Hello everybody, welcome back to another Photoshop tutorial. In this one, I'm going to show you how to work on the same image or the same document in two windows at the same time. What am I talking about? Let me show you here. I just grabbed the brush and I'm going to just say hi. And you're going to see here that as I work on the left side, it shows up on the right side at the same time. And vice versa, if I go to the right side here and I grab a circle and I draw a circle, something like that. If I zoom out on the left side, well, there it is, guys. How do I do it? It's not too hard. Let me show you from scratch. I'm just going to go ahead and delete this. And here is an image. I'll delete that too. Why not? Okay, cool. So here's an image, lioncloud.psd. The first step, and I'll just leave the hi there and you'll see it in action. The first step is you want to go to Window. You want to go to Work. Pardon me, Arrange. Come on, Curtis, use your words here. Arrange. And then you want to go right here. New Window for the name of the document. I've only got one document open. So that's what it's going to do. It's going to open up a new window for it. Nice and easy so far. You'll see here up at the top now that we've got it open twice. Now, the next step is you go to Window. You go to Arrange and then you can make a choice. You can do Two Up Horizontal or Two Up Vertical. I'm going to go with Two Up Vertical, but you can go Horizontal if you like. And you'll see here I've got the same document open at different zoom levels. On the left side, I'm going to go zoom nice right into the lion. And then here on the right side, I'm going to zoom out so we can kind of see the whole thing all at once. Okay, good. I'm just clicking back in between them. Now on the left side, I'm going to go ahead and grab this brush.  I'm going to go Y-O-I-U, something like that. There, you see now that the work I'm doing on the left side is showing up on the right side and vice versa. This is how you can create. This is how you do it, guys. Inside Photoshop, work on the same document too, Windows. Thanks for watching.


Hey Brad! This is Megan with Oxmore Toyota. I just wanted to send this quick video greeting just to personally introduce myself. It has come to my attention through one of our business partners that you're interested in the pre-owned 2010 Mitsubishi Lancer and you have some great news for you so when you can, go ahead and give me a call. You can reach me at<PHONE_NUMBER> and I look forward to hearing from you soon. Bye!


Committee 3 is responsible for the working methods of ITUT. So there are a number of important resolutions, including resolution one that govern our work as well as the entirety of the A series of recommendations which cover many of the more operational matters of our work methods. Number of issues, one as far as participation of various membership categories. There are issues in terms of work methods to try to clarify some of the procedures for the development and approval of many of our documents. Well, we've managed to clarify some of the procedures for development and approval of our documentation. We've clarified some of the responsibilities of TSAG to act between WTSAs in particular to evaluate the implementation of the WTSA resolutions. Well, I think we completed the work based on the proposals we have, but I would say that there's more work ahead. It was clear from our discussions that more remains to be done in terms of clarifying some of our working methods and we've identified areas of further work to be progressed in the TSAG between now and the next assembly. Well, I suppose the key takeaway is that we can be somewhat grateful to be working in Committee 3 rather than Committee 4 because some of the more contentious issues are over there relating to the program of work. But I'm happy that all delegates are able to reach a consensus on a way forward regarding our work methods and how we do actually progress work that we undertake.


It is official! Flighters sniffers and newbies. I'm Marlee McCohen and this is Brando and today We're doing the thing today.  Well, I mean other results gonna be in Officially. Oh, I thought it would take some time.  Yay, and also Megan looks like April O'Neill today. I told you that Well, I would have guessed that as soon as you come and when George comes home, he's gonna be like there's April O'Neill I Luca say hi to the camera. Why are you so rude?  Yes. Oh My god, the sniff of him is completely unreal Smell him from here. You can Brando is going To get his little testing right now. I told him that we are kind of late at the doctor Lloyd's gonna do it, right Lloyd? I'm gonna do it.    I'm gonna get you this ball. Oh my god Why is he the cutest bird in town? You like that? Yeah, don't forget guys We're in the presence of the bird bandit Attacker right here the parrot hero Lloyd knocked him out slammed him into a cage Didn't see that series. You got to go back and watch you'll be mind blown such a big deal It was on PD live. We are in his presence right now. Are you prepared? You know, I like just had my cat my camera sitting here and I was like well if anyone tries to get it Lloyd is here It's fine. I'm really nervous. Oh my god. My hands just got so cold So we just got a letter from Animal Genetics, Tallahassee, Florida. Hi, Florida This has Brando's DNA Results in it. I don't know why I'm nervous, but I'm nervous. I'm just gonna open it Oh my god, okay The moment of truth we find out if Brando is a little boy or a little girl I think deep down we all knew But to see it like really official so exciting on to the next order of business. I Have been tasked with making the box. Here's what's gonna happen. Okay guys I have to make up one of Marlene's feathered sun boxes This is what it looks like before I fold it all what I have to do is Either fill it with pink or blue Vinnie is going to break open the box and open it and it'll be lovely and blah blah blah I don't have all my eggs in one basket so to speak when it comes to Vinnie opening this box I've already told Marlene. I'm just like he better show up He better make a big spectacle of this in order to make an even bigger spectacle I have decided to make it a little more confusing I've learned a thing or two from Marlene and I have really embraced the chaos that is this house What Marlene doesn't know Come here.  Good bird.  I know you know I'm not wearing blue nails because I think Brando's a male I kind of don't want to know because I like not knowing One thing I learned about myself very weird is like I thought I'd be like dying to open the thing All my friends have been trying to steal my phone because it first came in an email and I didn't look at it So today we're gonna find out and if you're a female Maybe Picasso will come back and then you will marry Picasso And they will all make sense And if you're a male then you're gonna look just like Picasso And I'm gonna love you no matter what Oh, this is your special day. Yes, it is Oh, yeah Oh, you hear that? I'm so excited to find out about you mom. Yes Is Brando a male or a female? Male for sure. Really? I can say that Because first of all his name Brando sounds like no, I really think that he's um Male because he just has a male look about him and he has a male personality. No, Aura I'd like him to be a boy. Come on, Megan. Give it up with your eyes I'm not giving anything up, but I'm kind of suspicious that he's a girl. Oh, she blinked twice There done So what? Blinking is a sign of somebody saying that something's a lie. So so what's your conclusion that Brando's a girl Leo pink is if Brando's a girl And blue is if Brando's a boy What conclusion is this? Jenna Is Brando a male or a female? Well, I wanted him to be a boy, but I have a feeling it's a girl Any reason? Yeah, she's more picky. You more like No, okay. Okay. Pit me. Pit me. Okay. I got it. You know what I mean? Yeah Whereas like Picasso may have not May have also not liked being pet in a way like he was resistant for when you put his Your hand over him, but he was more with his body showing it. This one's with her words Oh, interesting. Yeah. Okay. Let us Brando. I don't think we need to ask her like I think she knows She's a male or a female Brando pink means you're a girl and uh blue means you're Okay, so you say you're a female Yeah, okay. Can we borrow those to ask other birds what you are? Is Brando a male? Look or oh, they can't even see color Whichever paw you give me left is a girl Right is a boy Right. So, okay. Give me your paw. Give me your paw. It's a girl. Okay. Dad Is Brando a male or a female? I can ask her. She'll tell me. Okay. Ask her then. Okay. Yeah If not, she's listening from the right hand side Right, she's a girl if she's On the left hand side. She's a boy Okay, look at that now. See See that's a girl Okay, George is Brando a male or a female? Okay. I would love For him to be a male. I don't know why but I feel like we wanted a male, right? But His eyes tell it all He's got the girly eyes. He does those boobly eyes and that very slanted reminds me of cody So I think it's a girl and today in the morning the way he looked at her she or he or whatever How they looked at us out they How they how the the bird looked at us Um, it had that feeling that it was a girl. So I think it's a girl and she has a small head Ask rocky if it's the brand Rocky, which one do you want? Megan is back with another box. Bring it over here, Megan Wow, it's your favorite So you want to chew the box? You chew every box ever Yeah, I think he feels the pressure We're not looking at you, buddy. Don't worry Yeah, you do that Why didn't you put a zipper on that thing? So how's everyone's day? If Rocky bit into the box Rocky doesn't bite into the box Yeah, he'd bite into the box. He loves boxes He's got a small little towel sticking out of it, that made you You're up, bite into the box We should have just made it like a cake and it's a rock No, it's gonna get baked goods in this house Excuse me, I'll show you disappeared Okay, this is gonna put a chunk in it though. We ready? Yeah, good idea Jenna That's who he's watching Hi Maybe you're kind of fired I know what it is. Yeah Do you? Yeah, I know also George, stop peeking, Megan Oh, what? I want to see Are you gonna? No, I don't know I don't know either I can't see That's okay, keep going How can you see 90 degrees? Move over back The new shredder It's blue Yeah Don't in that It's blue Is it boy? Oh my god No, she said oh Crinkle paper? What? Is it a trick? Oh, we wait for crinkle paper Did you do that on purpose? Maybe that's why it took her so long Wait a minute, am I doing only one if she's saying that? Go in deeper I saw something What is pink? It's pink It's a girl Come see pink I do, I think, I think Merlin wants to help This is the longest chance I don't see pink anywhere I think it's beauty service Let Merlin help No Nice rock Oh my god Girl This one Oh, okay The certificate? Yeah, that's cute It is official That was so cute Honestly, that would be a great show That was so cute, Megan Great job with wrapping it Look at Merlin, look what he's trying to do He's trying to do it He's trying to get himself Going out around here Okay He's still breathing Jeez You have a little girl I was gonna say, if it's a boy I would, I'm like, it's a mistake You're gonna have to retest them You're racist It's usually a chance, you know, that there's a mistake, right?  Megan, please make him one of these a day Yeah Like a full size Oh my god It's like all That's what we said at the start You know, we can also make like a baby bird, a piñata For which reveal now? Not just piñatas, but as a toy I'm officially calling it right now She is a she You said it's a Brando? No, it's Brando It'll always be Brando Brando No, Brando is the name He's the name of the... So It doesn't matter It's a last name It's a last name There's a Jeffrey that's a female and a Jeffrey that's a male I'm not gonna lie, I do know Joey that's a female But I know a Justin that's a girl You have a little bird It means we can't be so white Come back By the way, don't forget if you guys are looking for an amazing bird food brand For your bird that is healthy, organic, and not full of food colorings and sugar and peanut smash, check out Marlene's signature blend I did this along with Top's carrot food We just launched in the UK Northern Parrots now sells our food You guys have been asking for it You got it Also, Things for Wings in Canada sells our bird food right now I'm proud to announce and they will ship it to you I encourage you guys to check out my Feathered Fun Box It's a passion project It's a subscription box that comes with parrot toys for your bird And also special merch Kind of like my dream box Honestly, I put so much into it I love that there's something like this for birds out in the world That's why I created it www.featheredfunbox.com I love you guys so so much Thank you for listening


