Hello, I'm just going to test the mic and make sure that I have the right distance to the microphone here. So a couple of days ago I presented at Black Hat this same presentation, so I'm going to give it to everyone here today at Def Con. The first thing I said at Black Hat, I suppose, was I wanted to achieve two things and one of those things was not freaking out on stage, and what I hope I don't freak out on stage today, and the second thing was to give people insight into where kernel security stands today and what sort of bugs are present, how many bugs are present, what forms of exploitation are available, and that is what my presentation is on, kernel auditing and exploitation. So there are three parts in today's presentation. At the end of each part we'll stop for questions, but feel free to jump in with any questions if you want to. So the three parts are the auditing research that I performed, a sample of exploitable bugs and exploitation on some of those bugs. So part one is kernel auditing research. So last year, for about three months between July and September 2002, I performed a manual audit of the various open source kernels, and the OSs here were FreeBSD, NetBSD, OpenBSD Analytics. This was a part-time audit, so I wasn't spending 24-7 or even 8 hours a day or anything. It was just spare time that I had available. I just audited various bits of kernel source.  Why did I audit Linux so much? Probably just because I use Linux a lot. I run it on this computer and most of my PCs. So unfortunately Linux was a little heavy-handed in my auditing because I do enjoy Linux. So what prior work has been done on kernel auditing and so forth, there has been some prior work here. Probably the best that I think that I've seen is Dawson Engler's research. In the past couple of years, he has released a number of papers, some really great papers actually, where basically he wrote an automated bug discovery tool using a language called metal, and he released some papers on this, and to do this research he applied this automated bug discovery on large sources, namely being the operating systems kernels. So NetBSD, actually OpenBSD, Linux and FreeBSD, he certainly performed automated bug discovery on, and actually he sent most of those bugs I think to the Linux kernel mailing list, and found a lot of concurrency and synchronization issues such as double locks, double unlocks. That seems to be, he also found a number of buffer overflows, and this was all automated, but most of the bugs that were reported were concurrency and synchronization. The Linux kernel auditing project is an interesting one here. There's a bit of a question mark at the end of this line, and the reason for that is, I've never actually seen the Linux kernel auditing project do anything. They've got a mailing list, but there's very few posts to it. I think they released about two advisories for some issues that were already known, and they never really, like in my opinion, they really didn't audit the Linux kernel. They talked about, possibly let's audit the Linux kernel, but I don't think they actually did because there are places in the kernel source where you just, they have comments saying it's totally broken, please don't use, and these bits of code are totally exploitable. Just some notes for the rest of the presentation. When I'm talking about bugs, I'm always going to be talking about vulnerabilities. Volubilities is a really long word. I'll just say bug, unless I state otherwise. I'll just sort of summarize what happened after the end of these three months of auditing. Think in conjunction with the kernel developers and whatnot, at least 150 bugs were patched, and pretty much all of these were exploitable. So I'm just going to like, it might be there seems to be a lot of bugs in the kernels from what I've seen, but not many people seem to be auditing them, or if they're auditing them, I don't know. So I believe that there are certain myths or a bit of mythology around kernel source, and one of the myths I'm talking about here is that, maybe it's assumed by people that kernels are written by security experts and programming gods, and certainly kernel developers, some kernel developers are exceptionally talented and incredible programmers, but there's a lot of kernel source here, a lot of developers get involved, and so the follow-up to this myth is if the kernels are written by security experts and programming gods, they really mustn't have any security bugs, and if they have security bugs, they're not really simplistic. And I suppose that leads on to the next myth, it's just a rewrite of the first one, is that kernels never have simplistic security bugs. Therefore, only security experts or programming gods can find them, and I would disagree with this considerably, and I show evidence in contradiction to this by showing simple bugs that are exploitable and so forth. I've got one more final myth that, again, a follow-up to the second one, and the first one, that if kernels are buggy, incredibly difficult to exploit, and therefore, probably exploitation is just theoretical. Maybe you've heard that there are bugs, but they require something to be happening while something else is going on, and maybe the disk light is flashing a bit, these types of, these are the myths that I hear and I see, and I try to show evidence to contradict this, because there are simple bugs in the kernel, simple bugs to exploit, there are simple mistakes that are obviously spotable. So I make some conjectures for the auditing that kernel code isn't special, it's just another program, it's a big program, it's a big, big program, but it's just another program. There's certainly a lot of bugs in user land, so why not the kernel as well? And one of the reasons for this is that, I believe this, is that these kernels are written in the same language that the language of C that has had so many problems in the past with user land programs. User land programs generally written in C, lots of bugs, why do people not think the kernel is the same? And certainly, my conjecture is that kernel programmers do make mistakes, just like everyone else. If someone's, an average kernel, say a couple of million lines of code, we're expecting that one million or 10 million lines of code is 100% bug-free, that a simple mistake has an echoed somewhere in this, it takes a long time just to look at five million lines of code, let alone audit every single line there. So I started with a bit of a methodology for the auditing here, that I was only going to audit simple classes of bugs, not going to look though really complicated ways of attacking the kernel. If your disk light is flashing and maybe something is going on in the background and you're paging something, not going to go for any bugs like that, not going to go for any attacks on algorithms or so forth, just target really simple classes of bugs. And one of the ways to do this was to audit using bottom-up techniques. So basically, find places in the code that if were buggy could probably be exploitable, and the way that I do this would be basically to grab for good places and from that, look at the code around it, and if that code is buggy, it's probably exploitable. So looking for good entry points into the kernel, now kernel to user space copies and user space to kernel copies, buffer copies, a very good place to look. If these bits of code are buggy, then certainly buffer overflows and other problems are likely to be exploitable here. As the auditing continued over the period of months, certainly I got more experience in what sort of things I should be looking for and the number of classes of bugs and exploit classes certainly increased. So for example here, system calls are simple entry points. If you look from going to user land to kernel land and exploiting the kernel, system calls under the control of user land maybe they're exploitable. I think though that a lot of people, from what I've heard, if they've gone to audit the kernel, they look at system calls and they think, okay, let's go for the core system calls, maybe there's a bug there. But there's in fact, a lot of other places also that you can audit, such as the device drivers, these again have simple entry points. Primarily for the fact that in Unix everything, really the idea was that everything should be considered a file. So you can access a lot of code, a lot of kernel code through these device drivers, IACTLs seem to do everything. They're so generic, they basically can do anything and everything that you want and probably more, they increase the attack vector space massively. And it's argued that for Unix, everything is a file. What's the point of IACTLs for this? IACTLs break the design of Unix to say that everything is a file by introducing a system call that does everything at this point. So some of the Unix designers argue that that was a bit of a downfall of Unix at that point. I don't think so, it's certainly interesting. So there were some immediate results in the auditing here. The first bug was found within hours and this was true for all systems audited and it's arguable that the first bug in a non-familiar software is, you know, it's arguably the hardest to find. Once you start to have, you know, places to look for and ideas of what types of bugs are present, it's typically considered easier to find more bugs. So a couple of observations here. It does seem to be evidence of varying degrees of code quality and hence security bugs. The core kernel code in all the systems audited was pretty good. Not so many problems there. There were a couple, but, you know, ultimately it seemed to be a lot more bug-free than say, for example, device drivers, which pretty much anyone can write, make a submission for all the OSes here. So they did, in my opinion, seem to contain a large