Good afternoon everyone. My name is Zaffan. I am one of the leads of the knock of DEF CON. Thanks for being here. Um the last time we had one of these was DC-19 at the Rio so it's been a while. So through all the year we always get like questions how we do the network here and the network keeps changing over and over like different properties and things like that. So we submitted a talk. It got accepted. We hope you guys enjoy it. So starting with the most important introductions. Who are we? So I said already who I am. So we're just going to go around. I'm going to ask each one of you to say your name or handle. Say what you do here at DEF CON. How many years have you been gooning with the knock or with DEF CON? Um if you want you can say what you do for your day job and what do you do? Exactly. Right if you're in offensive security, networking, blue team, whatever. So turning over to Mack. Hey everyone. I'm Mack. I'm the number two in the knock. Uh responsible and this is like DEF CON 11 or sorry 11th DEF CON for me. Uh so I'm responsible for a lot of the core infrastructure and overall planning of the network. John? You going down the line? Yep down the line. Get in the lineup. Hi I'm John.  So I basically do stuff for Wi-Fi. Uh this is my third year officially and I've been a friend to the knock uh for a long time before that. My day job is working for the Wi-Fi vendor Aruba. And I think the reason that they asked me to be part of the knock team is they were too cheap to pay for a support contract and if they wanted like firmware updates they know that I can get that stuff. So I can think of no other reason why I'm here besides that. Hi my name is Phil. I uh I work with the knock. I am not part of the knock. I kind of am. I'm the uh regional infrastructure manager for Caesars Entertainment. I help them set up their network around the buildings. I escort them here. I escort them there and help them put their equipment in. Without Phil with these screws. Hi everyone my name is Moncy. I'm the knock's tribute. This is my third year. So all the gaff tape and running around. That's essentially what I do. Thanks. Hi my name is Price. Um this is my third year. I took a couple years off. Um I'm a runner for the for the knock and my day job I build automation frameworks from the ground up. Hi my name is Colin. Uh you can find me underscore CRB on Twitter. I am the I guess boss of John. Uh I'm the wireless team lead and uh my day job I work for CDW as the wireless technical architect so I've been doing wireless for you know about ten years now. Hi my name is Jared. I'm an alcoholic. I've been doing this for I don't know seven, eight years. Something like that?  Um I do wired site. Hey I'm Nick. Also um C75. Um this is my fifth year. And I do wifi reg and other miscellaneous things. Um my day job I'm the head of security at a cryptocurrency exchange called Kraken. Um and I also run drunk hacker history here at DEF CON. So tonight at eight o'clock um plan a Hollywood mezzanine stage. Join us. My name is Mike or Sparky. Um I've been with the the knock for sixteen years. Um I guess that makes me the most senior one. Um yeah except for I'm not the boss. Uh I run like operations set up teams uh for the knock and my day job is uh point of sale applications. Hi I'm Spencer. Uh I do most of our monitoring and wired switch config stuff. Um not most of that. I help with that. Uh for my day job I'm a reverse engineer for Cisco Talos. Hey um wish uh this is my second year gooning. Um I help with all the taping and wiring stuff and stuff. Hello I'm Tofer. I just showed up to the knock this year. Uh yeah. Um this is my second year gooning and I just work here. I'm fifth for death. I am actually number two to Phil. So I work for the casino and do executive with Phil does. So yeah this is my uh sixth year. And I'm uh dedication and I think I've been here for four years because I'm really good at building network cables. So we just want to highlight that the the team itself has got a mix of backgrounds and skill sets and that's one of the things that we really value inside the knock. Um you know going to the anyone can be a part of the knock. Obviously there's there's some some requirements but you know knock people can come from anywhere. So we're just like you. We even allow Canadians. Yeah. It's true. Grandfathered in. Alright. So that's that's about us. Um you know what do we do? Who do we help out? Basically we provide the core infrastructure that all the villages, press, contests, speakers, closed caption, DCTV, Roots, everyone connects to. Um and we also provide the wireless for everyone. You know any of the attendees here. Um and we've done a bunch of different things inside of each of each of these have their own requirements, their own needs and we try to satisfy and help out as many people as we can. Um you want to talk? Okay. So a long time ago, a long time ago being 11 years. So that's my memory. Uh we'd usually arrive sometime around you know Sunday night get started on Monday and would work through the week. We've started moving that a little bit closer uh in the last few years just because there's a lot more properties, there's a lot more people and there's a lot more going on. But it really comes down to you know just like you build out any of the foundations for other networks you got to have your wired in. You have to have your core in. You have to get your wired out to all of your edges. You have to get access points hung. You have to get them you know pulled back. You have to connect for everyone's there. Um and then conference starts and it becomes a whole lot of you know uh last minute requests, sudden requests, issues, etc. Um so this kind of leads into we moved a little bit earlier this year. I arrived Thursday week before to get stuff going. Um and it's actually been a fairly smooth year I think. Although I'm totally jinxing it right now. Um so we'll see what happens. Especially after the DNS talk and half hour ago. At a boy. Um so that's it. I mean there isn't a whole lot to the complexity and we'll totally go into questions in a bit. And you can ask what you want about the infrastructure. Um thank you everyone. Thank you. There you go. Thank you guys. It's not, it's nice to be the speaker. You have people bring you stuff. It's cool. You should submit. Thank you DCTV. Thank you DCTV. Um so that you know again not a whole lot there uh from the uh the complexity of the infrastructure side uh or the wired side. So now I'm going to talk about the wireless. Colin? John? Yeah? Sorry I bring open up here. Actually before. Sorry what I forget. No no come up. Yeah. Part of this present this is not a presentation. The idea is to be like you guys interacting with us and asking questions and so on and so forth. So instead of like trying to break the ice a little bit. Wi-Fi has a lot of information uh that I think is going to sparkle some questions in your mind or things that you already want to ask us. So John and Colin they're going to go through the wireless stuff but in the meantime take notes uh we want to hear questions from you guys otherwise we're not going to be here for the remaining 80 minutes. So as Mack and Louise mentioned um there's a lot of pre-con stuff that we do and specifically with the wireless if you guys have been coming for a couple of years you know we've changed venues. We've expanded uh we were at Caesars last year. A little closer better. Um so that's a challenge for the wireless. We're trying to put RF in different spaces. Um usually we're going to try and do some sort of a site walk through if it's a totally new property. Just so we can get an eye on you know what things look like. Um I do predictive planning using a cool a tool called EkaHow. So we actually take some time to see you know will this amount of APs cover where we think it will. Uh we also have the fun sort of situation where I'd love to give you guys more access points to have more wireless. We've got a limit on drops. There are not infinite amounts of drops. And where I want an AP doesn't mean there's going to be a network connection to feed that AP. So there's there's compromise in some of these spaces and we got to kind of work with that as as necessary and things change from my original plans. On top of that I'll tell you guys that the the folks that do the DEF CON planning do a great job of accommodating and moving things around but what's in what room is in flux so long up until we get here that I kind of take first shot at design and then we know we got to change it. Um we also stage equipment so all of our stuff gets stood up probably a month or so before the CON. We make sure that we got new code on it. We look at last year's config. Make any changes we need to make. Um and then make sure that that also integrates into the overall design. So again different venues the last couple years we've had different network network topologies which meant the wireless had to adjust slightly. Meaning we're not just plugging in what we had last year. Um and then you know as Max said we we get here a little early so that I was helping with fiber and getting APs out and inventoryed as early as Saturday evening when I got in. Anything else we're doing? Precon? You might notice the why that was in the previous slide. The wired network is only there to support the wireless network. That's the only reason that they put wired in. Um these are the tools that we've been using this year. So to do what we do we don't have to have these tools but I'll tell you it makes our life a lot easier. So down at the bottom left there you've got the account sidekick that's uh spectra analysis and some wifi survey work.  