Today, I'm glad to have Andre Kostin here today, and he studied computer science in Bucharest and recently finished his PhD on security and embedded systems. And he's done some pretty cool hacks, maybe some of you have looked them up. And he's the author of the toolkit, My Fair Classical Universal Toolkit, which enables you to crack RFID chips, basically. And he will talk about methods on how to make a large-scale security analysis of embedded devices possible. So enjoy it and give a warm welcome to Andre. Welcome to my talk. Thank you, Christian, for introducing me. My name is Andre Kostin. I'm a recent PhD graduate from Uricom in south of France, and today I'll be presenting you basically the quick squeeze of my three-year thesis on security of embedded devices as firmware, how to do it fast and furious at large scale with some demos. So a very short QMI, I'll not go too much, but in principle, I'm interested in embedded devices as such, regardless of the shape they take. They might take the shape of a RFID card or a credit card, or they take shapes of printers or funky CCTV cameras or even airplanes. All these are kind of examples of embedded devices fit in different bodies, let's say. But inside they're embedded devices, and this is what makes them a little bit different than normal PCs, and interesting for me. So we know that embedded devices are everywhere. It's not something new, and we are seeing this. We use them every day. We see that embedded devices, we are getting more complex and smarter because we really want to do more useful stuff with them, like writing a script for them, or calling an API, or trying to run some piece of advanced software on them, whether it's a smart home or a smart TV. And of course, embedded devices, they're also getting on top of that, they're also getting interconnected in the new buzzword, Internet of Things, IOT. And these layers of complexity, basically the interconnection of devices which before were not supposed to be connected, combined with new complexity of software and stacks and APIs, makes it a little bit harder to actually understand all the security surfaces. So it requires a little bit of a systematic approach. All these embedded devices, they run software. And regardless of their shape, how they look like, their software is called firmware because of historical reasons, so your smart TV, your smart meters, your home router, and even your hard drives in your PC, or network cards in your PC, they run these pieces of firmware, which is kind of a smaller set software operating system or not running inside of it. So there are some observations at present that back in 2014, we've seen at least in a part of the Internet, which is just a small observable part, that there are hundreds of thousands of firmware packages, which we've been able to download and partially to unpack and analyze. So there might be many more thousands of firmware packages, but at least we know there are hundreds of thousands of them. And there's also these interesting predictions that by 2014, there were 14 billion interconnected objects by Cisco Internet of Things connection counter. And the prediction is that the well-known hype is that by 2020, there will be between 20 and 50 billion of interconnected devices. So this basically brings us to importance of embedded devices and their firmware because the embedded devices are ubiquitous, even though they are invisible, they are essential to our lives. Think about pacemakers, think about ECUs in the cars, they can operate for many years, for example, for smart infrastructure, if it's buried in concrete or it's put somewhere in out of rich area, they should operate and they could operate for years even without getting no updates or no security updates.  So they need some kind of web interfaces, networking interfaces, and debugging interfaces so that they're able to operate easily. And it's not news that embedded devices are insecure. We've been seeing this trend from I guess 2005 or 2006 when increasingly more every day there are examples of embedded devices being insecure, like a lot of routers being insecure, when printers shown to be insecure on large scale, then VoIP phones and VoIP systems used in offices, cars shown back and even in present shown to be remotely hackable and insecure, drones, fireworks, all kinds of PLC, SCADA, industrial control systems. And the thing can go on because there's actually no limit on the type or application of embedded devices. And we can go on the blogs and on the reports and the white papers and see every type of embedded device have some kind of a flow. But what is the observation here is that most of these white papers or research was done in a manual or not necessarily just in a manual, but it was like every research was done in an individual manner, like taking a particular device or a particular embedded firmware and analyzing it heads to end. And basically it involves a lot of tedious work, a lot of manual work, a lot of scripting. And basically it cannot scale. If you want to understand what are the security implications of connected devices or security flows in hundreds of thousands of firmware images, we need scalable approaches. And these approaches where we do a lot of things manually just does not scale. I'll try to give a very quick overview of how usually the manual analysis process of firmware takes place. And for most of you, maybe it's not something new and for sure it's not. But the idea is that there's a firmware package.  You unpack or decrypt. And if you cannot decrypt, it's not a problem, you keep it and someday somebody will dump the key and you will be able to decrypt it and go back and do the process as if the firmware was decrypted, unencrypted. Then there's very generic steps like detecting the CPU or the type of binary, the load addresses, and then applying some kind of static analysis on the code or the source code of interpreted files and dynamic analysis. And then looking for some kinds of patterns, either in form of strings or function names or symbols or just chunks of codes which people try to do now with machine learning and intermediate language. But the idea is to try to find these kind of backdoors or debug interfaces or UART consoles or all those wounds. This can be done statically or usually can be done also dynamically, but it requires more effort as we'll go through. Then if you didn't have a device, you have to buy the device. Some people do it otherwise, they have a device, they dump the firmware, and then they start as if we started with the firmware itself. But in general case, if you want to do analysis on some devices, you don't want to buy every device every now and then just to analyze. So you want to start as cheap as possible and the cheapest start as possible is getting the firmware free from the Internet. And then if you find some indication that there's vulnerabilities, you will want to buy the device, you'll have to set up the device, meaning all the cabling, all the network configurations, all the drum base, right? And then eventually if you need to go even deeper or some vulnerabilities might require some physical intervention, you might need to even go and disassemble. So clearly there are two parts of this manual analysis process and we can see that the part of buying the device, setting up the device and disassembling it to go to its JTAG or UART console or just hook up on the microprocessors or flash memory is hard to automate because you don't have so much budget to buy all the devices, just go on Amazon and buy random devices that you think might be vulnerable. Second is not very easy to set up all the devices in uniform unless you have a very smart robot, maybe in a few years we'll have them. And also not very easy to automatically disassemble the device and go some robots to connect to the JTAGs and UART and find them. There are some steps towards the direction to automate this with JTAGulators and some moving parts to try to detect these UARTs. Still it's like a hard problem, it's hard to automate. On the other side we see that the first part is more or less easy to automate because getting the firmware is nothing but going to a download link that eventually logging in if it requires a username and password, downloading it, then trying to unpack it. If it doesn't work with a simple zip, you can use the brute force method, you just use the brute force and I'll show you some examples. And then you just try to do some heuristic, you detect some things which you might want to optimize for your analysis and then you just do static and dynamic analysis. Of course there are some caveats for all of these steps, but clearly this as a process as a fault