Здравствуйте, я Ретиньян Каркадзи и я лид-пенетрация теста в российской компании, которая имеет название ЗОН. Также я организатор, один из организаторов РФ ЗОН в Москве, и один из организаторов CTF ЗОН, компетиций CTF, а также веквальсов DevCon CTF. Сегодня мы поговорим об онлайн-банкинг-секурии. Во-первых, я на проектах, на моем работе, у меня есть много секретарных аудиторов, различные онлайн-банкинг-капликации, и в этом проекте я встретил, и мы встретили много различных vulnerability и других интересных вещей. Так что в этой презентации я хочу поделиться с вами какие-то эксперименты, какие-то интересные вещи. Так что этот talk будет интересным для афенсивных и афенсивных специалистов, которые работают с онлайн-банкинг-капликациями. И также будет интересным для разработчиков, которые работают с онлайн-банкинг-капликациями, и кто пытается сделать это safer. Но я пытаюсь сделать эту презентацию с большим трудом, и я надеюсь, что все могут получить что-то новое из этой презентации, и получить что-то интересное из этой презентации. Так что давайте поговорим о структуре этой презентации, о том, что мы будем говорить. Итак, сначала мы поговорим о различных, о ремонт-банкинг-анлайн-банкинг, о ремонт-банкинг-анлайн-банкинг. Мы поговорим о веб-банкинг-мобиль-банкинг, о различных между ними, и после этого мы поговорим о тестировании, о веб-банкинг-мобиль-банкинг, и о различных, как мы можем использовать эти веб-банкинг-мобиль-банкинг. Итак, и большая часть этой презентации будет, например, деталейной информации, как это работает, как это работает, и, может быть, какие-то плохие практики для выживания. И так далее. Также мы поговорим о первых практиках, как выживать эту веб-банкинг-мобиль-банкинг. Итак, давайте начнем с различных. Какие ремонт-банкинг-анлайн-банкинг-анлайн-банкинг. Это когда лайн не нужно идти в офис, чтобы делать какие-то акции в банке. Например, для выживания денег, для, я не знаю, проверения баланса в банке, и некоторые другие вещи. Итак, это может быть что-то, это может быть ATM, это может быть Call Center, это может быть SMS-банкинг, и также это может быть веб-банкинг-мобиль-банкинг. И, например, мы хотим уехать от аккаунта, так что мы пришли к ATM, и это один из примеров ремонт-банкинг-сервисов. Мнф, есть другой тип банкинг-сервисов. Это лайн-банкинг-анлайн-банкинг. Она не другой, это ремонт-банкинг-сервисов, но это идея, которую мы будем сказать сегодня. Эти санлайн-банкинг-анлайн-банкинг-это веб-банкинг-мобиль-банкинг-анлайн-банкинг-это веб-банкинг-это когда вы injected веб-сайт в банке на браузер, и на Nummer 2-3, лагин в вашу аккаунту и делай какие-то действия, может, трансформирование, чейк-балансы и так далее. В мобиле это абсолютно то же самое, но вы должны доноточить аккульт на вашу мобилу. После этого, опять же, вы лагинете в аккаунт и делаете какие-то действия. Сегодня мы поговорим о онлайн-банкинге, о веб-мобиле-банкинге. Итак, мы говорим о том, как это работает. Это очень-очень простая мобилья, да, но это хорошая мобилья, чтобы показать, что мы говорим об этом. Мы не говорим об инфраструкции, о банке инфраструкции, об процессе и других очень-очень комплексных вещей. Это магия для нас сегодня, и это совершенно невозможно. Мы говорим о том, что это очень-очень простая мобилья, это магия для нас сегодня, и это совершенно невозможно. Это как локбокс-фос. Итак, мы говорим об серверной сайте, об апие, да, мы говорим об фронт-тенте мобилья. В фронт-тенте это что-то, что стоит в браузере клиента. Так что это может быть ангуляр, это может быть реакт-апликация, это может быть HTML без аяк-реквеста, но это не так, как сейчас. Уже, может быть, есть банки с аяк-реквестами, но я не знаю, они не видели это. Так что мобилья, это совершенно то же самое, но мобилья-апликация, это как кастом-мейд-браузер, и фронт-тент и мобилья работают с апием, да, с серверной сайте. И они sent реквесты к апие, и они получают реквесты от апи, и они дают реквесты, они показывают твои глаза к клиентам, и клиентам могут работать с апием, и для каких-то экшенов, может быть, клиент на ботонах, и другие вещи, может быть, что-то. Так что обычно в банках с апием, это струнт-апликация для фронт-тента и... the same, sorry, same API for the front-tent and for the mobile. Sometimes maybe there are differences, maybe it is a split-ed API, so different API for front-tent and different API for mobile, but usually it is the same. And API, it is like something between... It is an application that helps us to work with bank infrastructure. It has API methods, it has some functionality that can be used by front-tent and that can be used by mobile. And after that it sends to bank infrastructure and there is some magic in bank infrastructure. The bank infrastructure is very, very complex, it can be anything, it can be monolith, it can be microservices, yeah. And so, but today it will be bank infrastructure and API, it will be server-side for us. So, and I think it is all that I wanted to say about how does it work. Again, it is very, very simple and we can't talk more detail because it needs a lot of time. It is huge topic. So, testing approaches of server-side and bank infrastructure, usually it is... API, it is usual web application, yeah. Bank infrastructure, it is a very complex thing, it is like a zone with different services, it can be anything and so it is very hard to hack it without understanding how does it work. And so, you can only try to maybe use fuzzing and other things and try to understand how does it work and it is only one way to understand how to hack the bank infrastructure. So, API, it is usual web application, so it can has any web vulnerabilities. So, if I'm talking about the possible vulnerabilities, like I said, it is usual web vulnerabilities, yeah, it is everything from the awasp, yeah. You just can take the checklist of awasp and any vulnerability in the most related to the server-side. So, also it is misconfigurations, it can be anything like a jinx misconfigurations, maybe other things. And also, it is logical vulnerabilities because the bank and the mobile banking, online banking, it is very, very complex thing, yeah. It has very, very complex architecture, yeah. And so, when architecture is complex, developers can do a lot of mistakes in this. And so, it can be any logical vulnerabilities, like idors, like, I don't know, leakage of sensitive data of clients, maybe, if it's correct to say, race condition, but it is not logical vulnerability, but sometimes it can be based on logical problems. So, and other vulnerabilities, it is only examples, so it can be anything. Next one, it is front-end, so it is user interface, yeah, based on the data received from API. And so, and because it allows a browser, yeah, browser take a lot of security job on itself. And so, it is very big difference between the mobile application, yeah, and front-end, because browser do a lot of security job by itself. But in mobile applications, developers have to do the things by itself. So, and possible vulnerabilities, that is XSS, that is, I don't know, DOM-based XSS, that is CSRF, yeah, maybe forgotten, or maybe unfinished pages, yeah. Sometimes, for example, developers make and publish in production react application, but this application has pages that doesn't work and they invisible for clients, but anyway, they exist in production. And so, after understanding, and maybe like reversing of react application, yeah, you can find this and you can recover the methods, API methods that application sends to API and gets, and it allow you to try more requests and maybe find another vulnerabilities. And also, it can be unsafe communication with API server, sorry, and it is everything about the society, it is everything about communication, maybe other algorithms and so on, so on. And again, it is only examples, maybe there are another ones, there are another ones, of course, there are. So, if I'm talking about mobile testing approaches, yeah, like I said, mobile, it is application, it is like custom made browser. So, and in this case, you have a lot of, I don't know, security and customization features, yeah, and so you have a lot of possibilities to do something wrong. And in this case, possible vulnerabilities, it is storing of sensitive data, yeah. And we will talk about this in one example a little bit later. So, also it is unsafe handling of external data and because there is one good example of vulnerability, when mobile application got data, external data and save it to SQL database. So, and there was a SQL injection in this. And if you can sniff and if you can edit traffic that application gets from the network, yeah, you can do the SQL injection on the client side, it is very interesting thing. So, also it is unsafe work with mobile platform, it is, for example, IPC mechanism and other things, maybe, and also there are a lot of different things. And let's talk about testing guides, testing approaches for every type of online banking, yeah. For web banking, you know, in this slide I wanted to set, I wanted to make the big table with comparing of different guides and with choosing the best one. But no, I just didn't find any other good guides except Avasp web and Avasp strategy. So, maybe you know and if you use something else you can maybe share it in comments. So, it is really good because, but for web banking we also usually use Avasp web, yeah. It has very good checklist and it has a lot of different vulnerabilities so it is really great and good job of someone who made this, yeah, of people who made this. And so, mobile banking, it is Avasp strategy and Avasp web guides. And Avasp strategy, it is about everything that relates it to mobile platform, all vulnerabilities related to this one. And why Avasp web here? Because we have a server site, yeah. And when we watching the mobile application, we have to check the platform, yeah, the application. And also we have to check the server site and how it communicates between the, how it communicates with the mobile application. So, for the platform, for the application we use Avasp strategy and for the server site we use Avasp web and it has maybe some intersections, yeah. And so, if in the best way this intersection should be fixed, yeah, and you have the best way is to have one big checklist and one big guide. And so, using of these checklists is very, very conveniently and it really helps us to don't forget something when we test it. So, after that we begin to talk about vulnerabilities and now it is the biggest part and we will talk about this until the finish of the presentation. And firstly, I want to say why I choose this vulnerability. There are free options and there are free reasons why I choose this. Firstly, it is, for example, some vulnerabilities are very common, yeah. You can meet it in a lot of different applications and it is very common and this is a problem. So, the second one reason it is because these some vulnerabilities are really interesting and they are not common, yeah, maybe it is very rare vulnerability, but anyway it is really, really