'm wondering in your data do you know how often people move and maybe it's the QLFS that you can use to detect this so is it the same people transitioning in and out and there's some people who are like in stable employment for the duration I think that might be interesting to look at another thing that was interesting and I don't know I don't think you commented on it was and the fact that for the female employees it seems that unions mattered and for the males the contracts mattered but not to the around so I was wondering if you had some comment on that thank you another another question in a country with huge spatial inequalities it's hard to measure lay spatial mobility but I wonder whether with the NIDS data you can do that and whether or not you factor that in at all do people is there also a corresponding degree of change in where people are working or where they live when they lose their jobs or when they gain a gain employment any views on that hi Carlos Radim from the University of Eagle I think the paper is very interesting because it deals with one very special issue in South Africa that is the lack of employment that is rising what is happening in the distribution one just one specific comment about NIDS data is that the special design of this data makes that people are not interviewing the same quarter in both ways so maybe you have you need to deal with possible seasonal effects of especially when looking at transitions and also that the time span between both interviews is different for for people so maybe also you are more likely to make a transition the longer the time between both interviews just a thought on the on the sort of time thing because I thought you said there was a there was a huge sort of drop in employment in that there's a change at the time of the crisis which then which then which then starts to starts to reduce with time is that right so the what might be going on is that it's quite tough in South Africa to lay to lay off workers but it's quite easy to do it if you can show that there's that there's some economic grounds for it so the kind of at the time of the crisis what you might be sort of picking up is some sort of pent up need to reduce the workforce and then the crisis hits and firms reduce a lot more than what they should ordinarily and a second thought just tying up your sort of paper with Haroon's I think it does show the important need for Haroon and them to to really think about the gender issues as well which which come out strongly in your paper just by way of a comment I mean one of the what are the related to him Ryan's thing point is that when the crisis struck there was a view particularly within the dispute resolution body that had to settle all these claims retrenchment packages that were offered that the majority of workers that were retrenched were those that had didn't have permanent contracts so I see there that you do have nature of contract but I was wondering if you could think of pushing that a little bit more maybe an interaction effect with sectors or something to see if there's something going on there because you may be underestimating that just because of the specifying at all and the specifying okay Dennis two minutes please yes oh well how often do people transition have no idea of that I think it would be possible using like duration models or something because in the QLFS you do have households well sorry you do have individuals that can be observed over a maximum of four quarters so it would be nice to see whether they switch from employment to non-employment or or it's always other people that do that so that's a very good suggestion about the unionization for females well actually I I I don't think well the the effect for males is also positive but it's it's not significant and in the QLFS I do find that the union membership which is only available in the two doubt from 2011 onwards that it's significant for both males and females so I'm not sure whether they are really any gender differences there about spatial mobility well I do include in all the regressions province effects but I haven't really studied in detail well some of them are significant but it's it's hard to find really a clear trend in that so so that's also something that I that I should look at and it needs you you you have data up to the district level so maybe I can do something with that dealing with interview data I think that's a very good suggestion because the interview data are available so so I can try and see if I reduce my sample or I adjust my sample to take that into account whether this makes a difference I think that's important makes it probably also better comparable to the QLFS then about the reducing buffering effects well I was thinking actually the same that that that as long as the crisis lasts it's it's easier to also fire those people that have higher skills or are better attached to the to the firm or have had more on the job training which are typically those with with higher education so that those with lower education that are more easily replaceable fly out first and then and then maybe then the others follow us as economic activity doesn't pick up so maybe that's but it's it's difficult to find really hard evidence for that and then about the interaction effects yes I think that's that's that's a very valid comment so I also some of the racial effects could perhaps be interacted with with industry effects with type of contracts actually in the QLFS if I control for for for the type of contract you see that the almost all sectors did did better than than agriculture because in agriculture so meaning that because in agriculture you you don't have you don't have those strong formal permanent contracts so I think the contract so part of at least part of the industry effects are due to the differences in contract I think contract effects are probably more important even then the specific sector so yeah thank you very much we have time for questions I'm Darrell sequera an independent environmental consultant I just have two questions one is you use the term Indian migrants where did they come from did they come from neighboring Kenya Tanzania or did they actually come from India or somewhere else that's one question the second one is you related the the higher profitability of Indian business enterprises to endowments and you mentioned what those endowments are but I was also but it seems to me perhaps I'm wrong that you did not include two factors one is the ability of the Indian businessman to speculate correctly how to promote their business in the future from from the present so correct speculation plays a role perhaps and secondly also the management of their ongoing businesses in terms of efficiency and profitability I just want to add on to that question for a minute were these Indian entrepreneurs ethnically Indian but possibly Ugandan citizens or were they actually newcomers to Kampala I always say recently if there is any xenophobic reaction in the country against this because in some countries these minorities that are doing well they had there is some xenophobic reaction against them and maybe this is the case this could explain also they are reluctant to give information that may be used against them so it's by ignorance