And as always there's a console cable in the mix and then uh a special console cable for our access points. And then just a little bit about the hardware we're using we've got a Rubus 7000 series controllers. The 7212 is kind of the big boy. It covers uh the larger of the venues. And then we've got a smaller 75005 covering just Flamingo. Uh right now we're running 65 code. We're using uh AP 305s. We've got about 80 of them out this year. Uh probably about 100 in inventory. So when we have more ports we put more out if we can. And then we're also running a Ruba air wave as a management. Just a little bit about the settings. So I've seen stuff on Twitter after the con talking about you know I was on the wifi and nobody attacked me this year. Well there's a reason for that. So uh Defcon Open is 2.4 gigahertz only. We have client isolation so that means clients can't talk to each other when they're on that network. We're blocking MD&S, bonjour traffic. Uh basically our firewall is saying you can only go to the internet. And obviously it's an open network so there is no encryption. Anything that you send over the air someone else can sniff. Our Defcon Secure on the other hand is 5 giga only. So that kind of takes a lot of the noise out of the cheap little devices from China that are really good at de-auth attacks. You have to be a little bit more specific to target that network. Again client isolation, DNS, MD&S blocking, same thing with the firewall. But we are using WPA2 Enterprise with uh PEEP MSChap V2. And then the back end of that is free radius for our client off. Um and then just sort of one underlying point that I wanted to make about these kind of networks. That they're very quick to come up. They're standing there for a little while. The simplicity is the key in this. We don't turn on a ton of features. We want to lock down the network. We want to keep it secure. But a bunch of the advanced stuff tends to cause problems with certain clients. Then you guys have a poor Wi-Fi experience. So we uncheck about as much as we can. Aside from the bare bones things are going to keep you getting on the network quickly. Getting you on the network securely and then just letting you do your thing. How many people use the secure Wi-Fi network this year? How many people use the open Wi-Fi network this year? So I remember uh DEF CON. I don't know which number it was. It was at the Riviera. When uh do you remember AirPone? When it first came out? Basically it was on a white uh an open wireless network. And what it was doing was essentially everybody that downloaded a page from the internet. It would replace all of the pictures in any web page with um with Goatsy. And so you would see I would just watch these guys sitting out there typing something and then all of a sudden they'd slam their laptop lid shut. And it repeated all over the place. That's why we don't use the open Wi-Fi network at a hacker con. Use the secure network. And things like that don't happen. And I'll say I'm proud of you guys. We had like well over 2,000 people on the wireless so far this year. You'll see better stats at closing. Uh and it's predominantly on the secure network. Like good job guys. I'm glad to see it. Oop. We got a question. Yeah. Uh the wireless is not. I'm sorry. Yeah. The the question was are we uh blocking DNS null queries? Correct? No the wireless is not. Firewall? No. I we have not looked at it from the wireless. What was the question? Yeah. I'm sorry. Um are we seeing a lot of instances of iodine? And I'm not familiar with it. So uh oh got it. Yeah. So DNS tunneling out. We don't really watch for it. Yeah we're not really watching for that. But as far as going out we kinda don't care. Go out. Like we're letting people go out and do what they need to do. Yeah we get that we get that question a lot of uh all of my application is not working. My something is not working. We're blocking nothing.  Uh and hopefully most of you know about wifi reg. It's the way that you create your credentials for the secure network. Uh it's there's nothing really fancy to it. It's a pretty simple web server. We've got a database in the back end. It goes live the week basically of the con. So we usually do some testing staging before we get out here. And then once we're here we fire it up so that if you guys want to do that password user creation you can do it on a secure network that you trust. So do it from home. Do it before you get here. You know whatever. You don't have to do that off of our network. And then we've got a bunch of instructions. So lots of different client types out there. You know how do you get your device configured appropriately to securely connect to the peep network. And sometimes we miss stuff. So we have got some feedback. So thank you for the folks that have said like hey I think you got a config line wrong. Um it's usually a quick and fast sort of uh change of that page. So yeah we miss things. We appreciate you guys giving us good feedback about things that we miss so we can fix it. Um and then just some examples of some funny new usernames. You guys get like pretty good usernames that we see coming through the wireless controller. Yeah. Alright this year we had added some stuff. So the lovely picture you see here um we found out that we had to provide some wifi over in the theater area. And kind of last minute threw up some access points. So again not an ideal scenario. If if me putting my wireless engineer hat on. I'd want those in ceilings with directional antennas. I'd want about four times as much to cover that area. But when you have to do it in two hours you work with what you got. Yeah so actually. I'll talk a little bit about mounting because you see in the picture here obviously that's not the way we like to mount wifi access points. And we see tweets about that sometimes. If you guys don't know what you're doing, you mounted the APs wrong. We do know what we're doing but we're limited by sort of what kind of um mounting is available. So you know uh day one here I think on Monday they wanted to put the APs on the ceiling here. Like as high as possibly could as they possibly could. Not optimal. Um we'd like them on stands. We'd like them up above the the people. And we'd like them horizontal. And that's sometimes tough just based on what types of uh stands we can get. And how we can you know we've used duct tape. We've used bailing wire this year. No kidding uh bailing wire to attach um APs. So it's just a matter of what we can get. And we got we got some of these this year. So this is sort of our ideal. Uh unfortunately we got them after all the APs were up in the air. This is called the wifi stand. So like very handy. Hopefully you'll see these next year. Because they orient the AP exactly how we want facing down. Uh they just made it here a little bit late. So hopefully next year that's what you're going to see everywhere. Um yeah. The no no chrome. I mean maybe we could you know bedazzle it or something. I don't know. This is a hacker job. Um so so many other stuff we added this year. Android app. So hopefully uh everyone trusted that through the Google Play Store. Um that was sort of a new experience for me. I borrowed that idea off of CCC. Um we've had troubles in the past with Android having such a large ecosystem. It's really hard to describe how to configure that client when it's different on so many devices. So this kind of was a little bit more effort but made it a lot easier to say. We know that you have the profile. We know that you have the cert. We know that you're doing the right checking. And it'll work on pretty much all Android devices. So um that was hopefully something we're going to keep uh going in the next years. We added more config instructions for Linux. I think we'd only had WPA supplicant up to date. We added some other stuff. Um and then Nick and Wish you guys want to talk about the or Nick and John want to talk about the Chromebook profile? So Chromebook profile is new this year. So people had been we saw some folks complaining on Twitter that we didn't have the config for a Chromebook. And so um how many people have Chromebooks here? Oh, handful of people. So so thank John actually. John stand up. Yeah John! For for spending several hours wrangling with the Chromebooks um in order to get that to work. But now it it works. Yeah. Yeah thanks guys that we were busy doing other Wi-Fi stuff so they pulled the pulled up the slack on that one. Um challenges for Wi-Fi. There are challenges and funny enough like we we think as professionals these are not necessarily Wi-Fi challenges. That seems to be the easy part but patching is difficult. Cable runs are difficult. Um sometimes we ask for a cable and it's in the middle of some space that it shouldn't be there or it needs 20 feet of gaff tape. As I mentioned before that the amount of drops that we have that we can actually backhaul to the switch. Not never as many as I want. Um POE can be a problem sometimes. We have POE at every one of our switches. But if you've got a bad cable run or let's say you terminated something wrong on one of the POE pairs uh we had John fought one of those for a good couple of hours where the AP comes up. Powers never never gets on to our controller because one of the pairs is flipped. And it's not something you'd catch unless you had a tester or you know everything looked okay. I need to complain about mine. I need to complain about because I'm sure some of you saw me on opening night in the chill out room next door in valleys trying to screw at that access point on the 50 foot pole. Uh that thing and we had three or four drops like this. AP comes up, power comes on so POE works. It can talk to the network that works fine. It can talk back to the controller that works fine. It sends five packets and won't talk anymore. Like the wires heat up and suddenly become non conductive or something. That's the sort of problems we dealt with. And changing out the cabling is the only way to deal with that. And sometimes it's the last cable in the room. So the wireless village this year was supposed to have an access point from us. We couldn't. It was the last possible jack in the room. It went bad so we ended up moving that out in the hallway. So um older hotels are no fun for this sort of thing. Yeah the wifi is easy. All the other pieces are hard. Um the mounting if you guys saw the stands that we have out there a lot of them are pointed down which is what we want. Um some of them we didn't have the little bit that we got from the encore folks to kind of give enough 90 degree angle to drop down. So we do have some that are facing polarized incorrectly. You're still getting signal. It's just not ideal. So mounting is not easy. And each of the different properties has different stands. So you know this would be great if it was just a single property. But we're kind of dealing with four different groups in in some regard. And that means the mounting may not be as consistent as we want it. By the way he mentioned encore. These guys are awesome. If you are people that hold conventions uh the encore folks support all the IT for uh for the hotel. They have been here uh day and night with us uh hanging out in rooms watching us plug cables in and that sort of thing. But they're just it's they're incredible. So um those guys plus Caesar's IT are wonderful to work with. Yeah thanks uh for mentioning that John. And those folks have come back working for us. Phil how many years have you you say you did this? I mean I've worked for Caesar's for 15 and I think I've done it for at least seven. Yeah so Phil's been around for seven years. These guys between Phil and Kevin and and the encore folks we we they are part of the doc. They they are here. They ask to come work with us every year. They they know what we do. They know how we do it. They're invaluable to our team. Because letting a hacker con into your MDFs and IDFs like what could possibly go wrong with that so uh you know testicular fortitude. Let's see I think I've got everything. Oh and the room changes like I said things change right and sometimes rooms actually change during the con and you get things like this left on the floor with no access point there anymore. So you know we have to be a little bit dynamic in the morning or even in the evening. Look kind of look in and see what the alerting system has said. Hey your APs are down. It's because an air wall moved and they those pictures there from an MGM property. So yeah it's always fun you know we don't really get to sit back too much. There's always something going on and we have to address it as the con goes on. You guys have done really good this year at not stealing our APs and we appreciate that too. Keep that up. Um just some miscellaneous thoughts and you know if you guys have questions this is probably about the time for the Wi-Fi questions but everybody blames the Wi-Fi and the reality is you know sometimes it is our fault but a lot