number of bugs. And I also make the comment that bug tends to exhibit signs of propagation and clustering. So what I mean by this is that say, for example, you have a device driver and this device driver, this code for this device driver, it becomes the reference implementation. And this reference implementation has a bug in it. And now everyone, when they go to write their device driver, copies the buggy reference implementation and thus the bug propagates with the security problems associated with it. The clustering observation is also that once you find a bug in a particular bit of source, you're probably more likely to find bugs nearby as well. So if you start to find bugs in, say, the video for Linux drivers, maybe there are more bugs in other video for Linux drivers, maybe in the file system code, look around, probably more bugs around that area as well. And there are identical bugs across all platforms. And I'll show you some examples of this. I've got like the asterix and the bracketed two stuff just in reference to some slides coming up. But just before I get into that, just a bit of research bias, manual auditing is inherently biased. Certainly I can't argue definitively that these observations are scientifically correct because my auditing is inherently biased. Maybe I believe that core kernel code is more secure, hence I'm not finding bugs in that. It's hard to argue through scientific means. However, Dawson Engler's work with the automated bug discovery is less biased since it is not done by a human. It is done by an automated process which can be repeated time and time again and so forth. So just some code in reference to having the same bugs across a number of platforms. We have here NetBSD and OpenBSD. This was a couple of versions ago. And it's a bad example to show you start off, but I should have changed this slide. But because you can't see the exact part where it's exploitable, you can just see part of the bug here. So I've highlighted, I don't think anyone can see this because I can't even see this from here. So basically it's in the I386 set LDT code. We're adding two numbers together, start plus num and checking if it's greater than another. And this is some input validation checks. However, the problem is that when we add these two numbers together, we can get a sign wrap around and with a negative number past this input validation check. And then a couple of lines afterwards, we have a buffer copy which now uses the failed input validation check. These have been fixed since, so they shouldn't be current in any systems. So just to show some evidence in contradiction to the myths that I presented earlier is that kernels aren't written by gods. Very talented, but not in the godly manner that the myth holds them to. So the initial bugs were found in all ours and bugs were found in large quantities. 10 to 30 per day wasn't really uncommon. In various places of the source, lots of bugs are present. And it was assumed and stated that code was secure when in fact it wasn't. This is actually pretty funny to be honest. So this is in Linux 2.4.18 and this is in the video for Linux code I think, one of the drivers for that. So the comment is that, okay, first things first, make sure we don't copy more than we have even if the application wants more. That would be a big security embarrassment with an exclamation mark at the end. The very next line, the exact next line of this comment is an integer overflow. Okay, so about two lines below that is a buffer overflow as a result of the integer overflow. So it's a very interesting comment, certainly. There is another interesting comment. There's a few interesting comments in the code and I'll show some more a bit later on. But for this comment, this routine does error checking to make sure that all memory accesses are within bounds. And then what we have, we have multiple problems in this code. We have an integer, a sign problem. We pass in a sign integer and do a comparison but we don't check for the case when it's less than zero. We also have an integer overflow even if we got this sign problem fix, we would have an integer overflow in the lines below. And then we have a buffer overflow after all of that. So, you know, they're pretty funny comments. I don't know, maybe it's just my bad sense of humor. So some more evidence in contradiction to kernel mythology. Kernels really do have simplistic bugs. You know, I really didn't do any intensive code tracking for this audit.  I didn't start at the boot sector and follow it all the way to what happens when you, you know, for just find simple places to audit and look at the immediate code around it. And certainly in some cases, there was simply just no input validation at all. Also inline documentation shows that, you know, code is not working. I should have some examples here. So we have this bit of code, ibcs2underschoolstat.c and this is in all systems actually, OpenBSD, NetBSD, FreeBSD and Linux, the bug was shared across all platforms. FreeBSD have not fixed this. I don't know why. So basically we pass in a length to a syscore. The length is just never validated. We do a, we copy a buffer using this length and there's no, you can put a length of anything. You can, any length you want and it will copy that. So, you know, no input validation at all. Here is another, another no input validation bug. This one is copying from kernel space to user space. So this will give us kernel memory disclosure. And again, it's from a, it's a VGA driver here. So the video driver of some kind looks like to be NetBSD I think. So we're gonna call an IACTL and then we can pass in account of whatever we want. We just pass in a length and it will just copy this back to user space. Okay, here's another bit of code. This one is in Linux and this one is still present in Linux. I released this and an exploit for it a couple of months ago at Ruxcon. And it doesn't seem that, yeah, it hasn't been fixed. So I'm not quite sure what the, what the story is there. So we have a comment and this is in the cough binary loader. Has a comment saying x, x, x, untested. And like, I can really guarantee that it's never been tested because if anyone used this it would kernel panic immediately. It has, it's using the wrong arguments completely. It's, there's no possible way it can work. But in this case it turns out to be, you know, it's exploitable and we can escalate privileges and get a reach shell by running a custom cough binary. So some more evidence in contradiction to kernel mythology. Kernels, if they're buggy, are not always difficult to exploit. To exploit 100% reliably prokfs bugs in Linux to perform memory disclosure is 38 lines. For FreeBSC there's accept system call advisory that was released last year, last year, 37 lines of C. FreeBSC and Linux, the developers of, respective developers both have exploits for these by the way. I did send the exploits that were written to them. Also an interesting thing, a stack overflow in Linux requires no offsets. It's very, very reliable. It assumes correctly that addresses, that return addresses on the stacker word line that's the only assumption it really makes to perform stack overflow in Linux. And in GCC it will always align return addresses. Actually when I presented this at Black Hat a couple of days ago, I was saying that I said exactly the same thing but I didn't want to say 100% certain always will be aligned. So I said GCC should, I'm pretty sure of that, but some guy did come up to me after the presentation and said yes, it's definitely 100% true that GCC will never have anything that isn't word aligned. So it's just a bit of a note there. So what attack vectors are present? At the result of auditing all this code and finding bugs and exploits, it does seem clear that the more code there is that's running the more vulnerable it is likely to be present, which is a pretty casual observation there. But the follow up to that is don't run these kernels that have everything compiled into them under the sun. Don't have support for hardware that you don't use. Don't have a million device drivers just running because all of these increase the attack space that you leave open. So definitely you can mitigate some risks there if you just compile smaller kernels and don't have so much support there for things that you don't use. So entry points into the kernel that use a link and control are certainly the vectors of exploitation here. And device drivers system calls file systems. File systems are interesting. Low code in Linux, PROC FS, in most of all of 2.2 and most of 2.4, I think there's some in the 2.6 tests at the moment and certainly in most of the 2.5s as well. I mean you can do things like lseq, if you can open a file in the PROC FS and it's readable by world, readable by everyone. So you open it, you seek to around four gig on 32 bit platforms, seek to around four gig. And then if you read something that you might be able to cause an integer overflow for around four gig plus what you read, get an integer overflow and then you can have things like memory disclosure. Also just to make one more comment on that last slide is that the core kernel code again is pretty good like in most kernels, not a couple of bugs there, but nothing major there. So I think someone read the slide there with Theodor Ratt just once in three minutes. He just had a bit of laughter. So the vendor response actually was really strong. Contacted everyone and everyone responded extremely well. Theodor Ratt sent an email, turned around, having a conversation with someone, turned back, under three minutes got a response about send a list of 10 to 15 bugs and in three minutes got a response on these. So I think that's not bad. Alan Cox was pretty good. He was the first person that I sent bug reports and vulnerabilities to. Send him