This is going to be Electro Vault, poning popular desktop apps while uncovering new attack services on Electron. So, let's put it together. Good afternoon, everyone, and thanks for coming to our talk. Let me ask you this. Have you ever wondered how secure it is to open a message within the desktop app you used to chat with your colleagues at work? Have you ever wondered how secure it is to open a source code, which you just downloaded from the internet within your favorite source code editor? What do this electron-based desktop applications have in common and how fundamentally secure are they? Before a year, we set out to find an exact answer to discover what lurks beneath electron applications and throughout the course of one year of our research, we were able to find flaws in more than a dozen iconic applications used by millions of people and uncovered new attack surface within Electron. Hereby, I welcome everyone today to Electro Vault, where I will take you on a journey to hone popular desktop applications while uncovering new attack surface on Electron. So, for the agenda of our talk, first of all, I will start with what is electron and the basics of electron. Then I will explain different security settings which Electron provides. Then we will hack real world applications starting from the least restrictive to the most restrictive settings. And then I will disclose a novel flaw which we discovered within Electron.js framework and at the end, I will end it with mitigations. So, let's get started. So, who are we? I'm Aditya Purani, aka Napstack. I'm a senior security engineer at a leading automotive company. My main areas of expertise are application security and blockchain. And on the weekend, I play CTFs with Perfect Blue. Joining me today is my colleague Max, aka the Grand Pew. Max is a security researcher at Asset Note and he has expertise in application security and blockchain and Max plays CTFs with Waterpeddler. We have two other research members who were not able to join with us today on the stage, but I would like to introduce them as well. So, we have Mohan, aka Sirius, who is a security auditor at Cure53. And we have William Bowling, aka Vax, who is a senior software developer at Biteable. So, let's get started. So, what is Electron? If you can build a website, then you can build a desktop application. That's the main concept behind Electron. Electron is a popular open-source framework used by multiple iconic applications, such as Microsoft Teams, Discord, Slack, and others. Electron is built on top of Chromium and Node.js, which means that by just using HTML, JavaScript, and CSS, you can ship an entirely cross-platform native desktop application. So, before diving into the bugs, it is really important to understand the architecture of Electron. So, for Electron, there are two types of processes. The first one is the main process and the second one is a renderer process. So, main process is the starting point of all the Electron application. Main process can create multiple renderer process using a class known as browser window. On the other hand, we have renderer process, which is used to render web pages using Chromium. And as Chromium is used, a lot of Chromium-related features are involved as well, such as Chrome multiple process, site isolation, and others. It is important to note that there can be only one main process, but there can be multiple renderer process. The way the main process and renderer process communicates with each other is through IPC or inter-process communication module. As you can see in the diagram on the left side, we have a Node shared library. These are the Node primitives, which are provided to both the main process and the renderer process. And as it is not secure to provide Node primitives to the renderer process, we have something known as browser window web preferences or security settings to limit the exposure of Node primitives. So, let's look how this all will look in a code. So, here we have a main process and first of all, we create a browser window with multiple web preferences, which are security settings with either true or false Boolean value. Then we load a URL, which is Google.com, and then we define an IPC event listener known as OpenURL, which will listen for this OpenURL channel and invoke shell.openExternal with the argument. On the other side for the renderer process, it is divided into two parts. The first one is preload.js and preload scripts contain code that is loaded prior to the web page. So, this script run within the renderer context, but are granted more privileges by having access to electron and Node.js APIs, so it can import a Node.js library here. Context bridge, which you see here, is a way to safely expose an API to the web page, which can be later accessed using window object. So, let's see how the web page would look like. So, here we have a web page for Google.com, which was just loaded by the main earlier, and it's a hello world web page where it uses window.electron.openURL and passes an argument to invoke that channel on the main process. So, as we noticed in the main process, we can set multiple security settings to describe what type of renderer process we want. So, if the security setting is, for example, Node integration is true and sandbox and context isolation is false, then it is the most insecure you can get. In this case, XSS is equal to RC. So, it's not a good idea to use this setting. Electron developers also thought about the same, and they came up with a solution, and the solution was to introduce a new feature known as context isolation. So, as you can see in this diagram, there is a slight change compared to the previous one. Now, we have two different contexts. The first one is the application context, and the second one is an isolated context. So, application context is the space where your web page JavaScript would run, whereas the isolated context is where your preload and Electron's internal JavaScript code would run. So, now we have a good segregation between that layers. So, in this situation, the node primitives are only exposed to the isolated context and are not reachable by the web page. And this is a similar concept used by Chromium Browser as well, where it is known as isolated world, where the extension which you install in your browser, its content script JavaScript runs on a different side compared to the web application JavaScript. So, there is an isolation there. So, throughout our talk, the attack surface would be the renderer process, and we will be start by abusing the least restrictive configuration and then move on to the complex exploits. So, to keep the slides clean, let us keep following terminologies in mind. So, I talked about node integration, context isolation and sandbox, but don't worry right now about node integration in workers and node integration in subframes. I'll talk about it in the coming slides. So, first situation, everything is red. Node integration is true, context isolation is false, and sandbox is false. In this case, it is very easy to get a shell as node is directly exposed to the renderer. So, a web page can just do require child process and exec their own shell command. So, the only thing you need to do as an attacker is to find a way to embed your JavaScript within the web page. So, again, we return to our schematics and the circle which is mentioned in the red is the area which we are targeting at this point. So, let's take a look at a real world case study where we were able to abuse this specific configuration to get RCE. So, we will look at VS code, remote code execution, which bypasses the restricted mode. So, VS code is a very commonly used source code editor. And when you open a project within VS code, it will prompt you that you wanna load this project in a restricted mode or you wanna open it in unsafe mode. So, this