of times it's DNS problems it's DHCP problems. Um we work really hard so that we know that our infrastructure is solid and unless you're in some area that doesn't have our APs like the casino floor you're not gonna get our Wi-Fi in the casino floor. Yeah there was a complaint last night so in in the conference spaces we are providing our app. Everywhere else we are not providing our app. Is is is wookie here? Maybe that was the Twitter user that reported it last night that wasn't working on the casino floor. That was a chance to throw something. Alright so uh the other thing we we say in the app had it as a default password defcon defcon and we wanted just to show you guys that if you're doing the correct checking in your self-licant because of rotating keys you're still secure using the same password. That that TLS tunnel is dynamic for procession so you're you're safe if you've configured your incorrectly and that's always the sticky part. More about that. Is fart face here? You downloaded 16.2 gigabyte so over the Wi-Fi over the last three days. So kudos to fart face I guess. And then just some future planning so um we really would love to get a WPA3 network out there potentially next year. You know there's still a lot of client proliferation that has to happen. Um I kind of want to stable code base for the Aruba controller that will support it well so that we can offer that. Uh and then we also want to potentially do OWE which is opportunistic wireless encryption. So it's it's like an open SSID no authentication but you get encryption. So you know try to move towards using some of these new technologies that will keep the onboarding process simple for the Wi-Fi but keep you guys secure. And we we could have done WPA3 this year we didn't want to just because the client situation is still in bit of flux and um that's likely to lead every time there's a new generation of kind of Wi-Fi capabilities it leads to compatibility problems and it takes a year or two for that to sort of work its way out. So um we we kind of made the executive decision he did that we're not going to do it this year but I think next year we're going to we're going to try. Yeah it's it's it goes back to that simplicity idea. If I turn on some new advanced feature there's going to be some devices that have a hard time with it and then can't get on the network and then that's really hard to troubleshoot. So yeah and then it's our fault right then then you guys come to us and say hey the Wi-Fi is broken and we say well you know you've got this client that's not behaving correctly um try to avoid that at all possible uh cost but once we get that proliferation proliferation of devices it should be uh a little bit easier to suss those problems out if they do occur. Alright. I think that was my last slide yeah. Okay. Any other questions? So I I want to notice I want I want to like demonstrate the point out the gear sitting on stage was in use up until the last couple of years where it got refreshed by stuff that's only slightly less as old. Um so one of the big hurdles right now with IPv6 is making sure that we can do it in a secure way which means router advertisement suppression which none of our gear supports right now. You know IPv6 has been out there for about 30 years. People have been kind of really deploying it for the last you know 5 to 10 and you know it's been secured for like the last I don't know probably next year. Um so that that's kind of where it's sitting. Uh the the second thing is uh all of that would be tunneled because none of our immediate handoffs are v6 uh upstream. So those are kind of the two things right now. So we'll go I'm just going to point out. More questions? You sir? Okay. Absolutely none. Yeah so uh so the first question is what additional privileges do we give to uh people who put out for the call for services or put stuff on the network? Uh yeah to the point realistically none uh if anything we give them less privilege from the standpoint of we allow people to connect to them. Which is you know opening it up. Uh so the client isolation is really from like. Yeah that's strictly wireless to wireless. Let's talk about VLANs. How many VLANs do we have? Like each podium has a different VLANs. Okay so yeah I mean from the standpoint of do you want to answer? No. Okay. Uh from the standpoint of the the uh wired separation we pretty much separate as much as possible. Every drop coming out of the wall uh gets its own VLAN network. It gets its own network. All of that is uh layer three controlled uh stateful firewall in between them and it takes it from there. So it's a specific operation to open something up where the like the CFS comes into play or the villages and contests. Over there. 802.11 R.  Oh I'm sorry. What advanced feature do we turn off that we wish that we could use? 802.11 R is a great example. It would improve roaming. Uh it breaks a lot of devices. And there's some security implications there too. Um management frame protections. Another one. That was always the hey why aren't you turning this on? It's cause most clients don't support it and then they cannot connect to the wireless. Discovery protocols. We had a conversation about turning on Passpoint this year. Hotspot 2.0 type stuff where your phones would have sort of auto connected to the network without you asking them to.  Which was kind of the point but we decided not to do that. Yeah we. John. Raise of hands. Who would be pissed off? Who would be pissed off if we. Yeah. So if Home Depot does it to you though. No. We're throwing we're not gonna run the idea of maybe doing a talk about that next year so that we could run it in a very limited location. So if you guys came into our talk. Your phones would probably get pass pointed. But uh not on the full infrastructure. There's a guy over there had a question. Yeah he read that. Got your I'm up. Got you. So there's a there's a couple diffs and sorry dips in the uh Wi-Fi user count graphs for the year over year. Uh and the question is what can we explain those? Uh when the simple comments is no I I'm trying to remember some time back. I'm pretty sure DC 16 is when that airplane thing came out that I was talking about. Yeah. That might be the reason. That was when they changed the option at Riviera DC 16. Yeah. One moment please. Well we confer about a proper answer to give you. Uh pretty much larger space, more APs, not necessarily. People like people used to be very skeptical about connecting to the Wi-Fi network at AFKON. Used to be. Uh people understood that it was okay to do it. Right? Um I think that's part of it. But it's not one one thing. We got year by year we get better segue to the next slide. Uh bandwidth uh not great but we keep trying to improve as much as we can. But if you guys have a great experience and it's secure, right? Secure to the point that they were talking about your device, your traffic is, the traffic is encrypted. Nobody else can connect your device to attack your device. And we're not looking at the traffic that you're sending. I think that's fair game for this, right? Um for us on the other side is available, availability. Right? We don't want uh people like we want the network up. The more this works the more beers we have. So through from Thursday last week through Thursday this week it's a lot of work that we do to make it work. Then we hope it doesn't break so we can kind of watch talks and things like that. One of the when the suggestions from our colleagues is that uh there are alternatives to the DEF CON network uh particularly uh you know cellular coverage and whatnot. And during some of these some of these years there was uh times where that was coming out and you could secure yourself easier than you could secure into you know your standard enterprise uh wireless network. Let's go. Oh you got a guy straight ahead here. He's kind of got his hand up. I'm not sure if he's just resting it. There you go. Commit then. Now stand up. No, no, no, no. I ain't gonna listen to your question.  There you go. Do we collaborate with the BlackHack guys like here? Sharing resources. No. I'm gonna move my marker away. Uh not as much. Back when DEF CON and BlackHack were a lot closer there was a lot of there was some shared stuff but uh corporate entities kind of forced that to be a lot more separate. Um. The timing doesn't line up either. Yeah. We we need to have our gear here and running and going. The same time BlackHack is running. So. Yeah we're also not sponsored. We're not funded like BlackHackers. Yeah this is big bar on steel. I know. Alright. We'll come back to number two over here. Stand up. Uh stories about disaster porn. Okay. So the question is uh given the attacks. Yeah what are the attacks we've seen? What are some of the particularly notable ones? So um you mentioned something that's very kind of interesting. You said under attack? Like as in we're not attacked? No no. Is that is that is that what you're? Really? I'm not sure if you understand how alerts work. Alright. All of our phones here. So um a few years back um we uh we ran into an issue uh with a gentleman uh that was what was he doing? Was it cloning or mimicking? Don't spoof any of the casino networks. That's a big, big no no. And uh the the short and skinny of it is that well we're not attacked directly maybe.  Somebody learns a new skill set and they decide they want to try to flex that out. Sorry this is difficult to do and this.  Um. Thank you. Ooh that's a healthy shot. Good luck. Um it's okay he is actually old enough to drink folks before anybody brings that up. He has been carted. Anyways um no we uh we'll go around and occasionally we have to work with uh Caesars um on helping mediate some of these issues. Now internally um so I mean from the attacks internal like we expect some of the network to be attacked and we kind of set it up and let it go that way. Again the open network if people are trying to attack that that's kind of the nature of what it is. It's meant to be that that playground for people to go with. Um then there's other things where it's like we you know there was a BGPA hijack a few years ago. Not necessarily anything that we you know it affected us or or whatnot but yeah we know the network was going through you know the upstream network was going through another provider um just to demonstrate it as a talk. Uh for the most part what we what we look out for are the the speakers who have some demonstration they want to do and those are the ones that are that are kind of memorable. Um lots of gateway attacks you know spoofing um you know the traditional wireless de-auths etcetera. Um why don't you talk about what happened with <IP_ADDRESS>.8 this year. Yeah. Which one? The uh Google DNS. Google DNS uh so yeah so what Sparky was saying is we don't necessarily you know worry about a lot of the attacks that are directed against us but if someone just happens to be doing an attack against outside hitting up Google hitting up you know uh Microsoft hitting up any of those you know nice companies they'll see it as attack and they'll block you know the blacklist the the Defcon egress networks. So that's like yeah that's the nature of it. Um please don't do that until tomorrow night. So it's it's always fun trying to like you know reach out to people we know you know someone who knows someone who knows someone can be like oh yeah they can they can allow that through um cause sometimes it is you know an exploratory attack sometimes it's just we have a 30,000 people connecting into this network and doing a bunch of stuff and it's become the practice recently that uh the way to test your internet is to ping <IP_ADDRESS> right? Yeah after enough of that on the same network Google's like why are you sending me all these ICMP. So it becomes interesting to test it uh yeah. And then you know I know we've also had the uh Wi-Fi spoofing attacks. We see Wi-Fi spoofing. That's the most I think it's most common thing we see with Wi-Fi de-auth attacks and then people will try to clone the black or the um sorry Defcon uh network or Caesars network or things like that. So we see duplicate SSIDs in the air. Um it's it's silly just don't do that because we can see which room you're in if you're doing that and if we're not drinking or otherwise occupied we'll come and find you which we haven't had to do that much this year. Thank you. And if it's the Caesar stuff Caesars will come and find you and you don't want that. No they come with a lot more people.  