interesting and it is like really hacking and, for example, like I said before, it is like making money from nothing, yeah, and so on. And so, it is really, really interesting and I love it because. And so, the third one reason it is because sometimes some vulnerabilities are really hard to fix, yeah. And developers trying to fix it and make another vulnerability. And so, we will talk about I don't remember one example of this vulnerability and so it, okay, a little bit later we will talk about that. So, let's begin from the first one vulnerability. And first vulnerability it is around an attack, it is currently around an attack and you know it is one of my favorite vulnerability because it is really, really like hacking like I said before and I talk about this vulnerability it is like making money from nothing, yeah. And so, first information that I found about this vulnerability it was 2011, maybe 2012, maybe there are early information but I didn't find. So, this vulnerability based on the incorrect incorrect unsafe using of round functions, yeah. And later we will talk about example but now very, very simple example of using of round functions and it is very simple but for us interesting last example when we can in round function we can set what what is we can set the decimal places that will be after rounding and as you can see on this example here it is two decimal places after rounding so after rounding we will get 1.52, yeah. And so you can say that it is not real vulnerability and it is not possible to admit it in real life but and for example all banks already fix it and all companies that work with money already fix it too and you can can't admit it in real life so but no there are examples and you can find it on Hacker one and you know I met I met this vulnerability two years ago and you know one very huge bank and so no examples exist so let's watch the example yeah for example we have one account yeah and this account has two wallets usd and rubble wallets yeah and you can transfer money between these wallets and when you transfer money the different currencies converting between yeah and for example in this case we have unreal unreal rates but anyway it is very comfortable for us it is for calculations so current rates it is 64 for one 64 rubles for one dollar in case of bank and the same 64 one usd in case of selling and so we have bank that use rounds into decimal places yeah and our goal is to become rich so what we can do let's watch the attack yeah we have one second we have one rubble one rubble sorry on the rubble wallet and we send it to the usd wallet and after rounding yeah firstly we converted to the usd and после of that calls function rounding and as a result we will get 0.02 usd from one rubble yeah after that we convert we send this to cents back to the rubble wallet yeah and it will be already one rubble and 20 yeah and now we have profit 120 persons why it happened this is happened because of this this is main reason so we had the one number and after wallet it became more yeah and this difference is very critical so we can get a big profit and you can say that now we have two additional rubble cents yeah and it is not it is not rich yeah but if you can repeat it 1000 or maybe one million times you will get real money i think banks not allowed to make this a lot of time because anti-fraud and some other things but anyway if this vulnerability exists sometime can someone can try to exploit it and it is i think the best way to fix it anyway so and i have very simple plot yeah firstly on the x we have transfer amount rubbles yeah and the y we have on the y we have profit and the persons yeah and so as you can see the biggest profit when we send about i don't know 0.3 0.4 rubles yeah to the dollars to the usd in this case the profit the highest yeah if and as you can see if we send more yeah the profit less less less and after some specific moment it is less than 100 so it is non profitable for us and from this you can see that it is first way to how to avoid this vulnerability it is set the limit of transaction for example if we'll set the limit of transaction in six six rubles yeah it will be unprofitable for anyone who tried to exploit this vulnerability so also there are two and other ways and second one it is that we shouldn't allow to clients to convert money from rubles to usd instead of this we should allow to to buy usd yeah for example client will buy 0.01 usd and it and after that client will get price and after that it they can finish the transaction so in this case anyway there is rounding yeah and it will be but in this case numbers are higher the numbers are bigger sorry and and it will be unprofitable for anyone who is trying to exploit this vulnerability so and there is another way it is at adding commission after 30 number of transaction it is not looks like good way but anyway it works and so but it looks like not not like good fix so but this vulnerability that I found this rounding attack took two years ago the bank fixed this by adding commission after specific count of transactions so on another example it is sensitive data disclosure it is very common vulnerability that is you can meet in every and a lot of application not every but a lot of but maybe maybe in every I don't know so let's watch an example very good example very interesting example and this example shows that is what is convenient is not always safe so we should look for balance between convenient and for between security and it is very important and case the bank added functionality that allowed to send money between cards and between cards yeah without login procedure yeah you so it looked like this so user enters firstly information about source card yeah about their card and after that user enters the information about this nature card yeah it is only pun code and the first step we enter the pun cvv and expiry date so on the second only pun code so on the third step user enters the amount of money for transfer yeah and on the next step system checks the balance and calculates the commission and if everything is okay money is enough and so on user gets sms yeah the user that has the source card get sms and after the entering the code the transaction is done if code is okay so let's watch into the htp request that was used for checking the balance yeah and it is that was a problem that main problem was that this server didn't check the expiry one second the expiry date and didn't check the security code yes so but it checked the money amount and card number so as a result everyone could get any could could could get balance for any card in bank so just by enumerating the card number it just and just by enumerating the money amount so so it worked like if you set to money too much money yeah server will return the error that money is not enough yeah in other case it will be everything is okay enter please code yeah please enter the code so and you can set any card number so so you can get information about every card in bank and it is not so good now it fix it next vulnerability it is unsafe otp firstly what is otp otp it is one-time password and it is usually one of the most popular realization of second factor yeah for example you enter to the mobile banking yeah you enter your login and password and after that you get the sms code or maybe push notification or maybe something like this yeah and you have to enter it to to pass the second factor or foundation and usually usually it deliver it via sms yeah and it is the most popular way for delivering so let's watch example yeah we are hawker yeah and we got access to user account and so we want to get money of this client so we have to send this money from our account to the from not no no no from user account to our account yeah so and for completing this transaction we have to enter the correct otp this otp sends to the mobile of this of the client or and the owner of this account and so we don't know this otp but we have to enter it and so after free and correct and every time when we create a transaction we have only three tries yeah after free incorrect entries transaction will be cancelled and otp has four random digits yeah tickets and it is for example one two three four yeah so как как сделать эту транзакцию как закончить эту транзакцию это как немного странно но что за институт бродфорсии otp да мы попробуем бродфорсию транзакции да что если это будет не бродфорсию но это будет выяснить звучит странно я объясню ок очень важная вещь если мы не ограничены в номер нового транзакции если мы можем создать и создать и создать и так далее да мы можем попробовать на следующей эксплуатации мы выбираем три разных otp да это должно быть потенциальный корректор otp 1 2 3 4 я не знаю 5 5 5 5 6 6 6 6 да и после этого мы создали новую транзакцию и попробуем выбрать otp да если это не верно обратно к степени и создать новую транзакцию но на этот момент это но каждую транзакцию это регенерирует то otp так что мы можем просто бродфорсию мы можем просто взять одну большую дикционеру да и использовать эту дикционеру чтобы нанимировать для бродфорса все existing otp нет это не работает так но это очень-очень символно да так и мы должны повторить эту алгоритму эту эксплуатацию до мы обмечили хотя бы 1 otp если мы обмечили хотя бы 1 otp транзакция будет закончена да и так это одна большая деференция выглядит как бродфорс но это не бродфорс это гейсинг так что в случае с бродфорсом мы знаем о когда будет закончена например дикционер у него к 10 000 линей так что будет закончена после Emmanuel 10 000 да Chain так что в случае с this бродфорс да но это гейсинг мы не уверены когда это будет закончена это может быть закончено после на следующей транзакции у нее может быть это это может быть закончена после 20 000 транзакций да мы гейсинг мы trying янамиры транзакции да до мы Until the generated OTP didn't match our OTP. So, I'll explain everything. No, I'm joking. I am not going, it is boring, so no, no, no. But it is very interesting results. Let's watch the results. So, probability of the successful transaction depends on the number of attempts. So, in our guessing exploitation, after 3,000 attempts, it will be about 60% probability. But if we can try 16,000 attempts, it will be 99%. So, it is a really good result, I think. And let's watch a little bit more complex example with new limitations. The same example, totally the same OTP, totally the same situation and so on. But after 5 cancelled transactions, we can't create a new one. We will be blocked for several times, for example for 24 hours. And so, what we can do in this case? There are two possible approaches. The first approach is totally the same exploitation, totally the same steps. But we try not free OTP for each transaction, but to OTP. So, in this case, we avoid the cancellation of transactions. And in this case, creation of transactions will not be blocked. So, it is one approach. Another one, we can, in the beginning, create several thousands of transactions. For