can be automated. So going from this point forward we have this idea to have a large scale automated analysis to better understand and classify and analyze firmware images without using the devices. That is very important because we don't actually need these devices because most of them can be with more or less effort emulated if we really need to confirm something or not. So there are some challenges like the large number of devices, the large number of firmware files. These are the challenges which have to be overcome. Also the thing that the IoT and the embedded devices, they are using different kinds of architecture. Of course, the most well-known are ARM and MIPS and PowerPC maybe. But there's myriads of other microcontrollers and microprocessors which you really don't know what they are and also not necessarily all of them use Linux. So you would need to know where to load that bytecode and so on. And basically we also have highly unstructured firmware data. Even though you can go and download all the files on the Internet, you need to know what is what because otherwise you end up in a very inefficient, very inefficient brute forcing process and you need to be really focused when you have a lot of data. So to overcome these challenges, we have some solutions, we propose some solutions such as for the large number of devices, the first thing we want to do, no devices analysis. So we try to do no devices. The large number of firmware files, basically we need to analyze a lot of data, okay, we need to devise scalable architectures. Because the systems are heterogeneous, we need to devise techniques which are generic enough, which do not depend on particular CPU architecture or hardware architecture. We want to be either on the intermediate level or have some specialized techniques from which we can pivot. Then there's a focus on web and network interfaces and APIs because all these devices they expose these network interfaces and APIs and in particular they expose the web interface as a mean to remote management or remote access to the device. Having highly unstructured firmware data, we propose that you need to do a large dataset classification, meaning that you use machine learning to classify the firmers and so on. And we'll show some examples of this. So first challenge, like firmware and device classification, why is that a challenge? We know that, again, there's hundreds of thousands of firmware packages and of course I don't see many volunteers in the room to manually triage and classify them. And we basically propose machine learning and we, in particular in our case, we use scikit-learn Python package and we try to evaluate our approach. The idea is that if you have firmware files and these firmware files usually are specific to devices, so if there is a device which has a particular number of megabytes for Flash, then the firmware file, if it's a full update, will have more or less 16 megabytes, right? So there are these kind of firmware properties like file size, file entropy, some strings and so on which makes those firmers particular to that device or that vendor. So these are kind of the properties of the files, firmware files which we use like file size, entropy value, how densities, the strings inside and unique strings in each category. And then we try to use these as features in machine learning algorithms, random forests and decision trees. And we did some sampling and we found that in our case what worked the best was the random forest with size, entropy, strings and strings unique features. And I know it sounds a little bit too much for this presentation but you can find the details in the papers which are at the end of the slides. How these features were chosen and how they are generated. But the idea is that if we, for example, include another feature of firmers which is not very good, then we have the classification of firmers or detection of firmers not very accurate. So in our case, we've been able to achieve more than 90% accurate detection of firmware by vendor or by vendor and product. So it helps us because we can basically say from this big number of firmers, let's put these in chunks and we have firmers from vendor A, vendor B, vendor C and then we can apply specific unpacking techniques or specific known exploits to test if those firmers are vulnerable or not because we know it's vendor A or B or C. So this is our local optimum where I list the feature is the same as on the slide. And the idea is that I can try to give you, I'll show a demo at the end of the presentation. So the next challenge is the automated static analysis. So the idea is that if you have a large number of firmers you want to do the analysis as quick as possible and automated as possible. So in the first instance, what we did, we took the files which we crawled, the several hundreds thousand firmers, we put them in a database. We developed some processing unpacking and analysis nodes. And basically you can scale it inside your own organization or you can scale it to Amazon Web Services, to whatever number of nodes you need. And basically these nodes, what they do, they just receive a firmware, they try to unpack using Beanwalk or using binary analysis toolkit. These are two very awesome tools. You can combine them or write your own and then you unpack the files, you get the file system if you're lucky. If not, you can write your own unpackers and plug them into Beanwalk and binary analysis toolkit and scale it to many numbers of nodes. Then we do some simple static analysis like collecting default or backdoor passwords or unusual passwords. Or we try to see if there are private certificates, private files, and which are in the firmware and should not be there. Then we also store this in a firmware analysis and report database and do some data enrichment, which I'll come down later. So what kinds of static analysis we perform in the first place? We do check for web server configuration. We didn't run any static code analysis because it was our first experiment. We didn't know what exactly to expect, what was the percentage of CPU architectures, what was the percentage of operating systems. And it's really hard to have a full set of tools, especially if you work open source or free software to tackle all these challenges. When we also look for credentials, weak default or hard coded in ETC password or we look for basically for strings in the firmware. And then we try to map them to hash, hashes in ETC password. And we found like dozens of them where the string, string inside the firmware is actually a password for an entry in ETC hash. We also use the versions and the keywords. For example, versions are useful if you want to test statically or dynamically if a particular open SSL library shipped in a firmware is vulnerable or not. The thing is that just getting the firmware version is not enough because you never know whether the library or the software package was compiled with particular set of options or was privately patched by the vendor and the vulnerability is not there. So if you have a CVE, it might not work just because of this simple reason because they privately patched it or they compile it in a way that it doesn't trigger. So version is just an indication of what you might be looking for, but it's not like a definite hit. And then we also use some correlation which I'll show some examples of them. We use the strings, we use the fuzzy hashes and private SSL keys. The fuzzy hash is an interesting thing, basically is a forensic technique which compares files by their similarity. They do not compare it one to one as in crypto hashes. So it gives you an idea if there is a common file in different firmware packages and there's some small modification between vendors and it makes it easy to find cross vendor bugs as I'll show in a second. So in one example, we had this firmware SD card, Wi-Fi firmware. So basically these are SD cards which have Wi-Fi chips in them and there was a known vulnerability in it like command injection and XSS. We know that this particular file in that firmware is vulnerable. Then when we do fuzzy hash analysis, we see that there's a few other like firmware 2 and firmware 3 and firmware 5 and firmware 4 which have similar files and we try to correlate them by fuzzy hash. And we see that some files are similar by fuzzy hash. So if this particular file is vulnerable to XSS or remote code injection, then the other two, because of their similarity, they might be as well. So this is a very good indication that you should pivot from firmware 1 to firmware 2 and firmware 4 and testing for exactly the same vulnerabilities or exploits. And the thing is that sometimes you get different