But I think it's something rolling think they're cute you know just yeah it's some kind of pie or something whatever.  We're slowly getting drunker and drunker up here. So yeah. So what they do is you know they do a one letter off and they try to get everybody else to try and authenticate to it because they don't put no encryption on it. We're we're we're we're better than that.  If you start trying to pretend you're Caesars and wander around the floor um there's a probability that somebody's going to notice and they're going to send a lot of a lot of dudes who you just don't want to visit you. They come see you. So don't sit like in one of the big bathroom stalls and do this because I'll just dump water over the door. And you know it'll be cold it won't be hot water it's going to be cold you're going to probably pee yourself two or three times while you're sitting there. So I'm going to regret saying this but yes please focus your attack attention on us not on Caesars. Hey I heard it here first folks. We're taking a bullet for Caesars. Yeah and I'm going to amend that by saying if don't attack our wireless network go to the wireless village and attack their network. Next question. Next question. On the same token it's like again 8 or 2 1x we make it as easy as we can for you to use right. We don't expect you to understand it 8 or 2 1x. It's not that complicated but it's not that simple if you're not a wireless networking person that's fine. But last year I was at Caesars going from my room to the knock and I'm walking by the buffet if you were there and some guy is on his laptop walking I'm like whoa do you get do you get signal here he's like what yeah I'm like from the DEF CON network he's like no I don't use that network I'm like but you're on the internet he's like yeah I'm using the hotel Wi-Fi I'm like the open one he's like yeah I'm like right on.  Yep there you go. So yeah how far out in advance do we do planning and design for the network? The calls of what a week after we leave here first call? Yeah. Yeah. So on average we do let's say well we should be doing 8 months.  We actually go to an amazing conference some of us out of Chicago called THOTCON and oh yeah yeah maybe recognize Nick. And we go there and a lot of us will meet up there beforehand and do a little bit of planning and it's got an amazing VIP section. I do the planning you guys are there drinking. Oh yeah that's actually that's sorry. I've got a wireless network to run. Colin Oslo is an opera over there and yeah we most of us just get trashed and shout out to Morgan and video man for that. Shout out to Morgan. So pretty much tomorrow all of us all of us are going to know where THOTCON 28 is going to be at. That's when we start planning. If it is the same thing we kind of know what we're doing and what worked and what didn't work. If it's a new place or adding more places then around December we start planning. Excuse me where are you guys going? The stock's not good enough. You in the front there. Come on. I think we just answered all the questions. Lots of activities.  Hotel corridor right now. What's covered now? I mean to a degree we have some monitoring telling us you know what is or isn't going and there's a whole lot of Twitter that would tell us what is or is not going on. So. My phone is on mute now so I don't know. Is it up? You have a question?  Dude you're like ten feet away. Come on. I was just curious what's the setup like between here and Flamingo? I don't know. Maybe it's all two, maybe it's all three. How do people at Flamingo talk to certain ones back here? So we'll skip through some of these. We'll come back to those. You can ask if you want to see those other pictures. Ask questions. There we go. So this is what the current planet Hollywood Paris-Ballies connection looks like. All of it is the same layer two segments. We have physical connections between all of these properties that we can extend all of our VLANs too. Sorry can you point to where the Flamingo is on that man? So the Flamingo is over here. It is a smaller property and unfortunately it is not layer two connected over there. So what we do is we basically stand up an IP second tunnel between the two properties. We have divided route domains such that the Hollywood cord network has one set of networks and the Flamingo has another set of networks and we do a lot of cross traffic a lot between those. So Wi-Fi reg is sitting in this building for instance. So someone over in Flamingo signing up would come up to the firewall, hop across the IP second tunnel and then drop down into our Wi-Fi reg. Other questions? What would you want to know about the other images? Stand up, stand up. Oh, who would like to talk about the floor? So the question was what do, you know, we never have a problem. We talked about the infrastructure and like how many lines go to particular places and then once you get to that place you have to plug into the wall somewhere. So we have a bunch of pictures of what it's like to plug into the wall at some of these properties or the floor. So sorry. Before we do this we like to say we actually really like Caesars and enjoy their company. Yeah, it's, it really is a stuff builds over time and these are no way properties become everyone's like this, right? Phil, is that enough of a backtrack? Yeah. All right, Nick I think. So some of us have to go around and test drops all over the different properties and I took this photo. That's a quesadilla. Down in there and this was in Planet Hollywood in the celebrity ballrooms. But Nick what would you eat a quesadilla with? And then I went to the next one and there was a fork in the floor pocket. And we've over the years we've found also things like shoes, underpants, random pills and candy from God knows when. It's the real death con scavenger hunt. Step one is collect underpants. All right. Other questions? Yes ma'am. Yeah. So the question is how do we secure the physical aspect of all of our networking gear? Duck, duck tape. Both of us are viciously tabed. Viciously assholishness. Bazooka bubble gum. We try to keep it away from you guys. As much as we can. Right? The distribution switches, core switches, it's everything like and within like unreachable places even to us. We have to be with Angkor or the hotel to be there. But access points and everything else, it's a crapshoot, right? It depends on the property that we're at. Alexis Park was fun. Riviera was much easier because they had no wall jacks at all. So the picture that we saw around here, the background picture is a wireless controller that provides power over ethernet. Right there. Yeah. Right there for them. To all the APs that we had. So the APs were in the ceiling. That's what he complained about because the APs were too high. But hey, nobody's gonna steal them or unplug them and try to do something bad. And other places like the real, that if you were there, the hallway that would lead all the way to the back there, everything was reachable, right? So how can we secure that? Some of them would do like port secure, I guess. Some of them like we can't, right? And good or bad, we're still sort of humans and we do misconfigurations and things like that. So it happened before.  It's like, cool, what did you do? Oh, I plugged and I saw all of your access points. It's like, fair enough, right? Because we have a VLAN for all of the access points and the port that we told you guys to use instead of going to the internet was seeing all the access points. Sure. You could DDoS and bring down all of the APs but fair game, I guess. Yeah.  So we know what's going on. Yeah, you tell us, Spencer. Your weakness will only last so long. If you do want to hack Wi-Fi gear, my company has a very good bug knocking program. So please do that, but not here. So we had seven minutes left. We have 37 minutes left. We have seven. Thank you to DCTV. Yeah, DC, stand up for DCTV. Nothing but love for DCTV. Stand up. But there are other departments at this conference just putting that out there. And yeah, stand up, give them a round of applause over there. There we go. The departments, you know, I'm looking at SOC, speaker ops. This is like, you know, a few other ones just saying. Thank you. Okay, so we'll say one last question. Who wants to go out on a good one? If you're holding your hand up. Yeah, you have a purpose. Alright, what are the legends that we passed down through the knock team? Uncle Sparky, can you tell us a story? I'm gonna probably pass this on to others just because a drunk hacker history is where you come to get all of the amazing historical stories. There you go. Now, some of the history, some of the past, things have changed dramatically since we started this little party. Back in the day, we used, you know, crappy D-links and we used to race the scissor lifts. This is like well before safety and unions. No, no, it was pretty, pretty well back there. We plugged the switches. What? No, no, no. Oh, the switches to give away. We're two-thirds of us are trashed and I'm on that part of that. No, some of the history, some of the things we used to do in the past is the bathroom IDF, there you go. Somebody asked about physical security. Well, it was locked in the shitter so it really, do you have a picture of that? Just before we go there, I just want to say- Sorry, I'm skipping ahead. Well, I'm just like DC-17 wired did a spread on us and there were a lot of things like even some of these switches show up in the wired spread but one of the things that they really wanted to point out over at the Riviera was an IDF. Yeah, yeah, it makes working those long hours a little bit more comfortable. Back of the day, all the tape that would be gaffed down, I would just drink a bottle because it works really good in a gaffer roll so you can just hold onto it and roll it out. Yeah, that's why you were drinking the bottle. Yeah, well, that was it, yeah. That also made for a lot of wavy lines so it's nice that we have professionals that do this now as opposed to us. Okay. You guys left about that toilet, it's probably the cleanest one on a whole property that Sparky had access to and you didn't. Yeah. You got anything else? No, all right. Well, so that's it, we're gonna give away history here so before we do that I just wanna say thank you for coming to the talk. Thank you for being a part of DEF CON and using the network. We do this for you and it is, it does feel really good to see it in use and see what's going on even with all the challenges. Before you guys leave, some of these switches were in Wired Magazine so, you know, they're famous switches. Yeah, centerfold. Centerfold style switches.  Too bad. All right. No, no, no. One question. Oh wait, wait, sorry. One question from now. If you want a definite switch, did anybody travel here from Russia? Anybody here from Russia? So we got nobody working the elections. Okay, you from Russia? Did you do anything with the elections? Put your hand down if you did nothing. Okay, you don't get a switch. All right, sorry. Raise your hand again if you want to switch and you're not from what Phil established here. All right. Keep your hand up if you are a student. All right, you guys are awesome. Come on up to the stage.