example, we can create 20,000 of transactions. And only after that, we will try the OTP. So, in this case, we will block the creation of new transactions after trying the OTP. But it is not affected. It doesn't affect us, because we already created the 20,000. And, as you can see from the calculations, in case of 20,000, it will be more than 99% probability of success. So, we will get profit. So, and also, very good question. Is SMS a secure way of OTP delivery? Yeah, it is. Good question, because there are a lot of attacks against the SMS. It can be fake BTS. It can be Riyusha of Simcard. It can be SS7 attacks. Yeah, for example, there are these two very, very cheap things. It can be used for creating the fake BTS, for creating the fake station. Yeah, and using this, you can try to attack the client. So, let's talk about the recommendations. Firstly, the second factor should be enabled for all critical actions. Yeah, if you, for example, login to account. If client, for example, logins to account. For example, if changes the profile information, maybe other critical actions. It should be, client should enter the second factor. Also, it is very important to limit the account of requested OTP. On the previous examples, we tried to limit the creating of transactions, but sometimes it is a little bit hard. Maybe you can make another vulnerability and so on. So, the best way is to try, is to control the OTP. So, how many OTP, how many generation OTP client asked. Yeah, and after a specific account, just stop this process. And also, maybe it is a good way to think about alternative for SMS, because SMS not looks like the best way for delivering OTP. For example, we can watch on the push notification, we can watch on the TOTP and HOTP. TOTP and HOTP, it is, for example, Google authentication, it is Microsoft authentication, it is application that you have on your mobile phone and they use cryptography for OTP process. So, but every alternative has another problems. For example, TOTP and HOTP has very big problem. It is totally silent, because it is not like, it doesn't have delivering. So, client doesn't know about that someone trying to brute force its second factor. And so, sometimes it is very critical. Because in case of SMS or maybe push notifications, client will get a lot of messages about that and understood that something wrong and maybe called to support and support will call to security information specialist. And so, maybe attack will be stopped. But in case of TOTP and HOTP, it doesn't work like this. Next vulnerability, it is unsafe randomization. And it is, you can meet it in application, where logic is based on the generation of random values. It can be sessions, it can be OTP, maybe UNIQ indeedifiers. And it is, for example, most common problems. It is using of unsafe predictable random numbers generators. In other case, it can be, for example, using the predictable functions for creating, for example, sessions, maybe UNIQ identifiers and so on. So, in a case when attacker can recover the sequence of random values. And it can be, in case of, for example, incorrect initialization of the random number generator and so on. And it is one very known example when, it isn't online banking, of course, but anyway, Russian engineer, they, but it wasn't one engineer, it was team. Okay, never mind. Team of Russian engineers, or maybe one engineer, reverse the slot machine, yeah, and they recovered the sequence, they recovered it of algorithm, how it used for, used randomization, yeah. And they developed the program, I don't know what they did, but they, for example, they developed the program that helped to recover this sequence. For example, they came to the slot machine, they played for several minutes. And in these several minutes, they got the sequence, what slot machine showed to them, yeah. And using this information, they recovered them all sequence of random. And they can, and they know what will be in the future. And so using this cheat, they can, they did a lot of money. And so it is one of the good examples. And so another one, good example, I heard from Timurinov. And he met, he met, it is on his project. So it, for OTP generation was used LCG generator, yeah, for randomization. So, but using of LCG is not okay, because it is not cryptography safe. And, for example, when you have sequence of several generated codes, you can recover all sequence. So you can predict next OTP codes. And for OTP, it is very critical. So something like this. Another vulnerability, it is mobile banking authentication. Yeah, it is not vulnerability, but it is like evolution, yeah, for mobile banking authentication. I'll explain, okay. For example, we have case client installed, installed our mobile banking application on the mobile phone, yeah. And client, very good client. Yeah, you know, they know a lot about security. And so client has very strong password. Yeah. And on the mobile phone and very strong password is not convenient. Yeah. And it's not so comfortable. And so our task is to develop the simple authentication process. And that works after the first login. For example, first time a user enters the login and password. After that, something happens and user can enter the most simply. Yeah, for example, using pin code or something like this. And so let's try to make this solution. Yeah. Firstly, what is the most simple way? After entering the login and password, yeah, application just save the user password to file. And every time when the user opens the application, application sends the password to the server and get the session, the live session. It is awful. It is totally unsafe. Because of the saving of passwords, it is awful practice by design. Do not do this. It is awful. The second problem that unlocked device provides access to mobile banking. So anyone who can take the, who can get access to unlock device, device doesn't have pin code, because it didn't set. Yeah. So in this case, anyone can just use the mobile banking. It isn't okay. And so finding the second factor doesn't help in this case, because this phone has the SIM card and the SMS will be on this phone. So, and this third one, the hacker can get access to the file with password. Yeah. And in case, for example, if application has vulnerabilities, yeah, or just because of hacker has hacked the phone and now has root access. And in this case, hacker can just open any file on the file system almost. So, another case, after successful login, yeah, user sets the pin code. Yeah, and pin code saves, or maybe not, not saves, but it's used by checking the access by application. Yeah. And, for example, the refreshed, now we use refresh token. Yeah. And I forgot to say that the best practice using not password for, save not password, but save the refresh token. Yeah. And using the refresh token for creating a live session. So, after first login, yeah, user set pin code. This pin code used for decrypting the encrypted refresh token. Yeah. So, and also it, this pin code used for checking the access. So you open the mobile application, you enter the pin code. Pin code, for example, comparing with something. Yeah. And, for example, decrypting the refresh token. The refresh token sends to server and server backs session, a live session. Yeah. Again, it is awful, awful realization because of, firstly, anyway, we store the refresh token in the file. So, Hacker, again, if there are vulnerabilities, or if Hacker get half root access on the mobile, Hacker can just get access to file with password. In another case, encryption of token with short pin code is useless, because pin code is very short and brute force of this will be very fast. And also any local checks like pin code check, and other things can be easily bypassed by Frida if you have enough access on the device. So, it doesn't work like this. So, next realization, we save refresh token to the kStore key chain. Yeah. And you know, kStore key chain is the very good option. But, it is unsafe only in one case. When we enable the checking of biometric open code, when someone opens this record. In this case, Hacker can't get access to these records in the key chain. In another case, if no access checking, and application just extract the data from kChain kStore without any interactions with the user. In this case, it is totally unsafe. Not totally, but unsafe, because of Hacker with root access can just extract it without any problems. So, also it can be problematic if user has all device. And in this case, maybe problems with kStore kChain, maybe just device don't have enough security functions and so on. And also, but it is very similar to the second one. And the third one is that you completely dependency on the kStore kChain security. So, if you, if there are some problems with this, you have problems with the application. So, like this. And the first, last one realization, application asks user to set pin code, and this will be sent to API. So, API controls the identification process. And in this case, you can control the anything, like brute force, like enumeration and other things. So, you can control anything. And in this case, it is totally the same. And, for example, in case of using kStore kChain, you can set, user can't use any pin code, because of, it will be pin code of device only. Yeah. In case of the last realization, user can use any pin code, because it is no limitation. And we can set, for example, we can ask for the big pin code, like six symbols, maybe eight symbols, any pin code. Yeah. And other things. And, but it is very important to that now we have to protect our server side, because everything depends on our server side. That's all that I wanted to show you. And so now about conclusions. Firstly, there are good testing guides, there are good testing approaches, and you can use it not only for testing the applications, but you can use it for developing the application, for making applications. So, and it is really useful. It has a lot of examples and so on. Also, next conclusion is sometimes convenience of the enemy of security, and as you can So, from the example, yeah, third example with Bank, that added the functionality of sending money between cards without login. It is sometimes too critical, yeah. And so it is very important to find the compromise between convenience and between security. Next one, that is be careful with cryptography, randomizations and other things, because cryptography is really complex, and it is very important to understand what do you do. And just don't use cryptography without understanding. It is bad practice. And the last one conclusion is use best practices and use experience of other companies. Watch on other products, watch on other applications, because a lot of problems, yeah, and some companies already solve these problems. And if you find the correct solution, it will be very good. So, it is everything that I wanted to say. So, thank you for attention. I hope you got something new from this presentation. Thank you.