and asking if there is the case in Uganda or not a question about age and whether family ownership I mean it looked like a very skewed sample from what you were saying you didn't get much response from many companies so was this with these sort of long established Indian companies that have been passed through from generation to generation sending their you know sibling their children to university this just looked like a very different kind of cohort so I can't remember all the slides but I had two questions one is if you had sex of dummies in there so to control for something else going on but related to that whether whether you you you looked at differences across the profit distribution so in a way you may be seeing something more interesting if you looked at low profit rather than high profit or low capital intensity and high capital stock firms and so maybe instead of an OLS you could go I don't know quantile or something just to see pick up something more interesting just one question and I've marked are these firms selling to the same type of markets like are some of these Indian firms exporting or do you know that are these all very small maybe that might make a difference okay so on the nature of the Indians and their business they're all real Indians coming from migrating from India and they're all first migrate first generation migrants so that during the Idi Amin area all Indians got expelled from Uganda actually that before there was an even larger Indian population so they all came back just in recent years and their businesses are still quite small so they do not export and yeah I think adding like management of the business or correct speculation I think yeah that would probably explain a lot the problem is I'm not sure how we don't have a good measurement of this I think but yeah maybe I need to further look into this the firm age is here so they are they they are not significantly older or well more well established than the than the Ugandan enterprise there's no significant difference in firm age and to your comment I think that's a very good idea I'm not sure how much I can do with a small sample size but I will definitely look into it I think that's a good suggestion all right thank you very much


Thank you, uh, Aloha and welcome to my talk, Nothing But Nets. Yes, I am Patrick Wurdle. I am the founder of the Objective C Foundation. Uh, you might know me from some of the, uh, Objective C free open source Mac security tools. I also write the art of Mac malware book series. And finally, organized, objective by the C security conference. So, what will you learn today? What are we gonna talk about? What are we gonna dive into? Well, pretty much four things that really in a nutshell will show us how to leverage, uh, macOS's Apple's networking frameworks to heuristically detect malware directly on, uh, a host. So we're gonna start by looking at some examples of Mac malware that utilize the network, because, well, before we write tools to detect such activity, we should have at least a baseline understanding of, well, what we're looking for. We're then gonna talk about how to take a snapshot, enumerate the network state on a Mac to see things like active connections, open sockets. Et cetera. We're then gonna kinda graduate up to more comprehensive tools that will allow us to continually monitor the network. Both DNS traffic and all traffic, including filtering and blocking certain connections. And then finally, we're gonna end with how to then tie that activity back to processes and determine if those processes are suspicious or malicious, because, you know, obviously legitimate software is also gonna be using the network as well. So we need a way to identify what is unauthorized. Now this is the main idea and this is a very obvious idea, so I'm not claiming this is new and it's just, let's detect malware via unauthorized network activity. This is based on two, again, very obvious, uh, observations, which is first, malware uses the network. How? Good question. In a variety of ways. For example, it pops, reverse shells. Uh, it might use the network to propagate to other machines. A lot of malware, especially back doors, will interact with a command control server and take tasking from a remote source. And now, we're gonna get to that. And now we're gonna get to that. And now we're gonna get to that. So, let's get to that. And now, we're gonna get to that. So, let's get to that. And now we're gonna get to that. So, let's get to that. And now we're gonna get to that. So, let's get to that. Now, let's get to that. So, let's get server. And then a lot of malware will also, for example, download additional payloads or files or exfiltrate up files to a remote server. So again, a lot of opportunities for detecting the malware based on its network traffic. So the idea is, if we can observe this network activity and classify it as suspicious or unauthorized, we should be able to generically uncover malware. Now the way network monitoring is normally done is via placing an application, network application in the network, especially in the context of the enterprise. So this is a separate hardware device that all traffic from the network may be routed through and it can then examine and look for anomalies. And this definitely works. There's some pros to this approach, but there's definitely some cons. So this talk, instead, we're going to focus on a host-based network monitoring, meaning our code is going to run directly on the host. The benefits of this are threefold. First and most importantly is the fact that if we are running on the host where we are observing network traffic, we will be able to identify the responsible process. Imagine you are a network appliance, you see a DNS request, you might not be able to say what application generated this, right? Is this the user's browser or a malicious backdoor? Well, if our code is running on the host and we observe that same DNS request, we will be able to pinpoint or tie that back to the process and then analyze that process to answer the question, is it malicious or not? So that's really kind of the main benefit of host-based network monitoring. It also happens pre-encryption. So if you want to do full packet capturing, well, you don't have to worry about removing SSL certificates, manning the middle, it's just there before it gets encrypted to go out on the wire. And then thirdly, it's more simple and maybe more cost effective. You don't need to buy any additional hardware. And especially recently, a lot of these hardware network appliances have security vulnerabilities that hackers are actually using to get into the network. So not ideal. Now you might be thinking, okay, cool, host-based network monitoring, it's pretty well understood, some good pros, why are we giving a talk about it? Well, a few main reasons. One of them is on macOS there's just really not been a lot of research or examples of how to do this. And there's a variety of reasons for this. One of the main reasons is a lot of the frameworks and capabilities we're going to use are only pretty new. They've only been recently introduced by Apple. There's also a lot of challenges, blood, sweat, and tears that I've been through the last few years developing host-based networking tools on macOS. So I want to kind of share some of the pain points so you all don't have to. So one example is Apple's networking frameworks used to be incredibly buggy. So you write this lovely user mode tool that leverages Apple's documented frameworks and then the user runs it and it panics the box. What do they do?  