and very useful for our audience. We understand that I think the general technology services, the hardware technology services are related, but you get consulting in your title. Talk about what your charter is, what the role of your organization is within EG. So as you indicated, we belong to the enterprise group, led by Dave Danottelli, and we want to make sure that any customer who buys a product or a solution from the enterprise group gets really satisfied about implementing that product or that solution. So we want to make sure that by delivering the best services possible, close to the intellectual property that we have, that we can make a success of the implementation of the products that are brought to market by the enterprise group. Okay, so help us understand the services within EG. Is there one group? There are multiple groups. So our consulting services, as I mentioned, are really focused on the enterprise group. That means that we focus on service, storage, and networking. And so we provide consulting services on data center consulting, on storage consulting and professional services, networking consulting, and professional services. So very aligned, very focused, because we want to make sure that around those enterprise group products that we are the best in class and that we can help the customer in any way possible. Okay, so tell me. Sorry, there's one thing that I would like to add. In our group, we also take care of the education services for HP and for the enterprise group. So that means that when a customer makes an implementation that we do not only do the installation from a technology services point of view, we do the consulting services from my team, but we also deliver the appropriate training and education services. Okay, in that education, those services are specific to the products, correct? Yep. In fact, we do three things in education. We give courses, trainings on how to use the products. Then we want to make sure that we help people on how to manage a project in that area, but we also give them consulting on how to organize their IT department. Okay, so tell us, where do people need help these days? What are people asking you for assistance on? Well, what we hear from customers, what we hear also from industry analysts is that when customers implement a product without the services that they do not get to the full extent of the capabilities that the products offer. Meaning they don't get the full value, obviously. They don't get the full value of it. The return on investment is not optimal. And we believe that due to the focus that we have on-service storage and network, that we gain experience and that we can share the experience with the customer so that they can get up and running faster but using all the functionality of the gear that they have in ours. Okay. So I'm going to ask about big data, because Meg Whitman talked about big data. That's obviously a hot area and security and big data, but let's take big data first. Hadoop has been a big interest area and a lot of enterprises are kicking the tires. Some are actually putting into production depending upon the vertical financial services, for instance, very aggressive with big data. What are you guys doing with your customers for big data? Because that's an area where there's awareness, there's a lot of active proof of concepts, architectural challenges, where does Vertica fit in, autonomy, what do I buy for our convert systems we had Tom Joyce on earlier. It's like, wow. I mean, just even putting your arms around that kind of blows your mind. Clearly. And so, although I mentioned that our focus is extremely strong towards the enterprise group around service storage and networking, we also understand that our customers want to have a solutions approach. They want us to match the business needs they have with the portfolio that we have available. And clearly, things like clouds, big data, mobility and security are very important items to our customers. And so, we want to make sure that we can help our customers in understanding what new opportunities big data can bring to grow their business or to make their business more flexible. So, big data for us is really one of the components on which we want to consult our customers. Now, when we do that, we always want to do that with an idea that infrastructure is going to be part of the solution and we are going to have that handle, that angle. Now, clearly, what we do not want to do is to come with a fragmented approach to our customers. And so, we understand that it's a combination of the data that they want to access. So, networking is important. You know, the way they want to store it, the way they want to store it, the way they want to calculate it, but also the software that is available from our friends from the software team. And so, the way we work that together is that when we have an overall engagement with a customer, we fit their products and their services in the overall solution. But we always do that with, you know, a total solution in mind, but we come from the infrastructure angle to the solution. So, let's talk about the infrastructure angles. That's kind of key because it's, you know, they're all their own products, but again, Tom Joyce is now a general manager. He has to produce some revenue around cloud systems, cloud technologies, which essentially package everything. It's basically packaging, in my opinion, and bringing that to the market and channel partners as well. Are you going to be involved in that? How much work have you done with Tom Joyce? And obviously, Stargilly has the cloud, converts cloud, which is more and more of an outward facing. But, you know, Tom has to kind of package it, take a little bit from Bethany Mayer's group and networking, grab some stuff from David Scott and Storage, and then bring in service from Potter. So, you know, again, it sounds easy, but not so that's straightforward. And I think that's really where services and consulting services can play an important role. Because, you know, customers are not looking for a product. They are not looking for a hardware product only. They are not looking for a software product only. They are looking for a solution. And to my opinion, you can build solutions by bringing products and services together in a meaningful way for the customer and linking it to the business needs that we have. And so, in the case of big data, what we want to do is we want to give them services around strategy and architecture. We want our customers to know which is the data they want to use, where are going to find it, and how they are going to use it. Then we need to make sure that together with the group of Tom Joyce, that we can build the right infrastructure underneath it. And, you know, it's even broader than what you just brought forward, because also the security element is becoming very, very important, certainly when you talk about big data. And so we want to make sure that you are kind of the glue between what is coming from the software team, what is coming from Tom Joyce team, and then how we bring that together with the security opportunities that we have in the customer. On security, what are the hottest things right now with security, with relatives and consulting? What are customers talking to you about? What are some of the conversations? So, the caveat I want to make there is that the overall security approaches that are needed by a customer are driven by our enterprise systems group or by the enterprise services group. And so what we do is we look at security when it is really close to the server, to the storage or to the network. As you already indicated, we have an extremely broad offering within the company, and I think it's really important to excel in a few elements and then bring it together. So security is really, really important, but we look at it, what does security mean from a storage point of view, from a network intrusion point of view, and from a computing point of view. How does mobile fit into that discourse that you just mentioned? Well, as I indicated earlier, despite the fact that we have such a strong focus on the products in enterprise group from Dave Donatelli, we look at the business from a solutions point of view what is important for our customers. And clearly, mobility is extremely important there. I think when you look at the show, you see everybody walking around with their own devices, and clearly that's something that is top of mind of the CIO, and it's clearly something that we need to address in a different way. So next to the services that we offer around cloud, the services that we offer around big data, we also have a full set of services around mobility. And by the way, we have two experience workshops in the show here, where we advise our customers on how to approach the mobility topic. You know, and I want to ask you about the, you know, you have a global role, right? So I want to ask you about differences globally. North America, Europe, probably pretty consistent, but maybe not. I'm curious as to your thoughts there and how the emerging regions, how are the demand for your services different, whether it's based on skill sets or priorities or maybe an emerging company's governments really trying to build infrastructure. Can you talk about that a little bit? Yeah. And maybe before tackling that question, I'm in a global role before, but I was in a regional role before and before I was in the regional role, I always was in countries with customers. So it's nice to look at the portfolio from a worldwide point of view. It's also nice to look at it from a field point of view, from a customer's point of view. And so to answer the question, I think there are a number of teams that are common across the different regions. For example, when you talk around data center transformation, you see that happening everywhere. But within our data center consulting team, we also have a service that is called critical facility services. And critical facility services, there we help customers on building their new data centers. And clearly we see that there is a growing need on new data centers in those growing countries. So it depends a little bit the maturity of the country, the maturity of IT in that country, the growth that you see on IT in that country on depending which services we deliver. That being said, what we try to do is to make sure that we have a very consistent portfolio that we can deploy across the globe. Because we serve a number of very large international customers. And I think one of the really unique things that HP can bring is that we can bring services in a very consistent way in all the countries where we operate. Whether it's from a support point of view but also from a consulting point of view. And the way we do that, we try to have as much as possible local resources and we complement them with resources that come from third parties, our partners. And then we have a number of top-notch people, gurus that we deploy on a worldwide basis. So a number of things are in common and a number of things can be very specific. And how about something like big data? I mean, do you see a lot of diversity in terms of the uptake and the requirement for your types of services? Is that vary widely by local region or other continents? Talking about big data, and by the way, I think you see that in about every trend that you have in IT. You have a face where the new technology is emerging where people are interested to know what the opportunity is, then it's maturing and then it becomes like everybody is starting to use it. So, and I think we are in a phase where big data, people are getting curious what kind of solutions big data for them can bring. I also believe that customers see that the amount of data they get at their disposal is becoming enormous. One of the things that is really nice to see is that the better customers use the data that is available, from their traditional databases that comes from sensors, from machines, data that becomes available through the net, I mean, the better they use that data, the better their results are. And so it's really important, as I mentioned earlier on, that we understand and that we help customers to identify where the relevant data for them sits, how they can access it in a good way and how they can use it in a meaningful way to bring to the business so that they can grow the business with that. And I think customers see more and more the relevance of that. Yo Han, my last question is information technology by its very nature is risky. It's a volatile industry and technology changes very fast. You've got information risk, you've got compliance issues. What are some of the biggest mistakes that you see customers making in that regard? How should they be mitigating them and how can HP help them? Well, I think it's something that comes back in every way of IT. And I absolutely, I truly believe and that's the reason why I like my job and why I think our team is so important. I think that's one of the, whether you talk about big data where we make important announcements today or when you talk around cloud services where we make important announcements today, I think it's really important that we can sit together with customers and that we can tell them that through our services we can share experience with them so that they do not fall in a trap or that they do not make errors that someone else has made them before. And so one of the reasons or one of the ways we approach that is that in every technology that is new, whether it is big data, whether it's mobility, whether it's a cloud, we organize what we call experience workshops. And in those experience workshops we explain customers what the new technology, what the new opportunity is from clouds, from mobility, from big data. And then from there, from that exploration phase, we can consult them, we can help them to design, we can help them to implement cloud services, we can help them to implement mobility solutions or big data solutions. So to be very specific, I think the investment the customer makes in a service probably is going to have a very strong return on that. Yohan Deshaifler, thank you for coming in and sharing your perspectives on your global business. It was great to meet you and appreciate you coming to the CUBE. Thank you very much. Thank you. This is Silicon Angle, this is theCUBE, we'll be right back with our next guest here. Day two, live coverage from HP Discover, three days wall to wall and we'll be right back with our next guest after this short break.