particular RC which I'm about to demonstrate will work on a restricted mode of a VS code. So, the bug here is we were able to find an XSS in markdown which was subjected to very strict CSP and electron policy and we were able to chain it with multiple bugs to get an RC on an insecure window. So, let's see how this works. So, this diagram is the entire exploit chain for VS code and here you can see three squares which I marked with different color. So, there is one with green, orange and red. So, the square which is marked in green is running with the most tight electron configuration which is the most secure. And our goal is to somehow go from that green to red. The red one is the one which is running with node integration true, which is the most insecure configuration which I talked about earlier. So, how do we do that? So, if you know on VS code when you open a project and when you load a markdown, it is not rendered by default. So, first of all, you need to create a malicious project and create a folder known as dot VS code. Within this folder, you can create a JSON file which is settings.json and you can enable markdown previewer. So, as soon as this project will load, it will not just put a code block but it will render the markdown. So, once a markdown is rendered, you can put your own JavaScript to get XSS but in the first window, the markdown previewer window, it is subject to a very strict CSP policy where on the script tags, it is subject to nones. So, unless there is a way to leak nones, we cannot embed a script tag. So, what we did here is we perform a meta redirect which is a way to redirect to an external site within the markdown. And once it redirects to our own site, it is not subject to that CSP policy. So, we can run arbitrary JavaScript. We also use an attack known as XSS leak in order to leak the origin of where this XSS execution was happening. And this leak provide us access to extension ID of VS code. So, if you have used VS code, there are multiple extensions you can install. And these extensions come with their own unique identifier which is a GUID string which is not guessable. So, we need to leak it. So, we leak that in the step number one. And step number two, as we land on attacker.com website, we can get an XSS on the second protocol frame which is VS code web view. So, there is an XSS vulnerability within the extension VS code web view protocol frame. And we use this XSS to make another post message to the top layer protocol frame which is VS code file. So, we send a post message known as channel do read. And what this will give us a response is it will give you the user directory where this project is running for. And this is important for the reliability of the exploit because you need to know where the user has downloaded it on their file system to perform further exploitation. So, once you leak this user directory, what you can do is you can perform a redirection to VS code file protocol which works similar to file protocol. Like if you have used file, ETC password to read a file. But the catch here is this protocol can be invoked from any origin, unlike the traditional file protocol. So, what we do is we do an attack which is VS code hyphen file colon slash slash. And then we perform part reversal with dot dot slash and append this directory which we have already leaked earlier in the previous step. And then we render an HTML page which does top dot require child process and get access to the node module because that is the window which is running with node integration through. So, let's see how this exploit would look like in real world. So, the victim has opened VS code here and now they will try to open our markdown. And as you can see, a calc is popped and that is our demo for the VS code, remote code execution. So, we received a bounty for $6,000 from Microsoft for this remote code execution bug. And the main takeaway is that if you are a developer for an electron app, it is important to consider all your windows as a part of the threat model and apply the most restrictive settings on all of them rather than just one of them or two of them. So, let's switch gears a bit and increase the restrictiveness a bit more. So, here we have context isolation is true. And as context isolation is enabled, node is not directly available to the renderer. So, we cannot use an exploit like the previous case where we just require a node library. So, there are two ways to exploit this situation. So, as you noticed here, sandbox is false. So, we can use a Chrome V8 renderer exploit. So, you can go to CR bug, find a crash proof of concept or a full blown Chrome and run it. Or you can find a way to disable context isolation somehow and that I will show you how we did in the coming slides. So, within our diagram, now we have two different separate context. XSS is on the application side and the node and electron API resides on the isolated context. So, there is enough segregation at this point. So, case study two, we will talk about Discord RC. So, Discord was using electron version 12.14.1 which was an older version when we tested on the latest Discord version. But it also means that it is indirectly using an older version of Chrome, which is Chrome 83. We found XSS in one of the video embedded in Discord. So, if you have used Discord when you chat with someone and you send them a YouTube link, it will expand and someone can click on that link and just watch it within Discord, the YouTube video, rather than going to the YouTube website. So, we were looking for embeds to figure out what sort of vulnerable embeds we can find and we were able to get XSS in Vimeo, which is another famous video sharing service. And we exploit this XSS and perform our attack. But the problem here is that iframes or embed in electron are sandboxed by default. So, we cannot just simply run a V8 exploit and perform our exploitation. So, what we did is we dig deeper into the Discord source code and we abused electron misconfiguration to open new window using window.open and this new window was loaded with sandbox disabled. And now we can easily navigate to the attacker site and run our Chrome V8 exploit. So, let's say Discord RCA. So, the malicious actor is gonna send URL to the victim and victim will try to interact with the URL. And as you can see, a new window has opened. This is without sandbox and we have this sandbox payload here, which is gonna pop a calc. So, we were awarded around $5,000 bounty for this bug in Discord. And Discord fixed it by upgrading to the latest electron version and also fixed this new window opener bug. So, next time when it opens a window, it will be open with a sandbox enable. And most of you might be knowing about this issue of running a renderer exploit to exploit electron apps, but what I'm showing you is that it is really common to have this in real world electron applications. So, for our next case, we have node integration to false. Sandbox is true in this case, but this time the context isolation is false. So, as sandbox is true, sandbox is enabled on the renderer process. So, we get the protection of Chrome Sandbox, which uses setcomp on Linux or Win32K lockdown on Windows. So, node or modules are exposing the renderer because node integration is set to false. But now, as context isolation is disabled, there is no isolation between the website you load and electrons internal or preload code. And let's see what I mean by that. So, in the diagram here, previously we had two separate contexts, but now the electrons internal code, preload and application all run within one single context. So, what can we do here? Because electrons internal code is running JavaScript as well. So, can we do something like prototype pollution and overwrite certain JavaScript function? Let's see. So, how to get a shell? So, if electron version less than 10 is used, then you