In this presentation, we will discuss the last-in first-out inventory system on a periodic basis rather than a perpetual basis. As we go through this process, we want to always be comparing those two, one, the LIFO or last-in first-out system to other systems such as first-in first-out and average, as well as comparing the perpetual system to the periodic system. We're going to go through this by looking at a problem, the problem going into a worksheet such as this. I do recommend learning this worksheet. The worksheet should look repetitive if you've seen the first-in first-out presentation as well as presentations for the perpetual system. That's because this worksheet can be used in order to work most of the flow assumption problems and there's a lot of them if you think about the combinations we can have. Including the last-in first-out method we will be working here, or the first-in first-out method and the average method, both those can be done either on a perpetual or periodic system. So there's a lot of combinations we could have, but they could all fit into this type of worksheet. Note that problems could ask a comprehensive worksheet such as this, or problems could ask for small components. If we learn the entire worksheet, however, we can fit that problem or that worksheet to all the problems related to this type of system, inventory flow assumptions. That format would be three sections that would be purchases and then the cost of merchandise sold and then the ending inventory. Within those sections we're going to have the quantity, the units and the total for each and that will be able to allow us to separate the purchases from the cost of goods sold and the ending inventory. When we're working in a periodic system as we are now, we won't be working with this middle column until the very end when we make the adjustment at the end of the time period recording that cost of goods sold and the related decrease in inventory. So the beginning transaction will be the beginning inventory. So we're going to say that we start off at the beginning of the month, in this case March. By the way, as well, note that these formats for the periodic system will look very similar for the systems, including first in, first out and the last in, first out until we get to the end of the problem, but we do want to go through this and just put together this worksheet so that we can see how it is formatted and compare and contrast these journal entries as we enter them. So we're going to put in the beginning balance, 100 units and they're at $50. 100 times 50 is 5000. So that's where we start. The beginning balance that we are starting with at the beginning of March note the conversion we have to do here one from units to the dollar amount to get the $5,000 that will be reported on the financial statements. We're going to pull that 5000 over to the right because later on we'll have multiple layers and it'll be easier to see if we pull this out to the right. This being the amount we would see on the financial statements. We have the trial balance here. Here's going to be our trial balance. It's in order assets, liabilities, equity, income and expenses. We know we're in balance because the debit balances are represented without brackets or positive numbers credits with brackets or negative numbers. And if we were to add all of them up, they add up to zero net income. Currently is a loss. There's no revenue and we have these expenses. 500, 300, 9,000, 9, 20 for a loss of 10,000, 7, 20. This is our Indian inventory that the last component that we just pulled over from the worksheet, 5000 is what is in inventory. That matches what is on our financial statements or trial balance here. That's our starting point. It's important to remember that this worksheet is in essence backing up, supporting, being the detail behind this inventory information on the trial balance or balance sheet. If we go through the next transaction, we're going to say that there's a purchase of 400 units at $55. Note that the price is rising. They were $50. Now they're $55. That's going to be the normal scenario. So the normal process, our price is rising. We want to consider factors as prices go up and then kind of reverse what would happen if there was a decline in price. So we're going to say on March 5th, we bought 400 units, which will clearly go in the purchases section. And they cost $55 to give us a total of 22,000. Note that this would be the same under FIFO and LIFO average. It would be the same under a perpetual or periodic in either system. This is not an estimate or assumption. We're then going to pull that over to the ending inventory and add it to what we already have. We want to have everything, however, under this line at this date line so that we don't start getting confused as the worksheet grows. Therefore, we're first going to pull this down. So we're just going to say this is the same information we just pulled down here, and now we have 100 units at $50. And then we're just going to pull this over to have the 400 units at 55. So we have a total of 500 units. 100 of them cost us $50. 400 of them cost us $55. If we were to sell something at this point in time and record it, we would assume under last and first out, we sold the last ones we purchased, these 400 first. However, we won't do that until the end of the problem, when we count it under the periodic inventory system. We're then going to add these up, the $5,000 and the $22,000, giving us the $27,000. That then will be the amount on the balance sheet or the trial balance. If we then record this, we're recording this purchase, this $22,000. Remember, it doesn't change under whatever inventory method we use. We're going to say that we bought inventory. Inventory has a debit balance. We got more of it. So we're going to do the same thing to it, another debit. We'll debit the inventory and then we will credit something, not cash. Cash isn't going down. We're crediting instead, accounts payable. The liability has a credit balance. We're increasing it by doing the same thing to it, another credit. So there's going to be our transaction. If we post this then, this inventory at $22,000 will be posted here, the $5,000 going up by the $22,000 to $27,000. This $22,000 for the accounts payable will be posted here to accounts payable. The $12,150 will go up by $22,000 to $34,150. That's going to be our transaction. Note that this $27,000 now matches what is on our inventory worksheet. If we look at the totals here, we see that they're back in balance, of course. We're back in balance, debits equaling the credits. And there is no effect on net income, meaning nothing happened in the revenue or expense accounts. All we did was purchase inventory. Inventory is not an expense when we purchase it. If it's an asset, when we purchase it, it will be expensed, however, but not until we use it in order to help generate revenue, not until it's expensed in the form of cost of goods sold. Next transaction, $3,900, sale of $420 units at $85. This is the only sales transaction we're going to show here because under the periodic system, we would not be recording this to the worksheet. We're only going to be recording the sales half, which is not located on our worksheet. We will post the journal entry just to show the journal entry. If it were a perpetual system, then we would be recording the second component and we would be recording it to our worksheet. We would be decreasing, in other words, inventory at the point in time of sale and recording the related cost of goods sold. However, here we will not. So if we think about a sales journal entry, we typically, under a perpetual system, which we are not using here, think of it as two types of journal entries, or we can't think of it that way and it's really helpful too when learning these two journal entries or the sales transaction of inventory. One related to the same type of thing happening if we were a service company eliminating inventory and related accounts, and the other having to do with inventory, recording the decrease in inventory. If we think about the first half of the transaction, the half that we could eliminate inventory accounts be very similar to if we were a service company. We'd say we made a sale on account. We didn't get cash. We got something else. We got an IOU, accounts receivable. It has a debit balance, well, it has a debit balance. We need to make it go up because people owe us more money. We do the same thing to it, another debit. And then the other side of it will go to revenue. Whatever that revenue called, service company might be fees earned. It might be income revenue or sales, depending on the type of company. It's all the same thing in terms of the type of account revenue. Revenue has a credit balance. We increase it with a credit. So this will be the same under a periodic or perpetual system. Also note that we have the 420 times 85 to bring us to that amount. What will not be the same is we won't have the second transaction here under the periodic system. We won't record the cost of goods sold, the expense related to this transaction, or the inventory. Now, you might ask why? Why wouldn't we do that? It seems reasonable to do that. We clearly had given up inventory and it should be going down. But it's usually with regard to the sophistication of our system. If our system is not an electronic system, we want to focus more on the sales process. So, especially if we have something like a clerk or something making the sales, they may know the sales price, but they may not know what the cost is and know if the cost will be different. The cost will not be this $85. It'll be what we paid for the inventory, what we're tracking on the worksheet. And if we don't have a sophisticated system, we might not know that at the point in time of sale or want to have to deal with that at the point in time of sale. We will deal with it periodically as we count the inventory at the end of the time period. Also note that this $35,700 dealing with this $85 times 420, once again this $85 is not something that we're going to see in our worksheet at all. It might have something to do with the cost. We might have used the cost to derive the sales price, but it has nothing to do with our cost worksheet. If we were to post this out then, we're going to say, Counselors' Sables here, Counselors' Sables there in this journal entry. It's going from $44,900 up by $35,700 to $80,600. Then we're going to post the income, the revenue or the income, the sales, going from zero up by $35,700 to $35,700. Here's all the accounts. If we note the effect here, we see that net income is going up substantially by the income here. It was at a loss. We have this revenue. This is not a loss. This is revenue over expenses, $35,000 minus the $500 minus the $300 minus the $9,920, giving us revenue. Note that this net income number is substantially wrong because we haven't recorded the cost of goods sold under the periodic system. It will be right at the end of the month when we do the calculation of the physical count of Indian inventory, recording the decrease in inventory and the related cost of goods sold. This $27,000 also wrong until we get to the end of the month, count the inventory, make the adjustment. So we're still at this $27,000 on the worksheet next transaction. We made another purchase, $120 units, $60. Note the rising prices, $50 to $55 to $60. That's the norm. You want to think about that as normal. And then if they reverse that, if you see the prices going down, you'll just have to reverse some of the assumptions we make or some of the outcomes that will happen. So we're going to say on March 18th, we have 120 units in the purchases section, of course, and we are saying they're $60 each. If we multiply 120 times 60, we get 7,200. Once again, we want to take this information and put it below this line and have everything below this line. To do that, we're going to say everything at this state line, below this line is what we had before, 100 units at 50, 400 units