In the United States, a best-guess estimate presented to the American Hospital Association was about a half million American deaths, with sufficient social distancing that may be reduced to around 100,000. Even at a half million, though it's still unbelievably, could be much, much worse. With thousands already dead, millions projected to perish, billions in lockdown, and trillions lost as markets tumble, COVID-19 is still only shaping up to be a category 2 or 3 pandemic. This is from the CDC's Pandemic Planning Guidelines. The Pandemic Severity Index is fashioned after the Hurricane Severity Index to define the destructive capacity of a storm. Well, this is the CDC's attempt at classifying the destructive capacity of a pandemic. It is based on case fatality ratio, also known as the case fatality rate. The percentage of those who fall ill, who eventually succumb to the infection. In the 1918 flu pandemic, about 1 in 3 fell ill, and of those about 2% died. That made the 1918 pandemic a category 5 analogous to a super typhoon with sustained winds exceeding 150 miles per hour. The rate of those dying from COVID-19 infection is much lower. If you include those who tested positive that were asymptomatic, it's looking like around the mortality of the last two flu pandemics or a bad seasonal flu season. If you're talking about true cases that people will actually get sick, we're talking closer to the 0.5% cutoff between category 2 and category 3 pandemic, meaning about 1 in 200 cases die. As you can see, the 2% case fatality like the 1918 pandemic is just where category 5 starts. COVID-19 shows that SARS-like coronaviruses can escape our grasp and spark a full-blown pandemic. SARS was rapidly stamped out by fever-monitoring travelers, but by the time it was all over, there were about 800 deaths out of 8,000 cases. That's a case fatality ratio of 10%. Thank heavens we're dealing with a pandemic from SARS-CoV-2 and not the original SARS coronavirus. Even more lethal, MERS killed more like 850 out of 2,500, which is a 34% case fatality rate, 1 in 3 chance of dying if you come down with it. Since 2002 with SARS and then 2012 with MERS, we've learned that coronaviruses could become deadly. They're not just the common cold viruses we thought they were. Now with COVID-19, we realize this family of viruses can also explode unfettered onto the global stage. So coronaviruses have already shown us they can do both. It's not hard to imagine a combination of transmissibility and lethality that makes the next coronavirus pandemic worse by an order of magnitude or more. But there's an even greater cautionary tale to be told, which is the primary subject of my new book. We've long known about the pandemic potential of the flu virus, but the deadliest it ever appeared to get was the 2% fatality of the 1918 influenza.  In 1997, a flu virus was discovered in chickens that would forever change our understanding of how bad pandemics could get. So far, it's remained a disease of poultry, not people, but of the hundreds of rare individuals it has infected, more than half have died. A flu virus with a case fatality rate exceeding 50%. What if a virus like that were to mutate to acquire easy human transmissibility? The last time a bird flu virus jumped directly to humans and caused a pandemic, it triggered the deadliest plague in human history. But what if instead of a 2% death rate, it was more like a flip of the coin? The COVID-19 pandemic is devastating, but food is still being restocked in our grocery stores. The internet may be slow, but it's still up. The lights are still on and safe drinking water is still flowing from the tap. Doctors and nurses are still showing up to work. If the predictions are correct and only about 100,000 Americans die, that's less than 1 in 3,000. In the pandemic of 1918, in which 2% of the cases succumbed, 1 in 150 Americans died. Imagine if it were 10 times as bad as 2% with 1 in 15 dying, or 25 times as bad, killing 1 in 6 of us. The good news is there's something we can do about it. Just as eliminating the exotic animal trade and live animal markets may go a long way towards preventing the next coronavirus pandemic, reforming the way we raise domestic animals for food may help first all the next killer flu. We got off easy in the last pandemic. Swine flu only triggered a Category 1 pandemic in 2009, but it showed a new origin point for pandemic viruses, pork production. It was like epidemiological blowback from our globalizing these intensive confinement methods. The unprecedented emergence of H5N1 and the 10 other new bird flu viruses infecting humans around the world has been blamed on industrial poultry production when we overcrowd tens of thousands of animals in these cramped, filthy football field-sized sheds to like beak-to-beak atop their own waste. It's just a breeding ground for disease. This year, numbers of animals, the overcrowding, the stress crippling their immune systems, the ammonia from the decomposing waste burning their lungs, the lack of fresh air, lack of sunlight, put all these factors together. And what you have is really kind of a perfect storm environment for the emergence and spread of these so-called super strains of influenza. That's why the United Nations has urged that governments, local authorities, and international agencies need to take a greatly increased role in combating the role of what they call factory farming, which combined with these live animal markets provide ideal conditions for the flu virus to spread and mutate into a more dangerous form. These so-called CAFOs, concentrated animal feeding operations, have vastly altered the evolution of the influenza virus. The H5N1 virus started out like all bird flu viruses as harmless, waterborne intestinal infections of waterfowl, but only gained airborne transmission in the ramping up of extreme virulence within massive intensive poultry production. Perhaps only a change in conditions as great as 10 million bird mega farms could account for the dramatic series of mutations sufficient to create such a monster. There also seems to be an acceleration of human influenza problems over the last few decades, evolving an increasing number of species and, according to the Food and Agriculture Organization of the United Nations, this is also expected to largely relate to the intensification of the poultry and possibly pig production. Big Ag may be brewing up big flu. For the underlying science, the evolutionary biological mechanisms allow me to refer you to my invited review I wrote for critical reviews in microbiology where I lay out all the evidence. It's free, no paywall. Just go to bit.ly slash flu review. Currently, the CDC considers the bird flu virus H7N9 to be our gravest threat, the virus with the highest pandemic emergence risk and the highest potential impact. An estimate was published as to what an H7N9 pandemic might look like in the United States, and they concluded millions of Americans dead. So far, H7N9 has killed about 600 of the first 1500 people that infected. That's around 40%, two in five people, thankfully. Neither H5N1 nor H7N9 have acquired the capacity for easy human-to-human transmission. But given that both H5 and H7 viruses have displayed the propensity to infect humans, there is heightened concern that they may evolve the ability to transmit between people and initiate a pandemic. They're still out there, still mutating. H7N9 may just be within three mutations away from effectively transmitting between people. Pandemics are always a matter of not if, but when. And a pandemic with more than a few percent mortality wouldn't just threaten financial markets, but civilization itself, as we know it. How can we stop the emergence of pandemic viruses in the first place? If there's one concept to draw from my work on preventing or reversing chronic diseases, it's that, whenever possible, treat the cause. What does the poultry industry have to say for itself? The executive editor of Poultry magazine put it this way, the prospect of a virulent flu to which we have absolutely no resistance is frightening. However, to me the threat is much greater to the poultry industry. I'm not as worried about the U.S. human population dying from bird flu as I am that there will be no chicken to eat. Others are more self-reflective, drawing on his 37 years of experience with the failings in the factory farming model in terms of spreading disease. One industry insider concluded his trade publication article Poultry Reality Check Needed with these prophetic words. Now is the time to decide. We can go on with business as usual, hoping for the best as we charge headlong towards lower costs, or we can begin making the prudent moves needed to restore balance between economics and long-range avian health. We can pay now or we can pay later, but it should be known, and it must be said, one way or another we will pay.