a list of bugs for I think 2.2.16 at the time and this was like 2.4. something that wasn't even the latest 2.2 version, some old Linux kernel that no one was really using and in about three hours, a couple of hours, he sent back a list, he sent back information on all of the bugs that I had reported. Some of the bugs he said, oh yeah, we fixed that in later 2.2 or in 2.4. For some, he could actually name the people that had fixed bugs from one to two years earlier saying that our solid designer had fixed various bugs, things for example, such as the get-sock-opset-sock-opt sign problems from two, most of 2.2. So that was pretty impressive, I thought. So just before I get too much into this, I am a little biased myself. I still believe in open-source software. So even though I think the responses that I received were exceptional, it's a little biased there. But maybe the reason why open-source response was so good was that they didn't have a marketing department, I emailed developers directly, people that actually code on these kernels. So maybe the only thing that could argue was source at that point, I don't know. So a bit more biased, I don't know if anyone can see this, but so a bit of a grep for the bit of grep for hack, the number of references of the word hack in the 2.4.19 Linux kernel credits, 106 times, so I don't know. I have a really bad joke, it's a bad joke, I gave it a blackout, no one laughed. It's like a lot of hacks in the Linux kernel, I don't know, no one laughed here again. So. A comedy, not my strong thing here. So just to talk about Linux here, a bit more about each vendor's response. Alan Cox, the first person I contacted, he remained personally involved and responsible for the entire duration, sent tons and tons of bugs, and he fixed the majority of software, patched a lot of things. Often attributed to me in the credits with small patches and whatnot in change logs, and even though these were one to two lines of code and were quite sort of obvious of what needed to be fixed, it was unusual that he attributed me for those. Solid Designer was responsible for the 2.2 Linux kernels, he was the person that was, I think if you look back last year, the 2.2 kernel was released after some long period of time of not releasing another 2.2 kernel, and that was really Solid Designer doing all of that work and back porting a lot of bugs from 2.4 as well. Dave Miller initially started on the Spark, Spark patches and whatnot, and then started to help in sort of generic stuff as well. So, in my opinion, Linux was probably the biggest success here. Certainly, Red Hat released an advisory last year about the 2.4 kernels, 2.4, I think 2.4 or 19 or 18, and they were pretty political in their advisory, referencing the DMCA and saying stuff like, we'd like to give you information on these vulnerabilities, but we can't because maybe the DMCA affects this. So, if you go to another website that's outside the US, you'll be able to see specific information on each of the bugs that were fixed. That was interesting, I thought, but now it seems, excuse me, now it seems that Red Hat, along with most of the other Linux vendors, do release kernel advisories, which seems to be fantastic. They do release regular kernel advisories now. So, it seems probable that this is probably attributed to the auditing work that was done last year. So, in my opinion, that was probably the biggest success story there. The audit, like it's, the irony is that, you know, there was the Linux kernel auditing project, but it seems that, you know, the audit performed last year was probably, probably the most complete for Linux at that time. What about FreeBSD? FreeBSD certainly has a more formalized process with vulnerability disclosure and bug patching and whatnot. They've got a security officer contact point, it took me a bit longer to get like a, you know, reasonable dialogue with them. You know, not, I'm not talking weeks here, but you know, I think it was like a bit less than a week, I think it took me to establish a, you know, really good, you know, really good dialogue there. But they're pretty effective. Wine's dialogue was established. They addressed the standardizations issue, which I haven't really described in my slides, but for one particular point, if we look at Linux 2.2 and if you look at Linux 2.2, there's the Get Sock Hop, Set Sock Hop code. The problem for that was that the socket option length could be a negative, and when it was a negative, it would cause memory disclosure. A very similar problem with FreeBSD, with the accept system call. The length of the socket address structure could be a negative, and when it was, it would cause memory disclosure again. The good thing that FreeBSD did was that they said, okay, let's change this type death for the socket address length to be unsigned, which essentially, you know, in my opinion, will solve problems that they haven't foreseen in the future. Unfortunately, the way that Linux went about fixing that, and it was unfortunate, like in some respects, because there was so many, there was so many specific bugs in the Get Sock Hop code for various protocols and whatnot. What was done was that a check very early on, early on in the code was performed to check for the negative case. It solved lots and lots of problems from hidden subsections of code that had the same sign bug, but my opinion was I would have liked that to be unsigned. So, was FreeBSD a success? They released an advisory last year with the accept system called again, and this was a bit of a surprise. I'm working at a vulnerability company at the time, and a co-worker, happens to be that guy sitting right there, comes up to me and says that he's gonna implement my vulnerability, and I'm like, what vulnerability are you talking about? And he's like, FreeBSD have released an advisory on the accept system call. So, yeah, I don't know, thanks FreeBSD. I really did not know about that, and I saw the advisory, I think I'm bug-tracking like everyone else. So, NetBSD, I didn't speak to NetBSD for too long, but they did resolve all issues. I think what happened with that, it took me about a week before like, I could really talk to, have a good dialogue with someone, and then it was about a week before they actually pushed patches into the main tree, the main development tree at this point. I think what was happening in the second week was that some guy had done the changes, they're very simple changes, done the changes on his own box and was doing a bit of personal QA, and then pushed it for the other developers to look at as well, back in the main unstable development tree, which is very typical in a development process. So, if we look at OpenBSD now, theater rat is probably the quickest response in documented history. Three minutes is, that's pretty fast. I can't get my mom to email me in three minutes. That's insane, it's three minutes. So, interesting thing with OpenBSD though, was that they released an advisory for the select system core, Stack Overflow there. And this was shortly after I sent them about 10 to 15 bugs, and some of these bugs, sent about 10 to 15 bugs, a bit after that they released a select advisory. What I think happened in that period of time was that Niels Provos and probably other people know OpenBSD started, at least a more concerted effort, if not the initial effort, I'm not quite sure to do kernel audits here. So, I think that was reasonably successful that certainly they started to look at other issues then as well. Interesting thing also with NetBSD, which I probably should have mentioned a bit before. I did, when I sent NetBSD a list of problems, some of the bugs were actually shared with OpenBSD as well, which isn't too surprising. The bugs that were shared were primarily just driver code, and that's, again, it's not surprising since OpenBSD can be considered a fork from NetBSD some time ago now, but some of the drivers are shared and some of the bugs were present in both. OpenBSD did take the patches for these things anyway, for NetBSD propagated to OpenBSD pretty quickly, but it was surprising to see the changelogs in OpenBSD because it's like from NetBSD, it's like, oh yeah, those are the integer overflows and the driver problems there and whatnot. So, I've got a couple of, okay, I've got one changelog here from OpenBSD. OpenBSD, there's another good changelog entry, which I probably should have included, but I'll just talk about this one for a sec. So, this is the IVCS2 code that I showed earlier, which had no input validation checking at all, and the comment in the changelog is that more possible integer overflows found. So, there were no integer overflows. It was just a no input validation check. Another interesting changelog entry, and this was for a couple of them, were it was like, I'm just trying to think back to the exact wording here. It was more possible integer overflows found by yada, yada, yada. Some of these are okay, but have been changed for consistency. And in fact, all of these were exploitable. It wasn't, some of these are okay, not, you know, those patches, you know, they're all exploitable. So, you know, it's not, you know, I think OpenBSD, you know, certainly, certainly very good, but it's certainly interesting changelogs as well. So, the IVCS2 stat.c code. Linux fixed it, OpenBSD fixed it, NetBSD fixed it, FreeBSD, I don't know why they've never fixed it. I've sent them, I've sent them this, and they've just not fixed it. I don't know why. I'm really, you know, at a loss to say. And I also explain this at Blackhand, I'll explain it here. The reason why there is a square next to the FreeBSD line is that this actually was a PowerPoint import into OpenOffice, and it didn't have the font for the smiley face. Well, you know, so that's the reason for the square up there. There should have been a smiley face, a frown, a frown, but oh well. So, where are we today in Kernel security? Auditing today, you know, always results in vulnerabilities being found. You know, there are bugs still present in all the kernels.  