It runs in user mode. How can it panic the box? And you look into it and it turns out that Apple has a kernel bog in their networking logic and you're like, thanks Cupertino. Now Apple is pre-receptive about fixing this, but again an example of, you know, kind of a trials and tribulations, let's just say. Other challenges, a lot of the frameworks are private. So you have a very powerful networking framework you want to use, but there's no documentation. There's no source code. So you have to go through and reverse engineer it. Also a pain. And then finally the documentation, super lacking. The other thing that Apple originally did, which was really not cool, was that they actually neutered capabilities themselves. So story time, you used to run network monitoring tools that ran directly in the kernel. This makes sense. That's where the networking stack is. Apple said, we don't want third party kernel extensions anymore in macOS, so we're going to kick you all out of the kernel. But don't worry, we've introduced some new frameworks that your code can link against and utilize to give you the same capabilities. And I was like, okay, this is actually kind of neat.  If there's a bug in it, it's going to panic the box. So yes, I would rather write a tool that runs in user mode if it gives me the same capabilities as before. What Apple didn't tell anybody is they exempted a large number of processes that would not be routed through these user mode networking frameworks. So imagine you wanted to write a firewall that maybe blocked all traffic. Yeah, good luck because Apple's system processes would be exempted from that. And again, they did this without telling anybody, which in my opinion is, well, wrong. So we reversed the engineer and figured this out and called Apple out. Turned out it was trivial to leverage these trusted processes to generate network activity on your own behalf. So once we created a proof of concept that was able to bypass this and reported it to Apple, they said, no, this is functionality by design. Went to the press, made noise, made Apple look bad. They immediately fixed it. So a takeaway, if you want to enact change at Apple, make them look bad. The unfortunate reality. So now as I mentioned, let's look at some Macmower, ones that access the network to get a good understanding of the kind of activity we're going to look for. The first malware sample I want to talk about is called dummy. I named it dummy because it's pretty dumb. But it's simple and effective in a way. So maybe that's a kind of a harsh name. We can see on the slide it's basically a bash script that executes various Python commands that do three things. Connect out to the attacker's remote server. Redirect standard in out error. And then spawn an interactive shell that's tied to those sockets. And again, because the file descriptors for standard in an error have been redirected to the socket, this gives the remote attacker a reverse shell on the infected system. So again, it's kind of a standard vanilla reverse shell. Another piece of Macmower that uses the network is IP storm. IP storm is interesting for a variety of reasons. One of the reasons is it was originally written on Linux. As Macs become more popular, more prevalent, especially in the enterprise, we're seeing a trend of malware authors and adversaries porting or recompiling their malicious creations to run natively on macOS. IP storm is a great example of that. So hackers are definitely taking notice of macOS's increased popularity. Now as we can see on the slide, the quote from the company that did the initial analysis, the malware would propagate from one system to the next by SSH brute force attacks. So the idea is if it could guess the password or brute force in, it would then infect the system. So it had some worm-like capabilities. Again, this network activity, if we can observe that, maybe that's an opportunity to detect this malware. Once IP storm successfully infected a system, it would then open a reverse shell. So again, network activity that we could perhaps use to detect the infection. Another recent Macmower specimen that leverages the network is GoRat. GoRat is a pretty standard but fairly feature complete backdoor for macOS. I've listed its capabilities. You can see it does things like upload files, download files, pretty standard. Howard does have some additional capabilities which we don't commonly see in Macmower that allow it to interact with other systems via the network. For example, it has the ability to generate a port scan. So again, if we're interested in detecting malware via network activity, if the malware is generating port scans of remote systems, maybe that's something we can pick up on. It also has the ability to set up tunnels and proxies, more network activity for us to detect. It's also worth talking about supply chain attacks. These are becoming unfortunately ever more prolific. And again, the adversaries are now starting to target macOS systems. Normally, supply chain attacks mostly impacted Windows systems. A great example of this, of a supply chain attack attacking and targeting mac systems is 3CX. What happened is an APT group associated with the North Koreans broke into 3CX, which is a popular PBX software for the enterprise. They installed a macOS backdoor on 3CX's build server and trojanized 3CX's desktop application. This meant when users around the world downloaded the update they would inadvertently get infected. One thing to note is before the adversaries did this, after they infected the installer, but before they distributed it, they actually sent it to Apple. And this is because in recent versions of macOS software has to be notarized, which means Apple has scanned it and given it their stamp of approval before it will run. So the attackers took a little bit of a gamble here, essentially sending the infected installer to Cupertino. Apple happily notarized it. Less than ideal. So how was 3CX, how was the supply chain found? Because again, super stealthy. And the payload is, you know, signed and notarized. Well, it turns out via network traffic. So as we can see on the slide from the 3CX forums, the user basically said, hey, one of my EDR products noticed anomalous DNS requests generated from the 3CX application. So again, this kind of drives home the point of the power of network detection and especially in the context of supply chain attacks, this is probably the best approach for us to detect intrusions. Speaking of best approaches, also worth mentioning iOS. Now this talk is predominantly about macOS, but a lot of the techniques we talk about, the frameworks also exist on iOS. So it would be not that difficult to write similar capabilities on iOS. Now to detect malware on iOS, you're basically SOL because iOS is so locked down on a non-GL broken iPhone, you can't even get a list of running processes. So like, how are you going to detect malware? Unfortunately, nation states have zero click, zero