vendors hit by the same bug just because it's a white label product and they buy an SDK or a development kit and they use the very same vulnerable software packages. Another example which we found interesting is that we had HTTPS certificates in the firmers and they had private keys along with them which is a mistake, but okay, whatever. You might think that maybe at the first boot they regenerate the SSL certificates. We look it up in our database, we see that this particular SSL certificate corresponds to a CCTV vendor A and we actually found some vulnerabilities in this vendor A. Going forward, we take ZIMAP outputs and they have the HTTPS ecosystem scan. What we do, we try to correlate the same fingerprint of the certificates in the IPv4 fingerprints and we find that actually the same fingerprint which is from the certificate in a firmware file is found online and by random sampling, we found that some of these online devices which use the HTTPS certificate, they actually come from a vendor B and the conclusion is that most likely these two vendors are affected by the same vulnerability we found in the first place by analyzing the firmware and you can go and pivot from vendor A and basically go and exploit vendor B devices which are online and one example of this is, I'll just show you, this particular example, so you can see that it is a prominent sentry, it's a CCTV camera and you can see that it's a prominent sentry, right? And that particular example I was talking about, but when you see the SSL certificate, it's Brickon and I'll show you dynamic analysis of Brickon device and how we do it. So the idea is that if you have these kind of situations where you have devices labeled by different vendors but have vulnerabilities which you don't know, you will not know if you don't do it at a large scale, you'll just focus on the Brickon devices and you'll think only Brickon is vulnerable. And to give you an idea is that I have a virtual machine, you can see that I have the same IP but different ports, 3080, 4080 and 2080, so I started with a Brickon and you see that in that virtual machine I'm running an emulated firmware which I'll explain a little bit down later, but what I want to say is that once we have vendor A, let's say Brickon firmware and we can do dynamic analysis, we can emulate it and find vulnerabilities inside it, we can easily find automated exploits and use them against vendor B and we can do admin-admin and you can see that this is basically an automated emulated system which emulates automatically this firmware from this particular CCTV vendor and you can do pretty much, in our case we focused on the web interfaces and I'll go into details a little bit later, but I want to show you that it's possible to do dynamic analysis as well, not just looking for SSL certification, do this in an automated manner and you can see that the web interface is pretty responsive and you can do, yeah, you see? I mean, this is really awesome, you find bugs like that, right? And that's the thing that you can start penetration testing tools like Arachni, like W3AF or your preferred commercial tool and you will easily find the XSSs and remote code injections and remote command injections and SQLs, whatever that web interface might have. Okay, so it was a small parenthesis. So in that case of these Brickon cameras, we found one certificate and we found one vulnerability which was important and we correlated to two vendors and correlated to a total of 35,000 online devices and we have, at that time back in 2014, we had 109 private RSA keys which were without passphrase and we can skim the fingerprints and go look around on the internet using Shodan or Senseys, whatever your system is. So as a first result from that very simple, not very complex static analysis like no code static analysis, we found 38 new vulnerabilities like XSSs, backdoors, non-trivial default or hard-coded passwords which affected around 700 firmware images and we correlated some of these vulnerabilities to around 140 online devices using Shodan and Google Dorgs. So the last challenge we had or we tried to tackle is the automated dynamic analysis like a sneak peek what I have shown you on the firmware emulation of the Brickon cameras. So the idea is that we have these unpacked firmware sources or you might have tons of them unpacked, let's say. Then you want to select some of them to do dynamic analysis. Your selection criteria might vary. In our case we selected the ones which had clearly a web interface inside and we could start the web interface because usually the web interface is the first thing which ends up on the internet when you plug your device to your router or to your direct connection and this is the thing you usually want to access to manage your device remotely unless you use some smartphone application but which basically does the same through the cloud and piggybacks on some HTTP connection to your device. So we selected these. We do some file system preparation because if you did a lot of firmware unpacking you'll know how messy it is and especially when you have hundreds of thousands of files or very diverse then automatically unpacking and extracting you'll get a lot of false positive, a lot of junk data, a lot of broken files just because the unpacker was brute forcing too much or maybe just because they used a slightly different settings of the packer for the firmware for example for SquashFS or for JFFS2 they use Big Indian, Little Indian with some specific options and then the unpackers, the default unpackers do not work out of the book. So the file systems sometimes are broken and you need some heuristics to broke the SIM links, you need some heuristics to find that some files are not properly there and try to make them as good as possible so that your emulation will be successful. Then what you do, you also try to do it scalable like the static analysis you want to do the dynamic analysis as well. It's a little bit slower because it involves both emulation on a much slower emulator and then also involves dynamic analysis tools basically which are fuzzers or penetration testing tools which send a lot of input. And we perform this dynamic analysis. Using QEMU, we collect the results and we use it for machine learning and for improving the analysis or analyzing why the particular emulation or failed maybe there was a kernel problem or maybe there are missing kernel modules and this might happen a lot because not all firmware packages are full firmware packages. You must know that most of the firmers are kind of partial updates. Most of the vendors, they just send you a diff or the updates of the impacted files. They do not send you every time the whole image of the file system and that's why sometimes you need to know why the emulation or analysis is failing. But the idea is that the challenging thing is how do you scalably emulate heterogeneous architectures or in general, how you automatically emulate because if you do it by hand, it's funny but you get tired after half a day. Then we need to choose an emulator and there are lots of options how to do the emulation or the analysis. So there would be the ideal emulator but the problem, it doesn't exist. And when I'm talking about ideal emulation, is the emulator which you give it a file and it will automatically know the architecture and will be able to emulate the CPU, will automatically know the operating system and will know how to boot it and will know at which addresses basically to load all these files. But from what we know publicly such thing is not available. Then generic system emulators, it's the QEMU and there are two options to use it with original firmware and the original kernel or with original firmware and generic kernel. The problem is that not many firmware come with a kernel update. Most of them, if you look at them, they're on kernel 2.6 to 10 years ago. So they do not update very often the kernels and you will not get them very often in the firmware update. So this means that you'll have to either extract it by JTAG or use some manual process which doesn't scale. And in that case, the generic kernel approach where you have a generic kernel built with all the possible modules and options would be a better idea. And then there are some other options where you can just take the application you want to test and you don't test it in an emulator but you load it in a test environment which is different from the emulated environment. And this works very well for interpreted languages like PHP, Perl, and things like that. Basically, where there is a virtualization environment and you can replicate the virtualization environment without putting all the QEMU