So I'm going to talk about management of pulmonary embolism and one of the things that I'm going to include here is our data from Baltimore from Maryland. So, and I think that's why this is very important. So I start as a director of the pulmonary embolism response team in 2017. So there's a lot of changes that you can see that occur during that time. And I'm going to show you what we have already. So I have no disclosures. So we know that the venous thromboy embolism affects about three to 600,000 patients a year in the United States. We've been talking about pulmonary embolism. 10% of the pulmonary embolism are rapidly fatal.   And about 3 to 5% of the patients develop chronic thrombombolic pulmonary hypertension. That is a late complications of pulmonary embolism. So what happened here in Baltimore in the University of Maryland? So when I start here, I start doing basically a chart review of what kind of patients we have. So we saw that we diagnosed with about 769 patients at the University of Maryland during two years. So this is a large volume of patients, but a lot of those patients were admitted with a different diagnosis and then they were found to have a pulmonary embolism. Not all of them where that was the cause of the admission. And if we see there was a lot of people that had like a recent trauma, 16%, that had some recent surgery, 32%, 25%, 26% of them have cancer. But what is very unique about our area is that we have almost 50-40, you know, between Caucasian and African American. So that makes our area unique. If you read any other cohorts in the United States, usually Caucasians about 80, 90% of the cohort in our area is almost 50-50. So what is how the part work, you know, we receive a consult from in the hospital, from inside the hospital, but also we receive referrals from other hospitals. So from 2019 to 2020, we received 97 requests for transfers, but we only accept about 60% of the transfers. And those are the hospitals that usually request for transfers. Most of these hospitals are within the University of Maryland Medical System, but we also receive even, you know, from other hospitals too. So whenever we talk about pulmonary embolism, we have to talk about what are the risk factors and why pulmonary embolism happened. So I always say this is a balance between pro-quagoland and anti-quagoland factors. So usually you can have some inherited risk factors and acquired risk factors. In the inherited risk factors, you have factor 5 lightning that is the most common one among Caucasian patients. That affects about 5% of the Caucasian population. Also, pro-thrombin G mutation affects about 3 to 5% of the Caucasian population. Factor 5 lightning, this is a common mistake that I always read in the notes, is a resistance to one of the anti-quagoland system that is a protein C and protein A, protein C basically. So the factor 5 itself has a mutation that does not accept protein C as an anti-quagoland. So also you can have patients who have a deficit protein C and protein S. Deficits of anti-trombin, those are the anti-quagoland system. In African American, that is what we see in this area, you know, that in this cohort, we have also elevated factor 8. Sometimes we have patients that you do all these work-ups, it's negative, and then you check for factor 8 and the activity factor 8 is about 400, you know. You have patients with sickle cell trait, sickle cell disease, they also have an increased risk of having venous thrombosis, and you have elevated homocysteine. You have several mutations of MTHFR, and this is not a strong risk factor for thrombosis, you know, just recently discovered, but we still consider it as a risk factor. And then we have, on the other hand, acquired risk factors for venous thromboembolism. As I show in the previous slides, you know, you have cancer, hospitalization, surgery itself can increase up to 20% your risk. I'm sorry, 20% falls your risk of venous thromboembolism. You have trauma, you have air travel, now we have COVID-19 infection, antifulfolipid antibodies, and malignancies, et cetera. So we have multiple things that we have to think about venous thromboembolism, and as I say, this is a balance between proquagolants and anti-quagolant factors. So then, how much these inherited thrombophilias can increase your risk of thrombosis? If we see, you know, factor five, heterozygos, that is what most of the people has increased between three to four times, you know, the risk of thrombosis. If you have a homozygos, it's way more. But if you have a combined factor five lighting plus pro-thrombin mutation, it goes up to 20 times. But this is really rare. You don't see that very often. And also you can have anti-trombin deficiency that is very, very, very rare also that increase up to 16 times. You know, antifulfolipid antibodies we see quite often, but it is between two to 11 times, you know, the risk of thrombosis. So what happened when somebody has a pulmonary embolism? You have the pulmonary embolism, you increase the pressure in the right ventricle because you increase your pressure, there is an increase in wall tension. Then because there is an increase in myocardial oxygen demand in the right ventricle, then you can develop ischemia of the right ventricle plus minus infarction. You develop hypokinesia and dilated right ventricle. And also you develop hypoperfusion of the coronary arteries. You have a decreased preload of the left ventricle and then you develop systemic hypotension and patients start getting dizzy, shortness of breath, etc. But the mortality is directly linked to this. And when we have a patient that comes, shows up to you with a normal blood pressure, you know, the mortality is quite low. But if you have a patient that comes to the hospital and is in hypotensive or even you're required to give CPR in those patients, the mortality can go up to 65%. So the clinical presentation is very important for this. Diagnosis, how you make the diagnosis. So then we have a multiple test. I'm sorry for the busy slide, but you have multiple scores that is telling you what is your pre-test probability to have a pulmonary embolism. But basically, all those scores includes history, clinical presentation and symptoms of the patient. You know, and depending on the score that you use, they tell you you have to do some biomarkers like in the year's score, they also go for the de dimer. And then you say, okay, you ordered a CTA. So in our area, I think if anybody has a suspicion of a patient can have a pulmonary embolism, they just ordered a CTA. And CTA basically is the gold standard. It's the gold standard for the diagnosis of pulmonary embolism. Now with the new CT scans that we have, you can even diagnose subsegmental pulmonary embolism. What is the problem with CTA that sometimes we have is in patients that has any allergy to iodine, or if the patient has some acute kidney injury or chronic renal failure, you cannot expose the patients to iodine contrast. So then you can use a ventilation or perfusion scan or VQ scan, and you can see the areas of mismatch. How is the ventilation perfusion scan done? You ask the patient to inhale synone gas, and also you inject radiolabel albumin. So and then you put the patient in the camera camera, and then you get pictures of the perfusion and the ventilation phases, and then you compare both and see if there's a mismatch effect. Then let's say you cannot do neither one. You don't have a nuclear medicine or you cannot do a CT scan. You can also do an echocardiogram. And if in the echocardiogram you find that the patient has signs of rib and tricolor strain or the dilatation or dysfunction, you can think about pulmonary embolism. Also, you have to do a venous duplex ultrasound of the lower extremities. If the patient has an acute blood clot, give you or increase your suspicion of pulmonary embolism. And regardless of if the patient has a DVT, you have to treat the patient. You can do an EKG. In the EKG, you can have the most common sign is sinus tachycardia. But you can have a new rib under branch block or some STT changes that can you can think about a pulmonary embolism. You can have a chest X-ray, you know, the most common chest X-rays and normal chest X-ray, but that could be an exclusion criteria that other pathologists like a pleural effusion or pneumonia is occurring in this patient. There's few signs like a oligoemia sign or the, you know, but those are really rare and rarely seen in the chest X-rays. An elevated de dimer is a good test that indicates that you have some kind of blood clot in your body. So it could be arterial venous, etc. It's not specific for pulmonary embolism. The problem that the dimer is also elevated in other pathologies. Let's say if you have cancer, if you have a recent surgery, if you have fever, you know, everything can elevate the dimer. So it's not specific. You can check for biomarkers of myocardial injury, you know, the troponin, the probium P can give you some idea. And also we use that for a stratification that I'm going to tell you later.  