can use a prototype pollution gadget to leak a remote or IPC module. So, according to electron documentation, remote module is used to bridge JavaScript objects from the main process to the renderer process. So, when you leak a remote module, even in a sandbox window, you will get access to node primitives. From electron version 10 to 14, electron developers thought that remote module is a very dangerous feature. So, they switched its default value to false, but developer can still go out of their way and enable it. So, you can do the same. You can use prototype pollution to leak remote or IPC. And most of the time, remote module is disabled because developer do not do that in this common apps. So, you need to find some sort of IPC misconfiguration to leverage it to RCE. Let's look at the third case. So, electron version greater than 14, which are the newly electron versions. In this case, remote is completely deprecated. So, there is no feature called remote, but developers can still do an NPM install electron slash remote to install it, but it is really uncommon to see that. So, what we do here is we leak IPC module, and our goal is to find an IPC misconfiguration within developer-defined IPC channel, like OpenURL, which we saw, or Electron's internal IPC channel. So, this is the novel prototype pollution gadget we discovered for the late-test electron version. And the concept of prototype pollution on context-disabled window was first proposed by Masato Kinugawa in 2018, but that exploit was working on the older electron version, and this one would work even on the late-test one. So, what this exploit does it, I overwrite certain JavaScript inbuilt properties, like Ends, Width, and Call, and on number three, I get access to Wepec Require, which contains all this node electron modules which you can use to pop a calc in your favorite apps. So, for a situation where sandbox is false and context isolation is false, you may be wondering why not just run a V8 exploit, but with prototype pollution, with Wepec Require, you get access to node primitives, and you get access to Electron Common API, which can be easily used to pop a calc. So, the benefit for using a prototype pollution compared to a V8 exploit is that here, you don't require any binary exploitation skill. It is a complete web attack. The second one is it is more reliable compared to, for example, a V8 exploit which can be more of a heap massaging in certain cases. And the third one is what if the app which you are targeting is using a very latest electron version, which doesn't have any Chrome and within the patch gap. So, this will be helpful. But let's return to our original case where sandbox is true. Let's see what we can leak. So, in this case, we don't have access to node or Electron Common APIs like previously, but what we can do is we can leak Electron's internal IPC bindings. For example, IPC renderer and IPC renderer internal. So, the IPC renderer is used to invoke developer defined channels, whereas IPC renderer internal is used to invoke Electron's internally defined channels. So, let's see how we use in a real world app. So, what I'm gonna talk about is a local file read in Microsoft Teams which leads to account takeover. So, Microsoft Team was using an Electron version less than 15. We found an access in renderer using a zero-day in CK editor which is used for rich text formatting for markdown. And what we noticed is when you create a new window similar to Discord, context isolation is disabled and sandbox will be enabled. So, as context isolation is disabled, what we can do is run the prototype pollution gadget, leak the IPC using XSS. So, once we leak this IPC bindings, we were not able to find any misconfiguration within developer defined IPC in Microsoft Teams. But, we were able to notice a misconfiguration in Electron's internal IPC. So, Electron has this IPC channel known as native image create thumbnail from path which takes a path and reads that file and gives you an output. Think of it as a local file inclusion or local file read. So, what we were able to do is, in Microsoft Teams, we were able to read desktop config.json, which contains user-specific property including the JWT token of the user. So, let's see how the expert would look like. So, here, the XSS is triggered. And as you can see on the attacker's website, they have access to desktop config.json. It is a bit small to read, but this is a content of the file which contains the access token of the users. And with that, they can compromise the victim's Microsoft Teams account. So, we received $3,000 bounty from Microsoft for this issue. Let's move on to the last scenario where everything is green. So, this type of app runs with the most secure settings and it is used by most of the application. So, node integration is false so you cannot get node primitives directly on the webpage. IPC cannot be leaked because context isolation is enabled and it is fully sandboxed. So, to hack this is the main part of our research. So, in the diagram, we are right now in the sandbox renderer and this is the most safest configuration possible in Electron today. So, at this point, you might be wondering that in this case, XSS in an Electron app would be same as XSS in a browser and the answer to that is no. The reason is that Electron apps are not same as your day-to-day use Chromium browser. Electron app is a combination of Electron, native C++ code and Chromium code. So, can we somehow find a way to abuse this intersection between Chrome and Electron and subvert all the security features possible? Let's see. So, we move on to enabling node integration in subframes from a compromised renderer which is a CV which was assigned to our findings. So, let's first talk about what is node integration in subframes. So, let's say you have a web page which is called example.com and within this web page, you create multiple iframes to load another web page. Now, let's say if you want to provide this iframe access to node primitives or preload APIs, then how would you do it? The answer to that is enable a feature known as node integration in subframes. So, once you enable this feature, all your child windows or subframes will have access to node primitives or context bridge exposed API. So, for every subframe, if your parent page example.com has node integration enabled and sandbox disabled, then node JS primitives will be available within your iframes. If node integration is disabled and sandbox it doesn't matter, enable or disable, then all your preload or context bridge exposed API will load within the iframe. So, let's take a look in the code to understand it a bit more. So, main process, here we have node integration in subframe set to false. Renderer process we defined open URL channel, just like the first example. And this is our main window which is google.com. What it does it, it creates an iframe with a URL porn.af. And then it access window.electron.openurl. Works fine. But when you try to access window.electron.openurl from the iframe, it's gonna throw an error. Why? Because node integration in subframes is disabled. This case, let's turn it to true and let's see what happens. So, here iframe will have access to that context bridge exposed or preload APIs and is able to invoke it successfully. So, most of the time when we get accesses in all these apps, it is usually in embeds. So, for example, if you saw with this code we had an access in Vimeo embed. And in this case, a node integration in subframes is mostly disabled because developers again, do not go out of their way to enable it. So, it's a bit sad because you don't now have access to context bridge exposed API. So, what can we do here? Can we still hack it? Let's see. So, let's take a deep dive into how node integration in subframes is enabled in Electron. So, Electron patches a blink web reference and