day vulnerabilities that allow them to infect iOS devices by merely knowing someone's phone number. So anywhere in the world, they can hit you. And once they're in, yes, that's a hard target to get into, but they can actually leverage the security of that system as a protection mechanism. For example, I just mentioned you can't run a list, a process listing. So the adversaries, once they're in, they're like happy. An example of this is Kaspersky and the triangulation malware, this recently came out where an unknown adversary hacked into corporate and employee devices of Kaspersky, the Russian antivirus company, and remain undetected for four years existing on their iOS devices. That is insane. Kaspersky is one of the top security EDR, AB companies in the world. They did not detect an infection on their own systems for four years and that's not their fault per se. How do they eventually detect it? Network traffic, as we can see on the slide. So again, if you're doing malware analysis on iOS or malware detection rather, network is really the place you want to be and perhaps the only way you're going to detect, especially these more stealthy and advanced attacks. Okay, so that gives us an overview of macOS malware. Hopefully you've illustrated that we really want to be looking at network activity, because again, most of the malware is going to generate something that's observable. So now let's talk about how to enumerate this network activity starting by using file descriptors. The idea is pretty basic and that is on macOS, very similar to BSD and some other Linux-like operating systems. File descriptors are kind of everything, meaning sockets themselves are also file descriptors. So what we're going to do is we simply query the operating system, we specify the process ID of a process we're interested in, and the operating system will give us a list of file descriptors that that process has open. What we can then do is iterate through that, focusing only on sockets, right? We don't really care about normal file descriptors. And for those sockets then, we can query the operating system again to get information about those. So here's the example code. I'm not going to walk through the code because I don't think you want me up here like going line by line, but you know, I wanted to put this up here for, you know, like as a resource, so later you can go back and check it out. But I'll briefly describe some of it. So on the bottom, what we're doing is we're invoking the proc-pid-info API. We invoke this first with a PID. The process we're interested in file descriptors.  The operating system will return to us the size of the buffer we need to allocate to store the file descriptors in memory. We allocate that buffer, call that API again with the size and our newly allocated buffer. And voila, we get a list of the file descriptors that the process has opened. Again, this is going to include normal files but also sockets. Now what we're going to do is we're going to iterate through all of those file descriptors and we're going to focus on those that are just sockets. So you can see again some example code that implements this. For each file descriptor that is a socket, we then call the proc-pid-fdinfo with that socket file descriptor to get socket-specific information. From that, we can now examine the socket. The first thing we do is we make sure it's a networking socket. On macOS you can also have UNIX sockets, which are local sockets used for IPC mechanisms. We don't care about those in the context of detecting MacMower. So you can see on the slide we focus on AFINET or AFINET6, IPB4 or AFINET6 sockets only. If we compile this code and run it, I run it against the GitHub desktop application that's running on my system. We can see it found 70 file descriptors and has filtered out those that are sockets, which is a very small subset. Why am I using GitHub desktop? Great question. It's obviously a legitimate application. This is not malware. It's easy to test with. It has a lot of legitimate connections. I always like to test my code on legitimate software before trying it on MacMower. And also, it illustrates the point that legitimate applications obviously are going to use the network as well. So now that we have a network socket, we can start extracting relevant information from that. If it's a UDP socket, there's not a ton of information because it's stateless. But we can at least, for example, extract the local port. For TCP sockets, there's tons more information available to us. Again, I'm not going to walk through all this, kind of some boring code, but you can see we're able to extract, for example, the information about the remote endpoint, the remote IP address and remote port. Clearly, you can see if we're trying to detect malware, this is useful, right? Where is this application talking to? Is it a command and control server in North Korea? Okay, that's a big red flag. Or is it just some well-known trusted endpoint? So if we compile and run this against GitHub desktop now since we're extracting all the socket information, we can see all the information about GitHub desktop's network activity. So socket details such as the family, the port, the protocol, remote local information, et cetera, et cetera. So now if we run this code against or on a system that is infected with OSX dummy, we can see that this code picks up the fact that there is a established connection on port 1337. Yes, this is the port the malware uses to some remote command and control server. And you're like, okay, that's interesting. Now we can determine that. But, you know, dummy as we know uses Python to set up the reverse shell. So the question is how can I tell from solely this network activity that this instance of Python is being used maliciously? Great question. We'll get to that shortly. Now let's talk about enumerating network state using the private network statistics framework. And the reason I want to talk about this other way is that it has some additional pros over the method we just talked, the file descriptor method. So via the PROC PID API method that we just talked about, a few kind of perhaps downsides to it, it's process specific, so you only get the file handles for the process you specify. Of course you can just enumerate all the processes and make the requests for each one, but that's some additional code. Also, we get all the file descriptors, so we had to add additional code to filter out the sockets. Again, totally doable, but extra code. Most notably though, it doesn't provide us any statistics. Like, I want to know how much data, how many bytes a network connection is responsible for. For example, is an application exfiltrating gigs of data? That's super interesting. We cannot determine that from file handles, file descriptors alone. So what do we do? Well, it turns out there's a very interesting utility that's built into Mac OS. It's an Apple utility called NetTop, and if you execute it, it gives us all the information we're looking for. So it's global, so it's for every process. It's just sockets, so we don't have to worry about other files. And also it provides statistics, how many bytes up and down each connection is responsible for. Unfortunately, this utility is closed source, so we can't utilize