at 55. We're just going to bring those down to our new section here. And then we're going to bring these items over. So now we're going to add the new rows. So that's what we have. Now we have 100 units at 50. We got 400 units at 55. We got 120 units at 60. If we were then to add these up, we would say that we have total inventory of $34,200 in terms of dollars. We're going to then record this purchase. And remember, this purchase doesn't change whether using FIFO, LIFO, AVERAGE, Perpetual, or Periodic. If we then do the recording, we're going to say that we got this 7,200 purchase. Inventory is at $27,000. We need to make it go up. We'll do the same thing to it, a debit, debiting inventory. The other side, not to go into cash, we're going to assume we didn't pay cash but bought on account. Therefore, the accounts payable credit will go up in the credit direction, $7,200. Then we're going to post this out. So here's the inventory here. Here's our inventory there. It's starting at $27,000, going up by $7,200 to a total of $34,200. Then we have the accounts payable here. It's going to go to the accounts payable there. Starting at $34,150, going up in the credit direction, $7,200 to $41,350. This ending inventory, that's where we're focused because that matches what we're tracking, the support of that number, that being the inventory worksheet. We look at all the numbers. Here's what we have. We note that there's no effect on net income. Net income isn't affected because no income, revenue or expense accounts are affected. We will expense the inventory but not at the time of purchase, at the time we sell the inventory in order to generate revenue. We won't do that on a periodic system until we count the inventory at the end of the period. In this case, the end of the month, the month of February. Next transaction, another purchase. So we purchased 200 units at 62. Note we're not recording all the sales here because the sales aren't affecting this worksheet. And this is one thing we have to note when we work through these worksheets. We have to note that we're zooming in on a particular thing and still have an idea of how it fits into the overall picture here. So the 200 is gone here. And note if we were in a perpetual system, we would be recording the cost that gets sold here as we go. So now we're gonna say on March 25th, we had 200 units, $62. Note the rising prices, 50 to 55 to 60 to 62. 200 times 62 gives us 12,400. Now we're gonna bring everything below this line here. We want everything below this line on the ending inventory. Very jagged line or like some crazy curve. But here's what we had before, 100 units at 50, 400 units at 55, 120 at 60. We still have those. Or we may not physically have those but they're still recorded on our inventory sheet. We did make sales and have sold some of those but we haven't known which one yet. We'll do that at the end of the process. So we're really calculating goods available for sale here. So here we have those here. Now we're gonna add the new layer. There's the new layer. So now we got 100 units at 50, 400 units at 55, 120 units at 60, 200 units at 62, 5,000 plus 22,000 plus 7,200 plus 12,400 giving us 46,600. So that 40,600 should be what should be on the financials or the trial balance. We're gonna record this to the trial balance. Remember that this amount, the purchase is not an estimate, doesn't change whether using FIFO, LIFO, AVERAGE, or Perpetual or Periodic. We're gonna record this purchase once again. Journal entry should look familiar. We're gonna say that inventory has a debit balance. We bought more of it. It's gonna go up by doing the same thing. Another debit. We didn't pay cash. Instead, the bad thing's going up rather than the good thing going down. Accounts payable, liability increasing, has a credit balance. We increase it doing the same thing, a credit. So there's our journal entry. Here's inventory. There's inventory here. It starts at 34,200. It's gonna go up by 12,400 to 46,600. Here's our accounts payable here. Here's our accounts payable there. Starting at 41,350. It's gonna go up in the credit direction by 12,402, 53,750. Concentration note here. Inventory, 46,600 supported now by our schedule. The 40,000, 46,600. Next we're gonna take a look at our ending inventory count. So we're gonna say that we counted the inventory to be 240. This is at the end of the time period. Month is over now. We're gonna do a physical count and now we do that in order to help us decide in a periodic system, how much of this available for sale inventory? How much of these layers of inventory or the 100 plus to 400 plus, the 120 plus to 200 units that we have right now? How much of those have we sold and kept? To do that, we typically look at a cost of good sold calculation and mandatory calculation one that we need to understand no matter what system we are using. We can see it in terms of units. We can do the same calculation in terms of dollars. Both are something necessary for us to know. The format will be beginning inventory. This is the generic format that we apply all the time. Beginning inventory plus purchases. That gives us the subtotal available for sale. That subtotal representing what we had available at any given time. Doesn't mean we had that inventory at any point in time but throughout the entire month, that's how many widgets went through the warehouse. That's how many widgets we could have sold given the fact that we had them at some point during that time process. Then we're gonna subtract from that our count, our ending inventory, which we would get from the physical count here. And if this is what we had available throughout the time period and this is what we still have at the end of it, the difference between those two will be our cost of good sold. So the beginning inventory plus purchases gives us goods available for sale. Minus ending inventory gives us cost of goods sold. Note that this is just a subtotal. You could eliminate this if you just want a formula for algebraic reasons because questions could ask this in any format. They could give you all the numbers except one of these and you just write out this same algebraic equation in order to solve it. What you don't want to do is to figure out and memorize an equation for purchases. You just want to say that if purchases is the unknown, then we're gonna use the same formula, write it out algebraically and solve for purchases. If they don't give you beginning inventory, then you want to write out this same formula and solve for beginning inventory. So you could just call it beginning inventory plus purchases minus ending inventory equals cost of goods sold and write that formula out. You do however need to know what goods available for sale is or need to be able to interpret that subtotal because it is often used in questions and in practice. So in our problem, the beginning inventory was $100 or 100 units at $5,000. So we're gonna start with units, 100 units. And then we purchased, and this is the reason we have this purchases broke out separately, 400 plus 120 plus 200 giving us 720. That'll give us the available for sale, 720 plus 100 or 820. That means that we had 820 units that went through the widget warehouse at some point in time and therefore could have been sold at during this period this month. Then we're gonna do the physical count. We counted what's still in the widget warehouse and there's 240 still there. So if there's 240 still there and we could have sold 820, the difference then is 580 or cost of goods sold. Now note that it could, something else could have happened. We could have lost them. We could have damaged some damaged goods or what a spoiled goods or whatever. But we're assuming that under the periodic system, and that's one of the faults of a periodic system, that it's sales that happened here. This number is due to a selling things and the shrinkage of other things that could have happened, hopefully is in material. The perpetual system when we do the same calculation is primarily or one major purpose of it is not to record the inventory but to detect that kind of shrinkage and problems with the inventory. Now, if we knew exactly that these inventories were all purchased for the same amount, then we could just do an easy conversion and figure out what the dollar amount is. However, they're not purchased for the same amount. This was 50, 55, 60, 62. These are all the same widgets but because purchased at different times, they cost different amounts. So that's our problem here. So doing the conversion will get a little bit tricky. Let's go through it. Same calculation cost of goods sold calculation with dollars. We started with $5,000 worth because we can do that conversion. That's where we started at the end of the last time period. Then we had purchases of 720 and in dollars, we know exactly what we're gonna pay. It was 22, 7,200, 12,000, four. Even though these are different dollar amounts, we know exactly what they're gonna pay. It's not an assumption. There's no difference in either method. FIFO, LIFO average, perpetual periodic. We're gonna, we bought 41,600 of purchases. So the goods available for sale then is 46,600, 5,000 plus 41,600. That's what we have here. That's basically what we've been tracking on our worksheet. What we don't have is the ending inventory in units. We know that, I mean, in dollars. We know the units were 240, the units here are 240, and those consist of these units, some of these units. So 240 of these units here, the 100, the 400, the 120, and the 200 that we purchased throughout this time period are still there. The question is which one of them are still there and how do we break out this number, 46,600, between ending inventory and cost of goods sold? And that's what we'll do. That's where this cost flow assumption will come into play, the last and first out assumption. So we have the last and first out assumption. Now note you could kind of view this from either a ending inventory point of view or a cost of goods sold point of view. Meaning you could say, hey, ending inventory is 240. And if I sold the last in was the first out, I would have sold these ones first, the 200, and therefore figure out how much of them are still left. Go back up here and try to say this 100 would be there and try to get up to this ending inventory of 240. Or you can do what we're gonna do here. We're gonna say there's 580 that were sold according to the number of units. And therefore, we're gonna go into this column. The column we haven't used the entire time period, the cost of goods sold column, and figure out the cost of goods sold not for one single time period, but for the entire month, the month of March. So we're gonna make our assumption here. Here's our layers. They cost 50, 55, 60, and 62. Here we have our cost flow worksheet again. We've got the 100 units at 50, the 400 at 55, the 120 at 60, and the 200 at 62. We could take this, we could look at that ending inventory and try to decide how much is left. We're talking about a last in, first out system. Therefore, these are the last ones we purchased at the bottom. Those would be the first out. So we can think of what's left and we can start saying, okay, this 100 would still be there because those would be the last to go. So of the 240 that are still there, that 100 would be there. And then see how much would be left of 140 of this layer would be left. Or we can think of it first as the cost of goods sold. What did we sell? This is the new thing that we haven't been dealing with with this entire problem. Until now, the column we would be dealing with on a perpetual basis at the point of sale under a perpetual system. But under a periodic system, we're only gonna be recording at the end of the time period. So we've got the cost of goods sold then 580, meaning we sold 580 units. So we could record over here which ones we sold, meaning under a last in first out, the last ones being at the bottom, we're gonna count up from 200 up until we get to 580 and eliminate what we had in inventory in