kitchen soup in there. Again, we had to make some choices. Perfect emulator doesn't exist, so we cannot use it. Not many firmers have kernels inside, so we cannot use it. And this was too experimental. The details about architectural CH route are in the paper. I'll not bore you now with this, but you can look it up what exactly it is. So we used these two approaches using the original firmware with a generic kernel and in cases where it applies to basically strip the whole document route if it's a Perl or PHP and put it in a X86 test environment and run it there under Apache or Light HDPD. Now, the idea is that you have the QEMU which runs inside the normal machine or it can run inside the VM. In our case, it runs inside the VM. We run on top of Dibian. These are technical details, but then we throw the firmware inside the QEMU and we CH route. The CH route is the procedure where basically you change the root file system, the perceived root file system of the environment you are working on, and you can basically say to the QEMU that from now on, the root of the firmware file is your root file system and you can basically use the environment from the firmware as if it was being provided by QEMU. So, in this way, you kind of can easily emulate. There are cavits with that, but it works pretty well for many firmers. Then you just, because you are in a CH route environment, you just bootstrap everything with Vinit, Linux, Rc, and so on and leave it run. Of course, some of them will fail because there's no device attached to QEMU because you need to write some plugins for QEMU in order to emulate the flash memory, the EEPROM memory, the serial port, the ethernet. Luckily, the networking is pretty okay done in QEMU and it works fine, but for the others, you would need to basically write a good set of plugin libraries which would be able to accommodate most of your devices, and once you have that, you can basically overcome those failures. And then you just fire the web server whether it's a BOA, LightHTPD, T-HTPD, and so on, or it's a standalone binary, and then you just interested in that part. In our case, we're interested in the web server part, and then we just plug the Arakhani Zap W3AF penetration testing tools. We use TCP dump in order to recover all the communication to be able to roll back and find what input trigger a particular exploit or a particular crash or a particular command injection. You can use Nmap, you can use Metasploit and Nessus, and basically fire all your arsenal of tools on the emulated systems on the ports you want to work on. In our case, we focused on the web interfaces, so we use these tools. And as a result, we had around 225 high severity vulnerabilities, meaning command injection, XSS, and CSRF, impacting around 10% of the original dataset we've started from, and these vulnerabilities impacted 25% of the vendors. The idea is that we didn't develop this framework to find all the vulnerabilities, but if you have such a framework and you can find the load hanging from very fast in one day and kill basically or close 10% of your vulnerabilities if you are a vendor, then it's a very useful tool, or if you are a pentester, you want to find all these things quickly.  Just leave it overnight. You come in the morning. You have 225 reports on 200 firmers, and your job is done for the day, right? No. Okay, so I showed you part of this demo. I mean, this is the BrickCom camera where some things you can play with, but what I wanted to show is that the process of starting from the firmware and going to the correlation, and then finding the interesting things. So, for example, if you have the analysis on these files, for example, you can correlate by string, and you can see that some of the firmers, in particular HP, for example, they had some firmware which they pulled out from the Internet for, I don't know, what reason, which contained this error, failed to open BackdoorNetChannel. I don't know what it means, but I think it's very not very funny. So, if you have this kind of, you can search by keywords, and you will be amazed how many firmers actually hit on the keyword Backdoor. Some of them, of course, are these snort or IDS rules which look for keyword Backdoor, and these rules basically give you a hit. But sometimes you actually find real Backdoors by searching for the keyword Backdoor, right? Now, I mean, they understood that this is very obvious, and if you know the story of Juniper, they started to use cryptograms. But I mean, if you have this kind of cryptograms, you can also start looking around at these firmware files, and then you look at the firmware details and what's the name, what's the version, and you can pivot from there. You can also look for those dual EC keys if they are present in this firmware or other firmers. But to give you an example of the fuzzy hash thing, as I mentioned you in the slides, somewhere here. Okay, so this is the fuzzy hash where I mentioned the SD cards and correlations of files. And the idea is that I can, I'll keep it shorter. We know this file is vulnerable in one of the SD cards. It was very well known blog post. We can look it by fuzzy hash, and we can actually see that this file is present in these firmers. Okay, there's some of them, and there's nothing particular because they're just incremental versions of the same device firmware. And we can also see that it's 100% similarity, so it means this file didn't change across versions. But the interesting thing is that you see that for some entries, the vendor change, and you can easily automate to trigger an alert or to basically pivot automatically when you have a similarity hit for one file across vendors. When it goes across vendors, you know that something is fishy. It means that the other vendor must be vulnerable. And you see that the similarity is not 100%, it's 46%. This is because these vendors of SD cards, they take the white label or SDKs or development kits, and they put their logo and their copyright text. So there's some change in the output or in the files. But the idea is that the core functionality stays the same, they never touch the core functionality of a web server or the kernel. They just update their copyrights, and that's it. That's why there is not full similarity, but there is some similarity. So if you look at this file, it's a PQI Air, and it's version 147, but the idea is that, okay, once you have this knowledge that this file is vulnerable and you have two vendors, you can just try to emulate both of them and see whether they are vulnerable. And in one case, you see it's the same IP, it's the same virtual machine, it's transcend Wi-Fi SD.  The idea is that with another parenthesis is that having this kind of emulation, you can also find very quickly bugged like unauthorized access, right? So you see that it asks me for a password, but if I go to this page, it's automatic like this. So you see that you don't need a very sophisticated thing, and you can use these pentesting tools or plugins for pentesting tools to find these kind of vulnerabilities very easily and basically generates CV reports every minute. Okay, we can log in. Sometimes the thing is the interfaces are broken because you see there is no MAC address, right? Because it tries to call some IOCTL which is not supported by QEMU, and you need to write a plugin in order to support all these kind of IOCTL. But the idea is that you can still find the vulnerabilities if you go, see, there's Arachne name. Arachne name is because now the Arachne is pentesting this machine. Okay, so it used to pentest this machine. I can do a very quick thing like that. So basically you see that using the emulator you don't need to buy that expensive 40, 50 euro card. You can find the vulnerability. And the same way, it's just a very quick example, but you can find also we found the same command injection which took some time for the guy to find them or write the write up, but automatically it's easier to find. Now we go to Kcard, which is basically the PQI air and we can go to Wifi setup and try to do the same. I mean, it's basically the same page in the back because it's a parallel, but the output is different. That's why I told you the similarity is different because if you look at the source, no, not this one, frame source, you see that there's this Kcard everywhere. So basically they use this Kcard SDK thing. And you see that it's basically the same. The idea is that you can find exactly the same vulnerability exacting the same files, Kcard edit, whatever it name it is. Very simple by just triggering the tools. And basically the pentesting tools will do this for you because it files for everything, for XSS, for command injection, for