You can't just audit something at some point in time and say it's going to be secure for the, you know, indefinitely. And certainly, you know, even though I will present a number of bugs in a number of bug classes, there's certainly more things that are exploitable and certainly a lot more classes of bugs in the code, as well, than there will just be described today. So, a couple of months ago, presented most of the bugs, a very technical presentation. Like, basically I was going through lists and lists of bugs and saying integer overflow, integer overflow, about four months ago, at Ruxcon, and released some zero-day, released some zero-day at the time. And some of those bugs are still present. I don't know why. So, the cough loader for Linux and exploit is available for that on the Ruxcon website. But I've never actually posted an advisory or posted anything to full disclosure or a bug track or whatever. And, yeah, it's never been fixed. So, an obvious question, does anyone, does anyone read the conference materials? And does anything about it? We're just presenting things for ourselves or what? So, at this point I'm going to pause for audience participation and ask if there are any questions. Okay, I've actually got a pretty interesting question here. Question was that basically when I talked about bugs being clustered, he was asking me if that was because of the way I was auditing. And I suppose my response to that is, I can't really present scientifically that bug clustering exists. All I can say is that I observed, in my opinion, bug clustering and it's possibly supporting evidence. And Dawson Engler's work certainly talks about bug clustering and bug propagation and that's probably certainly more scientific than the methods that I use, which manual auditing. I must admit I did look at certain bits of source and the sources around it in a reasonably closed time frame so maybe that was the reason why I saw bug clustering. But a good question, but okay, I'll go to the next part of the presentation which is a sample of exploitable bugs. And I'm actually gonna, it looks like I'm running really long here so I'm going to actually skip a few of the slides here. Okay, I've got a 10-minute sign up there which is pretty good. I'm going to go through a couple of bugs and go through a couple of classes of a couple ways to exploit them as well. Sample of exploitable bugs. This was, okay, I'll just skip to something that's more interesting. If you wanna, you know, if anyone wants to talk to me about this after the presentation, that's fine. So I'll go to something that's, okay, this one is interesting. What we have here is that we have, and I know that no one can read this so I'll try to explain it. We have a memory allocation and we have memory allocation of something like a size of, a long times, you know, something plus a one. And then down below we have a copy out call which is a kernel buffer copy from kernel space to user space.   So that seems to be a problem that exists when you see code like that and they say, okay, they're using one expression here and another expression down below. It's very, very often that it's exploitable in some way. This one, another interesting case. We take a minimum here, a minimum of two values. One of those values we control from a syscall argument. But the point here is that we control a syscall argument and we can make it a negative. So when we take the minimum of these two values here, you know, we're gonna come up with a negative. So then we do a copy out later on using this length which was a negative, now becomes a positive. I got a sign that I have five minutes to go so I'll skip most of these actually and I'll go to some ways to exploit, okay. Here's an example of what I was just talking about a second ago. We have a validation check on this count value here. This is in the PCI hotplug core.seeker which is a Linux code and we seem to have lost one of the, I'll look at this one now. We seem to have, so we do a validation check on this count, okay, and we check if count is less than or equal to zero. But then we do a memory allocation using count plus one. So now we have an integer overflow when we make count the size of uint max, an unsigned integer maximum. We can get count plus one to wrap around back to zero and kmaliking zero bytes will return successful providing we can perform a memory allocation to begin with. Interesting bug that I really do wanna talk about. This is very prevalent in a lot of the 2.2 Linux code and most of the 2.4. This is what I was talking about before when you L-seek to around four gig, we take the file pointer which typically is 64 bits but in some cases people scrap the prototypes and that causes problems and they cast it to a int and then they've had the file pointer which is cast now as 32 bit sign value plus the count which we're reading and that itself is an integer overflow and causes memory disclosure later on. Okay, I'm gonna skip at this point to some... Okay, I won't pause for audience participation and kind of exploitation. So there are two things that are two classes of exploits that we should look at here. Arbitrary code execution and information disclosure. So for arbitrary code execution obviously the best form of exploitation that we have can give us a reach shell, a privilege escalation, escape kernel sandboxing, security enhanced Linux for example, user mode Linux. If we look at digital rights management, save for example we have a certain kernel version or a certain distro that is signed and it says that okay, when you view this website you can't actually save any streaming content or so forth. However, if we have vulnerabilities in this software, we can control it at that point and we can make the software do something else than what the DRM people say it should do. Ultimately in the trusted computing doesn't actually provide any software assurance. Trusted computing is basically just breaking policy at well-defined sequence points and having trust relationships. But if you're trusted in a computing base or so forth is vulnerable or has hidden features then certainly other things are possible there. So and it seems to be the case if your trusted computing base is flawed and certainly in all of these things the kernel is seen as the trusted entity then ultimately system security is compromised. We have information disclosure as well. Such as, such as SSH private keys. If we can read arbitrary kernel memory we might be able to sneak out an SSH private key. I will just pause for one second. Okay, five more minutes and I will be tackled off stage. So I'll try to get in as much as possible here. Has been prior work to kernel exploitation. Nuire in a Frac-60 wrote a great article, great paper on smashing the kernel stack for fun and profit and this was an implementation of exploiting the OpenBSD so that kernel stack overflow. There have been other exploits in the past from Solaris and FreeBSD and whatnot. But in the general case it's seen that there aren't generic ways of attacking the kernel, which was probably a good thing of advice because he showed a class of bugs there. Kernel implementation, all the kernels are written in C. C has known bugs, known problems, known pitfalls, attack the language, attack the implementation, don't attack the algorithms. A very simple method of attack but a very effective one too. C has some pitfalls. I won't talk about these but C has lots of problems and they've been seen time and time again for many, many years now since the 1970s at least. So there are problems in pretty much all code not just user land or kernel code. All code really has the same classes of bugs that people are looking for and all code, we can find bugs in lots and lots of code. I will skip this because I've talked about it earlier on. Okay, so if we look at kernel buffer copies, okay, if we look at kernel buffer copies, okay, we can think of kernel and user space divided into segments. Kernel space is a segment, user space is a segment. When we do a kernel buffer copy, we need to validate the source and destination that they reside in the right segments so that when we're copying something from kernel space to user space, we are in fact copying it from kernel space to user space. We're not putting in values such as 0xc, something, something, something, which represents kernel space to a read or a write system call or so forth. For example here, if we were able to read something from the network and it was possible to put in an address such as 0xc104, whatever, would actually, if there was no validation done, would actually read this data into the kernel segment and overwrite kernel structures or executable code. And if that was the case that we could read into kernel space, then we could certainly exploit the kernel here. Okay, we have a FreeBSD SysExcept exploit here and I just wanted to show this code. It's about 30, 37 or 38 lines, what I said before. And the way to exploit this is pretty straightforward. The accept system call takes three arguments. The first argument is a socket. The second argument is a socket address and the third argument is the socket address link. We simply point the socket address to a user space buffer and then in our socket address link, we pass to it a negative value and I'm just about to get thrown off stage so I'm gonna wrap up right now. Okay, thank you very much everyone. I hope you enjoyed my presentation. I just wanted to say one more thing. If anyone wanted to continue this or have any questions, you can see me outside or right now, somewhere else anyway. But thank you.