You can check biomarkers or hyperperfusion lactate. That helps a lot in the stratification of the patient as well. So, but we have to think that every time that we talk about pulmonary embolism is not only the size of the club, you know, it's also the cardiovascular reserve. So I put as an example, Serena Williams, she had, I think like two or three episodes of pulmonary embolism, and she still is completely functional. She's still able to play. I think she just retired, you know, but she was able to do a top sport lady. So because she has a great cardiovascular reserve, and that's why, you know, whenever we're talking about classification, we're going to talk about the American Heart Association clinical classification of pulmonary embolism. In any of these categories that we talk here, we talk about size of the club burden. So we always talk about clinical presentation. And we have a patient that comes with a massive pulmonary embolism, and patient has a sustained hypertension for more than 15 minutes is not responding to IV fluid, you know, you give one to leaders of patients do not respond. Patients usually require vasopressure, and you cannot find any other causes of this. And also a patient can present with pulses electrical activity, and bradycardia and signs of shock that is a patient that has a massive pulmonary embolism. Then on the other side, you have the patient that has a low risk pulmonary embolism is a patient basic that comes sometimes have shortness of breath sometimes is just an incidental finding the V. And you have a normal patients, no hypertension, no evidence of right heart strain and no evidence of myocardial injury. And in the middle, you have a huge amount of patients, you know, from all flavors that you can have patient that are hemodynamically stable but has some signs of right ventricular dilatation some dysfunction. Maybe some enlarge right ventricle in the CTA, or in the echocardiogram, maybe some changes in the EKG. But you know the presentations are completely different in those patients. So that is a little bit of a problem. These two, you know, the massive and low risk. I think the treatments is straightforward in this one is what we have a lot of controversy. So there's other scores that we can use. We can use the PESI score that basically the PESI score divides into five categories, you know, you have multiple risk factors that you assign some points. Let's say if you are a male, you have 10 more points. If you have cancer, heart failure, chronic lung disease.  That goes from 1.6 to up to 25%. There is another score that, you know, this score is great, but the thing is takes a little bit of time to calculate and when you are in the emergency room on the ICU, that you have to go fast, you have something that is easier to do it. So then you have the BOVA score that basically has four elements. If the patient is hypotensive, you know, with a systolic blood pressure less than 100, you know, or I'm sorry, more than 100, between 90 to 100, you give one point or zero points or two points. If you have a elevated troponin, if you have ribenticular dilatation or dysfunction or if you have an increased heart rate. So depending on the point of score, you can have a BOVA 1, BOVA 2 or BOVA 3 and this is the 30 day mortality. However, we found that if you have a patient that is a BOVA 3 and you add an elevated lactate, you know, this is an important predictor of mortality in pulmonary embolism patients. So normally you classify BOVA 1, 2 and 3. In our hospital, we use a lot of the lactate plus the BOVA 3 to stratify those patients. So whenever we're talking about ribenticular strain, we can see the ribenticular strain in the CT scan and like in this CT scan, you can see that ribenticular is huge. But what is the sensitivity of the CT scan compared to the echocardiogram? Because sometimes the patient has, do not have or has ribenticular strain in the CT and they say why I have to ask for an echocardiogram. The sensitivity of the CT scan for ribenticular strain is about 40% and the specificity is about 80%. The other problem is that gives you only ribenticular dilatation but you don't have any idea about the function of the ribenticular. So that's why we always recommend to do an echocardiogram to confirm this. In the echocardiogram, you can have multiple signs like a ribenticular dilatation, ribenticular dysfunction and there's multiple parameters to evaluate for that. And usually what we do, you know, if you go to the studies, they say, okay, what is the RVLD ratio or TAPC and they based the outcomes is just one measurement. What we do here is we try to listen to the cardiologist and say, you know, I think patient has mild, moderate or severe dysfunction, mild, moderate or severe dilatation. One of the signs that we can see when a patient has a pulmonary embolism is a McConnell sign. And basically McConnell sign is global hypokinesia of the ribentrical and with hyperkinetic apex of the ribentrical and that gives you an idea that this patient has a lot of overload of the ribentrical. The other measurement that we check in the ribentrical is the TAPC or tricuspid annular plane systolic extrusion. So basically what we do is we measure the distance between the apex and the base and how they shorten in the ribentrical. So this distance and that is to give you an idea of how much the ribentrical contracts and normal values are above 15 millimeters, 15 millimeters and above. If it's less than 15 millimeters, you can say that patient has a ribenticular dysfunction. So in our hospital, you know, we found, we did a chat review and we say, okay, what is the difference between African-American and Caucasian? If you see that in the literature, you know, African-American has an increased mortality compared with Caucasians, but all those cohorts I'm telling you is 90% Caucasian, 10% African-American. So we decide to see what happened in our area when we have almost 50-50. So we found about 53% Caucasian and 46% African-American. If you see they are not similar, you know, the Caucasians are a little bit older, have more males. There is more diabetes in the African-American population, more chronic kidney disease. There are more smokers and they have more trauma in the Caucasian and more surgeries also in the Caucasians. So when we saw the presentation of the ribentrical, it was quite interesting because, you know, African-American have more underfilled left ventricle that you remember when I was talking about the path of physiology. You say that you decrease the pre-love of the left ventricle. So that occur more often in African-American that Caucasian, but also the ribentrical, you know, Caucasian has more normal ribentrical than African-American. But African-American has a more dilated ribentrical and more severe dilated ribentrical are more severe dysfunction when we compare with Caucasian. We think this might be related because of comorbidities. But when we compare about the mortality, there was no difference in the whole mortality between Caucasian and African-American. However, in those patients that require advanced therapies, I'm talking about systemic thrombolytics, catheter-based intervention surgery, there was higher mortality among African-Americans was 18.5 versus 3.8. So this is something that we need to look into a little bit more, but it's an interesting finding that I'd like to share. So now we're going to talk about treatment, you know, what kind of treatments we can offer to patients with pulmonary embolism. We have a lot of options right now. And it's not only that we have one or two anticoagulants, we have like a six, seven different anticoagulants. And we have a lot of advanced therapies that, you know, are in the market. So we have to talk about that. So I'm talking about anticoagulation, we have unfractionated heparin. If we, you know, it still is a great drug, we use it a lot, especially when we have a patient in the hospital that we don't know if we're really going to do an advanced therapy or not. We have low molecular weight heparin, we use it a lot. And if you have a patient that has any, we call allergy to the heparin or heparin induced thrombocytopenia, we have other options like argatroband, bivalidudin, and even we can use fundaparinox in those patients.  But we have the new drugs also like apixaban, rivaroxaban, edoxaban that are anti-tenet inhibitors, or we have direct thrombin inhibitor like a dabigatran. So if you think, and this is a business slide, I'm sorry for this, this is a coagulation cascade, the anti-coagulation system and the thrombolytic system. And we know that like in the case of warfarin, we know that warfarin works in several steps of the coagulation cascade and apixaban, edoxaban, you know, they work in one specific factor. So just keep that in mind, you know, the new drugs are really good. I use it a lot, but there is still room for the old medicines like warfarin. Tips about anti-coagulation, if you suspect that patient has antiphoffalipid antibodies, or if you suspect that your patient has a not reliable APTT, just switch the patient for anti-tenet activity. You know, it's not reliable to follow this patient with APTT. When is heparin resistant? We do require a lot of heparin. Let's say you have a patient that is requiring 60,000 units a day, 80,000 units a day, and you still don't have any changes in the APTT. Okay, maybe you have to check the patient, you have to switch the patient to anti-tenet, and if the anti-tenet is still not therapeutic, you have a true resistance to heparin. So maybe you have to switch to a different anti-coagulant. And also, as I said before, if you suspect heparin induced thrombocytopenia, maybe you have to switch the patient to a different anti-coagulant. Also for low molecular weight heparin, if you suspect that patient has HIT, you have to switch to a different anti-coagulant. And also you have to check anti-tenet once in a while in patients with that you are using low molecular weight heparin, especially if you have a patient that has a borderline kidney function, a patient that have like a borderline obesity, you have to think that for a low molecular weight heparin, the cutoff weight is about 150 kilos. If you have somebody in that weight, maybe it's a good idea to check anti-tenet as well. Also, in the underweight patients, you know, if you have a patient that is really thin, maybe it's a good idea also to check anti-tenet. Fundaparinux is mainly used for heparin induced thrombocytopenia. And argotrobin and bivalid are almost the same. Vitamin K antagonists, just remember now maybe the new physicians, they have all these new medicines. And I have these questions on and off about bridging of warfarin, you know, you still have to bridge warfarin. And usually you have to bridge warfarin for at least five days. Just remember that the factor 10 and factor 2 are the factors with the longest health life. So they check up to three, four days to suppress.  