path traversals, for file inclusions, and so on. So basically that's the idea. I guess I'll conclude now and we'll leave some minutes for questions, but the idea is that I can assure you there are plenty of Latin vulnerabilities in embedded firmware. Why it means Latin? Because they're there, they're just way to be discovered and many of the firmers are old as hell. Or even if they get updated, we see cases where they ship in a 2014, 2015 firmware update, 10 year old busy box or Linux kernel version. I mean, firmware security analysis is absolutely necessary is another conclusion and we see it by every day because the day that Juniper backdoor popped out, everybody started analyzing the firmware of Juniper OS, right? So we think and we also agree that the firmware security analysis is absolutely necessary and a broader view on the firmers, not just very particular view on these set of firmers is not just beneficial but is necessary because you can see that you can relate the same vulnerabilities or different vendors and you can actually discover the big surface, the big impact. You never know when we'll find those dual easy keys in other firmers and you'll be surprised that actually not just Juniper OS was affected by that backdoor or whatever. This is just an example. But of course, it involves many untrivial steps and challenges. We have to overcome them in some ways. Sometimes we take shortcuts and we don't get the 100% results but as long as we get some vulnerabilities, it's important and that we also see that for many vendors, in particular the white labels but not just white labels, it's also the big corporates who buy the white labels that security is clearly not a priority, that it's a trade-off with cost and time to market and they prefer not to invest a lot and actually be thirst to market and they completely ignore the security. So these are my references. You are more welcome to read them, share or retweet or cite them in your papers or studies or give me a sign if you need any question or any advice or you have an idea. I'll be around or you'll reach me on my email. I'd like to acknowledge my colleagues with whom I've done parts of his research and work. Jonah Zadak, Aurelian Francilion, Davide Balzerot and Apostoli Zarras and thank you. If you have any questions, I'm ready to take them. Thank you. Thanks for the great talk and we're taking questions now for 10 minutes and if you absolutely have to leave the room, please do so as quietly as possible. Okay, so just walk up to one of the microphones on my left or on the right and ask away. We start with the microphone to my right, please. Hi, thank you. Hello. Hi, thank you for the great talk. I was wondering if because you don't always actually purchase a device and actually test as exploits directly on a device if you have trouble with vendors acknowledging or being willing to receive vulnerabilities that haven't actually been tested against the physical device. Okay, so I'll repeat the question, whether the fact that we don't always buy the devices and we don't test on actual devices, whether the vendors are willing to take those reports in and address those vulnerabilities, this? Yeah. Yeah, so actually the talk today, the plan was to drop some zero days in some of the routers but because vendors actually listen or started to listen, we'll have to delay some of those. So the short answer is yes, most of the vendors start right now looking at these reports even though they're not tested on real devices, they look at these reports and we provide as much detail as possible regarding how we found them and what is they triggering input or what is the exploitation methodology and if they're not willing to take it in a responsible disclosure manner, then it's becoming full disclosure after the timeout and okay, otherwise I don't see, but yeah, to confirm is that vendors started looking at these reports, at least in our case, and it's good if they don't have a zero day, maybe they have time to fix it. Great, thank you. Okay, another question from the microphone to my father. Congratulations on a great talk. Thank you. Willa, did you actually write QMU devices and if so, will you make them public? That's a very good question. I'm not a very QMU guy. Dr. Jonas Zadak, my colleague, he's a very good QMU guy who is actually working on binary dynamic translation and analysis and he actually writes those plugins to map those devices and I only recommend to contact him if you have any question regarding this thing. In our methodology, we just used bare metal QMU but the idea is that once you have a library of QMU plugins or devices, it's just easy breezy to plug them in and basically broaden your testing surface. Thank you. So we have one question from the internet, if I'm correct. Yes. So Janix asks, are all the features you mentioned today available in firmware, Dolary? Or, and also is the project open source already available for download? Okay, so there are two questions, whether the firmers are available to be downloaded and whether it's open source. First, we can share some of the metadata and information about the firmware but we cannot share the firmers themselves because of the copyright. I mean, we are not distributors of software and usually this fires back, if you start putting them on your side, this fires back with legal claims that you're distributing illegally software which you're not entitled to and this is kind of a tricky situation but to address this, if anybody wants to run a specific test or analysis on the data we have, just drop me an email, I'll try to accommodate, I'll run your script or I'll try to give you access on our unpack environment where you can run it. So this is the first question. And second, the project is, well, it's not intended to be released as open source, it's more intended to be run as a service where we can give back to the community as much information as we can. And at the same time, try to improve our things. Basically, it's not rocket science what we've implemented and it's well described technically in the paper. It's just a distribution of jobs and so on. We sometimes also contribute commits or bugs or improvements to some of these tools like BINWALK or Binary Analysis Toolkit. So in that sense, yes, we contribute also to the open source community. Okay, we'll take two more questions, so please to my left. Hi, thanks for a great talk. And actually I have two questions and the first short question is that, how long does it take usually for the dynamic analysis on the formers? Okay, sure. Find vulnerabilities. Okay, so to emulate it, it takes, okay, we take some measure of precautions, we're having some dead times where we do weights or slips just to make sure that all the setup is fine because you cannot expect a consistent or constant time from QEMU running in different virtual machines, running on different hardware across the globe. So you don't have a consistent time, but in general is to start a QEMU for a particular image, takes around, I don't know, up to five minutes, depending what it has to load and what devices it can or cannot find or all kinds of faults. And to pentest it, it also depends on, okay, what kind of dynamic analysis? In our case, we run the pentesting and we use the XSS, CSRF and OS command injection modules from Arachne.  They generate around 10,000, 20,000 fuzzing inputs per each class. And basically it takes around half an hour, one hour to test. Can I have one more question? Yeah. Wait, I think we should take the ones waiting over there for a long time, so. Okay, first of all, thank you for the beautiful talk. I have many questions, but I have selected one that is most for me interesting. How would it go about scaling the firmware retrieval part? Because from some of your slides, I took, I thought that your current sample size is about 2,000 firmware images, is that right? And actually, how do you go about loading and processing all of the firmware from different routers which are not publicly available? And it seems that it involves manually Googling for the website to download the firmware. And so this was the first one. And the second one, what is your current sample size? Okay, so current sample size, we have the collected sample size which we used for the first study and it was estimated to around 170,000 firmware images. Okay, 170,000 firmware images which we crawled using the Google custom searches or using FTP spiders and FTP indexing sites. And we just took a seed of 500 FTPs and vendor sites and start crawling everything. And then we just filtered out the width, basically the PDFs, documentation, drivers and so on. And we ended up with 170,000 files. Now we did the static analysis on 32,000 unpacked files because academic deadlines do not usually meet with our desires. So we had to cut some lines and do on a shorter scale the static analysis and the dynamic analysis as well because it takes much more time to emulate and pen test all this. We did it on 2,000 firmware images. We tried to emulate and find web vulnerabilities in around 2,000. Okay, so this is basically the breakdown of the sample size. Now how do we do about the files we cannot get? Of course, there will be always files behind the paywall, a registration wall or which are not available if you are not registered as a customer or as a reseller and so on. That's why we have this service where people can draw them and as we move forward, we'll try to perform machine learning as well to classify them and also to analyze them and give results back, not just on the files we have. And from the public interface, we collected around 2,200 files, around 10 gigs of data, so around 50 megs per file. But there are some bogus files as well. People just drop some movies and MP3s. Okay, thank you. Unfortunately, we're out of time so we cannot take any more questions. Thank you for being here this morning and enjoy the rest of the Congress.