Alright you guys what is going on welcome back to another video today's video is going to cover a topic that is near near and dear to my heart it's a topic that I have been interested in for years in fact you know since I can remember I was interested in this topic and how to create wealth through property investment the reason I was into it so early at thinking back now you know I'm 27 now I've bought a couple of properties but thinking back you know when people do ask me okay how how did you first get involved with property why did you start looking at property for an investment opportunity you know who got you into property and that was my dad alright it was seriously my dad from from an early age he hustled he really did you know he's on average income his whole entire life he never had anything special but he put every single dollar he made into property either buying a property and holding or buying a property putting money into it and then and then flipping it so early on you know we we moved different how to different house after different house because obviously they were they were just moving up in the ranks you know buying this property doing it up a bit selling it buying a more expensive property doing it up a bit selling it so that was their strategy when they broke up everything got split and basically you know it all got halved and any dreams that they had my my parents of owning multiple rental properties you know having a life of financial freedom was cut short unfortunately due to the divorce so regardless of that early on I got the notion of property investment I got the notion of being able to make money through property I started thinking about interest rates I was good at maths when I was a kid so I started calculating interest rates I started calculating how much this would cost to pay this mortgage as opposed to how much I'd get for rent and I'd start working out well shit I could if I had $20,000 you know as a 10-year-old I was thinking shit if I had $20,000 I could buy that property I could rent it out I could make money each week and I could save another $20,000 and do the do it again and do it again and do it again I mean at that point I didn't realize that once you did gain equity in a property that you own you can actually use that I mean you can refinance that property take the equity out without having actually used any of your own money and and go on by another property so once you've got that first one things change and thinking about that you know people seem to get to that first property that that one investment property and stop especially in Australia I think something crazy like 85 or 90 percent of all owners of residential investment property in Australia have only one investment property I think something like five percent have two three percent have three and I think one percent have four or above something crazy like that so you know statistics are fine but let's let's look at that for a second what is happening people are buying one possibly making the wrong decision and not being able to continue with that property dream you know that I'm talking about to buy multiple properties if you make that wrong decision on the first one you can really really set yourself up for five to ten years of just chasing your tail so regardless of that that's how I was introduced to the property market that's how I started doing figures in my head that's how I started imagining my financial freedom my financial dream and so when it came time to leave school and get a job I was just like the rest of you at 17 18 I had all this knowledge I just had no money okay my parents were not gonna buy me my first property they were not gonna buy me my first car they were not gonna buy me my first anything and I think those fundamental values and the way that brought me up definitely set me up for a good future a good financial future or at least a good financial understanding of money and the value of money so left school I I couldn't see I couldn't see myself buying a property within the next couple of years my my you know income wasn't very good I was just out of school when I thought you know what what's the second best option a car everyone wants a car when they leave school so I bought a car I bought it on finance okay I was pretty pretty good with my money I'd saved up a little bit I had my job for a year I was 18 I was eligible for a loan so what did I do I went and got a loan bought the car it was a fantastic car fucking loved it probably had about three months worth of good times lo and behold was all eight what do all 18 year olds go and do when I've got a nice flash car they go and crash it well unfortunately guys I wasn't able to escape that either so I crashed my car I rode it off I had no insurance so by age 19 I was in New Zealand I had my shitty job I had a $10,000 loan for a car that I didn't have I'd lost my license so I couldn't drive anyway and you know everything was everything was just going south everything felt like everything felt like it was you know the whole world felt like it was against me to be honest especially that car thing at the age of 18 having such an awesome car having some great times in it and then riding it off and having nothing to show for it having a shit job having a $10,000 loan and not even knowing how the hell I'm gonna pay for it it was pretty depressing so what do I do I say fuck it to the loan I say fuck it to the house I say fuck it to all my financial dreams and say you know what I'm going to uni because it's the easy option okay I always thought I'd go to uni but I didn't know what I wanted to do so at age 19 with my debt etc I was still living at home I couldn't move out I had no money I went to uni four months later I'm 19 I'm about 19 and a half four months later I decided no uni's not for me so I quit uni I decided no there's too much opportunity cost that I'm missing out on here if I spend three or four years at uni come out of it with the degree that I don't even want to use I'm gonna be in a worse position than I am now so I had to make that decision early which was not easy it was hard because I still I came out of uni with a debt as well so I had my $10,000 car loan and for a car that I didn't have and I had a $10,000 uni loan for a degree that I didn't have so here we are $20,000 debt a shitty job well no job actually because I quit my job to go to uni I left uni tried to get my job back couldn't get my job back mate it was it was shitty times and then comes the big turning point in my life where I moved to Australia I moved countries at the age of 19 I left all my friends all my family and moved from Christchurch in New Zealand and moved all the way to the middle of Australia to Alice Springs where I where I still am today unbelievably eight years later or just about eight years later so I've been in Australia now for seven and a half years and it took me probably a good three years to get my feet on the ground and to get those debts that I had paid off and to start getting you know off the week-to-week cycle because you know being week-to-week guys you just can't see a future you can't see any sort of financial future living week-to-week on a paycheck scraping through to that next paycheck and unfortunately until you do what I did you're gonna stay in that situation you're gonna stay paycheck-to-paycheck you're never gonna be able to save any money you're never gonna be able to buy property and you're just gonna accept that life well you don't have to all right you don't have to before I go on I'm not a financial advisor take what I say as entertainment and on face value because this is my experience is what I've done but you know these things that I'm trying to tell you that my experience I'm hoping hoping that I can really connect with some of you guys out there and help your dream of financial freedom start all right because that's what we want to do we want to get financially free so we don't have to work every single motherfucking day for the rest of our life okay so anyways I came to Australia took me three years to get my to get my feet in the ground here I am in Australia as a 23 year old no money still no money in fact all I had was deck I had a credit card which was maxed out and I was still doing administration jobs so all of my jobs up until I got up until the point that I got my current job right now I was doing admin so I was doing computer work I was printing photocopying emailing Excel spreadsheets all sorts of shit like that I'm a fast typer so it worked but the reality is I was never ever going to get paid anywhere over $50,000 a year and for me to buy a property as well as live as well as save money as well as go traveling do everything I wanted to do it wasn't going to work so I had to take a leap of faith I had to leave the job and the industry that I was very very comfortable in and I started disability support work believe it or not so four years ago guys I started disability support work over four and a half years ago and it was the best move I ever made it really was not only the job I enjoy it but but let's not beat around the bush the reason I did that was for financial reasons so I entered into this job with no expectations all I knew was that I was keen to work I knew that I could get penalty rates for Saturday Sunday and night shift it was a shift work position I'd never done shift work I'd never done 12-hour shifts but what appealed to me was the fact that okay well if all I want is the most money possible I can get overtime for doing weekends I'm quite prepared to do that I can get overtime for doing night shifts I'm quite prepared to do that and if I was to do just four of the seven days a week I'd have 48 hours in the bank that's 96 hours per fortnight each fortnight you get paid a salary on 76 hours anything over that you get paid overtime plus it was a government job which is the reason why you get all these penalties and overtime rates most government jobs guys whether you're in Victoria South Australia Western Australia fucking Queensland doesn't matter where you are most government jobs you'll find will be Monday to Friday eight till four you get no opportunity for overtime you get no opportunity to work the weekends nothing so guys I've got to say I struck it lucky man to find a government position within the Department of Health Office of Disability I found a government position that allowed me not only to get my salary but to also work all those extra hours and for about two years for honestly for the for the first two years I came into that position when they were really really struggling for staff in fact to be honest four and a half years later we're still struggling for stuff but those first two years we hustled man at the team that started with me just hustled we were there every day 12 hour shifts man five six days a week and we were just hustling we were getting a hundred hundred and ten hundred and twenty hours per fortnight and no I wasn't sleeping much I was working but I had that vision in my head from way way back way back that I want to get financial freedom want to buy my first property and that is all I cared about so you know it made me happy to go to work it really did because I knew I had a vision I had a goal I was working towards it and I was loving it I was loving life I was loving seeing my bank balance finally start going up I wasn't living week-to-week anymore you know the first week the first pay check that came into my account where I didn't actually think for a week beforehand oh shit I can't wait to get paid can't wait to get paid to look at my account and see shit I got paid and not actually have to think about it because you're comfortable now it's amazing it really was an amazing feeling so from there guys here we are four and a half years later after two years of hustling my ass off in that job I was able to save enough money to buy my first property and how did I do it first thing I had to leave my current position I had to leave my my comfort zone of