So the first two, three days that you give vitamin K antagonist, you cause hyper-coagulant states. So that's why you have to bridge these patients with a different anticoagulant. DOAX, DOAX are really good. But avoid using DOAX when you have a patient with a confirmed antifulfolipid antibody syndrome, especially if you have antifulfolipid antibody syndrome for lupus anticoagulant. Where it's two or three antifulfolipid cardiolipin and beta-2 glycoprotein, you know. There is a study that is a trapstrile that they found that the patients that were treated with river oxaban, they bleed much more and they thrombose much more than those patients treated with warfarin. So be careful with antifulfolipid antibodies and DOAX. Those patients that has poor absorption, these drugs, the DOAX absorb in the stomach and the proximal duodenum. So those patients with gastric bypass, especially ROX and Y, you know, they probably have a decreased absorption of DOAX. Patients with Crohn's disease, patients with large bowel resections, just think about that kind of patients. And in hemodialysis patients, interesting, there's a bunch of information outside about anticoagulation for atrial fibrillation in patients using DOAX. And the results are really good, but there's no information about hemodialysis patients and venous thromboembolism. So we can extrapolate the information from the studies from AFIP, but there's no studies dedicated for hemodialysis patients and venous thromboembolism. I think there are a couple studies, you know, running right now, but that is something that we have to be careful. And morbid obesity, there is still some controversy about morbid obesity. There is some in the early ages of DOAX, you know, there was a statement that was not safe to use DOAX in morbid obese patients. Later, another study shows that, you know, there was no events when they use DOAX in patients with BMI is more than 40. So I personally, I use DOAX in morbid obese patients, but there's no good data about that neither. Advanced therapies. Anybody has any questions so far? No? Okay. So we go to advanced therapies. What is advanced therapies? We're going to talk about systemic thrombolytics. We're going to talk about catheter-based interventions that now is not only thrombolysis, we have a thrombectomy. We're going to talk about surgical pulmonary embolectomy, and we're going to talk about advanced cardiovascular support. Here at the University of Maryland, we have the ECMO program that we have a lot of patients. So let me start with this. This is one, you know, from the analysis that we did at the University of Maryland. We use about, you know, 75%, 76% of patients that require with pulmonary embolism that require only anticoagulation. About 11% of patients, we couldn't offer any treatment for multiple reasons. And about 14, 15% of patients require some kind of advanced therapies. And if you see most of the advanced therapies that we use was surgical pulmonary embolectomy and catheter-based interventions, we use some ECMO and very few systemic thrombolysis alone. But also we have a lot of combinations like systemic thrombolysis plus surgical pulmonary embolectomy, systemic thrombolysis plus catheter-based interventions, plus VA ECMO, etc. So I'm going to talk about those. Systemic thrombolysis, we know that they work these multiple trials that they have done in the past. I'm going to quote these meta-analysis that was done in 2015. And in these meta-analysis, they see, you know, they put all the patients together and they found that overall mortality improved when you use thrombolysis in those patients. You know, it favors the use of thrombolysis versus anticoagulation alone. Whenever they divide these in those patients that were stable, you know, they divide the unstable P versus the stable P, they found, you know, they just lost statistical significance with a P0.08.  But when they found about bleeding, you know, all the studies they show that thrombolysis increased your risk of bleeding. So what the guidelines say, you know, if you have a patient who has an acute pulmonary embolism that is unstable, we're talking about hypertension, you know, and they do not have a high risk of bleeding, you can use thrombolysis. You know, if you have a patient that is stable, you know, the guidelines do not recommend thrombolysis because the patient is completely stable. However, if you have a patient that is stable now, but you start seeing signs and symptoms that patients deteriorating, you might give systemic thrombolysis to those patients. And when I, you know, this is one of the talks that I have with the people here. Here at the University of Maryland, we have ECMO, we have many other resources, but if we have a patient that they are requesting for transfer and the patient is far away. They say, you know, if the patient is unstable or is becoming unstable, just give thrombolysis, don't wait for that. Give one shot of TPA and then send the patient because this can save lives. So now we're going to talk about catheter direct therapies. And this is a really hot topic right now. There is multiple products outside. However, even believe it or not, there is only a few good level of data. And I summarize this data in this table and believe it or not, this is the only randomized control trial that we have. That was the ultimate trial that was published in 2014. It includes 59 patients only, you know, that's the only randomized trial and the outcomes, you know, was the RVLV ratio improvement at 24 hours. If you see, you know, there was a statistically significant improvement of the RVLV ratio with the ultrasound, catheter ultrasound guided therapy. And, you know, with an acceptable bleeding and acceptable mortality was no different difference than that. All the other studies, the Seattle perfect flare and exact trials, those are single arm. This is a registered single arm. They did not include any control patients. The optimized PE trial, it was randomized to different doses of thrombolytics, but there was no control patients. There were no patients that were given just anticoagulation, you know, the flare is with a different catheter. This is a flow trigger from Inari is a single arm trial and also they extract PE with subnumbra catheter that is also a single arm trial. So we cannot say that we have a strong evidence in favor or against these catheters because there is not enough information. So what, you know, the AHA, they released a scientific statement in 2019 that says that current data shows that catheter based therapies improve surrogate outcomes such as ribentricular dysfunction improvement in acute pulmonary embolism, but currently they cannot support the use as a, you know, one A indication for patients with pulmonary embolism. They say they might benefit long term complications like chronic thromboembolic pulmonary hypertension, but there's no good data yet. So I know that if you go to any hospital and many people are going to think, okay, let's take the patient to a catheter based intervention. Let's say, let's use ECOS catheter or Inari thrombectomy. But what are the real consequences of using that if you increase your risk of mortality when you are in the hospital or what is the real benefit, the long term benefit of those interventions? So that is one thing. Now I'm going to talk about surgical pulmonary embolectomy. A surgical pulmonary embolectomy is used when you have a massive pulmonary embolism that is refractory to other treatments. Let's say if you try pulmonary embolectomy, you, I'm sorry, you try a catheter based interventions, the patient is not doing well, maybe you can call the surgeons, hey, you know, we need to do pulmonary embolectomy in this patient. When you have a patient that has a clot in transit, that is an indication to do a pulmonary embolectomy. When you have a clot in transit and a patent for Amino Valley, that is another indication. Patients with acute and chronic pulmonary embolism, but this is more an indication for a pulmonary thromboendarterectomy. That is a more complicated surgery. When you have a patient with the thrombus in the right ventricle or right atrium, and this is a very soft, but maybe I have seen this like a once or twice that you have a patient who have a pulmonary embolism, but also they are scheduled to have a cabbage or valve replacement. They take the patient to the ER and they do the two surgeries at the same time. So in our hospital, you know, what is our data from our hospital? So there is two big case series. One is from Brigham and Woman, the other one's from University of Maryland. And from Brigham and Woman, they show about 115 surgical embolectomies during 14 years. They had about 55 during four years. And the 30-day mortality was, I can say, very similar. Also one-year mortality was a little bit different, but I think the patients were not exactly the same. And the 30-day mortality was very, very similar. The difference here is that in our series was a lot of patients who require the surgery for acute on chronic. So we're a little more stable patients. But now, what is the best treatment? What will you use for your patients? So cataract-based interventions, we did this analysis. And what happened is we compare all the patients that received cataract-based interventions that were about 30 patients in our center. And we did a propensity score match. And we matched with patients who received medical therapy, just anticoagulation versus surgical pulmonary embolectomy. So what we found is that this patient was not, and we compare over time. We went up to two years, you know, of follow-ups. It was crisp to try to get all the data from other hospitals. And we found there was no difference in thrombus resolution in those patients. The patients who received cataract-based interventions versus surgical and medicine approaches. There was no difference in improvement of the right ventricular dysfunction recovery. All patients recovered that. The length of the stay was a little bit longer in the surgical arm. The first patients that received surgical pulmonary embolectomy stay a little bit longer than the other patients. And there was an increased risk of bleeding in patients who received cataract-based intervention group. So when we draw a Kaplan-Meier for mortality, we can see in the top, those are the patients who received surgical pulmonary embolectomy. And we can see everybody else, I'm sorry, we can see the patients with cataract-based interventions in blue. We can see that there's a difference here. But when we compare the cataract-based interventions with the patients who received medical group that is the yellow line, there was almost no difference in mortality between cataract-based interventions versus the medical group. One of the critiques of this study is most of the patients who received cataract-based interventions, they receive is a cataract-based thrombolysis with an ECOS catheter. There was only one patient who received a cataract thrombectomy. Now in the market, we have the inatic catheter that they use cataract-based thrombectomies, but we need to check the data in the future. But that's why it's important to do a comparison between medical therapy and cataract-based interventions. How about extracorporeal membrane oxygenation or ECMO? This is a patient that we have on ECMO. We have an arterial and a venous cannula, and we have the patient's cataract may walk while they are on ECMO. And now, during this pandemic, ECMO has been used a lot, especially in those COVID patients. So we use ECMO in our PE patients. And a couple years ago, Dr. Kahn published this case series of about 20 patients who received ECMO for treatment of massive pulmonary embolism. And there is another group from Europe that they also use ECMO in massive pulmonary embolism. And what we found is the outcomes for them, they report about 61% mortality and in our patients was about 5% mortality. And this difference is explained not because of the technique, not because of the equipment, it's basically the selection of patients. We found that if we have a patient that is more than 65 or 70 years old is not a good candidate for ECMO because almost everybody dies if you put them on ECMO. We found that if you have a patient who has a bad disease, let's say it's a cancer patient, or a cancer in a late stage. They usually, we don't use the ECMO in those patients because we know that mortality will not be good. So we have to be careful on which patients we select to put them on ECMO. So we did a couple of things while patient is on ECMO. One of the things that we saw is in few patients that we had before that we tried the catheter-based interventions. Whenever they come from the other hospital, we try to put the patient in the OR, we put the catheter in, the patient decompensates. And the patients sometimes end up in ECMO. So we say, okay, maybe those