Hey, this is Brett. I'm at the 2020 Chicago Auto Show, and today I'm checking out this 2020 Hyundai Kona in Lime Twist. This is an ultimate package. You can only get this color on the ultimate package. It comes with the paint-in polished aluminum rims. Goodyear Eagle 23545R18 tires. This one has the 1.6-liter turbocharged four-cylinder motor, which pumps out 175 horsepower. This one is an all-wheel drive. And we shoot all of our videos in 1080p, 60 frames per second, so if you have HD capabilities on your computer, tablet, or smartphone device, turn them on right now because it is like you're right here looking at the vehicle with me. And definitely your best way to check out the vehicle without actually being here at the Chicago Auto Show. Pretty good-looking vehicle. Like I said, you can only get this color on the ultimate package. LED running lights. It has like the HID headlamps, factory fog lamps, four-wheel disc brakes on here. Now we're going to check out the interior here. Looks like it has color match stitching and piping throughout. This one has leather seats, part of the ultimate package. Also has the Infiniti sound system, power driver seat, heated seats. You have blind spot monitoring, lane departure warning, heads-up display, and stability control. Gloss black and lime twist trim throughout the dash here. Nice little touch. Automatic transmission, getting AUGS in a USB. Looks like it has adaptive cruise control as well. Bluetooth audio controls. Sure, it's got the nav on here. They always deck these out for the Auto Show. I'm sure it's got a backup camera as well. Pretty comfortable seats. You do get SOS and homelink and stuff in that mirror there. And this one, of course, comes with the power sunroof. Notice the piping around the headrest and on that passenger seat as well as the stitching. These are heated seats. And it's just a power driver seat. Passing your seat is manual. Take a look at the back seats here. I'm actually going to hop inside. Pretty decent legroom. They're six foot, so pretty good. Latch child safety system. Get that piping on the back headrest as well. And these seats do fold down. They look like they go nice and flat from the trunk there. You can see that they do go pretty nice and flat. And decent amount of room back here as well. Pretty neat looking car. Pretty neat color. I'm going to say if you have HD capabilities, turn those on right now. Go back and re-watch the video in HD. Thanks for checking out the video. If you want to check out more HD videos like this one, you can go to our YouTube channel, which is youtube.com. Remember to like, subscribe, and share on this video and all the videos that you see there. In fact, in a second you'll see a link to subscribe to our YouTube channel on your left. A link to more 2020 Chicago auto show videos like this one on your right. And if you want to check out our website on the bottom link to that, click that there. And thanks again for checking out the video. Hope you enjoyed it.


Hi, beautiful. I'm not gonna lie, there is no plan for today's video, but I do have one thing, and that is a flowbee. If you don't know what this is, here's a little recap of how the flowbee was born and what it's done since.  Introducing the Flowbee Precision Haircutting System.  I found this haircutting contraption on Amazon, and it costs me $245. So I'm gonna need to lock my credit card in a bulletproof safe because that is not okay. And wait until you see what I got inside. I think that this is like a very rare like collector's item type of thing. I don't think they make them anymore. I thought I was gonna get at least like a literal vacuum inside since that's like how the thing works. No, let me show you. So let's open this box up and see what we got for $245.  That is it. This is so scary. There are literal teeth inside there. Oh my God. Okay, maybe it was worth $245.  What else do we have in here? We have a little oil for the cutter things inside that look horrifying. And then we have different lengths. I think this goes on there. It cuts your hair. We'll see later. I don't know. I think there's different lengths you can do. And then, oh, we got a charger. Okay, I was only a little bit ripped off. $150 ripped off. Like I would have paid $100 for this. Oh my God, hopefully this is charged already. I'll be really upsetting if it wasn't.  How do you charge this? This is crazy. This is really, really wild. I've definitely spent money on some ridiculous things but this, this takes the cake, baby. Let me turn on. Let's just see what happens inside. I am mortified. I am not cutting my own hair with this. I'm sorry. Also, to make things crazier, it is very loud already but you also have to connect it to a vacuum to make it work. I need to read some directions. Where is the directions? Let me get them, hold on. I found the directions. We have the Floby pamphlet. Love the logo. Living for the 1980s pictures of people cutting their hair. So apparently this only cuts short hair, you know? Which makes sense because those guards are definitely not that long.  I love that nobody knew how to do design back then. Okay, what the fuck? Why did I not get the mini vac? There's a vacuum. It does not come with this. You have to buy it separately because otherwise I read this today. I was like, oh, okay. So it doesn't come with the vacuums.  Hopefully that works. We have to get familiar with the spacers. So basically, it's the keto great haircut is what they're telling me. These come apart, I think. Okay, so this goes where? This goes here. Oh, this is like a tapered one. Okay, this just got really interesting. There's like a little taper on this one. So I think that you can do like your neckline. I don't know, I'm lost. Now I don't know what this is. Oh, that is what it's for. Oh my God, that's kind of fun.  Very, very interesting. Okay, and then this. Why is there two of them? I don't know. This is a lot of directions for me. Can I just figure this out myself? I don't want to read directions today. I'm like really not in the mood like this. Oh, that worked. Oh, okay. Why is there so many things on here? Oh God, did I break it? Oh my God, please no. I just need you to work for the video. Like I, okay, we're good. We're good. No, that doesn't go like that. It does have a diagram showing you exactly how to do these looks. We're gonna go with this one. Before I get to the haircut, where does the word flow be come from? Like flow, okay, like the flow of the hair makes sense, but a B? Flow B, and it's yellow. So I'm guessing it has something to do with it being yellow. The flow B.  So like I don't know, where's the B part coming from? Can somebody tell me? I must know the origin of the word flow B. Let's make sure this thing works first. I have to connect it to a Dyson. I don't think this is how they made it in the 1980s. They probably didn't use a Dyson, but that's what we got here. So I guess this goes into here. That does not fit at all. I think it came with an adapter. This thing, okay, that looks good. And then this goes into here. Okay, it fits. It does not stay in there though. I'm gonna have to do some taping. Hold on, duct tape. For a second, I didn't think I had any. And this was about to go really downhill real quick. But I'm actually impressed that this is working. It turns on, it goes into my vacuum. We're doing good. Okay, how do I tape this though? Dyson, please don't break on me for any reason. This is so cool.  I know that that's obvious.  But like, I don't know. I wasn't actually thinking about it until right now. So don't come after me.  Like literally don't embarrass me. Thank you. Okay, this has just got 10 times cooler with the vacuum. I am so ready for this. This is like really good if this works. All right, we have the contraption down.  And this, this is the one that I think is the strangest.  It works.  I don't know if it's strong enough. Let me put it on turbo. All right, should we try the cut now? First of all though, Miss mannequin has way too much hair on that head. We gotta take care of that. Girl, you're about to be bowled at the end of today. Hi, Miss mannequin, welcome. Today we're trying a new contraption. I know you love when I try new things on you. What?  That's okay. You're gonna learn to love it. Listen, you only get a good two months with me until you get retired. This is your time to be retired. I'm sorry, but you're getting old, Miss mannequin. You've been with me for like a good four months, too long. We're going short today. Okay, because our new contraption, the flow bee, it only does shortcuts. So we're gonna chop your hair off, girl. All right, let's do it. Actually kind of cute. That's a lot of hair. Okay. Oh, edgy. Fun though. Oh my God. Wait, hold on. I'm getting so distracted. See, this is what happens when I don't plan a video. But you guys always seem to love the videos that I literally don't plan anything.  Why is this chic? Let me cut the rest of her hair real quick. We're gonna leave a little length for flow bee, okay? Flow has gotta fix your hair. We can't make it look good. I feel like Edward scissor hands. I'm like, All right, here is her before. We'll get a nice shot of that. Great. Looking bad. Let's see if the flow bee can help. It's time to start flowing. I got the supplies in this minute, Quinn. You ready for your cut? Why is this dead? I just charged it for like 30 minutes. It looks like we're gonna just keep this plugged in as I cut, because I don't know what else to do. Where the hell do I plug this in? Oh my God, there's no battery. You just need to have it plugged in at all times.  I just pissed my pants a little bit. That was so scary. This is gonna be so loud. So apparently this part like goes on top. So this is how they told us to measure it. What is this telling me? I guess we want the length that long. Miss Manny Quinn, you're gonna get what you got today. I don't know.  