administration I moved into a new field I found a job that I could hit some overtime I found a job that I could get penalty rates I found a job that suited my life suited my gym you know schedule suited my sleeping schedule with the shift work and I just went went for it I did at the same time I was learning I was learning learning learning I was watching podcasts you know at the time I was doing cardio for you know cutting body fat and every single time that I went for a walk every time I went for a run I'd always put on a property investment podcast and I gotta say I learned a shitload off of two channels one is an Australian guy called Nathan Birch be invested and another one is an American channel called bigger pockets which is a podcast even just just getting your head around the real estate jargon you know different words you know conveyance a rental return landlords insurance everything like that you know body corporate understanding things so then you can sort of start researching properties you can look at properties you can look at the numbers and you can start doing your research you know and once you've got that deposit in the bank it is scary it's scary putting that much money into an investment that you don't exactly know what's going to happen but look at history guys you know history repeats looking historically at the Australian property market it's gonna continue going up so that is the investment vehicle that I've decided to use for myself going forward anyways first property I bought when I was 24 and a half my second property I bought when I was 25 I'm 27 years old right now I've just had my first daughter and we're on the way to buying my third so I've taken a little break the last couple of years in fact geez even with all that overtime that I'm talking about where it has slowed down a bit I sort of after the second property I took my foot off the gas a bit because I had you know I tied myself out man I really had so now I'm sort of getting my you know getting my life back into a bit of a schedule I've got my daughter Tate I've got my girlfriend we're living in a nice house right now it's time to start hustling again that really is so going forward guys just know that my financial goal is to buy a third investment property now the last thing that I want to mention if I left without having told you this I'd feel like I let you down the fact is is that yes the big banks are the ones that you see advertised all the time they're probably the ones that offer the lowest interest rates as far as loans go but the big banks are never going to be able to give you that one-on-one customer service they're never going to know your name you know all you're going to be to the big banks the big four is a statistic and that's not what you want when you're talking about home ownership when you're talking about investing your hard-earned cash you know if if anything you know I'd want you to go to a broker for a start someone you trust if you don't know a broker personally and you don't know someone who can sort of shop around for you I'd say go to a smaller bank if anything if you don't know anyone the banking industry if you don't know anyone the broken industry go to a smaller bank go to go somewhere where you can sit down with a bank manager the bank manager doesn't have a huge you know portfolio of clients you can actually sit down someone local and and start talking about it say what do I need what do I need to buy a property what do I need to buy this property you know even just do a bit of research grab a property take it in say what do I need to buy this particular property run through the numbers with the bank manager you'll leave there with an answer right there's no point in guessing in this shit there is no point because you just sit there going round and round in circles wondering wondering wondering do I have enough money how much money do I need blah blah blah blah blah go to the bank find out and start moving towards your goal I'm sorry I've been waving around this pen but it actually helps me talk believe it or not so anyways I want to say I hope you enjoyed the video I hope you got something from it if you are looking at buying your first investment property or you're back at the stage that I was back in New Zealand you know it's all it's all a journey it's all a stage of life all right you'll get that you'll get that but don't take too long because property value is only going to continue to go up so with that said guys I'll see you in the next one


BSU women they're looking for the weekend sweep over RIT first period they're on the power play Haley Mack to Emily Berglund who sneaks it in for the goal one-nothing home team freshman Kerrigan Dowey got the start in net made some big saves including this breakaway and a couple rebound attempts that'll keep it one-nothing then the second a great series for defense defender Alexis Joyce an absolute blast from the point her third of the weekend BSU by two they had a pair of three goal scores this series the other Haley Mack this one right out front for her own rebound third straight win for BSU as they get the weekend sweep three won the final from Saturday if you've enjoyed this segment of Lakeland news please consider making a tax deductible contribution to Lakeland Public Television


Our Bomber Task Force is our new regular way to employ bomber forces throughout the world. Bombers are the most responsive, flexible option that we have when it comes to needing to deploy forces in a quick manner. It is a very diverse group of troops that we have out here with us. Everything from the standard maintenance and ops folks to logistics gives us an opportunity to work together in a fashion that we normally don't get to work together back home. Under the Bomber Task Force we're actually able to do that as one cohesive unit in a deployed location. We've gotten a unique opportunity to integrate with a lot of our partners and allies that we don't get to do back home. So we've had a chance to actually integrate with the Kokajita, so the Japanese self-defense force, as well as the Indonesian Air Force and the Malaysian Air Force during this BTF. When it comes to United States, you have no better friend. That's what we're sending to our allies. Through our adversaries, there is no worse enemy than the United States.


Good day. This is the fourth session on the Zambian Tags Benefit Microsimulation Model, MicroZamard. And in this session, we're going to be looking at making some policy changes to the model. So, we'll firstly look at how to add a new system to MicroZamard. We'll then go on to look at how to implement a change to an existing policy in the model. And lastly, we'll look at how to add a new policy to MicroZamard. So, why might we want to add a new system? Well, we might want to add a new system if we're including a new policy here. So, for example, when we implement out 2016 and 2017 policy years, we will need to add two new systems in order to do this. We also might want to add a new system if we're implementing a reform scenario. So, as we'll see in this session, we will have such an example. And in this instance, we will need to add a new system. And it is always good modeling practice to add a new system rather than to amend policies in an existing system as this ensures that the parameters of the existing policy are preserved as a record for that specific time point. So, as I mentioned in this session, we're actually going to be making a reform, implementing a reform scenario rather. And we're going to have to add a new system in order to do this. And this is just so that the parameters of the existing policy are preserved as a record for that specific time point. So, when we make changes to the model, we don't lose any of the existing parameters. So, a new system is always initially a copy of an existing system. And thus, we can use the already implemented system as a template. And this will be our base system. In the first instance, the new system is an exact copy of the base system, except for the name of the output file. And it is also configured to run with the same data set as the base system. And we have two ways of adding a new policy. So, again, what I'm going to do is go through the PowerPoint first and then move over to the live version of the model to demonstrate these two ways of adding a new system. So, the first way of adding a new system is to go to our country tools tab and use the add systems button and then select a base system as indicated on the PowerPoint. Or we could right click on the head of the existing system, in this case ZM underscore 2015, and simply choose the first option which says copy paste. So, after using one of these two new methods, one of these two methods to add a new system, we then choose a name for the new system. And in our case, we're going to name our new system ZM underscore 2015 underscore reform underscore one. So, now I'll move over to the model to demonstrate how to add a new system. So, the first way of adding a new system is to go to our country tools tab, click on that and go to add system. It'll ask the select base system dialog box will pop up and it'll ask us to select a base system. We can choose our 2015 system as our base and click okay. And then we can name it ZM underscore 2015 underscore reform underscore one. And we can click on okay. And there we have our new system added to our main workspace. And as I mentioned previously, if we open up any one of our policies, for example, our constants policy, which is number four on the spine, we can see that our reform one system, so our new system, is an exact copy of our base system, which is 2015. If we look at the different values in our constants policy, we see that this is an exact copy. So, that's the first way of adding a new system. And similarly, we could also delete this system using the same country tools tab. And I'm going to do it for this demonstration because I'll then show you how to use the other method of adding a new system. So, if we wanted to delete the system, again, we'd go to country tools, delete system. Again, a dialog box will pop up, asking us to select the system we want to delete. We can delete our reform system. If we click on okay, it'll ask us if we're sure we want to delete the system. We can say yes. And our system has been deleted. So, that's the first way of adding a new system or similarly deleting a new system using the country tools tab. The other way of adding a new system is to right click on the base system on the head of the system that you want is your base system. In this case, ZM underscore 2015. Go to the first option, which says copy slash base system. If we click on that, the same dialog box as previously shown will pop up. And again, we can name it ZM underscore 2015 underscore reform underscore one. If we click on okay, again, our new system has been added to our main workspace. And again, if we wanted to look at open up one, any policy, we can see that again, our new system is an exact copy of our base system, which is in this case 2015. And then again, if you wanted to delete the system using the same method, you would right click on the head of the system and go to the third option, which is delete system. But for this purpose, I won't be deleting the system as we will be using it in our example later on. So, that's, those are the two ways of adding a new system. So, as we've just seen in our live version of the model, the new system has been added to the main workspace. And the system has also, has also been added to lists and country tools and the systems and databases. And we can quickly go and look at this. If we go to country tools, which we're already on, if we go to systems, we can see that our new system has been added to the system configuration. If we go to databases, again, we can see that our new system has been added over here. So, there are a number of policy changes that one could make to the model. We could either make a change in existing policy. And we could do a simple