Hi everyone. In this video, we are going to talk how to extend your list with another list or how to add lists of elements to an existing list. On the other words we could say how to combine two lists into one list. So let's make a list. Let's call it my list and let's put numbers 1, 2 and 3 inside this list. If we want to add for example a list with numbers 4 and 5 to this list will type my list. Extend and inside parents will put this list. So we're calling function extend and we put inside it as an argument another list. Those elements of that list will be added to our my list list. So let's press enter and now let's see my list and as you can see now my list has two other new elements added from the another list. That's all in this video. Please like share and subscribe. Happy coding.


Bismillah ar-Rahman ar-Raheem Wa sallallahu alayhi wa sallam Muhammadin wa la alihi wa sahbihi ajma'in As-salamu alaikum wa rahmatullahi wa barakatuh Allahu Akbar Allahu Akbar Allahu Akbar La ilaha illa Allah Wa Allahu Akbar Allahu Akbar Wa Lillahi Al Hamd Due to our unusual circumstances, this is not an official Eid khutbah, just a short reminder inshaAllah ta'ala to myself and by extension to all of you the Prophet sallallahu alayhi wa sallam he said he said there are no days more beloved to Allah s.w.t than he be worshipped in them than the 10 days of Dhul-Hijjah and this hadith is in multiple books of hadith to notice he said which in Arabic denotes a strong negation that there are no days whatsoever not even the days of Ramadan according to many scholars that are is in Arabic called an elative of comparison the root word is there are no days more beloved to Allah s.w.t than the 10 days of Dhul-Hijjah and when something is beloved to Allah s.w.t then it's the duty of the believers to pay close attention to that for example in a hadith the Prophet sallallahu alayhi wa sallam he said the most beloved places to Allah s.w.t are the mosques the Masajid and we know that but many of us don't even know what month it is or even what year it is according to the Islamic calendar let alone specific days Allah s.w.t he takes an oath in the Quran he says by the dawn and the 10 nights and by the even and the odd many exegents of the Quran say that the 10 nights mentioned here are the first 10 nights of the month of Dhul-Hijjah the first 10 nights of the month of Dhul-Hijjah while the even as shafa'i refers to iid al-adha also called yom al-nahar the 10th of Dhul-Hijjah wa the odd al-watar refers to the blessed day of Arafah the 9th of Dhul-Hijjah the Prophet s.w.t he said that there is no day when Allah s.w.t sets free more servants from the fire emancipates more servants from the fire than the day of Arafah and that Allah s.w.t draws near to his servants according to the hadith then praises them to the angels and says what do these people want and the hadith is in muslim and of course Allah s.w.t knows what we want Allah s.w.t's knowledge is perfect but the purpose here is to motivate us to make dua during this time furthermore Allah s.w.t says in the Quran that we prescribed for Musa s.w.t 30 nights and we completed it with 10 and so the appointment of his lord was completed at 40 nights right so Imam al-Tabari and many others Imam al-Zamaqshari they say that the 30 here right 30 night 10 refers to the month of Dhul Qaada while the final 10 right before that and we completed it with 10 more at the final 10 here referred to the 10 nights of Dhul-Hijjah that in other words the revelation of the Torah was completed in the month of Dhul-Hijjah so why are these days so blessed these are the days of Hajj the pilgrimage and the pilgrimage harkens back to the very primordial origins of our deen right the rites of the Hajj go back to our master Ibrahim alayhi salam right Allah s.w.t he says وَأَذِنْ فِي النَّاسِ بِالْحَجْ commanding our father Ibrahim alayhi salam to announce to the people the Hajj the pilgrimage so a man whose very name Abraham right Avraham in Hebrew his very name actually means father or patriarch of many nations this is a man that's revered and loved by over three billion human beings on planet earth so Eid al-Adha is really a commemoration of our master Ibrahim alayhi salam it is our origin story if you will a man who is called the friend of God Khalil Allah in the Quran he's also called the friend of God in the Hebrew Bible the Tanakh as well as the New Testament all three texts he is referred to as the friend of God as a man who is known as the great iconoclast right the breaker of idols a man who is called the Imam of mankind indeed I have made you for the people a leader the one about whom Allah says that he brought to his lord a sound heart the one about whom Allah says he was a nation unto himself devoted to Allah subhanu wa ta'ala the primordial and quintessential monotheist Hanifa and not an idolater the centrality of the Abrahamic tradition is very clear in the Quran the Quran says they say be Jews or Christians in order for you to be guided say no I would rather follow the the tradition the creed of Ibrahim alayhi salam he did not in partner with Allah subhanu wa ta'ala Allah says in the Quran Ibrahim alayhi salam was not a Jew nor a Christian the term Jew did not have any type of meaning at the time of Ibrahim alayhi salam it's anachronistic to refer to him as a Jew Jew comes from the word Judah one of the sons of Jacob and certainly there weren't any Christians around Christians are named after Christ which is the Greek of Messiah or Mashiach but al Islam submission unto God that was the religion of Ibrahim alayhi salam Allah subhanu wa ta'ala says he was a quintessential monotheist Hanifa and a Muslim a submitter unto God a submitter unto Allah subhanu wa ta'ala and he did not in partner with Allah subhanu wa ta'ala Allah subhanu wa ta'ala says Allah speaks the truth and the verb there is also used when Allah subhanu wa ta'ala says in the famous Ayatul Imtihan speaking directly to the Prophet Muhammad say to the people if you really love Allah then follow me then will Allah love you and forgive you your sins Allah is forgiving and merciful so in one verse Allah subhanu wa ta'ala commands us to follow the millah of Ibrahim alayhi salam his tradition his creed his religion in another ayah Allah subhanu wa ta'ala tells us to follow same verb the Prophet sallallahu alayhi alayhi salam so the exeges deduce from this that the Prophet Muhammad sallallahu alayhi salam he is upon the primordial Abrahamic path and this is actually stated explicitly in the Quran indeed the closest of humanity to Ibrahim alayhi salam are those who follow him as are this Prophet and those who believe and God is the protector of those who have faith so the Prophet sallallahu alayhi salam he is really the great restorer of the millah the tradition and creed of Allah's Khalil Ibrahim alayhi salam the Prophet sallallahu alayhi salam restored and perfected the deen and millah of Ibrahim alayhi salam so he restored and perfected it be ibn illa with the with the permission and the tawfiq of Allah subhanu wa ta'ala this is why he's Habibullah he's the beloved of God and not only that the Prophet sallallahu alayhi salam in his physical manifestation even resembled Ibrahim alayhi salam the hadith in the shama'il of imam at-Tirmidhi that the Prophet sallallahu alayhi salam describes the physical appearance of some of the major prophets and he said and he said then I saw Ibrahim alayhi salam and the closest an appearance to him is