And then we're gonna taper the back. Should I section it? I feel like no, right? Because people wouldn't have sectioned their hair. Should I section it? No, right? So I just realized something. The Dyson, you need to actually pull the trigger and hold it for it to work.  It'll be really loud.  I don't know how I'm gonna feel about this. Let's go. This is so loud. I hate it. You're actually kidding. It's a joke. I did not pay $300 for this not to work. Does this not work? This is not working. Hold on. I need to cut her hair short because I don't think this is like able to cut long hair. I'm gonna just try it on this section. I am so disappointed right now. Oh, I see hair inside here. It hardly did anything. This is the biggest scam I've ever encountered. Am I doing something wrong? I think I need to actually read the directions.  Okay, update. There's no technique. This is some bulls***. The only thing it says is to like move the thing up and down like that and not side to side. So let's just try and see if anything else happens. It also says to turn the vacuum on first.  I'm so upset. Why does this not work?  Okay, update. It works. I don't get it. I don't know what's going wrong. I think the vacuum's not strong enough. Dyson's are not made to use with hoses like this. Like it's just a little tiny vacuum. My vacuum is not strong enough. We can't change that. So I guess she's going really short because it only works without a guard and that is the only way to work. I guess we're just gonna go like with just this thing on it. I'm scared to touch this. Hi, be nice to me. Thank you. You're going bald, girl.  So update again. It only works if I hand feed the hair into the contraption because the vacuum is not strong enough. I thought it would work with just this small guard on it but it doesn't. I don't think I can do this.  But what am I supposed to do? Like there's nothing else I can do with this $245 tool that doesn't work because my vacuum is not strong enough. But Floby, why didn't you come with a vacuum? All right, we're on to plan F or Z. I don't even know where we are at this point. We're way past A, B, C, D, E, F, G. So we're gonna try and give her bangs with the Floby. Floby, baby, please co-operate. I mean, listen, it's definitely giving fashion. It worked. It sucked all of the hair into the vacuum so there's no mess. I guess I'll finish the cut. Maybe I'll give her like a little bob. I'm just trying to do something with this thing to make it worth all of that money I spent. Oh my God, I'm so mortified and embarrassed right now, please. This is tragic. I'm gonna try one last thing and I wanna give her like layers in here. If we direct the hair outwards and then Floby the rest of the hair, we should get layers, but probably not. I think my vacuum just died or something happened. All right, well, okay. I give up. I have a migraine from the sound of that thing, but it did give her layers, as you can see. Wow, gorgeous, awesome. This thing is patented. Somebody patented this. I need to decompress for a second. What was that? Miss Manny Quinn, I am so sorry for doing this to you. Like I've done some pretty awful things to mannequins. This is probably the saddest outcome of any and I didn't think it could get any worse. I really do apologize. Please don't haunt me in my sleep.   So if you would like my final review of the Floby, here it is for you. Don't buy one unless you have a vacuum from the 80s or 90s that apparently has an extreme amount of suction on it because the Dyson does not work. So if you have a Dyson and you wanna use this, don't do it. I do think the idea is there and it's interesting and intriguing but we gotta make those blades sharper, girl, because it doesn't do shit. Even when I was literally putting the hair into the blade, it was hardly chopping it. So we gotta fix that too. Apparently George Clooney loves this. George, if you're here watching, I know you are. I don't understand. If it works, maybe I would understand better. Unfortunately, I was not lucky enough to see this Floby machine mechanism machine thing perform well. I would love to though at some point. I'm so disappointed it didn't work. That was actually torture though. I'm sweating, very hot. If you like some things that actually work, check out my hair care and hair color line for gorgeous, fabulous hair care and hair color. You can shop right down below or go to xmondohair.com. All of our hair color has bomb builder inside of it. All kinds of nutritious ingredients to make your hair feel and look incredible. Make sure you follow me everywhere else. Here are my social media handles, including X Mondos. If you would like any hair inspo, you can find us there. If you'd like to watch more videos of mine, you can do so here and here. Go for it. Let's hang out some more. And that's all for today guys. Thank you so much for watching. Don't forget to live your extra life and I'll see you next time. Bye.


I've had some really great games, I've been playing heroes I've barely touched in Paragon, like Kuang, and I've been refining my Darbash gameplay. Fault's unique aspect and item system combined with these skill-focused ability changes have me rooting for the success of Strange Matter Studios. But here in Fault, there'd be monsters.  I have nothing against people playing as a team. There is absolutely nothing wrong with playing with your friends or meeting new people by buddying up on Discord. It's one of the things that makes games fun, but at this stage in the development of Fault, I think that players solo queuing into a stacked team is having an overall negative effect on growth. Now, I don't mind losing. I don't mind getting outplayed, but when you suffer a crushing, unrecoverable defeat at the hands of a well-coordinated team that starts the game off with a full deathball jungle invade followed by a tower dive killing your mid laner, it's straight to moralizing.  As an experienced player, I know it's going to happen and I just shake it off and move to the next game, but I've seen many, many people losing their minds when this happens, calling the game broken and logging off or hurling insults at everyone else. It's not a good look. People wanting to experience a Paragon-like game or having that joy ruined, and any new players who just happened upon the game will in steam are instantly driven away. Sometimes it's not even a stack. Maybe it's just a good team that wards well pings when someone is missing from their lane and keeps an eye on the map, but just knowing that five stacking is possible leads people to instantly assume that any kind of coordinated play is due to stacking, which is also a problem. Instead of saying, hey, the mid laner seems to be alerting everyone when I rotate, so let's watch out for that. People instead say, oh, for fuck's sake, it's another five stack, just surrender now and save some time. So what's the solution? Well, the obvious fix is to just make your own stack. You can use Strange Matters Discord to find a team, or the Fault Hub Network Discord is also a great place with plenty of players willing to group up. You'll probably find out pretty quick that five stacking doesn't just instantly guarantee wins, and it may change your outlook a bit, but having a good coordinated group where everyone knows what role they want to play sure does help out a lot. But this solution isn't for everyone.   I'm a pretty chill dude most of the time, but I've straight yelled at a guy in a Warcraft raid that had a hot mic and a baby crying in the background. I mean, for fuck's sake, if you need to take care of your baby, then what are you doing playing this game? People acting like I'm the monster in that situation.  Another solution I've seen through the stack problem is for games to implement specific modes designed for team play. You can't queue into normal matches with more than three people. This is a neat option, but I don't think Fault currently has a large enough player base to segregate the community like this. You would just be extending queue times and straining the matchmaking system. Possible idea for the future, but a no-go for now in my opinion. I think the best way to handle things is a combined approach. Limit the size of parties for now until the game grows a larger player base. Once they have a sufficient number of concurrent players, I don't know what that number would be, they can start having a team league. It would be stupid to limit party size forever, but at this stage of the game's development, allowing teams to queue into casual seems to be doing more harm than good. People assume that any kind of team coordination is a result of a five stack instead of just good old fashioned good play and while the perception may be wrong, the fact that it's a standard perception of the game will be detrimental to Fault's growth going forward. If you guys have your own solution that you think could be applied to this problem, please let me know in the comments below. I would be really, really interested to see what you guys think because these are the only solutions I could really think of. I truly hope that something can be done because Fault is fun as all hell. I've had some really good back and forth games. I've had a few come from behind victories and I've had teams pull a win out over me when I thought the game was all but one. However, these games are too few and too far between. Most games of Fault are decided in the first 10 minutes and five stacking or even the perception of five stacking is one of the contributing factors to this. If you enjoyed the video, please hit that like button and subscribe for more. But for now, this is the Man Goose signing off. You guys have a good one. Man Goose!