patients that are high-risk, it's not a good idea to use catheter-based interventions because they can go worse. But that's why if we stabilize the patient on ECMO, and then we tried the catheter-based interventions. So we did couple of patients before, and we did, I think, with six patients only. But we found that all those patients with massive pulmonary embolism that they were on ECMO, we found 100% survival in those patients. None of the patients require a tracheostomy. None of the patients require dialysis after the therapy. None of the patients develop an stroke, but they all require much more blood transfusion. So again, this was with ECOS catheter with direct thrombolysis was not with catheter-based thrombectomy. So there is a room for research in that area. If you have a patient with massive pulmonary embolism, maybe we can use ECMO plus catheter-based interventions. There is another question. Why if I gave systemic thrombolytics to my patients and then I put them on ECMO? Are the patients doing well or not? So we found in about 80-something patients that were on ECMO during, I think, was from 2017 to 2019, those patients were on ECMO for PE. And about 18 of those patients had received previous systemic thrombolytics. And we want to see what is the outcomes, you know, if the patients die more or not. Because usually we put them on ECMO because there was a failure of systemic thrombolytics. So we found that the interesting, the survival to discharge in that in those patients was a little bit better in the patients who received systemic thrombolytics and then require ECMO was 88.9 versus 84.6. But there was no statistical difference. However, you know, they require way more blood transfusions. You know, the mayor bleeding was 61.1% in patients who received previous systemic thrombolytics versus 26% in those that did not receive systemic thrombolytics. But, you know, mortality outcomes was okay. Then which therapy is better? And that is a million question, million dollar question. And when I came here to the University of Maryland, there was a lot of controversy between services because we don't have a good data. And still, I think we don't have a good data for that. So let me tell you a little bit of history. Let me see. Okay, a long time ago in 2018, PERT was created in the middle of the battle between medical rebels and the surgical empire to treat PE. As a result, an algorithm was created to keep the peace between services. So this is the algorithm that we use at the University of Maryland. And after I present all the data that I show it to you, we decide to work better with an algorithm. So after we diagnose the pulmonary embolism, you know, we see if the patient is stable or unstable. So we have the express PERT activation that we activate only if we have a moderate-risk patient that has a submassive, high-risk submassive, a Boba-3, or if you have a massive patient.  We usually put an access for ECMO in those patients. In Massive PE, we connect the ECMO. In the high-risk Boba-3, we use micro puncture only and we just leave the access, but we don't put the cannulas. If we have a massive patient, we can use systemic thrombolytics plus minus ECMO, or we can use ECMO plus minus catheter-based interventions. Then we put the patient on ICU for cardiovascular support. Whenever you have a patient that is a high-risk or moderate-risk, we usually don't do any intervention at this time. We repeat the echocardiogram at 48 hours. We see if the patient has a clinical improvement or not. Why 48 hours? Usually, if you see other guidelines, they take this patient right away to catheter-based interventions. But what we found is what is really the benefit to rush a patient for the catheter-based intervention? Most of these patients that we repeat the echocardiogram at 48 hours, we start seeing an improvement of the right ventricle function. The function is what really recovers faster than the dilatation. The patients remain dilated for a couple of days, but at 48 hours, we see that the patients start getting better. Most of the time, the patients do not require an intervention. However, if the patient doesn't improve, then we have to see if the patient is a surgical candidate or not. And if the patient, in fact, is a surgical candidate, we evaluate the patient for either catheter-based interventions or surgical pulmonary embolism. When we talk about catheter-based interventions, everybody thinks about myocardial infarction. In myocardial infarction, you have some goals in time between when the patient comes to the hospital, you have a door to balloon time, et cetera. And pulmonary embolism is not right equal to that. Whenever you see, you have up to 14 days to do a thrombolysis in those patients and it's successful. So as long as the patient is not unstable, you have some time to plan your interventions. You don't have to rush the patient to the OR. Also, you know, for surgical pulmonary embolism, if the patient is in this area that is on ECMO, you can also plan the pulmonary embolism. Because you have time, that means given by ECMO. Then if a patient has a clinical improvement, you just start a patient on anticoagulation and then you discharge the patient, and we have the pulmonary embolism clinic in the outpatient clinic. On the other hand, if you have a patient that is completely stable, that is low risk, you can either observe the patient or you can even send the patient home from the emergency room if they have a low risk of bleeding and low social profile. You know, the patient is reliable, basically. Now I'm going to talk about what consequences you have after having a pulmonary embolism. Not everybody goes well. You know, you have a PE, about 50% of patients after a pulmonary embolism have some kind of dysfunction. And this is based on the trial from Dr. Susan Tan, that is the ELOP trial. They found that 48.5% of patients after a pulmonary embolism, they develop shortness of breath. You know, they don't have a good quality of life. And when you check the echocardiogram, they don't have a normal right ventricle.  They can have also an abnormal VQ scan or they have still significant residual thrombosis in the CT scan. If you do a pulmonary function test, you see the gas exchange is not the best. You ask the patient to walk and you don't have a normal walking test, like a six minute walking test. You say, hmm, this patient might drop into the post pulmonary embolism syndrome. And this is basically like a new term. We don't know exactly why this occurs, why some patients develop post-PE syndrome, why patients do not develop post-PE syndrome. When they try to check if the residual thrombosis has something to do with this, this was not related to the residual thrombosis. So we are still looking in this area to see what's going on. We don't have a pathophysiology for this post-PE syndrome, but that occurs in our patients. But if we see what is the worst case of post pulmonary embolism syndrome, we talk about chronic thromboembolic pulmonary hypertension. In chronic thromboembolic pulmonary hypertension, we see significant residual clot in the pulmonary artery that could be proximal, like in type I or type II, or could be distal in type III and type IV. And those patients not only have residual thrombosis, they also have increased pulmonary pressure. And this patient comes with a pulmonary pressure of 50, 60, and they have signs of ribosecular dysfunction or failure. You need to have at least one pulmonary embolism, but up to 60% of the people do not remember having a pulmonary embolism. The mortality, if you don't treat this, is about 70% if your pulmonary artery pressure is more than 40, and 90% if your pulmonary artery pressure is more than 50, and you don't treat those patients. Those patients are usually treated with surgical pulmonary thromboendarcterectomy. You have to go and remove those clots, and you can use medicines to decrease the pulmonary pressure as well. When we did, we tried to check why these patients do not have a complete resolution of the clot. So we did an analysis of our population, and we found about 350 patients that has some kind of images after pulmonary embolism. They have either a CT scan or a VQ scan after APE, and we found that almost one-third of the patients do not resolve the clot. And the risk factors for an incomplete thromboids resolution were a history of cancer. If they have a concomitant lower extremity in DVT, and also if they were a non-calcation by race. The patients who resolved the clot really fast were those patients that had a provoked event such as after surgery or trauma. So those patients resolved really fast. So this is another interesting area that we are working on right now. So post-PE care, what we do when the patient has a pulmonary embolism, we need to check for thromboids resolution images. We usually do is a VQ scan. We don't repeat CT scans all the time. Also, we do an echocardiogram to see if they normalize the ribentricular function. You know, I usually see patients after a month, but I send all these tests between one month and three months. So as I told you, the ribentricular systolic function normalizing almost all the patients. The problem is some of the patients remain with a ribentricular dilatation. Also, we do a six-minute walking test to see what is the exercise tolerance on those patients.  And they use also cardiopulmonary exercise testing. An abnormal pig VO2 that is less than 80% of predicted is a good predictor that the patient can develop post-PE syndrome. Also, if you think that the patient still have the shortness of breath and you don't know what's going on, you can also send a pulmonary function test. Maybe the patient has any other like a COPD or any other lung disease that the patient hasn't been diagnosed before. So those are the usually post-PE care that we see. Sometimes we have to change anticoagulants. Let's say you have a patient that you do the VQ scan at three months and the patient is not only that hasn't resolved the clot. The patient having new clots. Maybe the anticoagulant that you are using is not appropriate for the patient. You have to switch to a different anticoagulant. Sometimes we have to think about a filter. But those are the things that you will see in your patient after a PE. So in summary, the correct risk stratification is key to apply the most appropriate treatment. You have to be very familiar with what you have in your hospital. You have ECMO, you have a cath lab, you have cardiac surgeons on call. Or if you don't have that, you have to be familiar to use a systemic thrombolysis or you can refer the patient to another hospital. If you have a patient with massive PE, you don't have time. You have to treat the patient right away. And if you have a patient that is stable, you know, you can use other therapies. Caterbase interventions are a great tool, but we don't have enough information yet. So we use it, but not as much as we used before. We are very cautious with Caterbase intervention. And I recommend to have a post-PE care in every single PE patient, because what you don't want is that the patient comes at six months and they have severe shortness of breath. And then you find that the patient has chronic thrombolypumillary hypertension and something that you might intervene earlier in the disease.