it programatically very easily, but if we look at its dependencies, the libraries it's linked against, and we can do that with the O tool utility, we can see that it's linked against a private framework called network statistics dot framework. Now, the well-regarded noted security researcher, Jonathan Levin, actually fully reversed engineered this framework and wrote a nice open source command line utility leveraging this network private framework. So you can check that out. I love that, but I wanted a UI version. I wanted a tool that a user would be very easily able to double click and see all network activity on their system. So the first tool I want to talk about today is called Netacit. It's built on top of the private network statistics framework, and it's a nice UI. It's a pretty simple tool, but it will show you all the network activity on your system, a snapshot of that, kind of organized by process. You can also see information as you would expect about the interface it's bound to, the state of the connection, but yes, also bites up and down. If you're interested in learning more about this tool, pop over to the Objective C website. It's free, fully open source. But let's look briefly at some of the code behind it, the code that interacts with the private network statistics framework, because it's actually pretty straightforward. So the first thing you have to do is create a end stat manager, a network statistics manager. You allocate that. Once that has been created, you set a callback block via the end stat sort set description block function. And we'll get to that in a second. Then you tell the operating system that framework that you're interested in all TCP and all UDP connection. There are APIs for that. And then what you do is you start a query. This tells the operating system to call the API in the framework and enumerate all current network activity. And for each connection, it will invoke the callback block that you've set. So here we just call NSLog, which will print out information about that. We then link in the network statistics framework and run it. What information do we get for each connection? A ton, which is great. Detecting malware, the more information we have, the better. So here are the details from one single connection from GitHub desktop. A little hard to read that's kind of by design, just to show you how much information this private framework gives you, again, for every connection on the host. You can see the responsible process. Again, this is something we really are interested in. Is it malware or is it, you know, GitHub desktop? We also get the transmitted bytes up and down. And then if it's a TCP connection, a ton of information about the connection as well. So a really powerful framework to use. Now, there's always pros and cons to everything. So I always like to point out some of the downsides. And the biggest downsides to the two approaches we've talked about so far are that they only provide you a snapshot of the current state of the network on the host. Why is this problematic? Well, if malware is sleeping or only beacons out once an hour and you perform your snapshot of network activity between that, you will not see the network activity associated with the malware. And this is actually very common. For example, both dummy and some of the 3CX payloads utilize sleep or beacon or connect out on certain intervals. So again, perhaps our tools might miss them. Now, of course, you could take a snapshot every five seconds, but that might be somewhat resource intensive. And also you still might miss the malware. So what we need to do now is kind of graduate up and talk about more comprehensive tools that allow us to continually monitor the network. So at any time if the network or a malicious piece of software tries to access the network in an unauthorized manner, we will be there to observe it. So let's start by talking about how to build a DNS monitor that's going to run natively on macOS fully in user mode. The idea is pretty straightforward. The majority of malware, regardless of how it gets onto your system, is going to connect out to a remote server and most malware does that via domain, which means it's first going to have to resolve the name. Sure, we all know how DNS works, but a quick recap. The malware tries to connect out. This generates a DNS request to the DNS server. The DNS server returns the IP address and then the malware connects out to the IP address. So the question is, is this a good approach to detect malware? And I think the answer is yes, it's very efficient because again, most malware is going to be generating DNS requests. We don't have to monitor all network traffic. And in the case of some very stealthy malware attacks like the 3CX one, this was actually how the malware was detected in the first place, anomalous DNS requests. So how do we build a DNS monitor for macOS? More generically, how do we build these monitoring tools that allow us to continually monitor the network? The answer is to use Apple's network extensions framework. This is a pretty new framework that Apple now affords us to use. I believe originally was available on iOS, but now you can utilize it on macOS. And like some of the other frameworks and APIs I've talked about, this is actually decently documented. So kudos to Apple here. You can read on Apple's site all the cool things you can do with network extensions. They're actually incredibly powerful. We're going to focus on the last two, specifically how to intercept DNS traffic. And then we're going to talk at the very end about how to filter all network traffic. So again, we can use network extensions to do both of these. There's a great WWDC video where Apple explains exactly how to use these. Have a watch. So in order to build a DNS monitor, we actually are going to use a DNS proxy class. And that is the NEDNS proxy manager class. So I saw this in the documentation and it says, hey, this will allow your application to intercept all DNS traffic. Perfect. How do I do this? So I write code by Googling things. And so I just Googled it and there was like two hits. The first one was Apple's developer documentation that kind of described the APIs, but not much more. And then the second hit was like, hey, y'all, how do we do this? So I was like, oh, well, other people are in the same boat as me. There's no example code. There's no great documentation. So this could also be a learning experience for me. This is a tool I want to write anyways. So I saw that there would be some other interest as well. I'm not the only person who wants a host-based DNS monitor from macOS. There's at least one other person. So worth it. So the tool I wrote is called DNS Monitor. Again, fully open source free on objectivec.org. And you see when we execute it from the terminal, if we then resolve a DNS name, for example, objectivec.org via NS lookup, this will generate a DNS request that we can intercept. Now, unfortunately, there are several prerequisites. So if you're interested in writing your own network monitoring tools, which you should, it's great fun, there are some hoops you have to jump through, unfortunately. So first, you have to have certain entitlements that Apple may or may not give you. So be prepared to beg. Also, then when