adds security featured flags. For example, it implements node integration in subframes by patching this file. And this is the code where that entire logic of enabling and disabling a feature takes place. So, if you are able to read or not, there is a file which is under a directory known as shell slash renderer. It's a renderer folder. And this file contains a code in which the area marked as red has something like renderer frame where it gets access to blink web preferences and then access like a property which is node integration in subframes. And based on the value of it, one or zero, it's gonna enable or disable it. So, if you are paying careful attention, you see that this feature and all these checks were implemented on the renderer side and not on the sandbox side. So, if you can use a renderer Chrome V at exploit and set node integration in subframes to one, then it should be able to enable it. So, let's look at an annotated version of our binary exploit. So, here on number one, we get access to the web preferences offset in the memory. Then we add this static offset to get access to node integration in subframes and then we overwrite its value to one from zero, which means enabling it. Let's see where in real world application we were able to find this. So, Element is one of a commonly used texting app and it was using Chrome 91 and Electron 13.5.1. We find an access on embed through a deep link misconfiguration and as we had access on embed, no context bridge API was exposed to embed. So, we run a Chrome renderer V8 exploit for Chrome 91 to expose context bridge API on embed. So, this is the code of Element. Here, they define a channel on main.js known as user download open and whatever the argument is passed, it goes inside a dangerous node.js function which is shell.openpath. This is a dangerous thing for arbitrary code execution. On the other side on the preload, it exposes a send method to the web page and which you can pass any channel and argument to it. So, as a diagram, let's go from sync to source. So, main.js contains our RC sync. Preload.js contains send method. Your main website of Element has access to window.electron.send, but your XSS doesn't have access to that API. So, with your exploit, what you can do is you can run a multi-stage exploit. For the stage one, you run V8 exploit and send node integration in subframes from zero to one, which enables it. And on the stage two, you create an iframe within your first iframe and this second iframe will load with node integration in subframe true, so it will have access to that send method which you want to get that code execution. So, this is the code version of the exploit and I create an iframe within iframe after enabling node integration in subframe. So, this will create another iframe and that's gonna pop a calc. Let's see how it looks like in the demo. Attacker is sending a URL to the victim. Victim is opening in the browser. They're gonna open in Element app. So, it's a video conference. Everyone wants to join a video conference. So, let's tap on join conference. And as you can see on the console, this is where our exploit is running behind the scene. It takes time to perform this heap massaging and calculating all this offset. And as you can see, we popped a calc. So, we received $3,000 bug bounty from internet bug bounty program and they fixed this entire electron specific feature by not exposing this context bridge IPC to child renderer process. So, if you do the same in the latest electron version, you won't be able to get access to window.electron.send within the iframe inside your iframe. So, second we move on to disabling context isolation, the most coveted feature of Electron.js from a compromise renderer. So, same story, Electron defines that on the renderer side as well. In the code, we again go to shell slash renderer folder which is a renderer side code and it gets context underscore isolation variable in step one from blink web preferences for a renderer frame. And then on the step two, it has a boolean which is should create isolated context which is based on the value from step number one. And at step three, there is a if statement. If it's true, then enable context isolation. If it's false, don't enable. So, same story, use a v8 Chrome renderer exploit and set context underscore isolation from one to zero. So, our annotated exploit would look the same as the previous one. We get access to context isolation in the memory and then we overwrite to zero from one. So, let's take a look at our final case study where we found RC in an undisclosed app. This app was using Chrome 94 and Electron version 15 and it had a feature to embed untrusted content within iframe. So, the code looks like this. On the right, we have the main.js which defines the same open underscore external channel which goes into dangerous node.js sync. On the left, we have a preload.js of which implements a wrapper and has a function known as is allowed URL. This is allowed URL function. We'll check whether a URL starts with a file protocol which is HTTPS. So, if we try to use a similar exploit as previous, it's not gonna work because we were passing like file path to calc.app. And in this case, file is the protocol, not HTTPS. So, let's see what we can do here. So, schematics, again, if we try to run the node integration in subframe exploit, we have access to open external URL API which was defined on the preload but still it will be subjected to the HTTPS check. So, how can we somehow directly make a call to the main process from our iframe? Let's see. So, here is our exploit. On the stage one, we will run a vate exploit to change context isolation from one to zero which means disabling context isolation. Then we perform a redirect after that step has happened and we load a stage two which is another page on your attacker website. And here we perform a prototype pollution attack which I showed you in the earlier slide for CI disabled windows. And this prototype pollution will leak you IPC bindings. And once you have access to this IPC binding, you can make a direct call to the main process using IPC.send with that particular IPC. So, here we are making a direct call to the main.js. So, this is our exploit. This is how it looks in the code. So, this is the disabling part. We redirect to leak.html. We perform our prototype pollution and we do an IPC.send with two arguments within the first is channel and the second is file part to calc. So, let's see how our exploit would look like. So, this is that famous undisclosed app running over exploit. So, as you can see, it is calculating certain offsets and then it is gonna perform the same thing which we had in the previous example. So, this will be its log. And as you can see, now we have access to the click me, which can pop a calc. So, we received $5,000 bounty for this bug for this program. So, now we will take a look into same site origins spoofing. So, for example, this is your shiny new electron app and it is loading a web page known as main.example.com. This web page creates two iframes. The first one is youtube.com and second one is sandbox.example.com. So, let's see how the process are created within electron apps. So, it creates a separate process for youtube.com but it uses the same process for main.example.com for the sandbox.example.com. And this happens because Chrome has a feature known as site isolation and site isolation doesn't apply when your top level domain are the same. So, in this case, the common between the main and sandbox.example.com is the example.com top level domain. So, Chrome uses the same process of both page. So, in this case, if you are exporting a real world app and you have access in sandbox which is on the sandbox.example.com process, then what you can do is, within a Chrome renderer v8 exploit, you can change document.url to main.example.com