Hi, thank you for attending our talk. I wish we were able to see you in person and hope that in the next year, the things will get back to normal. As you can see from the title, the topic is very important because the internet, the biggest storage of all your funny pictures and memes runs on electricity. And we are here to talk about internals of power generation automations, about vulnerabilities that we are able to find, and about what you can do about that. We are security consultants who have been working with different industrial solutions for many years. Actually, we have been doing it for so long that we have a long list of content information of different system integrators and industrial vendors. So when an asset owner, for instance, a power plant comes to us and asks for service, we don't just give them information about vulnerabilities that we found. We closely work with all involved entities, including the vendor to find together safe and reliable fixes and workarounds. We work at Gaspersky and this research is a result of the teamwork, not just of the three of us, but also of Lebedritsa, Sergey Andreev and Sergey Sidorov. Everything that we are going to discuss today was reported to the respective vendor. I'm talking about Siemens a long time ago, but actually this is not one vendor problem. You can find similar issues in systems of other vendors as well. We are going to talk about real vulnerabilities in real power plants out there and at the first glance, it may seem irresponsible. But if you think about it, for good guys to do such research, it's a challenge. You will need to have relevant experience. You will need to have a lot of time and, of course, you will need access to the industrial environment. So there is no working welcome sign on power plant stores, right? So for good guys, for penetration testers, for auditors, for power plant separators, it's challenging to get access to all of the things together. On the other hand, for bad guys, for those bad guys who would be willing and able to attack a power plant, they do a job to do such research. They have significant investments, they have a lot of time, but they keep their vulnerabilities to themselves for their malicious purposes. So we assume that those guys already have all this information and from our side, we would like to share this information with good guys with you so you would be able to act upon this. Power plants is the main source of electricity on our planet and thanks to carbon monitoring, anyone with internet access can get information about where different power plants located on the world map, what fuel they use and which is their capacity. The heart of every power plant is a turbine. We don't have a picture of a turbine here, but if you ever saw a modern airplane, I believe you also saw a turbine. This is a giant rotating thing generating electricity. So, and on power plants, they look and work quite similarly. And turbine manufacturers are generous in us to share information where the turbines are used. Here, for example, a screenshot from Siemens website. Turbines are used not only on power plants, they are used in many different areas like chemical or oil and gas and many others. If you correlate this picture with the previous one, you will be able to understand a solution from which vendor is used in a particular power plant. In addition to that, online, you can find a lot of information about what solutions are used in certain power plants in different pressure leases and marketing materials. You can find a lot of interesting information about software, hardware version, generations of different systems. Sometimes you can even find building plants. Here, just a small example. Okay, Google, show me some power plants of California. Here, just a few power plants of California, and they have one more thing in common. They use the same plant control system, SPPAT 3000 from Siemens. This is exactly the system that we are going to discuss today. But before we move on to power plant generation, automation, let's talk a little bit about power generation process in general, what we are going to automate. Here, and throughout the presentation, we will be intentionally oversimplifying a lot of things, partially to make them more suitable for the audience and partially because to be honest, we don't fully understand them ourselves. So let's go from right to left. We will need some fuel. Here is coal, for example. You put fuel into a combustion chamber, put it on fire, and it generates pressure to rotate a turbine. The turbine is connected to an electricity generator through a shaft, so when it's rotating, the generator starts generating electricity. It's important to mention that electricity doesn't go straight to your house or city. At first it goes to a special place called power grid. Power grid knows information about market demands, it receives energy from different power plants, and this is power grid who distributes electricity to consumers. So the burning process in the combustion chamber, you can have a lot of excessive heat, so costs called waste heat, and there are different ways how to approach it, you can release it to the air through a condensing tower, or you can reuse it during recuperation. For example, warm water and send the steam to a turbine to generate more electricity. Now that I used to automate this process called distributed control systems or DCS. They are designed to make life of power plant operators much, much easier. They allow you to conveniently start and stop the power generation process. They allow to control the amount of electricity you want to generate, you just enter the amount in megawatts that you want to have in the output. You can monitor everything. These systems are literally very powerful. They are connected through PLCs, they're connected to many parts of the plant including the turbine, and they control such interesting things as the amount of fuel, the temperature of the combustion in the combustion chamber, the speed of the turbine, and even control the turbine not to go into different dangerous modes. Obviously it's not a small piece of software that you just install on the server and it's magically worse. It's a very sophisticated system consisting of different hardware, software, PLCs, input output modules, the turbine itself, and a lot, a lot of things. And often starting to create such a system starts even from building constructors so someone comes to a vendor and says we have an empty field, please build us a power plant. And there are many vendors who do this, but today we will be talking about Siemens. The DCS from Siemens that we analyzed is called SPPAT 3000. Just like other DCSs, it consists of many different industrial components, PLCs, OPC, different servers, HMI, a lot of things, and it may have very different architecture depending on the site. So there will be two components that are unique for SPPAT 3000, they are called application server and automation server. And this is how we will structure our talk. First we will talk about application server, then we will move on to automation server, and then we will move on to conclusions. In different manuals and documentation from Siemens, you will see how the system should be built in a perfect way. For example, they will say that the application network where application server is located should never be connected to any external networks and how everything should be designed. However, also, we again here worry over simplifying everything. In reality, in real power plants, you will meet a lot of interconnections to other systems. For example, you will need a sensor network to monitor different vibrations inside the turbine. You will meet a demilitarized zone because you will need to get some kind of remote support from the vendor, you will need to get updates for your operating systems, for antivirus, and so on. You will need to push out OPC traffic to your corporate network or to a regulator because this area is very strictly regulated. So in practice, you will meet a lot of interconnections. The life of our vulnerabilities started almost two years ago. Back in November 2018, we reported a bunch of vulnerabilities to Siemens. And about a year later, Siemens published an advisory containing information about how to approach these vulnerabilities, and also a set of other vulnerabilities that were reported by other vendors. And that's great that this area receives a lot of attention from security researchers. But also about a year past, it doesn't mean that during this year Siemens didn't do anything. The thing is SPPTA 3000 is an exclusively supported system. It means that a system integrator for these Siemens themselves. So soon after we reported these vulnerabilities, Siemens started to roll out patches and working directly with their clients to fix everything. So December is just when this information became public. We don't have a lot of time to discuss in detail what kind of attacker, what can do with the system. I will just highlight that CVSS scores given here obviously do not represent how critical these vulnerabilities for real power generation process. They're just individual scores for vulnerabilities in the vacuum. To better understand what kind of attacker can do what you can take a look at our threat model that is published in our white paper. Let's start with application server application server is a logical core of the entire system. Everything has connections to application servers in the logical sense. If anything needs to connect to the network, it will end up in application server. Other servers start they work from the loading software from application server and launching it. So this is the heart of the system. And what can possibly go wrong if you open over 40 ports there. This is for an attacker. This is a huge attack surface. If they are lucky to get into their respective network, they can choose what they want to attack. Do they want to attack Windows operating system because this is simply a Windows server. Do they want to attack third party components or they want to attack on SPP 83,000 services, which are based on Java. Also, we hope that these vulnerabilities are already fixed. In industrial environment, usually you don't update your systems very often. Usually it's about a half of a year or several months between update major updates of operating system. So it's always possible to find a time window to with remotely exploitable abilities in Windows operating system. Configurations also could be better. You can find some statistics for security benchmarks on the right-hand side. But one of the biggest problems is actually passwords. The life of passwords has three stages. At first passwords were the same for all power plants. They were default and the same everywhere. And you can find them online. Obviously this screenshot went out from information published from Siemens. Some power plant separators decided that it would be a good idea to share passwords and a lot of other technical information with the internet. But they will be online and we also have a world list in our white paper. Around 2014-2015 Siemens started to generate different passwords for different locations. However, the process of changing them was challenging. You would have to be familiar with the process to change the passwords by yourself. And only in the last year in 2019, the process became easier and now you can do it yourself much easier. Now please welcome Radu, who will tell you about vulnerabilities in Java. Hello everyone. Let's look how SPPS software works on application server side. Operator can communicate with system through thin or fed client. In case of thin client, it use Java blade of internet explorer and communicates with server over HTTPS. So it can be outside of application network and its communication can be constrained by firewall. In opposite, in case of fed client, operator should belong to application network and its end fed client directly communicates with RMI registry to found RMI services and after that directly communicates with these services. Illustration of SPPS architecture was kindly provided by system through public URL. So not to be messed, let's divide it into spaces. In red zone there are items that process HTTPS request and in green zone there are RMI services. RMI service looks like network services which assert on dynamic TCP ports. SPPS consists of containers. All types of containers are represented on these illustrations and containers have self-explanatory names. So before we go deep inside internals of SPPS, let me introduce some tools which used in this research. First of all, all just files of SPPS are up to skated with commercial product. But the security measure can simply bypassed by public available tool. Secondly, sometimes it is useful to see how related software communicates with server. It helps to understand architecture and to see client workflow. In case of SPPS, RMI detector was written. It represents raw TCP streams and in human readable format. Inside it use read object method of STDK. It is known that this method is suffer from insect or desalination vulnerability. So be sure not to be exploited through remote pickup. The first pillar of SPPS is Apache web server. According to its configuration folder, Orion software config can be accessed by unauthorized user. But in fact, this folder contains some critical information about application and about items of application and automation network. Also, configuration of Orion web application in Tomcat also can be accessed. In Tomcat, there are three web applications registered in Tomcat. There are remote diagnostic service, manager and Orion. According to configurations of Apache and Tomcat, all these applications can be accessed by unauthorized user. Inside Orion web applications, there are surlets which can be accessed. All of them are listed in configuration web.xml and the list is huge. Some of surlets has attractive names for attacker. For example, Browse surlet. It