you build it, there's a lot of constraints. Specifically, you have to put your network extension in a certain place of the application. So building the project can get a little hairy. And then, of course, you have to sign and notarize this. So this means you have to at least pay Apple a few hundred bucks for the developer ID and get them to validate and notarize it. Okay, now you want your user to run it. What do they have to do? Click a lot. So if you go to objectivec.org and download DNS monitor, which is entitled, which means Apple gave me permission to do this, it's signed and notarized, which means Apple has scanned it and verified it. You still have to click allow. This is fari prompt. When you open it, gatekeeper is going to bug you, so you have to click allow there. When you go to launch the app, it's going to say, hey, wait a minute, this is a network extension, instead of a system extension, you need to improve that. So you have to click open security systems. You then once in there have to improve that, which is going to require you to authorize. So you're going to have to put in your password. And then finally, before it's able to access the network to monitor traffic, you're going to have to click allow one more time. So this is slightly annoying and if you're writing code, you have to handle all these situations. Like what if the user clicks no? You have to handle code to maybe do this again or fail gracefully. So this is a little annoying. And at this point I'm like, man, macOS has really become like Windows Vista. You might not be as old as I am. So you might not remember Vista, but Vista was like this Windows operating system where you had to click allow on everything.  Apple. They made these hilarious commercials basically ragging on Vista for having a user's click allow. And since you might not remember that, I have the commercial here that we are now going to watch. So I hope the audio works. If not, they're subtitles. Hello, I'm a Mac. Mac is issued a salutation cancel or allow commercial. Allow and I'm a PC. You're returning Mac salutation cancel or allow. Allow quite gives Mac is asking question cancel or allow allow. He's part of Vista my new operating system. PCs have a lot of security problems. So he asked me to authorize pretty much anything I do. You're pointing out Vista's flaws cancel or allow allow. I could turn him off, but then he wouldn't give me any warnings at all. And that would defeat the purpose. So you were coming to a sad realization. Cancel or allow. Hello. Hilarious. So I don't know if you were counting, but there was five allows. How many allows did we need to install a network extension? Six. So, you know, come on Apple. If you're gonna like rag on Windows, like don't become them. Now we're not here to pick on Apple too much. So let's get back to some code. But that was some good comic relief. So let's talk about how to activate a system extension. And network extensions are a subset of system extensions. So any network extension is also going to be a system extension. So again, not going to walk through the code too much. This is more of kind of a resource, but at a high level there's three steps. You basically are equate generate a request to activate a system extension. You then set your delegate. This is a class that's going to handle various methods that the operating system will invoke. And then finally you submit the request. This is what's going to generate one of the props pop-ups and if the user approves it, your system extension is going to be off and running. Now, though, we also want to monitor network traffic. Again, we're having a network extension. So what we need to do is we need to activate the network extension. This requires five steps. We load the current preferences. We set a description. We initialize and configure a provider protocol. In this case, we're using the N-DNS proxy provider protocol because we want to proxy DNS traffic. We set a flag to enable and then we save the preferences which triggers another pop-up that the user has to approve, which then, if they approve, will activate the network extension. At this point, our network extension will be off and running. You can confirm this using Apple's system extension control utility with the list command. If we do that, we can see that our DNS networking monitor has been loaded. Behind the scenes, what Apple has done is copied it from your application bundle and moved it into a route-owned directory and loaded it from there. So this is one of the reasons you have to be very careful about packaging up your application that contains the network extension because the operating system needs it to be in that specific location. Okay, so now we're off and running. That code so far was executed in our application. Now, since our network extension is loaded, it's going to be running as a separate process in the root session, we need to start monitoring DNS traffic. So the first thing we do is we call the start system extension mode function. Apple says do this right away. I don't really know what it does.  Behind the scenes, MacOS will consult the info.plist file of the network extension, which you will have to set up in a way to specify what class in your program is going to implement the delegates, for example, to handle new DNS requests. So on the slide, we can see how it would do that. So what are these delegate methods that this class has to implement? Well, there's three. There's a start one and a stop one. This just gives you the opportunity to perform any initializations or cleanup. The most important one is the handle new flow API method. Apple's documentation says this will be invoked any time a new DNS flow, which is essentially a connection is generated. Perfect. Now, remember we are building a DNS monitor, but we're using this proxy class, which means as a proxy, we are actually responsible for, well, proxying on the data. So what we have to do is six or so different steps. And I'll walk you through that. So an application or some malicious software needs to resolve a domain. So they do that, that generates a DNS request. Before that DNS request goes out to the DNS server, because we've installed a network extension, the operating system is going to deliver it to us. It's going to call our handle new flow method. What we have to do is open the local flow, read the datagrams, which is going to be a DNS question, a DNS query, and then connect out to the DNS server ourselves, build a new connection, and then write the datagrams, the DNS request out to that remote endpoint. So we are basically responsible for taking it and now delivering it, because again, we're proxying the request. This also means we're responsible for reading and delivering the response from the DNS server. So the next two steps are, we read the response from the DNS server, and then write it to the local flow, which means it will then be delivered to the local application or the malware whoever generated the DNS request. Now you might be wondering, okay, that's cool, but how do we parse the DNS packets? And this is a question I had, and I thought, do I have to do this myself? And I tried and then I was like, wait, this is a horrible idea. There's probably got to be a better way. Turns out there's a relatively