change, such as amending a means test threshold or cash transfer amount. We could do a more moderately difficult policy change, such as removing a means test or adding an extra amount for meeting a specific criteria. Or we could do a complex policy change, such as varying the means test and amount by a certain characteristic. The other kind of policy change that we could make is adding a new policy altogether. And we could do this by adding a new social benefit, for example. So, now we're going to look at an example of changing an existing policy. And it'll be a fairly simple example using the turnover tax policy. So, the policy TTN underscore ZM specifies the conditions under which individuals are liable to pay turnover tax. So, the current rules state that individuals with a turnover of less than 800,000 quattro per year are required to pay 3% of their total turnover in tax. So, those are current rules. So, what we're going to do and the policy change that we're going to be making is we're going to increase the rate of turnover tax from 3% to 5% and also increase the threshold for the tax from 800,000 to 1 million Zambian quattro per year. So, this is how our policy currently looks, our turnover tax policy. We see that we have our first parameter, which is our comp underscore count, which is our eligibility, which simply states that YTN, which is income from turnover, has to be greater than zero. And it has to be less than the upper limit for turnover tax, which we know is 800,000. So, once an individual has been identified who has to pay turnover tax, they then pay 3% on their income from turnover. So, if we multiply YTN by 0.03, that is the amount that individuals have to pay in turnover tax. We then have our output variable, which is generated, which is TTN underscore S, and all of this is done at the level of the individual. So, if you'll notice here, we haven't placed our turnover tax rate in our constants policy. Instead, we've put it in the actual turnover tax policy itself. Now, it isn't incorrect to do this, but it's always good modeling practice to put the any rates and amounts in our constants policy, as opposed to in the actual policy. So, there we have our upper limit for turnover tax, which is 800,000 Zambian Kutcher per year. So, we're going to look at the steps of how to make a change to an existing policy on the PowerPoint, and then we'll go over to the live version of the model and then go through these same steps again. So, the first step is to copy the latest system, which is our ZM underscore 2015 system, and name it ZM underscore 2015 underscore reform underscore one. And if you'll remember, we've already done that when we added our new system. Then, we're going to introduce a new upper limit and rate as constants. If you'll remember, the 3% wasn't a constant, but the 800,000 upper limit was. So, in this case, we're going to introduce both of these amounts and rates as constants. And how we're going to do this is we're going to go to our const def underscore ZM policy, go to our def const function and right click and add two new placeholders. We will then rename these placeholders to dollar TTN underscore upper underscore limit underscore reform underscore one for the new upper limit. And then, similarly, for our new tax rate, we will name this dollar underscore TTN underscore rate underscore reform underscore one. And once we've renamed our placeholders, we will then place the values in the ZM underscore 2015 underscore reform underscore one system. As 1 million quadra per year, so the hash Y indicates that it's per year for the new upper limit and 5% for the new rate. So, we can go to our model and implement these first three steps because we've already added our new system. So, we've added our new system and named it reform underscore one. So, our second step is to go to our constant's policy, open that up, go to our def const function, right click on that, go to show add parameter form, click on placeholder because that's what we want to add.  So, we'll open our def const function, right click on that, go to show add parameter form, click on that, go to placeholder, if we take that and in the count column, we can put two because we're adding two new placeholders. If we then click on add and then close this add parameter form and go back to our def const function, if we scroll down, we'll see that two new placeholders have been added. So, if we go back to our steps, we said that we would add two new placeholders, we've done that. Then, we said that we would rename these placeholders to dollar TTN underscore upper underscore limit underscore reform one for our new upper limit and TTN underscore rate underscore reform underscore one for our new tax rate. So, we can go back and do that. So, most importantly, all our constants, whether they are rates or amounts have to begin with the dollar symbol as per Euromod naming convention. So, our new upper limit for our reform scenario will now be called dollar TTN underscore upper underscore limit underscore reform underscore one. You can just click on enter and that's been added and then we will rename our new rate and call it as if you remember that we didn't add this initially to our constants policy, but we're going to add it now. So, most importantly, to start off with a dollar TTN underscore rate underscore reform underscore one. If we can click on enter and now that's been added, we can just make this a bit bigger so we can see it. So, we've now added our two new constants and renamed them. So, our last step now is to place the values most importantly in the ZM underscore 2015 underscore reform underscore one system as 1 million quatcha per year for the new upper limit and 5% for the new rate respectively. So, we can go back and do that. So, our new rate. So, most importantly, we have to add it to our reform one system. Otherwise, we'll be changing the values of our base system. So, if we click on that, remove the NA and add one million. So, it has to be a hash Y for million. And we can just leave a comment to ourself to remind us what this is and why we did this. So, this is our new upper limit for turnover tax reform. And similarly, we'll now add our new rate, which is 5% and we can just put 0.05 for that. And then again, this is our new rate for turnover tax for reform one. And really, the comments are just for you to remember what you did so you can put any kind of comment to yourself. So, those are the first few steps of making a change to an existing policy. So, now I'll go back to the PowerPoint. So, we've been through the step already where we've right click on our def const function. And so, you'll see in the PowerPoint that we did this under our existing upper limit for turnover tax. But it really doesn't matter where in the constants policy, your reform or your change to your policy goes. So, we saw this dialog box where we added our two new place holders. And then we had to rename them. And we renamed them TTN underscore upper underscore limit underscore reform one and then TTN underscore rate underscore reform underscore one. And most importantly, all of these have to start off with the dollar symbol. So, after renaming them, we then place the values in the reform one system. So, now our final step is to go to our actual turnover tax policy, which is number eight on the spine and then make the change to our policy. So, I'll do that now. So, we can close this and now go to our TTN underscore ZM, open that up. So, if we go to our reform one system, you'll see that it's still an exact copy of our 2015 system. But now we've changed the amount and we've called it something else and we've also changed the rate. We've put it in the constants and we've called it something else. So, we need to amend these two parameters. So, the first parameter starts off by saying income from turnover has to be greater than zero. In other words, someone has to be earning an income from turnover or earning turnover or making a turnover rather. And the second half of the condition states that the income from turnover has to be less than the upper limit. And if you hover on this part of the condition, you can see that the upper limit is specified, still specified as 800,000 per year. But we know that this has changed. So, we're going to click on this and then delete everything up to that point. So, we could have written this whole policy from scratch, but we could also just simply replace the upper limit with the new upper limit for our reform. So, we know that we've placed it in the constants. And in order for the model to pick it up, we have to start off with our dollar symbol. And then as soon as you do that, you'll see that it'll give you a list of amounts and rates and things that it thinks you're looking for. So, remember we renamed it TTN underscore upper underscore limit underscore reform one. So, there it is. So, if we click on that, that's our new upper limit. And there it is. So, our next part of the policy that we must change of the turnover tax policy that we must change is our comp underscore per tax unit, which is currently taking turnover, income from turnover and multiplying it by 0.03 in order to get this output variable TTN underscore S. But we know that we've changed this amount and we've also put that in our constants. So, we can delete the 0.03. We can keep the multiplication because we still want to multiply income from turnover. But again, if we start off with our dollar symbol, again, it'll give us a list of things that it thinks we're looking for. And if you remember that we renamed our rate TTN underscore rate underscore reform underscore one, if we click on that. So, that now states that individuals must have turnover and that's less than the upper limit, which is one million. And this turnover is in turn multiplied by 0.05. If you see, again, if you hover over this condition, you see that the new rate for reform one is 0.05. And so, those are the first two parameters. And then the output variable, which is generated is TTN underscore S and all of this is done at the level of the individual. So, now I'll go back to the PowerPoint. So, as you can see, those are the changes that we've just implemented. Now the new turnover tax policy states that individuals must earn a turnover, so their income from turnover must be greater than zero. And the income from turnover has to be less than the new upper limit for reform one, which is one million quattro per year. And then we take this income from turnover and multiply it by the new rate for reform one, which is 5% or 0.05. Then the output variable which is generated is TTN underscore S and all of this is done at the level of the individual. So, that's how we make a change in existing policy. So, now we're going to look at adding a new policy and specifically we're going to look at adding a universal child benefit. So, this example, we're going to introduce a universal child benefit of 140 quattro per month for children under three. And we're going to follow a few of the steps will be similar to the ones we've just done for changing existing policy. So, the first step will be to copy the base system, which in this case is ZM underscore 2015 and name it ZM underscore 2015 underscore reform underscore two, because we can't have the same name for different for more than one system. So, first we need to choose where on the spine the new policy should be located. And then after we do that, we need to right click on the policy before the one we want to introduce and then select add policy after. So, if we go to the model and just implement these first few steps. So, we can close that up. So, first we have to add a new system. So, again, I'm going to use this time I'll use the country tools tab and add a system that way. And then again, our base system will be 20 ZM underscore 2015. We can click OK. And now we're going to rename our system ZM underscore 2015 underscore reform underscore two. So, you'll now see that the system has been added to our main workspace. A handy tool for rearranging systems is if you wanted to rearrange these two systems to ensure that the one came before the two, you just click on the reform two system and just drag it to the right. So, that's just how to rename and to rearrange and reorder systems on the main workspace. So, now our second step is to choose where on the spine we want to add our new policy. So, as you can see, we start off with our definitional policies. We then have one income policy, which are poverty lines. We then have two social insurance contribution policies. And then our tax policies, another social insurance contribution policy. And then our benefit policies. So, we could add a universal child benefit. So, we could add our universal child benefit after our farmer input support program benefit. So, if we right click on that benefit, which is called BOT underscore ZM, and go to add policy after and it's a benefit policy. So, click on benefit, we then asked to name our policy. And because this is a benefit for children, our policy has to follow the Euromod naming convention. So, it has to start off with the broad category of the policy. So, if it's a benefit, it'll start off with B, as that's the broad category of variable of variables for benefits. And then, since it's a benefit for children, the next two letters that are going to follow the B will be CH, representing that it's a benefit for children. And then, most importantly, it has to be followed by underscore ZM, as it's a child policy for children in Zambia. So, we can just, once we've named it, we can click on OK. And there, our new policy has been added. It's now number 15 on the spine. And then, we can just name it under the comment section, so we know what it is.  