allows unauthorized user to perform directory listing on arbitrary folder. But in case of exploitation, another surlet is more useful. File upload. Surlet allows unauthorized user to perform file upload. And folder is fully controlled by parameter-based dir and target name of HTTP request. This vulnerability can simply bypass to remote code execution. For example, attacker can corrupt some startup scripts of SPPA or simply inject JSPS shell in Tomcat web application. And get remote code execution with system rights. Also, the surlet which has service factory in its name, this surlet directs HTTP request to remote services. Inside it uses parameter service url of HTTP to identify RMI service which will be called and serialized object in data section of HTTP request contains information about method and arguments which will be called. So the situations when a theme client and friend client can communicate with RMI services. But in case of FED client, it can communicate with RMI registry. So if application server miss some important security updates of Java, then server contains in sector deserialization vulnerability and public available to vice or serial can allow exploited and perform remote code execution with system rights on server. So the next steps will be to identify all input vectors for attacking. And for this task, we will try to list all RMI services in system. At first step, we will use a class locate registry office.com and get a big list of RMI services. All but one are jmx RMI services. And I assume that they used to control and manage containers of SPPA. For this investigation, we will choose lockup service. In fact, it looks like a collection of next level RMI services and using its public methods. We can get the reference to this next level RMI services. RMI says should implement interface service factory. So it also looks like some collections of another next level RMI services and using public methods get service and parameters such as client ID and name of the service. The instance of RMI of next level RMI service will be created and reference to it will be returned to client. And this next level RMI service is a server which perform real job of SPPA. But in fact, it contains a lot of public methods which can be accessed by unauthorized user. So input vector of SPPA is very huge. The next question is to understand how authentication perform on a system. For this task, let's look how client perform request to security service. To do this, first of all client tried to get reference on security service with some client ID. It needs to PC service factory use this client ID to get valid session in session manager. If session manager will fail, then exception will thrown and client request will be rejected. But in case of success, valid session ID will be returned to PC service factory. And in its turn PC service factory create instance of security service where session ID will start in login ID. And reference to this instance will be returned to client. Further client can call some public methods of this service. And in its turn this methods can perform some previous checks of client. So we have two security measures of system. But there's a question how client can perform login operation on system if he doesn't have any valid client ID. For this task at startup of SPPA session manager create anonymous session with client ID 0. And client used this client ID and perform login operation. But attacker can also use this and simply bypass this security measure. So to sum up we have, so there are a lot of RMI services which has a lot of public methods and permissions checks are fully delegated to this method. So it's really difficult to perform security management of this system. So we understand all input vectors and security measures. So it's time to find vulnerabilities. In the list of RMI services there is admin service. It can be accessed by an authorised user and its public method transcript doesn't have any privileges checks. In fact inside it first step create instance of class loader using bytes from arguments. In fact this step will load arbitrary Java class. This class should implement interface admin script and defined method execute. This method will be called by run script of RMI services. For this case we create Java class which simply run OS common. And this OS common will be run with system rights. In fact there is more powerful post exploitation because we inject arbitrary Java class around SPPA software. So we can use some Java reflection and patch some private variables of SPPA. And as a result we can corrupt some technological process of SPPA. To bypass privileges checks in methods as we can use second vulnerability. It's using RMI session service and its public method get login sessions. Attacker can get information about all login users on the system. This information contains user names, IP and client ID of login users. Attacker can reuse this and if in this information there is a user with admin rights then attacker can simply reuse his client ID and get the reference to security service with more privileged session. And after that attacker can call public method, get all users of security service and as a result get all private information about all users on system. All password hashes also contains in this information. Both of these vulnerabilities can be accessed from either external or application network. All communications between RMI services are encrypted so user name and password hashes are transferred in plain text. Moreover system doesn't have any session protection mechanism. This fact is more critical in case of fed clients because of attacker can perform mid attack on the user of SPPA and get valid username and password hashes from the traffic of user. And after that simply reuse this username and password hashes and perform login operation on the system. So attacker can also change the password of the user. I talk a lot about password hashes and users so it's time to understand how these items are organized on the system. So Alex, you're welcome. Hello everyone. Let's continue our discussion about application server. In this slide you could see how remote authentication works. Now I'm going to tell you about how it's organized locally. After the system gets started, it begins to read the content of files users 1.xml and pdata1.exe to get a user list and the password hashes. pdata1 is a simple xml while pdata1 has a slightly more complex structure. It's a jzip archive encoded in base 64. There is a javascript object in the jzip archive containing a specific xml. The field of this xml from pdata1 file are presented on the slide. They are used to calculate password hashes and check it during user authentication. In this slide you can see a password check algorithm in sudo code. The cryptographic scheme is a typical crypt hashing scheme like in your Unix and Linux machines. It has sold to different number of iterations and the only one thing which was added is hardcoded sold, the same for all users, which is concatenated to the password. The tool to extract password hashes and their parameters from pdata1 file has been developed. Its output is presented on the slide. The tool can be used during password auditing to check a week or dictionary passwords and their hash calculation parameters. The tool is available in our github repository. Draw the line under application server analysis. As you have seen, attack to face is really huge and include java remote services, tomcat applications and a lot of other. Secondly, it's about remote connections. Whether SPPA has or has not remote connections according to when the system integrator or someone else, you should check it. The good starting point for this is application server because OPC maintains remote operator. All of this thing will end up on application server. Thirdly, despite the fact that there is automation network between application server and field devices, an attacker can affect generation process from application server. This actions includes to start stop generation, change power output or just get information how power plant works. Of course, such ventilation will always be visible for operator always monitoring technological process. So real attacker will also be required to change or modify data on operators HMIs, but it's also possible with revealed security issues. That's all about application server. Now let's move on to another main component of SPPA infrastructure automation server. Automation server. The main goal of the automation server is to execute real time automation functions and tasks and tasks for power plant control. Depending on power plant project architecture and features, the role of the automation server can be different. We have distinguished three roles and the first one is automation. There may be slight confusion because the term automation is used both for server and its role, but analyzing automation server configuration and publicly available information about it. We have found that whatever the role is almost the same hardware and part of software are used. So we have decided to use this kind of roll classification, which seems less confusing to us but at the same time it's slightly different from the vendors one. In other words, having an automation role means that the server is responsible for interaction with input output modules, which control and monitor power plant equipment such as turbines or electric generator. The second role is communication. This role is used to communicate with certain parties systems. This is just a protocol converter supporting such protocols as Modbus, IEC-1001-104 and some others. And the last role is migration. In this role, the server is used to connect previous version of SPPA such as SPT-2000 or PERM-ME. In automation role, automation server can be run both on Simatica 7 PLCs or industrial PCs. In case of other roles, it can be run only on industrial PC. Let's talk a little more about each role and let's start with automation role based on PLC. PLCs are what directly control full devices and access to them is more for any security discussion. Any configuration changes and updates for PLC are required to stop technological process. Therefore, these devices usually have security misconfiguration and firmware without security updates. Another common security issue for PLCs is using unsecured industrial protocols. In case of SPPA, they are Simatica 7 protocol and PLC data protocol. There is quite a lot of information about SPPA, but not so much about PLC data protocol. So we had to deal with it and analyze it ourselves. It's not a special protocol for SPPA. When you program your PLCs and you need to exchange some data between them in real time, you use this protocol. It's pretty simple and maybe its description is available somewhere in the internet, but we couldn't find it, so just in case, show its structure here. It doesn't have any security mechanism and the only obstacle while do manage the middle attack to SPPA data is the sequence number, which we can get from a packet and just fuzz implementation. For protocol analysis, the Wireshark D-Sector has been developed and also available in our repository. During PLC security assessment, one of the main things which we check is unauthorized access to reading and writing the PLC memory. Availability of unauthorized access is determined by the position of mode selector of Simatic PLCs and some other configuration parameters. The metrics on the slide shows unsecured states for Simatic PLCs when unauthorized access is possible. The tool for gathering information from PLCs over the network and for its analysis has been developed by one of our colleagues and also available in our repository. Now, let's talk about automation server based on industrial PC. The workflow of all roles in this case is quite similar to each other. When automation server is based on industrial PC, it's just a Linux box. Now that we're in the start, it tries to download some additional files from application server. These files include JARs, which represent SPPA runtime containers, bar script, some configuration, protocol configuration files, and other. To execute downloaded JARs, PTC Perk virtual machine is used. It's a real-time Java virtual machine widely spread in industrial and military areas. Now that running JARs open NMI services or some of the extension, in case of migration server or your own RPC services, which are extension of classic Java NMI services are used and you can see the listing on the slide. Now, automation server based on industrial PC has following security issues. Firstly, there is a possibility to spoof downloaded from application server files. These files are downloaded over HTTP and there are no security mechanism like authentication or integrity check during this process. Secondly, it's about using default credentials. You can use the same admin with password same. Thirdly, it's RMI services running on automation server. The research has found two vulnerabilities in our own RPC services, which allow to perform sensitive data exposure and RC. And the last group is vulnerabilities found in the software used to fulfill a migration role for connection previous version of SPPA, SPPA T2000, also known as TXP. These vulnerabilities found in migration server software are related to different kinds of overflow, stack, heap, integer and other. Actually, there are so many overflows here that the stock would be overflowed by that if we started to describe all these vulnerabilities in details. If you was about RPC vulnerabilities, these vulnerabilities have been found in runtime engineering service. This service has a method requested on time container container where the first argument defines an action to be executed using the action read file. It's possible to read any file from the system using write config file action. It's possible to write any file to any folder in the system. And for example, it can be jar file which executes shell command from the command