your companion meaning himself sallallahu alayhi salam physically the khalq what what manifests physically is is the closest to Ibrahim alayhi salam internally as well as far as his ethos and his theology or teaching his millah Allah subhanahu wa ta'ala revealed to the Prophet sallallahu alayhi salam on the day of Arafa the ninth of Dhul-Hijjah during the final pilgrimage اليوم أَكْمَنْتُ لَكُمْ دِينَكُمْ أَتْمَمْتُ عَلِيْكُمْ نِعَتِيْ وَرَضِيتُ وَرَضِيتُ لَكُمْ الْإِسْلَامَ دِينَا that today I have perfected your religion for you completed my favors upon you and I've chosen as your deen al-Islam so according to many exegetes this perfection and this completion this kamal and tamam this perfection and completion refers to the establishment of the rites and procedures of the final Muslim ritual obligation the final pillar حَجُبَيْتِ اللَّهِ pilgrimage to the house of God such is the importance of the Hajj the Prophet sallallahu alayhi salam he said the one who performs the Hajj for Allah subhanahu wa ta'ala without engaging in inappropriate talk in transgression رَجِعَكَ يَوْمِنْ وَلَدَةُ أُمْمُ he will return like the day his mother gave birth to him this hadith is in Bukhari in Muslim this is a strange time as we said many of us intended to go to Hajj we even had our reservations booked but it didn't happen and masha'Allah we are we are content with the Qadr of Allah subhanahu wa ta'ala but many did make Hajj they were fortunate enough to make Hajj if you had that intention then insha'Allah ta'ala Allah will reward you for your intention and insha'Allah in the future we will definitely make the Hajj if Allah wills now given the high status of Ibrahim alaihi salam in our deen it pains me to say that society in general mainstream media and an ever-increasing monoculture in colleges and universities the academy they have declared ideological warfare on the middle of Ibrahim alaihi salam on Abrahamic tradition and Abrahamic morality and if you don't know this is happening then you've really been asleep college students are constantly told by their social science professors that all traditional value systems are inherently oppressive because they involve hierarchy and patriarchy and this has led many Muslims young and old to leave the religion altogether so not only a pandemic of COVID-19 but a pandemic of Irtidat of apostasy has afflicted the Muslim ummah so we need to advocate a return to Ibrahim alaihi salam and this is what Islam essentially is it is an Abrahamic theoethical Judeo-Christian reform movement at its essence an Abrahamic theoethical Judeo-Christian reform movement at its essence a reformation of Jewish legalism and Christian theology thus a restoration of the true millah of the great patriarch and Allah subhanahu wa ta'ala says at the end of Surah al-Hajj appropriately titled The Pilgrimage he has chosen you and has not imposed upon you any difficulties in the religion it is the religion the creed the tradition of your father Abraham and in the first instance Allah subhanahu wa ta'ala is speaking to the Arabs the Qureji Arabs who are literally descendants of Abraham minlata abii kum your ancestor but what about the vast majority of Muslims who are not Arabs well abii here abii kum ab also means spiritual father here's our spiritual father he is the one who called you Muslims in the past and in this scripture and the Quran now not to belabor the point because I talk about this a lot but I just want to mention quickly that the dominant epistemology today in the Western academy is broadly known by this term postmodernism and this includes various philosophical movements like critical theory and deconstructionism post structuralism neo Marxism and this is really our challenge right postmodernism is really our challenge obviously there's an explosion of sort of anti-muslim polemics that are coming from Christian elements as well and we can deal with those those are the old sort of tired arguments that they're just recycling but when it comes to postmodernism this is really a challenge that we need to focus on we need to understand what it is and how to deal with it or else this pandemic of irritad of apostasy will continue and continue in contrast to premodernism and modernism postmodernism is really a revolt against both faith and reason so this is something I've mentioned before it's against religion and rationality against naqal and akal right the most infamous of the postmodern philosophers he said quote it is meaningless to speak in the name of or against reason, truth or knowledge so reason, truth and knowledge so akal or mantik and haq and ilm these are meaningless he says reason is meaningless they say it's all about feelings now now reason is limited that's true but is it meaningless and can we really not know anything how many times do we find in the Quran phrases like أَفَلَا تَعْقِلُونَ لَعَلَّكُمْ تَعْقِلُونَ إن كُنتُمْ تَعْقِلُونَ Do you not reason in order for you to reason if you would only reason use your akal, use your intellect right Muslim theologians like even Utamia he said that عقل and naqal reason and revelation are not in conflict but that the proper use of the former will lead to the recognition of the latter because they come from the same source ultimately everything is from Allah SWT Imam Al-Ghazali says in his قصص المستقيم that the Quran itself appeals to logic through syllogistic arguments long before hellenistic influences upon Muslim theological discourse in other words the prophets themselves used logic and reason to appeal to the respective communities because logic and reason have efficacy and our master Ibrahim alaihi salam is a prime example of this Allah SWT tells us in the Quran Surah number 6 he says in meaning thus did we show Ibrahim alaihi salam the dominion of the heavens and the earth that he might be among those possessing certitude the word for certitude here right yaqeen the people that's the noun the people of yaqeen and the word yaqeen is used a few places in the Quran very notably in Surah Al-Hijr ayah number 98 when Allah SWT says yaqeen worship your lord until certitude comes to you most of the exeggents concerning that ayah they say that al yaqeen here means death this is imam razi imam qurtubi imam atabari as a maqshari etc worship your lord until death comes to you because death is certain and when human beings die that's when they actually wake up according to the tradition however imam ibn umar al biqa'i he says here that al yaqeen could mean the sapiential station of certitude in this life that it is to experience the reality of Allah SWT it is to know that there was no god but Allah SWT right so thus did we show ibrahim the dominions of the heaven and the dominion of the heavens and the earth that he might be among those possessing yaqeen those who experience the reality of Allah SWT so going back to the ayah the ayat in surah an-na'am when the night grew dark upon him when the night grew dark upon ibrahim alayhi salam and he saw a co-cub a star he said haatharabbi this is my lord but when it's set he said i love not things that set and then he saw the moon rising and he said haatharabbi this is my lord but when it's set he said if my lord does not guide me i shall surely be among those who go astray but then he saw the sun rising and he said haatharabbi this is my lord it is greater but when it's set he said oh my people i am free of the partners you ascribe truly as a hanif as a quintessential monotheist i have turned my face toward him who created the heavens and the earth now don't get the wrong idea here what's going on here there is no question of ibrahim alayhi salam even considering the worship of the sun and the moon and the stars as ibn kathir and others imam al-razi point out this is ibrahim alayhi salam's rhetorical argument against the idolatry of his people the ancient Babylonians he is drawing out through intellectual deduction through reasoning the flaws of their beliefs so he ascends yes there is order and predictability in nature the ancient Greeks call this logos that the cosmos right the universe has order has logos but natural phenomena also changes it is mutable it sets right when he saw the star falam ma'afala in its set and then he saw the moon falam ma'afala it's set and then he saw the sun falam ma'afalat right and that which changes as imam al-razi argues cannot be the eternal and if something is not the eternal then it is created and it cannot be worshiped in its right it cannot be ma'abud bihaqihi it cannot be worshiped in its right or to say it another way that which is perfect cannot change because it either changes for the worse or it improves but if it improves that means it could have been better therefore not