So, if we go back to the PowerPoint now, we've done, we've right clicked on where we wanted to add it on the spine, on the policy after which we wanted to add it on the spine. And then, we just said add policy after, and it's a benefit. So, now we need to name the policy BCH underscore ZM, as I've already explained why. The policy name is named after the output variable. Next, we right click on the new policy name and select a function. And in this example, we're going to be using the function BenCalc, although we could have also used a combination of Elge and Arithop. And then, most importantly, we have to turn the policy and the function on. Otherwise, the model won't run it. So, if we go back to our model, if we go to our BCH underscore ZM, right click again, we're now going to add function. And I've said that we're going to add a BenCalc, although we could have added a combination of Elge and Arithop. So, if we click on BenCalc, and most importantly, we have to switch both the policy and the function on. And we have to do this for our reform two scenario because this is where we're making our reform. So, we can go back to the PowerPoint now. So, we've added our function, BenCalc. Now, we're going to go and complete the criteria, the eligibility criteria for the policy, as well as specifying the amount of the policy and specifying the output variable and the tax unit. So, I'll do that on the model and then we can look through the PowerPoints and see how this has been done. So, my first step would be to add the benefit amount, the amount that we're going to assign to all the children that are eligible to the Constance policy. It's quite easy to forget to do this, so I always tend to do it first. So, if we go to our ConstDev policy, open that up, go to our Devconst function, right click as we did with our turn of attacks reform, go to show add parameter form, go to placeholder, you can keep the one under the count column because we're only adding one placeholder this time. If we go to add and close that, so as you can see it's been added to the very bottom of our ConstDev policy and then again we will rename it and in this case, we can call it BCH because it's a benefit for children and call it amount because it's the BCH amount and just underscore reform because we know it's a reform and maybe underscore 2 because it's our reform 2. If you click on enter, now we have to fill in the amount under our reform 2 system. So, we said that we're going to give every eligible child 140 kW per month and then we can just leave a comment to ourselves saying this is the universal child benefit amount reform 2. So, that's quite an easy step to do but also quite easy to forget. So, I always tend to do that one first. So, now we're all done with that constants, adding our constants, we can close that policy up. Now we can go to our actual universal child benefit policy. So, now we can specify our eligibility criteria. So, we said that we want to give children age between zero and two years and if you use the data requirement document, it'll specify that the variable for age is called DAG. So, in order to type in that condition, we first have to start off with our curly brackets and then type in DAG which stands for age and we said age between zero and two so that'll be greater or equal to zero. We can close that, that's our first half of our condition and again DAG less than or equal to two because we said all children aged under three which also means children age between zero and two years. So, we can close that up and again we can write a comment for ourselves saying that children aged under under three years old or we could have put children age between zero and two years. It effectively means the same thing. Our next step is to, so that's our comp underscore con parameter which is in essence our eligibility criteria. Our next step is now to fill in our comp underscore per tax unit which is our calculator in a sense. So, the comp underscore per tax unit we had said that we want to give each child 140 quattres per month but remember that we had specified this in our constants policy. So, if we click, if we start off with our dollar symbol it'll give us again a list of amounts, rates, upper limits that it thinks we're looking for and remember we had named our amount dollar bch underscore amount underscore form underscore two. So, if you click on that that's the amount that each child is going to be allocated and again if you hover over that you can see that it says dollar bch underscore amount underscore form underscore two which is equal to 140 per month. So, that's the amount that the that each eligible child will receive. Again, we can write a comment and say something like each child is allocated the relevant amount or any comments that you want to write to yourself. Our output variable we've already specified this is bc, we've already spoken about this rather is bch underscore s to indicate that this is what is going to be simulated and then we can write a comment again this is the output variable is called bch underscore s and lastly we have to specify our tax unit and this is the individual and then again our comment could be the calculation are undertaken at the level of the individual. So, that's a big part of implementing a new policy. There's still two other important steps that we have to do before we can say that we've finished and we've implemented a new policy but I'll just go back to the PowerPoint and go through the steps that we've already undertaken. So, our first step was to introduce bch amount as a constant and call it dollar bch slash underscore amount. So, we've done that. The next step is to introduce a new output variable using the variables tool if necessary. So, this wasn't necessary in our case as this variable has already been specified. Now, we need to add bch underscore s to the output policy if necessary. Again, this wasn't necessary as this has already been specified in our model. So, most importantly the final steps that we need to take is we now need to add the new benefit to ills underscore bensim which is simulated benefits and ills underscore bch and this is needed for the statistics presenter which will be covered in session five of these videos. So, in order the reason why we do this is so that these two income lists to which we're going to add this new benefit are needed in order for the stats presenter to work. So, if we go back to our model, so we need to add we need to add them in two new income lists. So, our income lists are our second policy on the spine. So, we need to add them to simulated benefits and if we go to that income list and open it up and we So, we'll first add our new benefit to our simulated benefits. Our income list called ills underscore bensim and again we'll do this in the same fashion as when we added our constants is we'll add a new placeholder and then rename this placeholder. So, then we'll go to show add parameter form tick placeholder again we only need one in this in this instance close that and here we have our new placeholder which we have to rename and the name of our new simulated benefit will be bch underscore s as we've already stipulated in our policy and then most importantly we need to put a plus sign under the reform two scenario so that the statistics presenter knows to add this to the list of simulated benefits when making its calculations. So, that's the first half of adding our new benefit to the income lists. The second half is that we'll see if we go to our if income is 2.13 and if we go over to the comment sign we comment section we see that this it says define income list child benefits child benefits in the statistics presenter. So, we also need to add this new benefit to this child this specifically child benefits function in order for the stats presenter to work and you'll see that we have a range of other benefits under this so we have social assistance benefits in the stats presenter we have widows and orphan benefits which we have not in Zambia but we need for the stats presenter we have disabled benefits so once you've added once you've made a reform and in effect if you've added a new a new benefit you have to add it to the simulated benefits income list first of all and then to only one of these income lists in order for the stats presenter to work. So, if you've implemented a benefit for disabled people then you would have to add it to the disabled benefits in stats presenter as well as simulated benefits as we've already done and again in order to do this we'll simply right click on the the name go to show add parameter form again put one placeholder add this close this up and then again we have to rename it and we can we know that it's going to be called bch underscore s and again we have to put a plus symbol under the reform 2 system in order for the stats presenter to know to calculate this when it's performing its its calculations. So, if we go back to the PowerPoint so this is what I've just explained on the live version of the model once we've added a new benefit in the form of making a reform so once we've made a reform scenario and we've added a new benefit for example we need to add the new benefit to simulated benefits first of all which contains all simulated benefits and then to one of the income lists for the stats presenter and as you can see these are mutually exclusive so you can only add it to one of the income lists. So, after we've made all our changes we save the changes to the model and we I'll show you how to do this and we'll go to the first tab which is save country and the differences between the base and the derived system can be highlighted and we can do this using a tool called automatic conditional formatting and I'll speak about this in our last session and then the last point is that the reform system system is run in the same way as other systems and we'll output the same variables unless a change is made to the output so unless a change is made to output underscore std underscore zm policy then the reform system is run in the same same way. So, we can go back to our model now and save our changes if we just above where it says country systems databases we can click on that little button and go to save country and then we've saved all of our changes and that brings us to the end of the session. Thank you very much.