unknown library called Libresolve, it was at least unknown to me, that ships with macOS that you can link into your application or your network extension and you can parse DNS packets. So on the slide we have an example of that. We give it a packet, a DNS request or response. We call the DNS parse packet, and it returns to us a structure with all the members of the DNS nicely parsed out. This is super helpful. Definitely use this library. What we haven't talked about yet is, how do we identify the process that was responsible for generating the DNS request? At the beginning of this talk I said, this is the best thing about host-based network monitoring. And, well, it is. So how do we do that? Turns out it's pretty easy. The flow object that gets passed to the handle new flow method has what is known as an audit token that uniquely identifies the responsible process. The application, the malware, whomever is trying to make the DNS request. Audit tokens are kind of modern ways to uniquely identify processes that are more secure than PIDs. But once we have this audit token we can retrieve the process's PID, its path, et cetera, et cetera, anything about that. So that's really helpful because that can allow us to identify who is responsible for that DNS request. So when we compile and execute this code on a system that's infected with 3CX we can now see that when, again, this very stealthy supply chain attack is executed, when the malware tries to connect out the Trojanized installer, connects out to the attacker's command and control server, we can observe this and say, hey, wait a minute, this isn't 3CX, it's talking to some MS storage boxes.com, big red flag. Now via the DNS monitor we can also do things like block DNS requests or responses because, again, we're proxying all the traffic. So this is great if we want to build perhaps a more proactive security tool. So let's look at how to do that. Super simple. What we do is we get the DNS request via the handle new flow API that, again, is going to be automatically executed for each new DNS request. We parse that packet using libresolve and then what we can do is we can extract the question, that is the domain that the application or the malware is trying to resolve. And if it's on a block list that we specify, we simply close out the flow. This means that the connection is actually never going to go out and from the applications point of view the DNS resolution has just failed. So if we implement this in the DNS monitor, we can now see that if, for example, I've told it to block Google.com, if we try to resolve Google.com via, you know, NS lookup or any other way, it's just going to time out and the system is going to be like, I can't help you. So this is great. This means now if we know the command and control server we can block where the malware is trying to connect out to. It won't be able to resolve it and then won't be able to connect out. We can also block the answer. The answer is going to be the IP address that the domain resolves to. So perhaps we might not know what all domains malicious IP address is mapped to. As long as we know that the IP itself is suspicious or bad. When the answer comes back, the answer recall is proxied through us before it gets back to the application. So again, we can simply say is this something we want to block and if so close the flow which will have the same effect the application will never get the response. Last feature of DNS monitor, you can dump the cache. This was actually one of the features I wanted the operating system to give me and one of the reasons why I wrote this tool. So what we can do is we can send a signal to the DNS monitor and it will basically dump all its records, all the domains and the IP addresses for all the queries on the system. This is great perhaps as a troubleshooting DNS troubleshooting tool. Now there's one short coming. Again, pros and cons, everything's a package deal and that is that we are only going to see DNS traffic. So let's turn our eyes back to dummy and if we look at line number six, we can see it connects out to the attacker's command and control server. It uses a hard coded IP address which means what? No DNS traffic which means we will not see any of dummy's network traffic because it doesn't need to use DNS. So the next question is can we enhance our DNS monitor or take a more comprehensive approach to see all network traffic? The answer is of course we can do this and also throw in some rules to build a utility such as a firewall. So Lulu, you might be familiar it's been around for a while recently updated it to use Apple's new network extensions framework. Previously it used a kernel extension and well it's a firewall, right? I don't need to explain this but the idea is it sees all network traffic and if it's from an authorized or trusted process it allows it. If it's something that it doesn't recognize it prompts the user to be like yo something's happening confirm or deny. Oops, maybe I do it too. All right, so how do we do this? We use another class that the network extension APIs and library affords to us which is the NE filter data provider. This allows you to monitor and govern all network flows as we can see from the header file description. The idea is all network traffic comes to us and then we can classify it as benign, authorized or perhaps suspicious and malicious. The way we do that and we'll dive into that shortly is by either looking at the responsible process, we can do some analysis on the traffic itself or we can ask the user. So very similar to the DNS monitor we need to enable the network extension by again these four steps. There's a few differences here since we're monitoring all network traffic we have some more customization capabilities including the fact that we could in theory monitor or rather examine all packets. For firewall we don't want to we just care more about the connections so we say no. However, we do say we want to filter all sockets so we set that to yes. Once we've saved these configuration changes this will activate the network filter and all network traffic will now be routed through us. Again, the handle new flow method will be invoked. Apple describes the handle new flow method it's pretty similar to the DNS monitor with one separate or new thing and that is it expects a response from us whether to allow or deny the connection. So there's three answers you can give and you have to give an answer either block which will cause the operating system to drop the connection allow it which will allow it or pause it for example if you want to ask the user and then you can resume or block it at a later time. Now if you want a passive monitor you just click or return allow for all connections. Okay, so now maybe the most important part of the talk, the conversation is okay now we have the ability to take snapshots of network activity, traffic, look at DNS traffic or even monitor all system traffic. How do we, and this is an incredibly important question determine if that traffic is unauthorized, malicious, belongs to something that should not be on the system talking to the network? So let's talk about some heuristics. I mentioned there's two main ways three if you ask the user but let's just focus on two here. The most