line. And then using the same request runtime container method, it's possible to execute to this jar later. Now let's talk about automation server to sum up automation server can be run on PLC or industrial PC. In case of PLC, it's a usual PLC with well known security issues. The industrial PC is a Linux box, which tries to download jars from application server and then execute them with PC or virtual machine and attack again spoof downloaded files or just exploit revealed vulnerabilities in network services. I haven't mentioned any network equipment used in distributed control systems. During the research we saw a wide variety of network devices and network infrastructure. They include different kinds of switches routers firewalls and more rare devices such as data died for example. In order to summarize all this information and got common as we pay network topology scheme presented on the slide. We have shown in purple usual places for network devices but it also also should be mentioned that the same devices in the same places can can be found in other distributed control systems from other vendors. In industrial network usually have a lot of security issues. The reason is these devices don't require any configuration and can be run out of the box. So for the things like we community strings in SNMP we credentials in HTTP, HTTP, telnet and other services from where this publicly available exploits and just security misconfiguration, all these things is common and typical for industrial network devices. Additionally, some industrial protocols, for example, such as a profanet dcp can allow to get a set network configuration of these devices. In case of profanet dcp. In case of profanet dcp it also can be very useful for device enumeration. And the last thing about industrial network devices is always remember that these devices with years of uptime can act unpredictably for completely legal and normal activities, such as browsing web page with statistic or login into telnet. Thank you. Thank you, Alex. So the topic of power plants is huge and the topic of DCS is huge. So we just tried to poke a couple of things here and there and show that to affect the power generation process you don't have to go deep to field level to PLCs, but you can focus on higher logical levels like application server and automation server. And what we do not talk about today is havoc or damage that you can cause by such attacks. Actually, that's because it's not that bad. If you already imagine a hacker and a hoodie who writes a couple of lines and after that the entire city goes into the darkness. It's not like that, because it's power grid who is responsible for power distribution is it's just not power plant. So here we mostly talk about more local damage like wouldn't be possible to damage a turbine. Since a turbine is connected to DCS PLCs.  And it's self degrades by working probably by putting it into different uncomfortable modes or quickly starting can stop in it it would be possible to make it degrade even faster or even break it. Unfortunately, or actually this fortunately we were not able to find a spare turbine on eBay. But we are making an educated guess that the damages are there based on the system architecture. To make life of power plants a little bit easier and we prepared a small do your own assessment guide that you can use to check your SPPT results and system for vulnerabilities that we will discuss today. You just connect your laptop to a couple of places in the network. Go through a simple checklist. You don't have to hire expensive security consultants for that. And after that you can fix some parts yourself or you can call your system integrators to discuss what to do further. Just any other industrial system DCS is not so good in terms of security, it could be better. And we recommend you to take a look at I say I see 62 443 set of standards to know what to do to improve security in terms of communicating with different entities because in the industrial area is usually a challenge when you, for example, when a vendor is not interesting to fix in something. So it describes in particular what kind of relationships you can build with regulators with vendors and other parties involved in industrial area. Of course update your systems change your passwords improve your configurations according to the vendor security guidelines. We also recommend you to set up monitoring since most servers are based on standard windows and Linux boxes. You will not able will not be able to detect different Java attacks but at least you will be able to detect some parts of attacks. And again, this is more about DCS and industrial security in general, rather than, than by one system by a single vendor. We released a lot of information there was the white paper different tools that we mentioned today. I recommend you to take a look at our GitHub page to find all of that. And we would like to thank Siemens product search who made all the communications very effective they were very responsive. They allowed us to contact Siemens product team. And of course they released the patch. Take a look at the advisory and Siemens always tries to raise awareness of their users, how to better build such systems, what are better configurations, but they also highlight that it's not the vendor who is solely responsible for security of an industrial environment. There are a lot of things that power plant separators can and must do themselves. So please follow the guidelines for that. Thank you for our talk. Thank you very much for your attention and we will be glad to answer any questions.


First question is from Jen's hikes. What do you recommend for someone who has lazy glutes? I try really hard to connect my mind to muscle, but after leg workout, my quads are super sore and never really feel it in my glutes. It's like that, no matter the exercise. I know it goes from sleepy to lazy. Yeah, let's define this for a second. So essentially somebody who's doing, you know, traditional glute exercises, so like barbell squats, for example, or lunges, and their glutes just don't seem to develop. They don't seem to feel it in their glutes. It's much more quad dominant for them. So it can be very frustrating. Sometimes people will get this with their chest when they're bench pressing, uh, sometimes people will get in their back when they're rowing where they just don't feel the target muscle, but they feel all the other muscles involved. And then the development starts to reflect this. Now here's what's happening. Now we've called this sleepy butt syndrome. You could call it lazy glutes. Really, what's happening is you have a recruitment pattern that happens every time you do a movement. This reminds me of the weight belt question that we have, right? That we often get where people ask about weight belts. Studies show that when you wear a weight belt, you still get the same core activation as when you don't wear a weight belt. So then the argument is, well, then weight belts are perfectly fine. It's not disengaging the core. The problem isn't the disengaging. The problem is how the recruitment patterns working. When you wear a belt, your core pushes out against the belt. When you don't wear a belt, your core kind of sucks and embraces. So what we need to do here is change the recruitment pattern to make it more favorable for this person's goals. Okay. So how are, how are we going to do that? Well, changing form and technique is the obvious answer. The problem is this person is probably so disconnected to this favorable recruitment pattern. It just doesn't work. One way to do this is to prime before you do these compound lifts with maybe an isolation exercise where you can squeeze and feel the glutes. Now, does this intrinsically or physiologically increase the connection to the glutes? Not necessarily. What it does though, is it allows you to feel the glutes more. So now that I have a little bit of a pump of my glutes and I've squeezed them with, let's say hip thrusts or donkey kickbacks or tube walking. Now when I squat, because I already felt my glutes earlier, like, you know, three minutes ago, now I can position myself in a way where I can change the recruitment pattern enough to get those glutes to fire more. Same thing with like doing like flies before a bench press. Now you can start to feel where you want to feel the exercise.  If it's something that you've noticed for a long period of time, there needs to be, you know, quite a bit of attention and repetition doing that consistently before it's really going to start to respond because of such a loud signal and opposition that you've been running off of forever with the quads. I wouldn't make the argument that it actually does help you use more glute and recruit that. I mean, when you do a squat, it's a hip hinge movement, right? And when you lay down and you do like frog pumps or, you know, floor bridges before, that's a hip hinge movement, but it's isolating the glutes in that situation or as closely isolating as you can. Obviously, there's a little bit of quad extension in there also, but it's mostly the glutes that are firing. And so you are neurologically training the brain to use the glutes in that movement, which mirrors the similar pattern that you would do going into a squat. So if you prime that first, you train it neurologically to go, oh, this is how I, when I do this hinge, this is where I should feel it and this is what it should be like. So then when I go in there, because we've talked about this before, I can take the same exercise and I can make it work a specific muscle more than the other. And then I can go into the next set and flip that and literally can take an exercise and change it like that because it's cognitively focusing on because, because, especially compound lifts, there's so many muscles that are required to do that movement that, and I can control my muscles without having any resistance, right? I can flex certain ones. So if you can flex your glutes with no weight, just if you could stand still and activate, that should be the goal, right? To be able to just flex your glutes. Well, yes. And that's what priming is doing. Like you are, you're getting down there and you're practicing flexing the muscle you want to work really well. Then you go into the movement that you have a hard time feeling that muscle and all you're really thinking about is flexing that muscle. You get down to the bottom of your squat and now you're thinking about, oh, what you were doing in those floor bridges. When I was in the floor bridge, I was squeezing those glutes and so you think about it. Here's the challenge and this is where you're going to get the people that are going to counter you. They're going to bring up these EMG studies that show it doesn't activate the muscle more than if you did whatever. Now, here's the problem with that is you can't separate the fact that I can consciously feel a muscle and now change my technique enough to squeeze it versus is it just automatically physiologically changing the recruitment pattern? But you can't separate the two. So it really doesn't matter which one it is. The truth is, look, here's a good example. As a personal trainer, one of the hardest muscles to get people to feel. Generally is any muscle in the back, right? Because they don't see it. Like trying to get someone to squeeze their rhomboids of their lats who's untrained and they're just having a tough time doing it. Here's a simple trick. I used to teach my personal trainers. If you take a pencil and touch the muscle, that's all you got to do. Here, squeeze right here. Just because you're touching it, the person automatically can now squeeze it more because they have that feel that feedback, that feedback, that outside feedback. Priming does that as well. So priming, I don't care if it does or doesn't automatically increase the, or improve the recruitment, what I think it's really doing, the value is you can feel it now. Because people who have trouble activating their glutes can't feel them. They typically can't feel them when they do almost anything. I hate when trainers and coaches try and argue the science and the semantics around this. When literally it's like, go apply it.   It's just, it's very practical, very practical advice. Maybe the way we communicate it isn't come full circle because the science is still not complete around exactly what's happening and going on. But I'll tell you right now from teaching enough people, if you struggle with filling your butt and exercises are supposed to be for your butt, do an isolation movement, do a kickback, what is it called? Donkey kickback.  And then the next part of that would be if you want to prioritize development of your glutes is to just train your glutes first. And this is just an old school principle.  Well, then do your butt exercises, because you could prime your glutes and then go into some heavy hip thrusts and do that. And then go into all the other exercises. Like that's the other part of that. Hip thrusts are such a good movement for somebody who especially that struggles with this. So if you are wanting to build your butt and you've heard enough times that squatting or deadlifting are great movements for that but you struggle to feel it during those movements there.  And one of the things you got to remember this when you want to build a butt, you got to, and this is the mistake I think a lot of people that are in this category do is they do donkey kickbacks or they do frog pumps or floor bridges and they feel it the most in their butt there. So they think that's the best way to build their butt. We still got to load it. Yeah, and those are really, those movements you can't really load very much. And if you can't, a dumbbell or whatever, that's 50 pounds between your legs. That is nothing like, but you can load a barbell and do a hip thrust really, really heavy. And so if you want to build your glutes, you struggle with that. That's a movement that should for sure be in your repertoire.