and security context origin port to 443. This way, you will be effectively able to masquerade to your parent window and are able to access all the context bridge exposed APIs or node primitives which are available to the main window. So, this is one way to do this. So, let's talk about patch gap. So, as we noticed in a lot of this real world applications, we have used Chrome v8 renderer exploit. You might be wondering, is it really very likely to use a v8 exploit in all this real world app? And the answer is yes. And this stems from the fact that there is a noticeable patch gap between Chrome, Electron and Electron applications which makes most of them susceptible to this attack. And an adversary or an attacker can also go one step further and can use sandbox as for Chrome. But here, which I showed even with a renderer exploit, you can do a lot of stuff and just defeat the entire ElectronJ security features. So, let's talk about the mitigations. So, for the developers, I would suggest that enable all the security features because a lot of this bugs which we submitted to ElectronJs frameworks were fixed promptly by it. But there is a design flaw which is present in the ElectronJs framework which allows you to access these features from a renderer process. So, this flaw is currently still present. So, even with a renderer expert today, you can disable context isolation, for example. But ElectronJs developers have took enough step to not expose APIs, for example, in node integration in subframes which prevents a few of our exploits here. So, if you are using an app, make sure to upgrade your Electron version very regularly. So, if you are a developer who is always keeping up with the pace of this Electron releases, then you should be pretty much safe for this patch gap and it would be narrow. And if you have an organization who can maintain your own fork of Electron, you can cherry pick this V8 fixes and can deploy it there to be one step further. So, another important aspect is to don't use a third-party embeds on your website. We saw that the failure point with Discord was to use Vimeo embed, for example, here. So, make sure that you use pretty trusted embeds and even if you use, make sure you have enough defense in depth because that embed can lead to like a code execution in your own app. So, be careful about that. And the last suggestion here is to mitigate vulnerabilities across all your assets. So, even if you have subdomains, as we saw that you can use an access on subdomain and then just go back to the main window using the same site exploit. So, that should be the part of our mitigations. So, as a part of our epilogue, what I wanna mention is we were able to compromise 20 different electron applications. These are used by millions of people. And some of the examples which I didn't show in the talk are JupyterLab, Mattermost, Basecamp, Notion, RocketChat, and others. So, for our takeaways as a part of this talk, I wanna emphasize on three key points. The first one is related to bug bounty hunters and security researcher. And it is to dig deeper into the framework which you are auditing and to not limit yourself to the application layer. So, in our research, we didn't stop on just the JavaScript side of the things on Electron, but we took a look into how these features were implemented and what are the possibilities to tamper with those. So, go as deep as possible when you are auditing these sort of frameworks. The second one is Electron apps are a very ideal adversarial or red team target. As you can see all this app discord element, you just send a link and it just requires single click and some of our exploit even doesn't require a click and you can gain a system level shell on the operating system. So, users are gonna open the link, they are going to join conferences and they are going to click on certain stuff. So, this is really important and if you are on the detection team or blue team, it is important to also consider Electron's app as a part of your threat model and see it as a same entry point as any other asset you have in your organization. The third one, if you are a developer, minimize attack surface on your application as much as possible. So, Electron is not bad. I would say if you are implementing and doing all the base practices, it is still gonna provide you and guarantee you security features, but you need to work towards that. You need to minimize this attack surface. So, a good example to this is a textbook low-level attack known as open URL redirection, which is a PFI on a lot of bounty program. In Electron app, if you find open URL redirection, you can redirect to your own website and you have control to the window and then you can just run this Electron exploit to gain RC. So, who knows, some days open, sometime open URL redirection in your app can lead to RC. So, please pay careful attention to your assets as well. So, at the end of this, I would like to thank everyone for coming and viewing our talk and for your attention, time and interest. And if you wanna understand in details about our findings, we have created a website which is electrovol.io. And within this website, there is a menu for blog which opens blog.electrovol.io and there you can find proof of concept and this exploit code for the use cases which I mentioned here. And we will be also updating this site time to time to include all the 20 use cases and Electron.js specific flaws. So, with that, I conclude my presentation here and thanks again for coming to see ElectroVolt.


Good morning, everybody. I'm Tommy O'Brien, coming to you live from TfNN headquarters in St. Petersburg, Florida, 10 a.m. Eastern time on Friday, 30 minutes into the trading day. And we've got markets starting off to the negative side after quite a GDP number coming out of 3.2% far above expectations. But when you get into that number, it might not be as rosy as it may seem. Market reacting. S&Ps, negative by 5 points trading at $29.21. NASDAQ right now, negative 50 points trading at $8,068. And the Dow, negative by 48 points trading $26,415. Gold catching a bid up $7 at $12.8720. Oil pulling back from some of those recent gains off a buck 30 at $63.91. Dollar, a little bit of negative action off 204 ticks at $97.15. And we're getting some lower yields, higher price. 10-year yield, excuse me, 10-year note, up 9 ticks, $123.21, 30-year bond up 16 ticks, $147.21. We'll start it off. Let's get over to the futures markets. We'll start it off with the Dow. So there's your volatility on that GDP number. And we'll get over it. Why don't we get over to it right now? Because that's driving a lot of the action this morning. Growth of 3.2% topping forecast. The number that they were looking for was 2.3%. But when you really get into it, consumer spending, biggest part of the economy, rising slightly above forecast of 1.2%. And then when you look at personal consumption expenditures, the price index excluding food and energy slowing to 1.3%, well below the 2% objective. So nonetheless, jumping back to the charts, you'll see a little volatility on that number. We do spike higher, but the Dow, right back to where we were, we spiked from 26,000 above 380. We trade up almost 100 points. We're right back to that level. NASDAQ 100, quite a sell-off, 77.61. You're talking about 80 points in the last about hour. S&P is much the same. We spike higher from 8am up to 29.32. We give back about 10 or 11 points pretty quickly. There's your pullback in crude, trading at 63.74. Gold contract, catching a bid. Gold trading at 12.87. And Euro US dollar with a little bit of a dollar weakness. Euro strength, Euro trading 11.55. Stay tuned, folks. Come back at 10 o'clock with Tom. Then, of course, we have fast market TD Ameritrade at 11. Basil Chapman, Steve Rhodes, Dave White, Tom O'Brien all this afternoon. Stay tuned, folks. Have a great Friday.