this format. Note, you might be thinking, well, that's a little backwards. Why would we be selling the last ones first? What kind of company would want to sell the last inventory first? And the assumption probably is not as accurate in terms of the actual flow of inventory or at least the desired flow of inventory. But because it's just an assumption, we don't know which inventory was sold. We're not tracking them. They could have taken any of the inventory. They're all the same types of widgets. Therefore, we can make the argument that a last in first out method is just as plausible as a first in first out method, given the fact that we just don't know. And so here we go. We're gonna say that the 200 here is gonna be wiped out first. Those are the first units sold. So we're gonna say these are gonna be gone at 62, so 62 is pulling over, and that's the 12,004. That's part of the cost of goods sold, part of the 580 units we sold. Here's the dollar amount related to 200 units of that 580. Then we're gonna say that this 120, these are gonna be wiped out as well at $60. If we multiply that out, that's the 7,200. Those have all been sold. Now we're at 320, we need to get to 580. So we're gonna go into this 400 and pick out as many as we need to get there. We could do the math of 580 minus 120 minus 200, gives us 260, or in other words, 260 plus 120 plus 200 gives us the goal of 580. Those are how many units we sold. So these 260 will be at $55. If we multiply that out 260 times 55, we get the 14,300. The 12,4 plus the 7,002 plus the 14,300, that is our cost of goods sold for the entire time period, the entire month of March. Then we're gonna figure out what is left, how much is still in ending inventory. And so what we're gonna do there, it seems a little bit bad, it's a little bit more difficult to think about this than the first end, first out, where we could just kind of compare top to bottom. We can compare here, we can say, well, this bottom layer is wiped out. I'm gonna leave some space and I'm gonna put the entire four columns here. So of the four columns, the 200's what we did first. So this 200 right here minus the 200 means we have zero of those left. At 62, those are gone. Of the 120, here's the 120, 120 minus 120 is zero. Those are gone at 60. So these at 60, there's none left. And then of the 400, the 400 and minus the 260 gives us 140 left that will still be there. Those are at the 55, 140 times 55 means we have ending inventory of 7,700. And then of the 100 of course, those are all gonna be brought down here. They haven't been touched. And there's the 50 and there it is. And so that's gonna be the effect of the last end, first out. We might have this old layer on there forever because if we never, if we always have new layers, we never get to sell that old layer. And over time, this $50 will be quite low in comparison to what they actually cost at some point in the future. Now we can populate this information over here. We're gonna say ending inventory. Well, if we add this up, we got the 5,000 plus the 7,700. Everything below this line is where we're working with now. 12,700, that's gonna be the ending inventory. We can now calculate cost of goods sold as either.  Now we'll do the adjusting entry. That entry we haven't been doing under the periodic system which we would see under a perpetual system reducing the inventory and recorded the related cost of goods sold at the point of sale under a perpetual system not being done until now until the end of the month, the end of March in this case in a periodic system. So note that when we make a sale under a perpetual system we record the first half of the journal entry increasing the accounts receivable and increasing revenue, debit accounts receivable and credit revenue. What we do under a perpetual system that we don't do under a periodic is at the point of sale record the decrease in inventory and related cost of goods sold. And in a periodic system, we'll do that at the end of the process. We're recording that second half not for one transaction only however but for the entire period, the entire month, the month of March. We can see that of course the inventory now before that time period is overstated as is, well the cost of goods sold is understated. It's at zero right now until we make this adjustment. So the adjustment will be inventory has a debit balance. We need to make it go down for all the sales we have made through the month of March. So we're gonna do the opposite thing to it, a credit. Cost of goods sold is an expense account and so we need to make it go up for the expense of what we have consumed inventory in order to help us generate this revenue over the month of March. So we will debit cost of goods sold, debit in the expense, crediting inventory. So this is gonna be that journal entry that journal entry that again we would see this form every time we make a sale under a periodic under a perpetual system every time we make a sale. However, under a periodic system we only see it at the end of the time period recording the cost of goods sold and the reduction in inventory for the entire month in accordance with the physical count. So that's how we determined what the adjustment will be. It's gonna be coming from this cost of goods sold. So once we post it, we're gonna record the cost of goods sold and the reduction of inventory, the reduction of inventory then should result in an ending inventory of 12,700. You can see that we have currently 46,600 which is our goods available for sale, which we are now allocating between what is left in ending inventory and what has been sold and is now in cost of goods sold, the income statement account. So if we post this out then we're gonna say cost of goods sold started at zero. It's going up by 33,900 to 33,900. Inventory started at 46,600. It's going down by 33,900 to 12,700. That 12,7 matches what's on our worksheet here as does the 33,9 in cost of goods sold. If we look at the full transaction then we can see that our inventory is much lower than before this end period adjustment and our cost of goods sold is much higher which brings net income down substantially. So net income was 40,180 before this went down by 33,900 to 6,280. So until we record this adjustment under a periodic system we can't rely on our net income number. It's gonna be completely wrong because the cost of goods sold is the biggest expense typically for a merchandising company. Our assets will be way overstated as well because they will not be recording the inventory being decreased as sales happen until the end of the time period. So it will be a good system at the end of the time period once this adjustment has been made. If we look at all the components here we can see our matching of the cost of goods equation.  We have the cost of goods sold and the cost of goods sold calculation. The cost of goods sold would be the same number here, 12,004 plus 7,002 plus 14,003 adds up to 33,900 and we see it here in the cost of goods sold on the trial balance.


Welcome everyone to this issue briefing on humanitarian response in Ukraine. Welcome to those in the room and to those of you online. My name is Heba Ali. I'm the CEO of the New Humanitarian, which is a news organization that reports about conflicts and disasters around the world. And we have been covering the conflict in Ukraine since 2014, actually long before Russia's invasion. Of course, we saw the devastating effects even back then, but they have certainly escalated since we are seeing millions of people displaced, food production around the world affected, huge damage to civilian infrastructure, and as many of you know, the list goes on. So today we're going to look at how particularly Ukrainians are responding to the humanitarian crisis and where we go from here, how the needs have evolved and what the longer term plan looks like. A reminder for those of you who are tweeting on your social channels that you can use the hashtag WEF22. So we have three Ukrainians with us here today. I can tell you that they traveled through quite a journey to get here, 14-hour train to Warsaw, plane to Zurich, 19-hour train, there you go. But they felt it was, as you told me yesterday, important to keep a spotlight on Ukraine in the midst of what you feel is already dwindling attention. We have two members of parliament. So right next to me is Yevhania Kravchuk, who is the deputy head of the Servant of the People Party, the President's Party in Parliament. And next, well, on the far end, also from the Servant of the People Party, Rukh Salana Pidlasa, who is the deputy chair of the Parliamentary Committee on Economic Development. And in the middle, we've got Fedor Serdyuk, who quit university to join the Red Cross rescue team after the Ukrainian Revolution. He then went on to found a company that provides health and safety consulting for businesses, and he's now ended up as basically everyone as part of the civilian humanitarian response. So I want to start with you, Rukh Salana. You're an MP, as I said, focused on economic development. How did you end up managing a humanitarian hub in the west of Ukraine? I think that my story is very similar to the story of millions of Ukrainians who, one day on the 24th of February, we woke up to the bombing of our native cities to the places we lived. I woke up at 4 a.m. I went to the parliament to vote for the introduction of the war time. And then, well, we didn't know what to do, and the legislation didn't seem to be in the focus back in the time, and many people evacuated to the west on the first days of the war. And we realized that being in the west is an excellent opportunity to enhance the volunteer organizations that started working from the very first day. They started working on bringing humanitarian aid to Ukraine, and I saw the opportunity to help them, because initially many people in Europe were reluctant to... They wanted very much to help, but they didn't know how to help. And when the member of parliament steps in and says that, I know these people, they're trustworthy organization, it helps to build this connection, to build the trust, and to bring more aid to Ukraine. That's why we started this hub, and we continue working with it today. But I want to emphasize that it's one of the thousands of similar initiatives in Ukraine, and grassroots movement is enormous now. And it's not only government-to-government action. It is mainly not government-to-government action. It is NGO sector working on bringing aid to Ukraine. It is municipal efforts. And also that many members of the parliament and deputies of different levels are working on that today. Great, thank you. And I'll try to come back to you later to better understand how the International Community can kind of tap into that volunteer effort. But I want to turn first to Yevhania. Can you give us a bit of a sense of how the humanitarian needs have evolved in the country since the beginning of the crisis to now? I guess across a number of categories you've got displaced people that are in areas that are not occupied. You've got areas that have been recently liberated. You've got people who are still under Russian occupation. So across that range, where are you seeing the most urgent needs? Thank you so much. At the very beginning, I will give you some numbers to understand that I don't think there is a family in Ukraine that was not affected by this war. And Rukhsalana just said that there are hundreds, thousands of similar cases, what she did. One-fifth of all of the population of Ukraine became volunteers of some sort. Bringing stuff, finding people who are in need. So it's truly a national war. It's not like military is fighting and everyone is watching. Everyone in Ukraine does something to bring the victory closer. Now we have 12 million people that are displaced, 5 million outside of the country. We do not call them refugees because refugees, they just sort of, you know, giving their passport, they say, I'm not coming to my motherland. They are externally displaced people, just people seeking asylum and want to come back. Also have 7 million of internally displaced people that went from south, from central churches like from Kyiv at the very beginning to the west and to other, you know, safe places in central Ukraine. So I would cover it to like three stages of humanitarian needs and crisis. First of all, the churches that are under control of Ukrainian government. By the way, we have fully operational government, parliament, local councils. And that's very important as it differs Ukraine of many, many wars and conflicts throughout years. So in these places you have like these additional 7 million people that will need to find a place to leave, a hospital to go, to, you know, school online, to join school online. But that's, you know, the very modest stage of humanitarian needs. And then you have the fully, the liberated, recently liberated cities.  