common way and this is well established is via the network information that is provided in the flow. Now there's been talks about this, books written on it, this is how most network appliances classify network traffic as being unauthorized or not. So things like state, right? Like a listening socket bound to the external interface on port 1337 or 666 like big red flags, right? Also maybe statistics is something beaconing every hour or perhaps once a day at midnight and uploading a gig of data to some unknown endpoint. That's suspicious. But again, since we're doing host based traffic analysis and running on the host we can also bring in the responsible process. Perhaps for example that process that's beaconing at midnight and sending a gig of data somewhere is the backup solution just backing up the user's files at midnight and that's fine. You will not be able to tell that from a network application or network appliance. But if we're on the host we can say, hey, who is doing this and answer that question conclusively. So let's talk about now how to examine that responsible process to perhaps determine if it's malicious or not. Now I will caveat there are many ways to do that. That could be a talk unto itself but let's look at some recent examples that would at least be able to identify the malware samples we talked about earlier in the talk as, well, malware. So some examples, you know, is the item that's running a non-platform binary? Is it something that's non-notarized? Is it persistently insolved? Perhaps a red flag. And is it doing something unusual for example with the process hierarchy? So let's look at that. The first one is how to determine if something belongs to Mac OS proper in Apple parlance. They say that's a platform binary and also if it's notarized or not. So notarization I talked about is a method where applications, programs are submitted to Apple and they are approved. Yes, Apple sometimes inadvertently approves malware but generally speaking, all legitimate third party software is mostly notarized whereas most malware is not. So this is kind of a good, pretty solid red flag if you see something that's not notarized. Not gonna go through all the code but once we have an audit token for the responsible process or even a PID what we can do is we can invoke various code signing APIs in Mac OS to ask questions like is this an Apple binary? Is this notarized? And then the operating system will figure that out and give us an answer that will allow us to well answer this question. If you're interested in the full implementation I wrote a utility called block block which does some other stuff but it also has a full implementation of this code. Next question, is it persistently installed? The majority of Mac malware is going to persist so if you see a network connection that's tied to a persistent process maybe cause for concern or at least something you're gonna wanna look at a little closer. On recent versions of Mac OS persistence is governed or managed by this undocumented background's item database. I wrote an open source utility that will deserialize the items in this database and print them out for you. So this for example is what dummy looks like in the database. So OSX dummy persists as a launch daemon. It's component as we saw is a script that will run as root and since it's a script it's not signed. So we have a persistent script running as root. That's not common, that's cause for concern. And then finally and we'll stick with dummy here you should also look at the process hierarchy. So at the very beginning I posed the question how do we know that this instance of Python is malicious or being abused rather? Well if you look at the process hierarchy for it you will see that Python is a child of bash which is a child of launch d meaning that it has been persisted and then executed via bash. We can also see it's running as root. So now what we have just to put everything together we have a established connection to some unknown IP address on port 1337 strange. It's tied back to a script that's running as root via Python that's spawned via bash that's persistently installed. Like all those things are kind of individually strange but then if we combine them all together that's a huge red flag. 99% of the time that's probably gonna be malware at least something you want to take a closer look at. All right so let's conclude this and wrap this all up. So hopefully I've illustrated to you that by leveraging macOS' networking frameworks we can heuristically detect malware directly from the host. Again this is based on the very keen observation that malware uses the network and so if we can detect this unauthorized activity we can uncover malware. If you're interested in learning more I've written a book on analyzing mac malware. It's 100% free on taomm.org for the art of mac malware. I'm also writing another volume which will be about the programmatic detection. So think this topic plus many more. This will also be free as well. I'm gonna be doing a book signing tomorrow on volume one at the no starch press table at 11 a.m. So if you wanna pick up a copy of the book or have me sign it, stop by and say hi. I wanna end by briefly talking about our organization because I think it's amazing and I'm super stoked. So the Objective C Foundation is a non-profit and we do some really cool things that I just wanna share with you because I'm excited about it. So we organize the OBTS security conference. I look around and I see many familiar faces from the conference, speakers, attendees, you haven't heard about Objective By The Sea. It's awesome. We also generate raised money for college scholarships for high school students and have some diversity programs which we're really stoked on as well. So again, pop over to ObjectiveC.org. Now I wanna end maybe not on the happiest note. Many of you know I live in Maui. The Objective C Foundation is born in Maui. The OBTS conference started on Maui. I made all these slides on Maui. And earlier this week, there were some really catastrophic wildfires on Maui. Many people died, lost everything. So what we're doing is we are launching a fundraiser through our non-profit, our 501-C3 to raise money for that. So if you're called to support a great cause, check that out or just even pass, share on the link. 100% of the money is gonna go to the residents of Maui that have literally lost everything including loved ones. So again, pop over to ObjectiveC.org to get some more information about that. Finally, I just wanna thank the companies who support the ObjectiveC Foundation. They're the ones that allow us to organize the conference, support my research, allow me to be able to write a book and make it free. The goal is really for us as a foundation, me as a researcher to empower the community, share my knowledge and that is, I'm able to do that because of these companies. So just again, I wanna end by thanking them. I also wanna thank you for sitting through my talk. Really appreciate your attendance. Think I'm out of time so maybe no public Q&As but I will pop over here and since this is the last talk of the day we can hang out here as long as y'all want and so if there's any questions, come ask away. Again, thank you so much. I really appreciate y'all being here.