Hi guys, this is Jason Zach from Nathaniel School of Music. In this lesson, we are going to focus on a couple of exciting things on the piano. First of all, chord voicing for the left hand. I think there are some nice strategies in this video which can benefit you greatly to make your chord sound a lot more deeper, a lot more richer, powerful, at the same time very expressive and very unique and you could also argue very jazzy or that sort of a thing. And in the right hand versus the left hand, we are going to coordinate our hands with a very simple arpeggio which I have developed as you heard in the intro video. We are going to play that arpeggio in two different time fields. Time field is essentially how you divide the beat. So we will do it in sets or divisions of four, we will do it in sets of many things actually and then divisions of two, three and four and then organically try to grow some awesome music together. So you need to bring your keyboards out and learn with me as it's a step-by-step workflow. So I am first going to talk about the chords, the voicing in the left hand, a few alternative options in the right hand and after we look at the lesson from a chord voicing or a harmony perspective, we will then look at it from an entirely rhythmic perspective. And the rhythmic perspective is also intended to help you improvise your own stuff. In this lesson we are tying ourselves down to just the four notes which I am going to show you but in the future you can always go forward with this in many different ways. And hand independence on the piano can be practiced in so many forms. You can do bass in the left hand, you can do melody in the right hand, you can sing and also train your hand independence. You can do chord patterns here, arpeggios there. There are so many permutations of hand independence and it's a widely searched topic as well on the internet. So what you could also do at the end of the video after finishing it of course is head over to our playlist which is in the description on hand independence and you will find a lot of learnings on those subjects. And we also have a lot of topics on voicing of chords. We have spread voicing wherein we again focus on the left hand territory and we look at other open voicings used for jazz music and blues music. So there is a lot on our channel if you are a first time visitor and if you are new to the channel or if you are old to the channel or whatever be the case. If you haven't subscribed to our channel it will be awesome if you could hit that subscribe button and turn on the bell icon for regular notifications. And all of the notes for this lesson are neatly saved on our Patreon page. You can head over there and you'll find pretty much all the notes for this lesson and stuff we've done in the past and also what we'll be continuing to do in the future for just a $5 subscription a month. So let's get started with the lesson. I hope you've got your keyboards out. So first of all the right hand is going to play a simple C F G B flat. You could play it above or you could play it low up to you. Let's start above which is the C above middle C this is middle C this is the C above middle C. What do we call this chord? Theoretically you could call this a C7 sus4. The left hand is going to produce three chords and I'm going to explore those chords in three different complexities which will stretch out your hand more and more.  However I would encourage you all to consider playing basketball or a sport which might widen your hands. Just kidding or maybe not. Who knows? Basketball actually helps. I'm not an expert.  The hybrid minor scale is a scale wherein the six can either be a flat six or a normal major sixth and the seventh can be a normal seventh major seventh or a flat seven also known as a minor seventh.  So then you can pull in chords from all these different intervals and play them together. So C minor, A flat major and F major however we are not going to play the chords like that. The voicing technique number one would be a sparse voicing using seventh chords. So C minor I'm going to play it as this C, G, B flat. Now you could either go C, G, B flat or you could even add in that F whenever you feel it doesn't sound so muddy or so you know annoying maybe to the ear. This sounds good actually so you could stack over an F but if you find your fingers are a bit tense you can ignore that F and just do C, G, B flat. So the notes would be C, G, B flat, C, G, B flat with an alternate C, F, B flat. So you could either play C, F, B flat, C, G, B flat they both sound good. So C, F, B flat could be a quartal voicing of the C7 sus4 chord. A C with G and B flat could be a C minor 7th or even visualized as a C7 sus4 with a sparse voicing. By sparse I mean you're ignoring one or two notes of the chord. So this is C minor, originally you would play it like that right but this is a bit muddy and sounds a bit bad down below as well. So this is a nice way to open it out, this is a nice way to play it as well. Then when we come to A flat major, instead of playing it like this I'm going to play it like this A flat, E flat and G that would be root, perfect 5th, major 7th and no 3rd. You could also refer to this as A flat major 7th in brackets, some people write no 3. So there's no 3 there because I think 3 will again make it quite muddy and maybe a bit tricky on the fingers so you can get the same similar color without that C. I think this is nice. So chord number 1, C7, then A flat major 7th, no 3 perhaps and the third chord would be F dominant 7th. Now F dominant 7th you could play like this 1, 7 octave but a colorful way to play it would be 1, 5, 7 flat, 1, 5, 7 flat, F, C, E flat okay. So I'm going with this as the initial voicing strategy. So you have C F B flat or C G B flat and then you go A flat E flat G and then F C E flat F dominant or if you wish you can also do F E flat F, it's not so colorful so you could do this. So let's do this with the right hand playing a simple arpeggio or 2 simple arpeggios. The first one would just be semi quavers where you count 1 E and 2 E and 3 E and 4 E and with that chord I taught you earlier C F G B flat so C F G B flat C F G B flat semi quave 3 4 1 and the left hand we can play the pulse 2 3 4 1 2 3 4 1 and if you observe the left hand there's a little bit of a chord structuring going on. I'm playing the first chord because it's the root or the tonic chord. I'm playing it a bit longer so I'm playing C minor for 4 counts 2 3 A flat major 7th for only 2 counts F dominant for only 2 counts so 1 2 3 4 1 2 3 play it with me I'm gonna do it very slowly and go 2 3 4 1 2 3 4 and again 2 3 4 1 2 3 4 and if your right hand gets bored doing semi quavers it can then start doing another time field which is called as triplets. That will be 3 4 1 and 2 and 3 and we can say 1 and 2 and 3 and 4 and or in India we say taqita and if you want some variety in the triplets you can do C F B flat or you can do C G B flat or you could do a combo of both C F G F G B flat so it's a package of 3 it still feels like a triplet so again 1 2 3 1 2 3 1 2 3 1 this will also be nice if you're playing faster triplets like semi quaver triplets 16 no triplet right let's go to normal quaver triplets or eighth no triplets next chord A flat major 7th then F dominant 7th let's do that again with the left hand normal quaver eighth no triplets may flat major 7th F 7th 7 sus 4 major 7th dominant 7th with that sparse voicing of no third ideally except for the C 7 sus 4 which you can play all four notes come to think of it or without the G or without the without the F okay so you can do semi quavers or triplets in your right hand and coming back to the left hand so voicing strategy number one was what I could call as a within the octave voicing strategy where you're never going beyond that high C but now voicing strategy is moving forward will expand our hand a bit more so first chord in in the original style what we learned first chord number one chord number two chord number three that would be C minor 7th or C 7 sus 4 A flat major 7th F dominant 7th now as we journey forward what you can do is open out your voicing more by doing what we call as fifth voicing or quintal voicing or what I would also call as ninth voicing where you go one five and then the second degree of the root but played an octave higher as we play it an octave higher we call