perfect so at the end of this ibrahim alaihi salam he says inni wa jahdu wa jia lillahi fataras samawati wal-argh hanifa that indeed i have turned my face toward him who created the heavens and the earth as a pure monotheist wa ma'ana mil al-mushrikin and i am definitely not among those who associate imam atabari even mentions here that there's a hint of sarcasm in ibrahim's argument this sort of adds to its rhetorical power as if to say come on you know better than worshiping mutable changeable celestial bodies worship the immutable supernatural creator and this is one of his names as-salam Allah subhanahu wa ta'ala is as-salam and as-salam here doesn't mean the peace it means the perfect right the perfect it's related to the word salim or salim the perfect one and there can be only one perfect being because in order for two beings to differ there must exist a lack of something between them in other words if you know something that i don't know and i know something that you don't know then neither one of us is perfect right neither one of us is as-salam there's naqs there's deficiencies in our knowledge now if a skeptic were to posit two perfect beings let's say a skeptic says look there's here's two perfect beings perfect then we could ask well which one has power over the other one of them both of them neither of them every answer is wrong and we come to a logical impasse Christians say that there are three perfect and equal persons of God yet the second person the son s-o-n according to them this is according to them was caused was generated by the first person the father these are their terms so they admit that the father is the cause and origin of the son and Matthew 24 36 according to Matthew Jesus admits again this is according to Matthew he admits that he does not know the day of judgment he admits deficiency in his knowledge therefore Jesus is not perfect he's not as-salam and thus not worthy of worship he's not ma'bud bi-haqihi he's not worthy of worship in his right ta'lamu ma'fi nafsik wa la'a'lamu ma'fi nafsik right on the yawm al qiyamah we're told in the Quran that eesa aleyhi salam wa say to Allah subhanahu wa ta'ala you know what is in myself but i don't know what is in yourself in another place in the Quran Allah subhanahu wa ta'ala says in al-baqarah have you not considered the one who debated with ibrahim aleyhi salam about his Lord because Allah had given him sovereignty right and who is this one who debated with ibrahim according to the Mufasirin the king of Babylon Nimrod right when ibrahim said my Lord gives life and causes death then Nimrod said I give life and cause death and the tafsir says he called for two slaves he released one and he killed the other qara ibrahim fa inna allaha ya'di bishamsi minal mashriqi fa atibiha minal maghrib so that ibrahim responded truly Allah subhanahu wa ta'ala brings the sun from the east bring it then from the west thus he who disbelieved was confounded bohita and Allah subhanahu wa ta'ala does not guide a wrongdoing people so in this debate ibrahim aleyhi salam he points out the limitations of human volition of human choice Nimrod claimed to be god in fact many exigents say that he was the first man in history to make such a claim that's why the word nimrod in modern english slang means an idiot or a fool a moron if nimrod is limited in his choices and potential then he is not perfect if he's not perfect then he is ontologically essentially inferior to a deity doesn't qualify as being a deity therefore his mulk his sovereignty could not have originated with him it was given to him and this is Allah subhanahu wa ta'ala says an atahullahu al-mulk that Allah gave him sovereignty ibrahim aleyhi salam demonstrates this quite dramatically by demanding nimrod to bring the sun from the west in other words you think you have power over life and death let's see you let's see you have power over the sun and this is easy for Allah subhanahu wa ta'ala because Allah has absolute unrestricted volition within his nature he is omnipotent Allah has qudra mutlak it is one of his qualitative attributes one of the qualities sifatul ma'ani as we say of Allah subhanahu wa ta'ala inna allah ala kulli shayin qadir nimrod has no rejoinder in this debate we are told that ibrahim aleyhi salam he destroyed the idols of his people he was a very young man living in a city called uur in ancient mesopotamia ur of the ur of kaldiz in modern day iraq and he said to his people he said do you worship that which you carve Allah subhanahu wa ta'ala created you and your actions so the argument here is how can how can something that you made be worthy of your worship and only exist because of you you are if you are a sufficient cause thus you are greater yet Allah subhanahu wa ta'ala made you thus Allah is greater and since Allah subhanahu wa ta'ala is the only real creator and there can only be one creator or else we're stuck in the intellectually repugnant paradox of infinite regress since Allah subhanahu wa ta'ala is the only real creator and the only one creator and the efficient cause of all creation then only he is worthy of worship their response to this was so threats violence ad hominem attacks there is an amazing ayah in the Qur'an that ties all of this together Allah subhanahu wa ta'ala says al-muminin who believe if you turn back from your religion then Allah subhanahu wa ta'ala will bring in your place a people a people that he loves and they love him lowly with the believers and strong against the unbelievers and striving and struggling in his path and not afraid of those who find fault so the exegetes mentioned two things here they say there's two main reasons for this irtidat for this apostasy that we can gleaned from this ayah number one a lack of love this is why Allah subhanahu wa ta'ala says that he'll bring a people bi qawmin yuhibbuhum wa yuhibbunahu right a people that he loves them and they love him because these people have a lack of love Allah subhanahu wa ta'ala says that Ibrahim alayhi salam is from the muhsinin in at least three times in the Qur'an Allah subhanahu wa ta'ala explicitly says that he loves the muhsinin the people of ihsan the people of spiritual excellence Inna Allah yuhibbun muhsinin and the prophet sallallahu alayhi sallam he defined ihsan as an ta'bul Allah k'annakataraat to worship Allah subhanahu wa ta'ala as though you can see him and I always uh when I talk about this I give the analogy of imagine your CEO asked you to make a sales call and then he sat in your office as you made it and the speakerphone is on and how excellent you would make that call well that's some CEO that's some human being and the other reason for the irtidad that we can glean from this ayah is a lack of intellectual sophistication so why does Allah subhanahu wa ta'ala say that these people wa la yakhafuna loma talaim they're not afraid of people who reproach them for their faith it's because they are intellectually formidable they're intellectual warriors that they'll engage in dialogue with the reproachers bil hikmati wal mu'idahil hasana with wisdom and wise exhortation with academic rigor and rational proofs and with good ethos good character so this is the way of our master ibrahim aleyhi salam this is the way of our master Muhammad sallallahu alayhi salam love of god rooted in the knowledge of god a ma'rifah of Allah subhanahu wa ta'ala that leads to ma'habah and I'm out of time inshallah ta'ala as a reminder that the substitution of the ram for ibrahim's son serves as the basis for the ritual of slaughtering an animal the udhiyyah the qurbani that is required as a final rite of the hajj so make sure that you perform the udhiyyah or have someone do that on your behalf don't forget to do the takbirat after every prayer that's farat that's obligatory right after the prayer right after the salam engage the takbirat it's wajib according to the Hanafi school to say it at least once after the fard and this began at fajr on yomi arafah the ninth of dorhijjah and this will continue 23 prayers so the last one that you'll do will be after asr prayer on the 13th of dorhijjah which is on monday inshallah ta'ala may Allah subhanahu wa ta'ala bless all of you may Allah subhanahu wa ta'ala accept a pilgrimage from the from the hajj that we're able to make pilgrimage may Allah subhanahu wa ta'ala accept the intention of the pilgrimage for those who intended to go but could not go may Allah subhanahu wa ta'ala increase all of you in love of Allah subhanahu wa ta'ala and may Allah subhanahu wa ta'ala increase all of you in your ability to reason and use logic in order to defend this religion and we ask Allah subhanahu wa ta'ala to give us victory over the shaitan and over our enemies