You know, they are ruined. No electricity, no gas. I mean, people stayed in basements without food, water for weeks, without electricity, but possibility to call the relatives saying that, you know, I'm alive.  And then you have these occupied territories. For example, Kherson region is now freshly occupied. And that's not a humanitarian crisis.  Russians are not letting any help to these regions. People want to leave these regions. They would stand in the field for five days in their cars. And Russians are not letting them out. That's, you know, in Kherson region. Luhans Oblast, Donetsk Oblast is being erased from the face of the earth. It's literally hell over there. And what is, you know, my message here. The closer is Russia, the worse is humanitarian situation. You know, it's as easy as that. We need to kick out Russians from our country. What is it that can be done in those areas that are, while the Russians are still there, in those areas that are occupied? You know, when I'm being asked what is the, you know, best humanitarian aid for Ukraine, I'm sorry to say, but I say it's weapons. It's heavy weapons to kick Russians out because you can't bring a relief to these people that are occupied territories. I mean, they're being tortured, children being raped.  You know, the only way to give relief to these people is to liberate land and to kick out occupiers from this territory. Fedor, you're providing a different kind of aid. You've trained the army, police officers, medics, volunteers to do first aid and emergency response mostly on your own dime. About 4,000 people have been trained since this latest invasion, but 50,000 since 2014. What are you seeing on the ground? What kind of challenges are you facing? The things we see now in Ukraine is an enormous storm for medical system, especially for the trauma system because we have many casualties. First of all, the military and defense forces, but also a huge number of civilian casualties. As Russia uses the weapons, which are not precise, they use artillery. Mainly, more than 70% of the casualties have the shrapnel wounds, so not bullets. And you are not able to control where your rockets are flying. So they cover, they shell actually the huge areas. You receive one time a lot of casualties at the same time, so the response of the first responder is critical because 70% or more of the preventable fatalities. People who could be saved, they die from severe bleeding, and bleeding kills a person very fast in three to five minutes, sometimes ten. Our task is to have, as we do not know, where Russia will strike. They can strike a market, they can strike a street, they can strike a military base. Also, they sometimes pick up military targets eventually. Why not? So they mainly attack civilians, but sometimes military. Our goal is to have people ready to stop the bleeding and to apply first aid, open the airways, close the pneumothorax wounds on the chest in three to five minutes. So we need a lot of first responders. We need a lot of equipment everywhere where Russia can strike. So almost everywhere through our line of the war zone. So our goal now, and what problems do we experience, we see that we're running out of equipment because every medic or every first responder needs to have first aid kit for himself and for many casualties because there are artillery strikes and there are like a mass casualty event. And though we have to have a load to recharge because every time medic runs out of equipment, he needs more equipment. So basically what we need is a first aid equipment for medics and first responders and for soldiers and even for civilians. And it is a question of time when the hospitals will run out of equipment more advanced. We receive enormous support in terms of medicine. We have a lot of different medical equipment coming from western countries and some other countries. We appreciate it. But the warfare is irregular, so we do not know where the next strike would be placed and the logistics failed. So Russia bombs the roads and bridges. So we are not able to move this equipment really fast as fast as we need. So we really need a lot of equipment to be prepared. We talked earlier about the volunteer response. That's been a huge part of the effort in Ukraine. And we are hearing in our reporting about trauma, about burnout among the volunteers. We heard from one international peace building organization that local volunteer coordinators were working, you know, 50 hours a week to manage these masses of volunteers. You've been doing this now for three months, Federer. How long can you last? Is this sustainable? Well, I do not want to say naive, but we will last until our victory because we have no other chance. I mean, in the ideal circumstances, we'll have way different system that we have now and way different answers that I give you now. And it is definitely not okay that my people who are teaching thousands of people risking their lives and like working from early morning to late of night, they work as volunteers. But it is a challenge now to secure resources enough to continue operation. And we have the managerial capabilities to do so and we have the corporate social responsibility and we have international donors. So I believe it is a question of time when we'll secure enough resources. So what I believe in that we are now on transfer as we understand that the war will not end in the nearest time. It will continue until our victory. And I'm sure of it again. We'll operate and we'll find resources and reinvent the model to make it more sustainable. But what I want to mention also that the western world and our partners from the civilized world from many countries including like east and thousands of whatever, they have now to make their decision either to send us tourniquets forever or to send us weapons now because what my health and safety experience shows that prevention is always better than management. If you prevent the injury, you do not have to deal with it. And now medical aid, not the best doctor if you would send us the best Switzerland doctor or the professor will save as much lives than the peace agreement which only would be possible when Russia will be defeated. And I wanted to show you this helmet. It's a helmet from the volunteer who mobilized to fight Russia. So he wasn't about to fight Russia actually because I don't believe he cared. He was about to protect his house. Whenever we're about to attack any country, we're fighting on our ground. It's important to understand. So we can have the best helmet and the best medicine and the best doctors. We train them really well now, but it will never save lives as effective as the peace agreement. And the peace agreement without a destruction on the world order, rule-based world order again is possible only with the defeat of the aggressor, not with like relaxing the aggressor, not with like saving, protecting the face of the aggressor, but with defeat. That's why I'm as a person who really loves peace, who enjoys my peaceful life. I'm listed to Forbes Europe. I'm listed to Ukraine.  So I don't want to continue to understand my motivation. I'm telling you now that that's the only option. And I'm sorry to tell that, but that's the only truth. And I want you to see this from the other side, right? So this is penetrated. I mean, you will never have enough of the protection, but the full prevention of the war. We failed to prevent it, but we still have the war every day. So it's never too late, right? But every day we're running out of people, of equipment, of everything. So make the decision. We're sending tourniquets forever. We're sending weapons now. I just wanted to jump in and support what Ferris said, because when we are speaking in our panels about humanitarian crisis, this humanitarian crisis was not caused by a flood, by a tornado, by, I don't know, something natural. It was caused by a country called Russia with dictator called Putin, who brought troops into our country. We're a peaceful nation. We don't need an inch of Russian soil. But if someone comes to our land, we will fight. We will fight until our victory. And the only way to stop these atrocities, to help the people who are wounded, who are hungry, who can't, you know, kids. I mean, I have eight years old kid. During the night, she has to go to the basement because we have air alerts. And at nine in the morning, she turns on her laptop and go to online schooling.   And today an 11 years old girl from Donbass region died because of Russian bombs and shelling. And she's the 233rd child that was killed by Russians in this war. And we have to stop it and to kick out the aggressor from our country. I will say, as someone who watches the humanitarian response system very closely, it's very rare to hear when you ask someone what are the humanitarian needs for them to respond, send us weapons. So this is a very different kind of dynamic. Then we're used to hearing with aid agencies that insist on neutrality and not being part of the conflict and not taking sides. But I think actually one that the international community often forgets is at play. Rukh Solan, I just want to come back to you on some of the wider implications of this crisis. Of course, it's been devastating for Ukraine, but it also has global implications in terms of food production and wheat supply. What do you think needs to happen in order to avert that kind of a global food crisis? Well, I will not be original. It all comes to weapons. But there are other ways, of course. We do talk in the world and it's like the global topic today, the food security and that the economist was out last week with the cover that the world is on the fringe of mass hunger because of Russia attacking Ukraine because Ukraine is the world's largest producer of grains and food and the countries in Africa and Asia are very dependent on Ukraine in terms of export and what Russia is doing right now. They are causing humanitarian crisis not only in Ukraine but also in the world and they are doing that deliberately. Russia wants the world to suffer from hunger, from poverty and from every possible thing, every worst thing that you could imagine. And they are doing this mainly by blocking Ukrainian seaports right now. The harvest that Ukraine collected last year, it is blocked in the ports of Odessa, it is blocked in Burdansk, it is blocked in Ilychowsk and other, which is Chornomorsk now, and other places, even in the places that are not occupied right now by Russian forces. The Russian warships are on the rate in front of these cities and they are not allowing any commercial ships to go to these ports to collect the harvest, to collect the grains and bring it back and bring it to the other places. There are different, there are a couple of ways how the world could respond. We were talking about a lot with different trade organizations and with UN as well about the ocean, well the kind of operation that was used in the Gulf of Odin, the Ocean Shield operation when the NATO convoys were going with commercial ships to the ports to load them. It is one possibility but also the another possibility is always providing heavy weapons