it a ninth because a ninth when played an octave higher generally wants to believe or assume that there'll be a third somewhere and you don't want to clutter it up by playing it inside if we played inside the sound would be very muddy so we call it a nine for various reasons I guess the main reason is because there's a third and a seventh in the chord or more specifically a seventh so all of the chords now let us voice using ninths one five nine that's C G D you could also locate it as two perfect fifths around the circle of fifths in clockwise direction C G D A flat A flat E flat B flat and then F C G okay C G D A flat E flat B flat F C G very open and you can play this you can play this very low it's also very modern rock or heavy heavy guitar music you'll find them voicing the chords generally this way as it's cooler I guess otherwise your one note lesser or one note in this case your one note more than creating a power chord this is a power chord which I think is not so colorful while this tells a story and you can even play it lower it's very open so all my chords now with the semi quaver in the right hand let's try all ninth chords or you could call them add nine chords without the third try it with your triplets back to semi semi quavers 16th notes and I like this kind of open style of playing chords because theoretically you can compose on either you can say Dorian or Aeolian in this kind of context Dorian would be a major scale with a flat 3 and a flat 7 so you can do which is a flat 6 that makes it Aeolian that also kind of works because you're not committing to either A or A flat in this voicing right so that's voicing strategy number two guys and voicing strategy number three will really stretch out the hands but gain a lot of the jazz intervals out there so that would be the first chord C minor would now be played as root flat seven and ninth so this would be a C minor ninth or some ninth chord I could probably call this a minor ninth because I'm in a minor world so C minor ninth and now the A flat chord could be played as this voicing now this is a ninth but there's a six also so we call this as a A flat six nine chord it's a six nine voicing and then F I'm going to play it as a F dominant chord with the dominant seventh and the ninth there it's you could look at it as an F ninth but in the left hand you don't have the I guess the budget to play that many notes or the bandwidth to play that many notes because of the frequencies colliding with each other so it'll if you were to it'll sound very muddy so this is a simple way of playing it so you could say third chord is F ninth without the third and the fifth or no three no five so first chord I'd leave it to you I think you could even now combine the voicings together the first chord you could perhaps just keep playing like this because your right hands anyway is doing that just to keep it kind of clear or unified you could perhaps play the first chord like this and whenever you you're done with the practice you can open up into the jazz higher voicings okay I'm just going to show you the higher voicings now C ninth and then A flat six nine F nine repeat A flat six nine F nine but without the three and five you could also play it in this sevens us four no problem or this way this will stretch out your hand a bit more you need to stretch at least to a ninth but only a nine that's it's not too too much of a stretch actually and a good way to kind of get this stretch a good trick would be to move your entire hand away or away from the keyboard or towards you and if you observe my thumb my thumb is just clinging on to the D a lot of people think that you should play the keys here not necessarily you can play them here sometimes you can play them inside you can do all sorts of things at the end of the day the key is just a trigger for an eventual hammer which whacks the strings of the piano and then resonates on the through the soundboard so your job is to somehow trigger that hammer you can do it with your thumb all the way down or in worst case scenarios you could also perhaps use your nose perhaps so you this would be the extended voicing and then you have F nine and then that A flat six nine chord there so let's go through all the voicings we have and then move on specifically towards rhythm so voicing number one within the octave C sevens us for A flat major seventh F dominant seventh without the three of course voicing strategy number two the quintal or the fifth voicing with perfect fifths or you can call them as ad nines very open sounding C ad nine A flat ad nine F ad nine the third voicing which is more jazz using the jazz extensions like the nine and the thirteen would be the one seven flat and nine voicing then the six nine voicing for the left hand and then the back to the seven nine for F nine could call this as an F nine so that's about your chords that's about your voicing so moving on to the second half of the lesson which won't be that much theoretical it's just going to involve rhythm maths and how you can coordinate your two hands so there are two ways of generally doing things on a musical instrument whether it's melody chords arpeggios or whatnot first off you need to divide the beat by something you divide by two you divide by three divide by four five or whatever and then after you divide we tend to have some obvious packages of notes which are created that would be at the division rate for instance if I divide by two I also want to play my notes in sets of two if I divide by three I play my notes in triplets in sets of three if I divide by four I want to play probably semi quavers which is sets of four but this whole lesson is going to kind of take our mind away from that and that's going to improve your independence on the piano as people call it so your left hand is going to keep keep things very simple we'll just do the pulse three whatever voicing you enjoy two three four and the left hand I'm not going to talk about the left hand anymore we've looked at a lot of options so it'll just be the right hand with respect to the left hand now so I showed you the general division system between the right and the left hand already to some level first off we had semi quavers semi quavers then triplets one two semi quavers one okay so that's your division system so you can divide by two you can divide by four you can divide by three I'm not going to divide by two maybe we'll do it later but let's start with the notion of dividing by four and let's take the same semi quaver idea we are saying one e and a two e and a three e and a four e and a one e and a two so this is dividing by four but playing a set of four notes and that set is you could argue subjective because all human beings could value a set differently a set of data but this is made very obvious because of the physics of what's going on that is pitch is changing in a very periodic way it's low higher higher highest or even if it was highest lower even the lowest that also sets up a mental pattern of four groups of notes right one two three four one two three four one so the whole idea in this lesson is to break that notion go against the the mind's natural response but continue in the same world of beat division so I'm going to keep dividing by four one e and a two e and a three e and a four e but I'm going to phrase it differently so we use the word phrase we use the word accent grouping I'm just using the word sets of something so you're dividing by four and in this explanation divide by four and sets of four so there's division of four and a musical performance which is a set of four notes now I want to do divide by four and set of three and that's going to start sounding really cool check this out so if I do one two three one two three one two three one two three one two three in my mind actually and the maths behind all this is one e and a two e I'm still doing a takadimmi dividing by four but now I package it physically on the piano as in threes one two three or you could keep that let me just take cfb flat which is an obvious visual set of three as you can all see but I'm not doing it in triplets I'm not doing that's triplets right I'm doing one e and a one e and a but now keeping that same speed or that same rate of flow and doing three one two three so you could argue you can even count one two three one two three one two three one two three one two three one two three one two three one two three one two and it takes a long time to resolve you need to go back to your fifth or sixth grade maths class and learn up lcm and hcf least common multiple and all of those sort of things to actually understand what's going on or when the two hands actually recycle which is a very interesting fact because if you do three meets five then you need to know the end result where it is 15 three fives are 15 right so one two I could even say but the beat division continues to stay the same and this also is a little bit of a tester for music notation because how do you notate this in an inspiring way for a reader in classical music I guess this the concept of sets sets grouping accents was not so much there but you could still go ahead and put the accent sign but the grouping is usually in force in classical music so at least for me personally it's very tough to read certain things with the sheet notation because it's not inspiring at all and it confuses me because I still look at it as a set of four it's a visual set of four an actual sonic set of three and the maths division of four so that's creating a lot of conflict if you ask me so I would say pause on the reading when you do this lesson you don't need to read too much you just need to play by feel and look at your piano it's one E and your semi quavers but now I take sets of three in the same speed so you want if you want to get this tight with your get it first with your body and say things like one E and a two E and a three and or an easier Indian words now change the takadimi it's very simple takadimi change it to the same speed of takadimi but in the words of takita which is three and automatically your ta becomes a important phenomenon it also creates an interesting polyrhythmic vibe if you ever want to take this into the polyrhythmic world because that's one two three four that's very much of poly so I want to now play it here there we go so what's happening now we've divided by four sets of three and dividing by four sets of four was easy that's what we've been doing throughout the lesson well what about something which maths has to offer which then we have to push ourselves to doing on the instrument divide by four sets of five why not now for sets of five the pinky is sleeping a bit so let's wake the guy up there we go you can add that note with just a simple octave nothing or you can add a D which would make it a nice ninth edition and just keeping it to C for now now one E and a two yeah right one E and a two now check this out making it five I'm saying five for now as it's gonna take a lot of cycles to kind of repeat itself right there we go it's it's a great way to kind of make your arpeggio stand out maybe you can use this as an intro of a song you could use it as the bridge of the song and while your entire band is playing some bass notes you know they could all kind of phrase on those specific accents even though internally these are not quintuplets these are not dividing by five these are sets of five this is a human made set of five what was made by mother nature is how the beats got divided right the maths is dividing time by four you cannot control that that that has been governed by mother nature but what we as humans can then do is to make it subjective and use again the properties of physics which are pitch volume and time or duration to craft it to serve our own brain so to speak so we have sets of three possibility I showed you sets of four sets of five you also have the trivial set of two which could also work a bit boring because it's it's anyway dividing by four and two is an even number but if you think about it makes the performance a lot less lazier than this if I now do sets of two here we go and just to conclude the lesson let's flip the whole process around I don't want to divide by four rather I would like to divide by three so let's start with usual good old triplets now I want to do this but have a set in my mind this is sets of three dividing by three normal I guess we've already done this what if we do sets of four and dividing by three one so first say the division and now going one but in my mind we're going we're dividing by three actually right the triplet triplet triplet so I start starting again with triplet now giving myself a set so it'll take three cycles to recycle again to get the number of cycles it would take you use the LCM of the two numbers so if you take three and four LCM three fours are 12 or 12 multiplies both those numbers right multiplies three as well as four there we go now I've become a maths teacher maybe you should invite people here to learn some maths let's go for it so you go one two three one two three one two three four one two three four one two three four one two three four and then of course you have all sorts of other phenomenon you can do dividing by three but sets of two one two three one two three rather two congested so let's do sets of five while dividing by three so that would be again we pull out our pinky so you'll get one two three one two three one two three but with that five feel and why not start with the pinky all through the lesson I've been going up why can't we go down one two three four five one two three four five one two three four five one two three four five there we go other chords the challenge will now be to play each of these chords four times you should remember that or the first chord four times the second chord two times and the third chord two times as we said you almost don't care when they resolve whether if they are well they will resolve mathematically but you don't need to care because you're already in the division world as well as the set world almost together it's almost like you've split your brain into two or you are two people thinking together so to speak so the piano is a is a freak of an instrument if you think about it if ever I were to compare this with anything I would compare it with a drum kit I could not compare it with anything else which I can think of at least so have fun with the exercise and just to recap we've done some voicing in part a and in part b we have done all this sets grouping accents and we've done beat division as well so hopefully you find this useful have fun practicing it and I have an instagram channel as well you can record your work and send it you can tag me and I'll be happy to to share it and listen to it and so on and if you're a patron you can also chat with me send me your assignments you can check out the tires we have and also receive the notes as part of your subscription you'll receive all of the notes for this lesson you also receive midi tracks you receive backing tracks and a ton more right guys thanks a ton for watching the video I will catch you in the next one cheers


the road, simple complex, some might say simply complex, an endless set of beginning and end points, all co-existing as coplanar points on the same plane, interconnected and endless, an arrangement of horizontal and vertical lines criss-crossing at a global scale, so linear, so directional, if you will. Little-known fact, the inventors of the modern road are Thomas Telford and John Loden-McCaddon, and this modern marvel inspired a different kind of route for the joint worldwide intelligence communication system, to harden an existing infrastructure to increase traffic and spanning multiple levels of effort, shaped in a future-driven endeavor, engineered using best practices across commercial and government to deliver connectivity at the edge, an information highway traversing a changing mission landscape, providing information advantage to senior decision-makers and the warfighter, because warfare is no longer purely kinetic, not the physical complex. J-Wix must modernize its complex network architecture to meet changing mission demands, in order to collect, disseminate and protect information from our adversaries, a Herculean effort, yes, formidable but also achievable, an important labor impacting how to prevent and decisively win wars, capable of transporting us and vast amounts of mission data designed to support for the future, while securing the present, drawing from our past and propelling us into the future, yes, it's a transport resilient, redundant and secure, a road like no other, the J-Wix network is modernizing for the future. Herculean