and anti-ship missiles for Ukraine so that Ukraine could protect its own ports itself. It could go hand in hand together, it could be done separately, but it is important to understand that we must do something right now because the situation is decreasing, it is getting more and more severe. Apart from the seaports we also have a huge problem with the fuels because Russia is deliberately bombing the oil refineries in Ukraine, destroying them so that Ukrainian farmers could not sow the grains this season so that there will be no harvest at all next season if they don't do that. And that would be the ideal situation for Russia because everyone in the world would be forced to buy Russian grain. Well if the world wants to buy Russian grain I'm sure they don't we have to respond right now and we don't have that much time now. We're speaking, well seaports is one thing but we're also speaking about humanitarian aid in terms of fuel because while the Ukrainian market was very much dependent on Russia and Belarus in terms of importing the diesel and petroleum while the commercial market is shifting towards shipments from Europe we have to work on the shipments from also public reserves from the West, from the European countries and from the US because the situation is quite urgent and we don't have time to wait while the market will adjust on itself. You talked about fuel, I'm going to put aside the weapons for a minute coming back to the actual needs, I mean what we often see in crises is that people send all kinds of stuff and in this crisis that's not an exception, so like 10,000 pairs of women's leggings endless boxes of pasta without fuel to cook them, I've heard even of a truck full of breaches so what is your message as a government in terms of how you'd like the international community to coordinate with you when they do want to be helpful? First of all I'd like to repeat my message that we do have full operational government and parliament and local councils, so it's not like the situation that I don't know United Nations helicopter is just sort of bringing packs of food and putting them on the ground we do have the system of bringing the aid into the different regions and the stocks and hubs from which this help goes to the communities that need the most of course at the very beginning of this full scale invasion we had a lot of trucks with food and you know this water supplies but now the most urgent need is medicine, is money we need financial aid because we spent so much money on the war that I mean we need to finance the social needs, we have these displaced people inside of the country they lost their jobs they need to have some sort of income our GDP has dropped for 30% because our factories are bombed part of the territory is occupied as Rok Solana said the fuel the diesel and petroleum because we had to change the whole logistics of bringing these to Ukraine and of course you know there is a shortage of petroleum and diesel right now and for example Poland can mix the number but pretty much big amount of petroleum from their reserves as a country and also I think that as I said I mean I can call any ministry or any you know like government, governor from the regions if you want to I don't know rebuild a school or rebuild a museum or try to save the cultural heritage or help the library you can ask that and we'll help you to do the direct help to you know to concrete region to concrete if you have I don't know you want to help kids we have the organizations, we have the Ministry of Social Affairs we will bring your help to the person that is on the ground enjoys working on the ground and you know delivering these help directly I think what we've heard certainly from the humanitarian community is if there was ever a crisis in which all of the pledges to localize aid delivery could become reality it is this one because you have a functioning government because you have some new resources in place and if aid can't be localized in Ukraine then when will it ever happen so there's a call to that Fedor did you want to jump in? Yeah I wanted to add something I believe you're expecting for some you know suggestion for those millions of people all over the world who are willing to help and we really have amazing support now I believe in the power of the horizontal surf organization the decentralization that's what really leads the world to success in my humble opinion in the last years and our system is antifragile it proved itself to be antifragile because it's extremely decentralized as Eugenia mentioned before like 20% of our citizens who stayed in the country are now volunteers Sorry to interrupt, how does the international community tap into that network? There are some prominent organizations one of them developed by the Ukrainian global shapers community called SON, they support Ukraine now but generally there are people from different countries on the ground in the regions different I meet them in Odessa, in Mikolayev and very close to war zone surprisingly close to war zone they have actually very brave and these people they pick up the leaders from the small organizations and then support them and they have amazing result it might not look that sustainable that we expected to be but they're extremely efficient because these people know the situation on the ground and we started our operations in Odessa for instance training military reserve there to move them back to combat and training the responders who responded the missile strikes so then we had to move to Mikolayev and I traveled there found a house I go by this house like starting doing my operation met some people and then I like in three days understood all the rock stars of Mikolayev Red Cross volunteers rescue volunteers international organizations so what my suggestion is if it goes direct to support small volunteer organizations on the ground especially Ukrainian because these people are they have amazing motivation and thanks to World Economic Forum and international community we now have this organization having its voice on international media so if you are reading Financial Times or Bloomberg or something else about organization of three like 30 people 300 people not the huge one just Google them support them and you will really you will have a lot of appreciation from them you'll have amazing results from them and you will contribute I'm not having anything against big organizations but this irregular warfare means that smaller sometimes is better and the flexible is better for I'm sure that the flexibility is the crucial for efficient response on humanitarian especially humanitarian not wartime issues now Rukselina last thoughts I think I want to second what Fedor said if you're if you are donating personally donate locally donate to small organizations because they are the most efficient and often the most reliable and less money will go to the bureaucracy of the big organizations but I also would like to appeal to the governments of an intergovernmental institution and international organizations about our needs very quickly we need fuel we need weapons that's we already established but also we need fuel three hundred three thousand three yeah three hundred thousand tons per month only for diesel we need ambulances we need fire trucks we need temporary housing facilities because Russia destroyed thirty eight million square kilometers of residential buildings and we need the mining facilities for newly liberated towns and regions thank you I just want to end with you Kenya if you could give us very briefly thoughts on the longer term we've talked a lot about immediate needs longer term what are you thinking in terms of what needs to happen as we all said Victor of Ukraine needs to happen and then the sustainable sustainable peace cannot be without justice we need to bring all of these you know soldiers and their command and up to to political command to the responsibility this evil cannot go unpunished because it will be repeating in other corners of the world and I'm pretty sure that we will end up creating a special tribunal as it was in Nuremberg after the Second World War because already we have the cases of thirteen thousand or four crimes committed in Ukraine and you know if we do not end this war by winning this number will grow and grow and grow and the price tag for the lost infrastructure will grow as well and of course we'll need the new Marshall plan for Ukraine to rebuild the country to establish economy and Ukraine I'm sure needs to be a part of European Union a full member of European Union because we chose these European values were dying for them and we want to be inside of the Union and be part of European family another example of how a humanitarian response can't really be separated from the wider political and military context so thank you very much for your attention thank you to the three of you for making a long journey and giving your insights on what's really happening inside the country and there will be a special address by the Ukrainian president at eleven fifteen I believe today so you can stay tuned for that as well thanks very much


You might notice that one problem with working with systems of linear equations is we have to deal with fractions. Now for many of us fractions are fun. We love dealing with additions, subtraction, multiplication, and division of fractions. But then there are some of us, maybe only 90-95% of the population, that finds dealing with fractions a little bit tedious and possibly somewhat intimidating. While it's not generally possible to completely avoid fractions, we can at least reduce the amount of time we have to spend with them through the use of re-parameterization. So if you like adding, subtracting, multiplying, and dividing fractions, you don't really need to watch this video. On the other hand, if you want to avoid working with fractions, a careful choice of parameters can help you avoid them. We'll proceed as follows. Let P1, P2, all the way up to Pm be the pivots of our row echelon matrix. Let K be the product of all of these pivots. When we choose our free variables and set up our parameters, we'll include a factor of K in all of them. For example, suppose I want to parameterize the system whose row echelon form is given. We'll go ahead and write this as a system of equations using our variables x1, x2, x3, x4, and x5. We see that x1, x3, and x4 are leading variables, while x2 and x5 are never leading variables, so x2 and x5 will have to be parameterized. Now our pivots are 3, 2, and 5, so let's include a factor of 3 times 2 times 5, that's 30, in all of our parameters. So that means we'll let x2 be 30t, and x5 is going to be 30s. Now we'll substitute these into our equations. So our last equation tells us that 5x4 plus 2x5 is 0, so I'll substitute in my value of x5 and solve for x4. The next to last row tells me 2x3 minus x4 plus 2x5 equals 0, so I'll substitute in my values for x4 and x5 and get a value for x3. The first row gives me the equation 3x1 plus 2x2 plus x3 minus 4x4 plus 5x5 equals 0. Substituting in these values, I get my value for x1. While we can't avoid fractions forever, we can minimize the amount of time we have to work with them. So if my augmented coefficient matrix has row echelon form as shown, we can parameterize our solutions as follows. This time we'll use the variables x, y, z, and w, and the two rows of our augmented coefficient matrix correspond to the two equations, 2x plus 3y plus 3z plus w equals 5, and 7y plus 5z plus 3w equals 1. x and y are leading variables, so they'll be basic variables. z and w are never leading variables, so they'll be our free variables and we'll parameterize them. Our pivots are 2 and 7, so we'll parameterize z and w with a factor of 2 times 7 or 14. So we'll make z equals 14t and w equals 14s. From the last equation, we can substitute in our values for z and w and solve for y. Our next to last equation, we can substitute in our values for y, z and w, and solve for x. And so we have our solutions for x, y, z and w.